GAO-10-810, Medicaid Managed Care: CMS's Oversight of States' Rate Setting Needs Improvement


This is the accessible text file for GAO report number GAO-10-810 
entitled 'Medicaid Managed Care: CMS's Oversight of States' Rate 
Setting Needs Improvement' which was released on August 4, 2010. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to Congressional Committees: 

United States Government Accountability Office: 
GAO: 

August 2010: 

Medicaid Managed Care: 

CMS's Oversight of States' Rate Setting Needs Improvement: 

GAO-10-810: 

GAO Highlights: 

Highlights of GAO-10-810, a report to Committee on Finance, U.S. 
Senate, and Committee on Energy and Commerce, House of Representatives. 

Why GAO Did This Study: 

Medicaid managed care rates are required to be actuarially sound. A 
state is required to submit its rate-setting methodology, including a 
description of the data used, to the Department of Health and Human 
Services’ (HHS) Centers for Medicare & Medicaid Services (CMS) for 
approval. The Children’s Health Insurance Program Reauthorization Act 
of 2009 required GAO to examine the extent to which states’ rates are 
actuarially sound. GAO assessed CMS oversight of states’ compliance 
with the actuarial soundness requirements and efforts to ensure the 
quality of data used to set rates. GAO reviewed documents, including 
rate-setting review files, from 6 of CMS’s 10 regional offices. The 
selected offices oversaw 26 of the 34 states with comprehensive 
managed care programs; the states’ programs varied in size and 
accounted for over 85 percent of managed care enrollment. GAO 
interviewed CMS officials and Medicaid officials from 11 states that 
were chosen based in part on variation in program size and geography. 

What GAO Found: 

CMS has been inconsistent in reviewing states’ rate setting for 
compliance with the Medicaid managed care actuarial soundness 
requirements, which specify that rates must be developed in accordance 
with actuarial principles, appropriate for the population and 
services, and certified by actuaries. Variation in CMS regional office 
practices contributed to this inconsistency in oversight. For example, 
GAO found significant gaps in CMS’s oversight of two states. 

* First, the agency had not reviewed Tennessee’s rate setting for 
multiple years and only determined that the state was not in 
compliance with the requirements through the course of GAO’s work. 
According to CMS officials, Tennessee received approximately $5 
billion a year in federal funds for rates that GAO determined had not 
been certified by an actuary, which is a regulatory requirement. 

* Second, CMS had not completed a full review of Nebraska’s rate 
setting since the actuarial soundness requirements became effective, 
and therefore may have provided federal funds for rates that were not 
in compliance with all of the requirements. 

Variation in a number of CMS regional office practices contributed to 
these gaps and other inconsistencies in the agency’s oversight of 
states’ rate setting. For example, regional offices varied in the 
extent to which they tracked state compliance with the actuarial 
soundness requirements, their interpretations of how extensive a 
review of a state’s rate setting was needed, and their determinations 
regarding sufficient evidence for meeting the actuarial soundness 
requirements. As a result of our review, CMS took a number of steps 
that may address some of the variation that contributed to 
inconsistent oversight, such as requiring regional office officials to 
use a detailed checklist when reviewing states’ rate setting. However, 
additional steps are necessary to prevent further gaps in oversight 
and additional federal funds from being paid for rates that are not in 
compliance with the actuarial soundness requirements. 

CMS’s efforts to ensure the quality of the data used to set rates were 
generally limited to requiring assurances from states and health plans—
efforts that did not provide the agency with enough information to 
ensure the quality of the data used. CMS’s regulations do not include 
standards for the type, amount, or age of the data used to set rates, 
and states are not required to report to CMS on the quality of the 
data. When reviewing states’ descriptions of the data used to set 
rates, CMS officials focused primarily on the appropriateness of the 
data rather than their reliability. With limited information on data 
quality, CMS cannot ensure that states’ managed care rates are 
appropriate, which places billions of federal and state dollars at 
risk for misspending. States and other sources have information on the 
quality of data used for rate setting—information that CMS could 
obtain. In addition, CMS could conduct or require periodic audits of 
data used to set rates; CMS is required to conduct such audits for the 
Medicare managed care program. 

What GAO Recommends: 

GAO recommends that CMS implement a mechanism to track state 
compliance with the requirements, clarify guidance on rate-setting 
reviews, and make use of information on data quality in overseeing 
states’ rate setting. HHS agreed with our recommendations and 
described initiatives underway that are aimed at improving CMS’s 
oversight. 

View [hyperlink, http://www.gao.gov/products/GAO-10-810] or key 
components. For more information, contact Carolyn L. Yocom at (202) 
512-7114 or yocomc@gao.gov. 

[End of section 

Contents: 

Letter: 

Background: 

CMS's Oversight of States' Compliance with Actuarial Soundness 
Requirements Has Been Inconsistent, in Part Due to Variation in 
Regional Office Practices: 

CMS's Limited Efforts Do Not Ensure the Quality of the Data Used to 
Set Rates: 

Conclusions: 

Recommendations for Executive Action: 

Agency Comments and Our Evaluation: 

Appendix I: Methodology for Selecting CMS Regional Offices and 
Analyzing CMS's Medicaid Managed Care Rate-Setting Files: 

Appendix II: Methodology for Selecting States to Contact: 

Appendix III: Selected States' Reported Efforts Intended to Ensure the 
Quality of the Data Used to Set Rates: 

Appendix IV: Comments from the Department of Health and Human Services: 

Appendix V: GAO Contact and Staff Acknowledgments: Tables: 

Table 1: Summary of the Regulatory Requirements Covered in CMS's 
Checklist for Reviewing Medicaid Managed Care Rate Setting: 

Table 2: Extent to which Evidence Was Cited in the 28 CMS Files We 
Reviewed: 

Table 3: CMS Regional Offices Reviewed: 

Table 4: Description of the 28 CMS Medicaid Managed Care Rate-Setting 
Files Reviewed: 

Table 5: Information about the Medicaid Managed Care Programs of 
Selected States, as of 2008: 

Table 6: Eleven States' Reported Efforts Intended to Ensure the 
Quality of Data Used to Set Medicaid Managed Care Rates: 

Abbreviations: 

ASOP: Actuarial Standard of Practice: 

CMS: Centers for Medicare & Medicaid Services: 

FFS: fee-for-service: 

HHS: Department of Health and Human Services: 

OACT: Office of the Actuary: 

PCCM: primary care case management: 

PERM: Payment Error Rate Measurement: 

PPACA: Patient Protection and Affordable Care Act: 

[End of section] 

United States Government Accountability Office: 
Washington, DC 20548: 

August 4, 2010: 

The Honorable Max Baucus: 
Chairman: 
The Honorable Charles E. Grassley: 
Ranking Member: 
Committee on Finance: 
United States Senate: 

The Honorable Henry A. Waxman: 
Chairman: 
The Honorable Joe Barton: 
Ranking Member: 
Committee on Energy and Commerce: 
House of Representatives: 

The importance of managed care in the Medicaid program is significant, 
with nearly half of all Medicaid enrollees--approximately 20.7 million 
individuals--enrolled in capitated managed care in 2008 and a total of 
over $62 billion in federal and state spending for managed care in 
2007.[Footnote 1] Moreover, Medicaid--a joint federal-state program 
that finances health care for certain categories of low-income 
individuals--is expanding. With the passage of the Patient Protection 
and Affordable Care Act (PPACA) in March 2010, states will expand 
coverage under the Medicaid program to an estimated 18 million 
additional people.[Footnote 2] Expansions of Medicaid are likely to 
increase the number of people enrolled in and amount of spending for 
managed care, making effective federal oversight of this large and 
complex component of the Medicaid program particularly critical. 

The potential benefits and risks of Medicaid managed care are 
substantial. Managed care is designed to ensure the provision of 
appropriate health care services in a cost-efficient manner. However, 
capitation payments, which are made prospectively to health plans to 
provide or arrange for services for Medicaid enrollees,[Footnote 3] 
can create an incentive to underserve or deny access to needed 
care.[Footnote 4] Thus, appropriate safeguards are needed to ensure 
access to care and appropriate payment in Medicaid managed care. One 
such safeguard included in federal law is the requirement that states' 
capitation rates be actuarially sound.[Footnote 5] In 2002, the 
Centers for Medicare & Medicaid Services (CMS), the agency within the 
Department of Health and Human Services (HHS) that oversees states' 
Medicaid programs, issued regulations defining actuarially sound rates 
as those that are (1) developed in accordance with generally accepted 
actuarial principles and practices; (2) appropriate for the 
populations to be covered and the services to be furnished; and (3) 
certified as meeting applicable regulatory requirements by qualified 
actuaries.[Footnote 6] The regulations also specify the documentation 
states are required to submit to CMS regional offices to demonstrate 
compliance with the requirements, including a description of their 
rate-setting methodology and the data used to set rates. In 2003, CMS 
finalized a detailed checklist that its regional office staff could 
use in their reviews of states' rate setting and for states and 
states' actuaries to consider in setting rates.[Footnote 7] 

The Children's Health Insurance Program Reauthorization Act of 2009 
directed us to examine the extent to which state Medicaid managed care 
payment rates are actuarially sound.[Footnote 8] Specifically, we 
assessed (1) CMS's oversight of states' compliance with the Medicaid 
managed care actuarial soundness requirements, and (2) CMS's efforts 
to ensure the quality of the data used to set rates. 

To assess CMS's oversight of states' compliance with the actuarial 
soundness requirements, we reviewed documentation of CMS's oversight 
efforts from 6 of the 10 CMS regional offices. These offices were 
responsible for reviewing rate setting and approving rates for 26 of 
the 34 states with comprehensive managed care programs, were 
geographically diverse, and oversaw states with programs that ranged 
in size and accounted for about 85 percent of national managed care 
enrollment.[Footnote 9] Our review of CMS's oversight efforts included 
completing a structured review of 28 CMS files documenting rate-
setting reviews completed as of October 31, 2009.[Footnote 10] (See 
appendix I for a summary of the criteria we used to select the 6 CMS 
regional offices and the methodology for our review of CMS files.) To 
supplement our review, we interviewed officials in CMS's central 
office and the 6 selected CMS regional offices to obtain information 
regarding steps taken by CMS to ensure the actuarial soundness of 
rates; and we reviewed regional office standard operating procedures. 
We also interviewed Medicaid officials from 11 of the states overseen 
by the 6 selected CMS regional offices to obtain their views of, and 
experiences with, CMS's oversight of state compliance with the 
actuarial soundness requirements.[Footnote 11] These states were 
geographically diverse and had managed care programs that varied in 
size. (See appendix II for our criteria for selecting states for 
interviews.) 

To assess CMS's efforts to ensure the quality of data used to set 
rates, we reviewed CMS policies and guidance related to rate setting. 
In addition, in interviews with officials from CMS's central office 
and the selected regional offices, we asked about steps CMS takes to 
ensure data quality, including what information CMS requires states to 
include in their rate-setting submissions to demonstrate the 
appropriateness and reliability of the data used to set rates and 
whether any audits or studies of rate setting had been performed. We 
also assessed, as part of our review of CMS files, the information 
provided in states' rate-setting submissions about steps taken to 
ensure data quality, including statements made by states' actuaries. 
In interviews with state Medicaid officials, we asked about their 
processes to ensure data quality and their experiences with CMS 
oversight of data quality. We also reviewed relevant audit findings 
from the Washington State Auditor's Office.[Footnote 12] Finally, we 
contacted officials from five health plans to discuss their efforts to 
ensure the quality of the data submitted to states for rate setting. 
[Footnote 13] 

We conducted our performance audit from October 2009 through July 2010 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 

Background: 

Under Medicaid managed care, states contract with health plans and 
prospectively pay the plans a fixed monthly rate per enrollee to 
provide or arrange for most health services. These contracts are known 
as "risk" contracts because plans assume the risk for the cost of 
providing covered services. States' processes for developing rates may 
vary in a number of ways, including the type and time frames of data 
they use as the basis for setting rates, referred to as the base-year 
data,[Footnote 14] and what approach they use to negotiate rates with 
health plans. After rates are developed, an actuary certifies the 
rates as actuarially sound for a defined period of time, typically 1 
year. In order to receive federal funds for its managed care program, 
a state is required to submit its rate-setting methodology and rates 
to CMS for review and approval. This review, completed by CMS regional 
office staff, is designed to ensure a state complies with federal 
regulatory requirements for setting actuarially sound rates. 

CMS's Oversight of Rate Setting: 

CMS published a final rule on June 14, 2002, outlining the agency's 
regulatory requirements for actuarially sound rates. These 
requirements largely focus on the process states must use in setting 
rates.[Footnote 15] For example, the regulations require states to 
document their rate-setting methodology and include an actuarial 
certification of rates. In addition, the regulations include a 
requirement that when states use data from health plans as the basis 
for rates they must have plan executives certify the accuracy and 
completeness of their data. The regulations do not include standards 
for the type, amount, or age of the data that states may use in 
setting rates. The regulations also do not include standards for the 
reasonableness or adequacy of rates. In the preamble to the final 
rule, CMS noted that health plans were better able to determine the 
reasonableness and adequacy of rates when deciding whether to contract 
with a state. 

In July 2003, CMS finalized a detailed checklist that regional office 
staff could use when reviewing states' rate-setting submissions for 
compliance with the actuarial soundness requirements and that states 
and states' actuaries could use when developing rates.[Footnote 16] 
The checklist includes citations to, and a description of, each 
regulatory requirement; guidance on what constitutes state compliance 
with the requirement; and spaces for the CMS official to check whether 
each requirement was met and cite evidence from the state's submission 
for compliance with the requirement. The checklist also provides 
guidance on the level of review that should occur for different types 
of rate changes. When the state is developing a new rate, or using new 
actuarial techniques or data to change previously approved rates, the 
checklist indicates a full review should be done, which entails 
reviewing the state's submission for compliance with all of the 
requirements covered in the checklist. For adjustments to rates that 
were previously approved as meeting the regulations,[Footnote 17] the 
checklist indicates a partial review should be done; a partial review 
focuses on a few key requirements in the checklist, such as ensuring 
that the state has included a certification of rates from a qualified 
actuary. As of June 2010, CMS was in the process of revising the 
checklist. One of the planned changes was to emphasize the need for 
more complete encounter data because CMS officials indicated that the 
agency has determined that encounter data that do not include pricing 
information are not sufficient for setting rates. CMS expects to 
complete the checklist revisions by November 2010. (See table 1 for a 
summary of the sections in CMS's checklist.) 

Table 1: Summary of the Regulatory Requirements Covered in CMS's 
Checklist for Reviewing Medicaid Managed Care Rate Setting: 

Section of the checklist: Overview of rate-setting methodology[A]; 
Description of key requirements: State is required to provide 
documentation regarding the general rate-setting methodology, contract 
procurement, and the actuarial certification, including: 
* the rates and the time period for the rates; 
* a description of risk-sharing mechanisms; 
* a projection of expenditures, and; 
* an explanation of rate setting. 

Section of the checklist: Base year utilization and cost data[B]; 
Description of key requirements: State is required to provide 
documentation and an assurance that all payment rates are: 
* based only upon services covered under the state Medicaid plan or 
costs related to providing these services, such as health plan 
administration;[C] and; 
* provided under the contract to Medicaid-eligible individuals. 

Section of the checklist: Adjustments to base year data[D]; 
Description of key requirements: State is required to provide 
documentation of any adjustments to the base year data, including 
detailing the policy assumptions, size, and effect of the adjustments. 
Adjustments may include changes to the following: 
* services covered; 
* administration; 
* medical service cost and trend inflation, and; 
* utilization. 

Section of the checklist: Rate category groupings[B]; 
Description of key requirements: State is required to create rate 
cells specific to the enrolled population. Categories the state should 
normally consider in the establishment of rates include age, gender, 
locality/region, and eligibility. States may omit categories or 
combine them with another category. 

Section of the checklist: Other sections[B]; 
Description of key requirements: State is required to document their 
methodology in a number of other areas. For example: 
* document that they have examined base year data for distortions, 
such as special populations with catastrophic costs, and adjusted 
rates in a cost-neutral manner; 
* document the use of reinsurance and other risk-sharing mechanisms; 
and; 
* explain any incentive arrangements in the contract. 

Source: GAO analysis of CMS checklist. 

Notes: 

[A] This section of the checklist is addressed in both full and 
partial rate-setting reviews. 

[B] This section of the checklist is addressed in a full rate-setting 
review, but not in a partial review. 

[C] State Medicaid plans are approved by CMS and define how each state 
will operate its Medicaid program, including which populations and 
services are covered. 

[D] This section of the checklist is addressed in a full rate-setting 
review and may be covered in a partial review for adjustments that the 
state made that had not previously been subject to CMS review. 

[End of table] 

According to CMS officials, the regional officials responsible for 
conducting rate-setting reviews may have a financial background, but 
are not actuaries. Officials also noted that CMS's OACT, which 
provides actuarial advice to other offices within CMS, is generally 
not involved with Medicaid rate-setting reviews. However, they 
indicated that when the CMS officials responsible for rate-setting 
reviews have concerns with a state's rate-setting methodology and 
cannot resolve those concerns with the state, they can contact OACT to 
request an independent review. 

Actuarial Principles and Practices for Medicaid Managed Care Rate 
Setting: 

CMS's regulations require that actuarially sound rates be developed in 
accordance with generally accepted actuarial principles and practices. 
There is no Actuarial Standard of Practice (ASOP) that applies to 
actuarial work performed to comply with CMS's regulations. However, in 
2005, the American Academy of Actuaries published a practice note that 
provides nonbinding guidance on certifying Medicaid managed care 
rates.[Footnote 18] 

The practice note includes a proposed definition for "actuarial 
soundness," as there was no other working definition of the term that 
would be relevant to the actuary's role in certifying Medicaid managed 
care rates. Under the definition, rates are actuarially sound if, for 
the period of time covered by the certification, projected premiums 
provide for all "reasonable, appropriate, and attainable costs;" also 
under the definition, rates do not have to encompass all possible 
costs that any health plan might incur. The note emphasizes that the 
definition only applies to the certification of Medicaid managed care 
rates, and that it differs from the definition used when certifying a 
health plan's rates. 

The practice note also provides information on the actuary's role in 
assessing the quality of data used to set rates and refers the actuary 
to the ASOP on data quality for further guidance.[Footnote 19] The 
practice note explains that if the actuary is involved in developing 
the rate, then the actuary would consider all available data, 
including FFS data, Medicaid managed care encounter data, and Medicaid 
managed care financial reports and financial statements. The actuary 
would typically compare data sources for reasonableness and check for 
material differences when determining the preferred source or sources 
for the base-year data. The ASOP on data quality clarifies that while 
actuaries should generally review the data for reasonableness and 
consistency they are not required to audit the data. The ASOP also 
explains that the accuracy and completeness of the data are the 
responsibility of those that provided them, namely the state or health 
plans. 

CMS's Oversight of States' Compliance with Actuarial Soundness 
Requirements Has Been Inconsistent, in Part Due to Variation in 
Regional Office Practices: 

CMS has been inconsistent in its review of states' rate setting. In 
the six CMS regional offices we reviewed, CMS had not reviewed one 
state's rate setting for compliance with the actuarial soundness 
requirements and had not conducted a full review for another. We also 
identified a number of other inconsistencies in CMS's review of 
states' compliance with the actuarial soundness requirements. 
Variation in CMS regional offices' practices contributed to these 
inconsistencies in oversight. 

CMS Has Been Inconsistent in Reviewing States' Rate Setting for 
Compliance with the Actuarial Soundness Requirements: 

In the six CMS regional offices we reviewed, we found inconsistencies 
in CMS's review of state's rate setting, including significant gaps in 
the agency's oversight of two states' compliance with the actuarial 
soundness requirements. First, CMS had not reviewed one state's 
(Tennessee) rate setting for compliance with the actuarial soundness 
requirements or approved the state's rates. In 2007, Tennessee began 
transitioning its managed care program, which included all of the 
state's approximately 1 million Medicaid enrollees, to risk contracts 
that were subject to the actuarial soundness requirements. Since 
moving to risk contracts, the state submitted at least two actuarial 
reports to CMS's Atlanta regional office indicating the program 
change, but these documents did not trigger a CMS review. These 
reports did not include actuarial certifications, and Tennessee 
officials confirmed that the state's rates had not been certified by 
an actuary, which is a regulatory requirement.[Footnote 20] As a 
result, according to CMS officials, Tennessee received, and is 
continuing to receive, approximately $5 billion a year in federal 
funds for rates that we determined had not been certified by an 
actuary or assessed by CMS for compliance with the requirements. Based 
on issues we raised during our review, CMS determined that Tennessee 
was not in compliance with the actuarial soundness requirements and, 
as of June 2010, was working to bring the state into compliance. 
[Footnote 21] 

Second, while CMS officials said that all states should have had a 
full review of rate setting after the actuarial soundness requirements 
became effective in August 2002, it appeared that CMS officials had 
not completed a full rate-setting review for Nebraska.[Footnote 22] 
CMS had no documentation of its last full review of Nebraska's rate 
setting, but officials believed that the last full review was 
completed in 2002.[Footnote 23] According to Nebraska officials, the 
state last made significant changes to its rate setting for the state 
fiscal year beginning in 2001, which according to criteria in CMS's 
checklist would have triggered a full CMS review. Based on what CMS 
and Nebraska officials told us, CMS's last full review was likely done 
before the actuarial requirements became effective. As a result, 
Nebraska received federal funds for more than 7 years for rates that 
may not have been in compliance with all of the actuarial soundness 
requirements. 

In addition to these gaps in oversight, we found inconsistencies in 
the reviews CMS completed. In instances when CMS did a full rate-
setting review, it was unclear whether CMS consistently ensured that 
states met all of the actuarial soundness requirements. We found 
evidence that the rates in all 28 of the CMS files we reviewed were 
certified by a member of the American Academy of Actuaries, as is 
required by the regulations.[Footnote 24] However, the extent to which 
CMS ensured state compliance with other aspects of the actuarial 
soundness requirements--such as the requirement that rates be based 
only on services covered under the state's Medicaid plan or costs 
related to providing these services--was unclear. For example, in 
nearly a third of the files we reviewed, or 8 of 28 files, CMS 
officials did not use the rate-setting checklist to document their 
review; therefore we could not determine whether CMS ensured that 
states were in compliance with all of the requirements. In 17 of the 
20 remaining files where the CMS official used the checklist, the 
official cited evidence of the state's compliance for some 
requirements, but not others. 

When officials did cite evidence, the evidence did not always appear 
to meet the requirements. For example, one of the requirements in the 
regulations is that states provide an assurance that rates are based 
only on services covered under the state's Medicaid plan or costs 
related to providing these services. Of the 19 files where CMS 
officials cited evidence of such an assurance, we were unable to 
locate the assurance in 2 of the files. Another requirement is that 
states include a comparison of expenditures under the previous year's 
rates to those projected under the proposed rates. In the 15 files 
where CMS cited evidence of the comparison of expenditures, we did not 
find a comparison that appeared to meet the requirement in 2 of the 
files. See table 2 for more information on the extent to which 
evidence was cited in the CMS files we reviewed. 

Table 2: Extent to which Evidence Was Cited in the 28 CMS Files We 
Reviewed: 

Actuarial soundness requirements covered in CMS's checklist: The state 
must include documentation of size and effect of adjustments to base 
year data for medical/trend inflation; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 19; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 0; 
No evidence cited[A]: 9. 

Actuarial soundness requirements covered in CMS's checklist: The state 
must include documentation of size and effect of adjustments to base 
year data for administrative cost allowances; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 19; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 0; 
No evidence cited[A]: 9. 

Actuarial soundness requirements covered in CMS's checklist: The 
state's documentation must include an assurance that capitation rates 
are based only on services covered under the state's Medicaid plan or 
costs related to providing these services; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 17; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 2; 
No evidence cited[A]: 9. 

Actuarial soundness requirements covered in CMS's checklist: The state 
must document final capitation rates; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 14; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 3; 
No evidence cited[A]: 11. 

Actuarial soundness requirements covered in CMS's checklist: The 
state's documentation must include an assurance that capitation rates 
are for Medicaid-eligible individuals; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 14; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 5; 
No evidence cited[A]: 9. 

Actuarial soundness requirements covered in CMS's checklist: The 
state's documentation must include a comparison of expenditures under 
the previous year's contract to those projected under the proposed 
contract; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 13; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 2; 
No evidence cited[A]: 13. 

Actuarial soundness requirements covered in CMS's checklist: The state 
must include documentation of size and effect of adjustments to the 
base year data for incomplete data; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 13; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 0; 
No evidence cited[A]: 15[B]. 

Actuarial soundness requirements covered in CMS's checklist: The state 
must include documentation of size and effect of adjustments to base 
year data for benefit differences; 
Number of files where CMS cited evidence: Appeared to meet the 
requirement: 10; 
Number of files where CMS cited evidence: Did not appear to meet the 
requirement: 7; 
No evidence cited[A]: 11[C]. 

Source: GAO analysis of 28 CMS files. 

Notes: 

[A] This column includes 8 files where CMS officials did not use the 
checklist to document their review, as well as other files where the 
CMS official did not cite evidence for a particular actuarial 
soundness requirement. 

[B] In 6 of these files, CMS did not cite evidence as the state did 
not make the specified adjustment and thus the requirement for 
documentation was not applicable. 

[C] In 2 of these files, CMS did not cite evidence as the state did 
not make the specified adjustment and thus the requirement for 
documentation was not applicable. 

[End of table] 

Finally, CMS did not consistently review states' rate setting for 
compliance with the actuarial soundness requirements prior to the new 
rates being implemented. In 20 of 28 files we reviewed, we found that 
CMS completed its review of rate setting after the state had begun 
implementing the proposed rates; that is, after the effective date of 
the proposed rates. CMS officials told us that a variety of factors 
could delay the approval of rates, including states submitting a 
request for approval after implementing the rates. CMS officials 
further explained that they did not consider a state to be out of 
compliance with the actuarial soundness requirements until the end of 
the federal fiscal year quarter in which the state implemented the 
unapproved rates.[Footnote 25] Of the 20 files where CMS approved 
rates after the state implemented them, 13 had rates that were 
approved more than 3 months after the state implemented the rates, 
which means that the rates were approved after the end of the quarter 
in which they were implemented.[Footnote 26] CMS officials confirmed 
that the agency generally continued to provide federal funds for the 
states' managed care contracts even in cases where the rates were not 
approved by the end of the quarter. According to CMS officials, if the 
state failed to gain CMS approval or had to lower the rates to achieve 
approval, then CMS would reduce future federal reimbursement to 
account for federal funds paid to states for rates that had not been 
approved. However, CMS reviewing states' rate setting after states 
have begun implementing rates may result in changes to states' rate-
setting methodology; this could lead to retroactive changes, including 
reductions, in health plans' rates. The possibility of rates being 
decreased retroactively may make it difficult for health plans to 
assess the reasonableness and adequacy of rates when contracting with 
states, an assessment that CMS relies on as a check of states' rate 
setting. 

Variation in Practices among CMS Regional Offices Contributed to 
Inconsistent Oversight: 

Variation in a number of regional office practices contributed to the 
inconsistency in CMS's oversight of states' rate setting. Regional 
offices varied in the extent to which they tracked state compliance 
with the requirements, the extent to which they withheld federal 
funds, their criteria for doing full and partial reviews of rate 
setting, and what they considered to be sufficient evidence for 
meeting the requirements. 

* Tracking compliance. Officials from all of the regional offices we 
spoke with told us that they tracked basic information regarding the 
status of the CMS review process, such as when a state's submission 
was received and when CMS's approval letter was issued. However, based 
on our interviews with CMS regional officials, we found that four of 
the six regional offices did not track information that would allow 
them to identify states that were not in compliance with actuarial 
soundness requirements, such as the beginning and end dates of the 
rates specified by the actuary in the certification. Officials from 
the remaining two regional offices, Kansas City and San Francisco, 
told us they tracked the effective dates of approved rates. 

* Withholding funds. There was also variation among regional offices 
in the conditions that had to be met in order for states to receive 
federal funds. For example, officials from the San Francisco regional 
office told us that they did not release federal funds to states until 
the states' managed care contract and rates had been approved. 
Officials said that the office had withheld funds in several cases 
until the state demonstrated compliance with the requirements. For 
example, from October 2008 through April 2010, the San Francisco 
regional office reported withholding a total of $302.7 million in 
federal funding for Hawaii because the state's contracts and rates did 
not meet the actuarial soundness requirements. In contrast, officials 
we interviewed from the Atlanta regional office said that the office 
would release federal funds to a state even if the state's rates had 
not yet been approved by CMS. 

* Criteria for full and partial reviews. CMS regional officials had 
different interpretations of when full versus partial reviews of rate 
setting were necessary. For example, officials from the New York 
regional office told us that they completed a full review for each 
rate-setting submission received, regardless of the changes made to 
rates or rate setting. In contrast, a Kansas City regional office 
official told us that she completed a partial review in cases where 
the state adjusted the rates but had not changed the data used as the 
basis for rates. 

* Sufficient evidence for compliance. Regional office officials varied 
in how they determined sufficient evidence for state compliance with 
certain requirements. For example, for the requirement that rates are 
for Medicaid-eligible individuals covered under the contract, 
officials from the San Francisco regional office told us that, while 
they had verified information provided by states on the populations 
covered under the rates, they mainly looked for an assurance from the 
state that rates were for eligible populations. In contrast, a Kansas 
City regional office official explained that an assurance from the 
state alone would not be sufficient. Rather, the official would 
require evidence of the eligible populations included in, and excluded 
from, the rate-setting methodology. 

* Other variations. Variations in other regional office practices may 
also have contributed to the inconsistency in CMS oversight. For 
example, management oversight of rate-setting reviews in regional 
offices varied. A Kansas City regional official who reviews states' 
rate setting told us that, prior to approving states' rates, she 
submitted memoranda outlining the impact of states' proposed rate 
changes and the rationale for recommending approval of the package to 
her regional office managers. In contrast, officials from the New York 
regional office told us that most officials responsible for reviewing 
and approving states' rate setting worked independently and managers 
did not review a completed checklist. Other variations in practices 
that may have had an effect on CMS oversight included differences in 
training and standard procedures for conducting and documenting 
reviews. 

As a result of our review, CMS took a number of steps that may address 
some of the variation in regional office practices. For example: 

* officials from two regional offices told us that their offices were 
implementing new standard procedures to address inconsistencies in 
reviews identified through the course of GAO's work; and: 

* in December 2009, CMS began requiring that regional offices use the 
checklist in reviewing all states' rate-setting submissions and assure 
central office of its use before approving a state's rates. 

However, as we reported above, variations existed even when the 
checklist was used, such as in the extent to which CMS officials using 
the checklist cited evidence of compliance for each of the actuarial 
soundness requirements. 

CMS's Limited Efforts Do Not Ensure the Quality of the Data Used to 
Set Rates: 

CMS's efforts to ensure the quality of the data used to set rates were 
generally limited to requiring assurances from states and health 
plans, which did not provide the agency with sufficient information to 
ensure data quality. CMS regulations require states to describe the 
data used as the basis for rates and provide assurances from their 
actuaries that the data were appropriate for rate setting.[Footnote 
27] The regulations also specify that states using data submitted by 
the health plans as the basis for rates must require executives from 
the health plans to attest that the data are accurate, complete, and 
truthful. The regulations do not include requirements for the type, 
amount, or age of data or standards for the reasonableness or adequacy 
of rates. Additionally, CMS does not require states to submit 
documentation about the quality of the data used to set rates. In our 
interviews with regional office officials, we found that, when 
reviewing states' descriptions of the data used for rate setting, CMS 
officials focused primarily on ensuring the appropriateness of the 
data used by states to set rates rather than their reliability. This 
included reviewing the specific services and populations included in 
the base-year data or checking for assurances of appropriateness from 
the states' actuaries.[Footnote 28] CMS officials noted that if they 
had concerns with the quality of a state's data they would ask the 
state questions. None of the officials, however, reported taking any 
action beyond asking questions. 

With limited information on the quality of data used to set rates, CMS 
cannot ensure that states' managed care rates are appropriate and 
risks misspending billions of federal and state dollars. Actuarial 
certification does not ensure that the data used to set rates are 
reliable. In particular, 9 of the 28 files we reviewed included a 
disclaimer in the actuary's certification that if the data used were 
incomplete or inaccurate then the rates would need to be revised. 
Additionally, in more than half of the 28 files we reviewed, the 
actuaries noted that they did not audit or independently verify the 
data and relied on the state or health plans to ensure that the data 
were accurate and complete.[Footnote 29] Officials from three of the 
five health plans we spoke with raised concerns about the completeness 
of the encounter data used by states to set rates. Additionally, state 
auditors in Washington have raised concerns about the lack of 
monitoring of the accuracy of data used for rate setting. The auditors 
found that the state did not verify the accuracy of the data used as 
the basis for Medicaid managed care rates in fiscal years 2003 through 
2007. The state auditor's report from fiscal year 2007 concluded that 
the risk of paying health plans inflated rates increased when the 
accuracy of data used to establish rates could not be reasonably 
assumed to be correct.[Footnote 30] 

States have information on the quality of data used for rate setting-- 
information that CMS could obtain. State officials we spoke with 
reported having information on, and efforts intended to ensure, the 
quality of the data used to set rates. For example, New Jersey 
officials told us that the state tested the reliability and accuracy 
of the health plan financial data used to set rates against encounter 
data and required health plans to have an independent auditor review 
selected portions of the financial data. Additionally, Arizona 
officials indicated that the state periodically completes validation 
studies of the state's encounter data in which they traced a sample of 
the encounters back to individuals' medical records.[Footnote 31] 
State officials indicated that CMS used to require the state to submit 
results of these studies as a condition of operating its managed care 
program.[Footnote 32] However, given the state's extensive experience 
with managed care, CMS no longer requires the state to submit these 
studies for all participating health plans.[Footnote 33] (See app. III 
for a summary of selected states' efforts intended to ensure data 
quality.) Without requiring and reviewing information on states' data 
quality efforts, CMS cannot ensure that these data are of sufficient 
quality to be used for setting rates. 

In addition to information from states, CMS conducts audits that could 
have provided CMS officials relevant information about the quality of 
the data used to set rates. For example, when describing the state's 
efforts to ensure the quality of data used to set rates, officials 
from South Carolina noted that CMS periodically reviews the state's 
FFS data through the Payment Error Rate Measurement (PERM) program. 
[Footnote 34] Error rates calculated using FFS and encounter data 
through the PERM program could provide CMS with insights regarding the 
quality of the data that some states use to set rates. In CMS's rate-
setting review file for South Carolina, however, there was no 
discussion of PERM results by either the state or CMS. CMS central 
office officials confirmed that regional office staff do not consider 
the results of data studies, such as state validation or PERM program 
reports, when reviewing states' rate-setting submissions. 

CMS also could have conducted or required periodic audits of the data 
used to set rates. In Medicare Advantage, which is Medicare's managed 
care program, CMS is required to conduct annual audits of the 
financial records of at least one-third of the organizations 
participating in the program.[Footnote 35] For Medicaid, however, CMS 
had not conducted any recent audits or studies of states' rate 
setting, including the quality of data used. Specifically, officials 
in all six of the regional offices we spoke with told us that they had 
not performed any audits or special studies of states' rate setting. 
Officials from CMS's central office were also not aware of any recent 
audits or studies done by the four other regional offices. In 
addition, officials from CMS's central office told us that they could 
only recall one instance, in the nearly 8 years since the regulations 
were issued, where OACT arranged for an independent assessment of a 
state's rate setting; that assessment was done more than 2 years ago. 

Conclusions: 

The statutory and regulatory requirements for actuarially sound rates 
are key safeguards in efforts to ensure that federal spending for 
Medicaid managed care programs is appropriate, which could help avoid 
significant overpayments and reduce incentives to underserve or deny 
enrollees' access to needed care. CMS, however, has been inconsistent 
in ensuring that states are complying with the actuarial soundness 
requirements and does not have sufficient efforts in place to ensure 
that states are using reliable data to set rates. During the course of 
our work, CMS took steps to address some of the variation in regional 
office practices that contributed to inconsistencies in overseeing 
state compliance, such as requiring regional office officials to use 
the checklist in reviewing all states' rate-setting submissions. While 
these are positive steps, they do not address all of the variations in 
regional office practices that contributed to inconsistencies in CMS's 
oversight of rate setting. For example, these steps do not address 
variations in tracking state compliance, which may have led to CMS's 
failure to review Tennessee's rates for compliance with the actuarial 
soundness requirements. Additionally, the steps taken do not address 
the variation in what evidence CMS officials considered sufficient for 
compliance, how officials used the checklist to document their 
reviews, and what conditions were necessary for federal funds to be 
released. CMS also does not have sufficient efforts in place to ensure 
the quality of the data states used to set rates, relying on 
assurances from states without considering any other available 
information on the quality of the data used. By relying on assurances 
alone, the agency risks reimbursing states for rates that may be 
inflated or inadequate. 

As a result of the weaknesses in CMS's oversight, billions of dollars 
in federal funds were paid to one state for rates that were not 
certified by an actuary, and billions more may be at risk of being 
paid to other states for rates that are not in compliance with the 
actuarial soundness requirements or are based on inappropriate and 
unreliable data. Given the complexity of overseeing states' unique and 
varied Medicaid programs, it is appropriate that CMS would allow for 
flexibility in states' rate setting and would expect states to have 
the primary responsibility for ensuring the quality of the data used 
to set rates. However, CMS needs to ensure that all states' rate 
setting complies with all of the actuarial soundness requirements and 
needs to have safeguards in place to ensure that states' data quality 
efforts are sufficient. Improvements to CMS's oversight of states' 
rate setting will become increasingly important as coverage under 
Medicaid expands to new populations for which states may not have 
experience serving, and may have no data on which to base rates. 

Recommendations for Executive Action: 

To improve oversight of states' Medicaid managed care rate setting, we 
recommend that the Administrator of CMS take three actions. 

To improve consistency in the oversight of states' compliance with the 
Medicaid managed care actuarial soundness requirements, we recommend 
that the Administrator of CMS: 

* implement a mechanism for tracking state compliance, including 
tracking the effective dates of approved rates; and: 

* clarify guidance for CMS officials on conducting rate-setting 
reviews. Areas for clarification could include identifying what 
evidence is sufficient to demonstrate state compliance with the 
requirements, the conditions necessary for federal funds to be 
released, and how officials should document their reviews. 

To better ensure the quality of the data states use in setting 
Medicaid managed care rates, we recommend that the Administrator of 
CMS make use of information on data quality in overseeing states' rate 
setting. CMS could, among other things, require states to provide CMS 
with a description of the actions taken to ensure the quality of the 
data used in setting rates and the results of those actions; consider 
relevant audits and studies of data quality done by others when 
reviewing rate setting; and conduct or require periodic audits or 
studies of the data states use to set rates. 

Agency Comments and Our Evaluation: 

We provided a draft of this report to HHS for its review and comment. 
HHS concurred with all three of our recommendations, and commented 
that it appreciated our efforts to highlight improvements that CMS can 
make in its oversight of states' compliance with Medicaid managed care 
actuarial soundness requirements, as well as its focus on the quality 
of data used to set managed care rates. Moreover, HHS noted that CMS 
has identified many of the same issues. (See appendix IV for a copy of 
HHS's comments.) 

HHS agreed with our two recommendations related to improving the 
consistency of CMS's oversight, namely that CMS implement a mechanism 
for tracking state compliance with the actuarial soundness 
requirements and clarify guidance for CMS officials on conducting rate-
setting reviews. HHS noted that CMS has established a managed care 
oversight team to develop and implement a number of improvements in 
its managed care oversight, some of which will address our 
recommendations. These improvements included CMS's plans to develop 
standard operating protocols for the review and approval of Medicaid 
managed care rates and provide comprehensive training to CMS staff on 
all aspects of the new process and requirements. As CMS implements 
efforts aimed at improving its oversight, we reiterate the need to 
implement a mechanism for tracking state compliance with actuarial 
soundness requirements, including the effective dates of rates. 

HHS also agreed with our recommendation that CMS make use of 
information on data quality in overseeing states' rate setting. In 
commenting on our finding related to CMS's limited efforts to ensure 
data quality, HHS noted that a number of requirements within PPACA 
will give CMS additional authority and responsibility for acquiring 
and utilizing Medicaid program data.[Footnote 36] In response to our 
recommendation, HHS noted that, as part of a broader effort to 
redesign how it collects Medicaid data, CMS will be setting standards 
for the type and frequency of managed care data submissions by states. 
HHS commented that with more complete data at its disposal, CMS will 
be able to better assess the underlying quality of data submissions 
and, thus, better execute its oversight and monitoring 
responsibilities. CMS should use these assessments and other available 
information when overseeing states' rate setting. Finally, HHS 
provided technical comments, which we incorporated as appropriate. 

We are sending copies of this report to the Administrator of CMS and 
other interested parties. In addition, the report is available at no 
charge on the GAO Web site at [hyperlink, http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-7114 or y [Hyperlink, yocomc@gao.gov] 
ocomc@gao.gov. Contact points for our Offices of Congressional 
Relations and Public Affairs may be found on the last page of this 
report. GAO staff who made major contributions to this report are 
listed in appendix V. 

Signed by: 

Carolyn L. Yocom: Acting Director, Health Care: 

[End of section] 

Appendix I: Methodology for Selecting CMS Regional Offices and 
Analyzing CMS's Medicaid Managed Care Rate-Setting Files: 

To assess the Centers for Medicare & Medicaid Services's (CMS) 
oversight of states' compliance with the Medicaid managed care 
actuarial soundness requirements, we conducted a structured review of 
CMS files from 6 of the 10 CMS regional offices. We selected CMS 
regional offices that: 

* represented at least 5 of the 10 CMS regional offices, 

* collectively had oversight responsibility for at least 65 percent of 
the 34 states with comprehensive Medicaid managed care programs, and: 

* were geographically diverse and oversaw states with Medicaid managed 
care programs ranging in size. 

The six regional offices that we selected for our review had oversight 
responsibility for 26 of the 34 states (or 76 percent) with 
comprehensive Medicaid managed care programs.[Footnote 37] According 
to information from CMS, these 26 states accounted for about 85 
percent of Medicaid managed care enrollment nationally in 2008 and 
state program size ranged from 8 percent of Medicaid enrollees in 
Illinois to 100 percent in Tennessee. (See table 3.) 

Table 3: CMS Regional Offices Reviewed: 

CMS regional office: Atlanta; 
Number of states in region with comprehensive Medicaid managed care 
programs: 5; 
Range in size of state programs (percentage of Medicaid enrollees in 
Medicaid managed care): 20% to 100%; 
Percentage of national Medicaid managed care enrollment: 14.8%. 

CMS regional office: Chicago; 
Number of states in region with comprehensive Medicaid managed care 
programs: 6; 
Range in size of state programs (percentage of Medicaid enrollees in 
Medicaid managed care): 8% to 71%; 
Percentage of national Medicaid managed care enrollment: 18.7v. 

CMS regional office: Kansas City; 
Number of states in region with comprehensive Medicaid managed care 
programs: 3; 
Range in size of state programs (percentage of Medicaid enrollees in 
Medicaid managed care): 16% to 48%; 
Percentage of national Medicaid managed care enrollment: 2.5%. 

CMS regional office: New York; 
Number of states in region with comprehensive Medicaid managed care 
programs: 2; 
Range in size of state programs (percentage of Medicaid enrollees in 
Medicaid managed care): 64% to 72%; 
Percentage of national Medicaid managed care enrollment: 16.0%. 

CMS regional office: Philadelphia; 
Number of states in region with comprehensive Medicaid managed care 
programs: 6; 
Range in size of state programs (percentage of Medicaid enrollees in 
Medicaid managed care): 45% to 70%; 
Percentage of national Medicaid managed care enrollment: 10.7%. 

CMS regional office: San Francisco; 
Number of states in region with comprehensive Medicaid managed care 
programs: 4; 
Range in size of state programs (percentage of Medicaid enrollees in 
Medicaid managed care): 47% to 91%; 
Percentage of national Medicaid managed care enrollment: 22.2%. 

CMS regional office: Total; 
Number of states in region with comprehensive Medicaid managed care 
programs: 26; 
Percentage of national Medicaid managed care enrollment: 84.9%. 

Source: GAO analysis of 2008 Medicaid managed care data published by 
CMS. 

[End of table] 

We conducted a structured review of a selection of files from the six 
CMS regional offices. Specifically, we reviewed the files for CMS's 
rate-setting reviews of the most recently approved contract for each 
state's comprehensive managed care program, or, for states with 
multiyear contracts, the file for the most recent full review of rate 
setting completed as of October 31, 2009.[Footnote 38] Several states 
in the selected regions had multiple comprehensive managed care 
programs that had separate contracts and rate-setting processes each 
subject to CMS review and approval. For states that had two programs, 
we selected the file for the program CMS officials indicated was the 
largest, as defined by the number of enrollees and estimated 
expenditures.[Footnote 39] For the states that had more than two 
programs, we selected the files for the two largest programs. For 2 of 
the 26 states overseen by the six regional offices (Nebraska and 
Tennessee), CMS had not done a review that met our criteria, so we did 
not review a file for those states.[Footnote 40] In total, we reviewed 
28 files, which covered 24 states, 4 of which had two or more programs 
for which CMS did separate reviews. (See table 4.) 

Table 4: Description of the 28 CMS Medicaid Managed Care Rate-Setting 
Files Reviewed: 

CMS regional office: Atlanta; 
State: Florida; 
Medicaid managed care program included in review: Non-Reform; 
Time period of rates covered in review: September 2008-August 2009; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Atlanta; 
State: Florida; 
Medicaid managed care program included in review: Medicaid Reform; 
Time period of rates covered in review: September 2008-August 2009; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: Atlanta; 
State: Georgia; 
Medicaid managed care program included in review: Georgia Families 
Program; 
Time period of rates covered in review: July 2009-June 2010; 
Change in rates from prior year: [A]; 
Actuarial firm that certified the rates: Aon. 

CMS regional office: Atlanta; 
State: Kentucky; 
Medicaid managed care program included in review: Kentucky Partnership 
Program; 
Time period of rates covered in review: July 2009-June 2010; 
Change in rates from prior year: [A]; 
Actuarial firm that certified the rates: PriceWaterhouse Coopers. 

CMS regional office: Atlanta; 
State: South Carolina; 
Medicaid managed care program included in review: Medicaid managed 
care; 
Time period of rates covered in review: April 2008-March 2009; 
Change in rates from prior year: [A]; 
Actuarial firm that certified the rates: Deloitte Consulting. 

CMS regional office: Chicago; 
State: Illinois; 
Medicaid managed care program included in review: Risk-Based Managed 
Care; 
Time period of rates covered in review: August 2008-July 2009; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Chicago; 
State: Indiana; 
Medicaid managed care program included in review: Hoosier Healthwise; 
Time period of rates covered in review: January 2009-December 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Chicago; 
State: Michigan; 
Medicaid managed care program included in review: Comprehensive Health 
Care Plan; 
Time period of rates covered in review: October 2008-September 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Chicago; 
State: Minnesota; 
Medicaid managed care program included in review: Prepaid Medical 
Assistance Program; 
Time period of rates covered in review: January 2009-December 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Chicago; 
State: Minnesota; 
Medicaid managed care program included in review: MinnesotaCare; 
Time period of rates covered in review: January 2009-December 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Chicago; 
State: Ohio; 
Medicaid managed care program included in review: Covered Families and 
Children; 
Time period of rates covered in review: January 2008-December 2008; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: Chicago; 
State: Wisconsin; 
Medicaid managed care program included in review: BadgerCare Plus; 
Time period of rates covered in review: January 2009-December 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: PriceWaterhouse Coopers. 

CMS regional office: Kansas City; 
State: Kansas; 
Medicaid managed care program included in review: HealthWave 19; 
Time period of rates covered in review: July 2008-June 2009; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: Kansas City; 
State: Missouri; 
Medicaid managed care program included in review: HealthNet Managed 
Care Program; 
Time period of rates covered in review: October 2009-June 2010; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: New York; 
State: New Jersey; 
Medicaid managed care program included in review: Medicaid managed 
care; 
Time period of rates covered in review: July 2009-June 2010; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: New York; 
State: New York; 
Medicaid managed care program included in review: Medicaid Managed 
Care and Family Health Plus; 
Time period of rates covered in review: April 2008-March 2009; 
Change in rates from prior year: [A]; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: Philadelphia; 
State: Delaware; 
Medicaid managed care program included in review: Diamond State Health 
Plan; 
Time period of rates covered in review: July 2007-June 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Solucia. 

CMS regional office: Philadelphia; 
State: District of Columbia; 
Medicaid managed care program included in review: District of Columbia 
Healthy Families Program; 
Time period of rates covered in review: May 2008-April 2009; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: Philadelphia; 
State: Maryland; 
Medicaid managed care program included in review: HealthChoice; 
Time period of rates covered in review: January 2009-December 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: Philadelphia; 
State: Pennsylvania; 
Medicaid managed care program included in review: HealthChoices 
Physical Health; 
Time period of rates covered in review: July 2008-June 2009; 
Change in rates from prior year: [A]; 
Actuarial firm that certified the rates: Mercer. 

CMS regional office: Philadelphia; 
State: Virginia; 
Medicaid managed care program included in review: Medallion II; 
Time period of rates covered in review: July 2009-June 2010; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: PriceWaterhouse Coopers. 

CMS regional office: Philadelphia; 
State: West Virginia; 
Medicaid managed care program included in review: Mountain Health 
Trust; 
Time period of rates covered in review: July 2009-June 2010; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Lewin. 

CMS regional office: San Francisco; 
State: Arizona; 
Medicaid managed care program included in review: Arizona Health Care 
Cost Containment System Acute Care Program; 
Time period of rates covered in review: October 2008-September 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: State self-certified. 

CMS regional office: San Francisco; 
State: Arizona; 
Medicaid managed care program included in review: Arizona Long-Term 
Care System; 
Time period of rates covered in review: October 2006-September 2007; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: State self-certified. 

CMS regional office: San Francisco; 
State: California; 
Medicaid managed care program included in review: Two Plan Model; 
Time period of rates covered in review: October 2008-September 2009; 
Change in rates from prior year: CMS regional office: [A]; 
Actuarial firm that certified the rates: CMS regional office: Mercer. 

CMS regional office: San Francisco; 
State: California; 
Medicaid managed care program included in review: County Organized 
Health System; 
Time period of rates covered in review: July 2009-June 2010; 
Change in rates from prior year: [A]; 
Actuarial firm that certified the rates: State self-certified. 

CMS regional office: San Francisco; 
State: Hawaii; 
Medicaid managed care program included in review: QUEST; 
Time period of rates covered in review: July 2009-October 2009; 
Change in rates from prior year: Decrease; 
Actuarial firm that certified the rates: Milliman. 

CMS regional office: San Francisco; 
State: Nevada; 
Medicaid managed care program included in review: Medicaid managed 
care; 
Time period of rates covered in review: January 2009-December 2009; 
Change in rates from prior year: Increase; 
Actuarial firm that certified the rates: Milliman. 

Source: GAO analysis of CMS documentation. 

[A] For this program, the CMS file did not provide a clear indication 
of how the rates changed from the prior year. This may have been for a 
number of reasons. For example, the documentation may have indicated 
increases in rates for some populations and decreases for others but 
not provide a description of the aggregate effect on rates; or the 
documentation may have indicated a change in expenditures but not 
describe whether this resulted from a change in enrollment or a change 
in rates. 

[End of table] 

As part of our file review, we assessed the degree to which CMS 
documented its review. Specifically, we determined whether the CMS 
official completed CMS's checklist--a tool CMS developed for regional 
office staff to use when reviewing states' rate-setting submissions 
for compliance with the actuarial soundness requirements.[Footnote 41] 
For those files where the CMS official did not complete the checklist 
and provided no other documentation of the review, we did no further 
assessment of CMS's review. For the files where the CMS official 
completed the checklist, we assessed the extent to which CMS ensured 
that the state complied with the actuarial soundness requirements. To 
do this, we identified several requirements of the regulations, 
including that rates were certified by a qualified actuary, that rates 
were based on covered services for eligible individuals, and that the 
state documented any adjustments to the base year data. For these 
requirements, we assessed whether (1) CMS documented that the state 
met the requirement, (2) CMS cited evidence for the assessment that 
the state was in compliance, and (3) the cited evidence was consistent 
with the guidance in CMS's checklist. Additionally, as part of our 
review, we summarized descriptive elements of states' rate setting and 
rates. For example, we documented the types of data used as the basis 
for rates and how the state's rates changed from the prior year. To 
ensure the accuracy of the information collected as part of our 
structured review of the files, we conducted independent verifications 
of each review. 

[End of section] 

Appendix II: Methodology for Selecting States to Contact: 

To describe state views of the Centers for Medicare & Medicaid 
Services's (CMS) oversight of state compliance with the Medicaid 
managed care actuarial soundness requirements and state efforts to 
ensure the quality of the data used to set rates, we selected 11 of 
the 34 states with comprehensive Medicaid managed care programs and 
interviewed officials from those states' programs. We selected states 
that: 

* were geographically diverse; 

* varied in the size of their Medicaid managed care programs, as 
defined by the numbers of managed care enrollees, the proportion of 
states' Medicaid population that were in managed care, and the number 
of MCOs participating in the program; and: 

* overlapped with the oversight responsibilities of the six selected 
CMS regional offices. 

Table 5 provides information about the selected states. 

Table 5: Information about the Medicaid Managed Care Programs of 
Selected States, as of 2008: 

State: Arizona; 
Medicaid managed care enrollment: 949,404; 
Percentage of national Medicaid managed care enrollment: 5; 
Percentage of state's Medicaid population enrolled in managed care: 91; 
Number of health plans participating in Medicaid managed care: More 
than 15; 
CMS regional office with oversight responsibility: San Francisco. 

State: California; 
Medicaid managed care enrollment: 3,395,468; 
Percentage of national Medicaid managed care enrollment: 16; 
Percentage of state's Medicaid population enrolled in managed care: 51; 
Number of health plans participating in Medicaid managed care: More 
than 15; 
CMS regional office with oversight responsibility: San Francisco. 

State: Florida; 
Medicaid managed care enrollment: 813,427; 
Percentage of national Medicaid managed care enrollment: 4; 
Percentage of state's Medicaid population enrolled in managed care: 36; 
Number of health plans participating in Medicaid managed care: More 
than 15; 
CMS regional office with oversight responsibility: Atlanta. 

State: Indiana; 
Medicaid managed care enrollment: 582,714; 
Percentage of national Medicaid managed care enrollment: 3; 
Percentage of state's Medicaid population enrolled in managed care: 66; 
Number of health plans participating in Medicaid managed care: Fewer 
than 6; 
CMS regional office with oversight responsibility: Chicago. 

State: Maryland; 
Medicaid managed care enrollment: 491,274; 
Percentage of national Medicaid managed care enrollment: 2; 
Percentage of state's Medicaid population enrolled in managed care: 69; 
Number of health plans participating in Medicaid managed care: From 6 
to 15; 
CMS regional office with oversight responsibility: Philadelphia. 

State: Nebraska; 
Medicaid managed care enrollment: 32,716; 
Percentage of national Medicaid managed care enrollment: Less than 1; 
Percentage of state's Medicaid population enrolled in managed care: 16; 
Number of health plans participating in Medicaid managed care: Fewer 
than 6; 
CMS regional office with oversight responsibility: Kansas City. 

State: New Jersey; 
Medicaid managed care enrollment: 659,586; 
Percentage of national Medicaid managed care enrollment: 3; 
Percentage of state's Medicaid population enrolled in managed care: 72; 
Number of health plans participating in Medicaid managed care: Fewer 
than 6; 
CMS regional office with oversight responsibility: New York. 

State: New York; 
Medicaid managed care enrollment: 2,663,935; 
Percentage of national Medicaid managed care enrollment: 13; 
Percentage of state's Medicaid population enrolled in managed care: 64; 
Number of health plans participating in Medicaid managed care: More 
than 15; 
CMS regional office with oversight responsibility: New York. 

State: Pennsylvania; 
Medicaid managed care enrollment: 968,713; 
Percentage of national Medicaid managed care enrollment: 5; 
Percentage of state's Medicaid population enrolled in managed care: 53; 
Number of health plans participating in Medicaid managed care: From 6 
to 15; 
CMS regional office with oversight responsibility: Philadelphia. 

State: South Carolina; 
Medicaid managed care enrollment: 184,526; 
Percentage of national Medicaid managed care enrollment: 1; 
Percentage of state's Medicaid population enrolled in managed care: 27; 
Number of health plans participating in Medicaid managed care: From 6 
to 15; 
CMS regional office with oversight responsibility: Atlanta. 

State: Tennessee; 
Medicaid managed care enrollment: 1,207,136; 
Percentage of national Medicaid managed care enrollment: 6; 
Percentage of state's Medicaid population enrolled in managed care: 
100; 
Number of health plans participating in Medicaid managed care: From 6 
to 15; 
CMS regional office with oversight responsibility: Atlanta. 

Source: GAO analysis of CMS's 2008 Medicaid managed care enrollment 
report and CMS's organizational chart. 

[End of table] 

[End of section] 

Appendix III: Selected States' Reported Efforts Intended to Ensure the 
Quality of the Data Used to Set Rates: 

The 11 states we interviewed used a combination of approaches intended 
to ensure the quality of the data used in Medicaid managed care rate 
setting. These included front-end efforts intended to prevent errors 
in data reported by providers and health plans, reconciliation methods 
to help ensure the reliability and appropriateness of reported data, 
and in-depth reviews that identified and addressed issues of ongoing 
concern. See table 6 for a summary of the selected states' efforts 
intended to ensure data quality. 

Table 6: Eleven States' Reported Efforts Intended to Ensure the 
Quality of Data Used to Set Medicaid Managed Care Rates: 

Type of effort: Front-end efforts; 
Efforts: Data edits; 
Number of states reporting: 7; 
Examples: South Carolina's information system checked fee-for-service 
data against a set of edits that rejected inappropriate claims and 
checked the data for internal consistency. 

Type of effort: Front-end efforts; 
Efforts: Data reporting requirements for health plans; 
Number of states reporting: 8; 
Examples: Maryland had standard reporting guidelines for financial 
data to ensure the reliability of the data; New York required 
financial data to be certified by health plans' chief executive 
officer and chief financial officer. 

Type of effort: Efforts to reconcile reported data; 
Efforts: Reconciliation of data with other data sources; 
Number of states reporting: 9; 
Examples: California reconciled financial data used to set rates with 
enrollment data to ensure that the data were only for individuals 
eligible under the managed care contract; 
Pennsylvania compared health plan-provided enrollee data to state data 
to ensure that the health plans' cost reports reflected all 
eligibility groups covered under the managed care contract. 

Type of effort: Efforts to reconcile reported data; 
Efforts: Checks for internal consistency and completeness; 
Number of states reporting: 11; 
Examples: Tennessee information technology staff reviewed submitted 
encounter data reports quarterly to identify duplicate or high-cost 
claims, which are returned to health plans for explanations and 
adjustments as necessary. 

Type of effort: In-depth reviews; 
Efforts: Audits or reviews; 
Number of states reporting: 9; 
Examples: Maryland contracted with an outside organization to annually 
audit financial data from each health plan with which it contracts; 
Arizona completed annual validation studies of encounter data, which 
included tracing encounter data submitted by health plans to 
information in medical records; Florida convened a workgroup to review 
its rate-setting process including the appropriateness of the data 
used as the basis for rates; the review found that the FFS data used 
no longer reflected the experience of the state's managed care 
population. 

Source: GAO analysis of information reported by state officials. 

[End of table] 

[End of section] 

Appendix IV: Comments from the Department of Health and Human Services: 

Department Of Health And Human Services: 
Office Of The Secretary: 
Assistant Secretary for Legislation: 
Washington, DC 20201: 

July 23 2010: 

Carolyn Yocom: 
Director, Health Care: 
U.S. Government Accountability Office: 
441 G Street N.W. 
Washington, DC 20548: 

Dear Ms. Yocom: 

Attached are comments on the U.S. Government Accountability Office's 
(GAO) draft report entitled: "MEDICAID MANAGED CARE: CMS's Oversight 
of States' Rate Setting Needs Improvement" (GA0-10-810). 

The Department appreciates the opportunity to review this 
correspondence before its publication. 

Signed by: 

Andrea Palm: 
Deputy Assistant Secretary for Legislation: 

Attachment: 

[End of letter] 

General Comments Of The Department Of Health And Human Services (HHS) 
To The Government Accountability Office's (GAO) Draft Report Entitled, 
"Medicaid Managed Care: CMS' Oversight Of States' Rate Setting Needs 
Improvement" (GA0-10-810): 

The Department appreciates the opportunity to review and comment on 
this GAO draft report. We appreciate GAO's efforts to highlight 
improvements that the Centers for Medicare & Medicaid Services (CMS) 
can make in its oversight of States' compliance with Medicaid
managed care actuarial soundness requirements and focus on data 
quality used to set managed care rates; the agency has identified many 
of the same issues. 

CMS is implementing a broad set of initiatives to strengthen its 
oversight and compliance of managed care services and to ensure access 
to services and quality of care for all Medicaid beneficiaries. 
Managed care has been a valuable development for Medicaid 
beneficiaries over the past decade, but the growth in managed care 
gives rise to the need for increased Federal oversight to assure sound 
payment rates and access to care. This is necessary not just to ensure 
that current beneficiaries receive high-quality care, but also to 
prepare Medicaid's delivery system for the significant increase in 
eligible beneficiaries under the Patient Protection and Affordable 
Care Act (Affordable Care Act), many of whom will likely enroll in 
managed care. 

As part of these oversight efforts, CMS is also implementing section 
403 of the Children's Health Insurance Program Reauthorization Act of 
2009 (CHIPRA), which applied substantially all of the statutory 
Medicaid managed care requirements to the Children's Health Insurance 
Program (CHIP) "in the same manner" as they apply to Medicaid. These 
recent legislative changes make it even more critical for CMS, working 
with States, to implement rigorous improvements in managed care 
monitoring and oversight. The improvements will focus on States' 
performance in meeting regulatory requirements as well as their 
assurance that their managed care systems deliver accessible, 
available and appropriate services to Medicaid beneficiaries. 

GAO's Findings and CMS Actions to Date: 

During its review, GAO found that CMS' oversight of States' compliance 
with actuarial soundness requirements has been inconsistent, due, in 
part, to variation in regional office (RO) practices. By the time GAO 
initiated this review, CMS had identified these inconsistencies as a 
concern and had begun developing a plan for corrective action. This 
plan would strengthen both oversight of actuarial soundness compliance 
and our approach to managed care program reviews in order to ensure 
adequate access to and quality of care provided to beneficiaries. In 
December 2009, the Administrator of the Consortium for Medicaid and 
Children's Health Operations issued a directive to the Medicaid 
Associate Regional Administrators that the existing contract review 
and capitation rate review checklists must be used and documented 
before either the contract or capitation rates are approved. 

GAO also found that CMS's limited efforts do not ensure the quality of 
the data used to set rates. A number of statutory requirements in the 
Affordable Care Act will give CMS additional authority, as well as, 
responsibility for acquiring and utilizing Medicaid program data. 
Current Medicaid statute and regulations require managed care 
organizations (MCOs) to keep patient-specific encounter data and make 
that data available to the State and CMS. However, section 6402 of the 
Affordable Care Act, effective March 23, 2010, requires States to 
report MCO encounter data to the Secretary or face reduced Federal 
financial participation. This action should improve CMS' access to 
encounter data and enable analysis of the data used for rate setting 
by using encounter data as a comparison point. 

GAO Recommendations: 

To improve consistency in the oversight of States' compliance with 
these requirements, CMS should: 

(1) Implement a mechanism for tracking State compliance, including 
tracking the effective dates of approved rates; 

(2) Clarify guidance for CMS officials on conducting rate-setting 
reviews; and; 

(3) Make use of information on data quality in overseeing States' rate 
setting. 

CMS Response: 

As noted above, CMS has identified many of the same issues regarding 
the need for more robust oversight of managed care rates and the need 
to address inconsistencies in our approach to reviewing managed care 
rate setting. The following is a description of the initiatives that 
we have underway to improve our oversight of Medicaid managed care 
plans and responses to the recommendations raised in this report. 

Recommendations 1 and 2: 

We concur fully with GAO's first two recommendations. CMS has 
identified key elements needed to move toward rigorous and consistent 
oversight and monitoring of Medicaid and CHIP managed care programs 
operating under any statutory authority and using any delivery system 
model. These key elements address the specific recommendations made by 
GAO, but also include other components of an improved managed care 
oversight program. CMS has established a managed care oversight team 
to develop and implement a number of improvements, including: 

* Standard Operating Protocols (SOP) for the review and approval of 
Medicaid and CHIP managed care contracts. These SOPs will address 
workflow and process and set standard timelines for contract review; 

* Medicaid contract review checklist - updates and directions for use. 
The new checklist will include instructions and technical guidance for 
the review of implementation evidence, compliance criteria, and 
sanctions for noncompliance, including the withholding of funds; 

* CHIP contract review checklist. This activity is dependent upon 
publication of regulatory requirements for CHIP managed care 
oversight. In the interim, a tool addressing the statutory 
requirements of Section 403 of CHIPRA will be developed and 
implemented; 

* Online contract review tool. The tool will provide contract-related 
data aggregation capabilities and ensure consistency and workflow. It 
will permit CMS to track State compliance with specific criteria, as 
well as conduct service- or population-specific audits of State 
programs. It will also enable review triggers to be set and monitored 
on a regular basis; 

* Standard Operating Protocols for the review and approval of managed 
care rates. CMS will clearly define the circumstances under which a 
full or partial rate review will be performed and will incorporate 
standards for the type, amount, and age of data used to set rates to 
assure appropriateness of data quality. A process will also be 
designed to document health plan executives' certification regarding 
the accuracy and completeness of data. CMS will enlist staff from the 
Office of the Actuary (OACT) in this effort and build OACT 
consultation into the review process, to the extent feasible; 

* Guidelines for consistent interpretation and enforcement of 
regulatory requirements. To ensure national consistency to the extent 
possible, definitions and expectations related to requirements for 
access and availability of services will be developed and applied; 

* Managed care program monitoring/review guides — updates and 
directions for use. The existing guide will be revamped to be of use 
for any type of managed care program, and will include expanded data 
review and program integrity modules; 

* Formal dissemination of sub-regulatory guidance to States. State 
Medicaid Director and/or State Health Official letters will accompany 
CMS guidance on compliance expectations and requirements, and training 
provided as needed; 

* Training for CMS staff. As new processes and requirements are 
developed and implemented, staff responsible for oversight and 
monitoring of Medicaid and CHIP programs will be trained on them. 
Additionally, once all improvements are in place, staff will receive 
intensive and comprehensive training covering all aspects of the new 
processes and requirements; and; 

* Shared and accessible resource library of policies and procedures 
for CMS staff in Baltimore and ROs. 

RO staff has already made substantial progress in reviewing and making 
preliminary revisions to the two compliance checklists. The managed 
care oversight team, composed of CMS staff and managers from Baltimore 
and the ROs, is working to finalize these and distribute them as 
formal CMS guidance by November 2010. We also expect to have the 
contract review SOP issued by that date. These documents will populate 
the CMS managed care oversight resource library. 

At the same time, the team will work throughout the remaining half of 
this year and into 2011 to develop the additional elements of our 
managed care oversight improvement plan, including guidelines for 
interpreting and enforcing our regulatory requirements, providing 
additional guidance for States, and training for CMS staff. The 
oversight team will also work on an ongoing basis to ensure that new 
statutory and regulatory provisions affecting Medicaid and CHIP 
managed care are reflected in CMS guidance documents, protocols and 
tools. The team will report to CMS leadership on a regular basis on 
the implementation of these new approaches and make recommendations 
about what additional oversight efforts and approaches are needed. 
Finally, CMS will explore, with the American Academy of Actuaries, 
possible development and/or refinement of Standards of Practice for 
Medicaid and CHIP managed care rate setting. 

Recommendation 3: 

We concur and acknowledge improvements we need to make regarding the 
third recommendation. The CMS has already recognized that data 
validation and analysis is a critical component in the efficient 
operation of the Medicaid program. CHIPRA, the American Recovery and 
Reinvestment Act and the Affordable Care Act contain many new 
provisions to enhance the scope and quality of the Medicaid/CHIP 
programs; these provisions also implement a number of new programs 
that require more and better information to operate efficiently. 

Currently, CMS is undertaking a fundamental redesign of Medicaid data 
collection and the development of robust analytical functionality that 
will offer strategic programmatic insights of use to States, Federal 
partners, and other stakeholders. In collaboration with States, CMS'
redesign will use a comprehensive performance and quality management 
approach to implement nationally consistent data collection, 
aggregation, and analysis methods that can be used for program 
integrity, fiscal accountability, program effectiveness and effective 
program management. 

Managed care data collection is a critical component of these efforts, 
in light of the increasing prominence of managed care delivery 
systems. CMS will be setting standards for the type and frequency of 
managed care data submissions by States in order to expand the type and
consistency of data on managed care programs. With more complete data 
at its disposal, CMS will be able to implement more rigorous analysis 
to assess the underlying quality of data submissions. These analyses 
can then be used to help CMS better execute its oversight and
monitoring responsibilities, including ensuring the actuarial 
soundness of managed care rates. The data will also be of use to 
States as they administer their managed care programs. 

CMS appreciates GAO's efforts to highlight areas of improvement for 
managed care rate-setting oversight. CMS intends to take these 
findings and recommendations and incorporate them into the larger 
compliance monitoring and oversight plan we are developing. CMS looks 
forward to working with GAO as we proceed to address these issues. CMS 
is committed to ensuring that States' managed care delivery systems 
provide the highest quality care to Medicaid recipients, while 
ensuring access to all program services in the most efficient and 
effective manner possible. 

[End of section] 

Appendix V: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Carolyn L. Yocom, (202) 512-7114 or y [Hyperlink, yocomc@gao.gov] 
ocomc@gao.gov: 

Acknowledgments: 

In addition to the contact named above, Michelle Rosenberg, Assistant 
Director; Joseph Applebaum, Chief Actuary; Susan Barnidge; William A. 
Crafton; Drew Long; Kevin Milne; and Dawn D. Nelson made key 
contributions to this report. 

[End of section] 

Footnotes: 

[1] Data on Medicaid managed care spending were not available for 2008. 

[2] Pub. L. No. 111-148, 124 Stat. 119, tit. II, subtit. A, as amended 
by the Health Care and Education Reconciliation Act of 2010, Pub. L. 
No. 111-152, 124 Stat. 1029, tit. I, subtit. C. Beginning in 2014, or 
sooner at a state's option, all citizens and certain legal residents 
with incomes at or below 133 percent of the federal poverty level 
($14,404 for an individual or $29,327 for a family of four in 2010) 
and who are under 65 and not already required to be covered under 
Medicaid will be eligible. See Pub. L. No.111-148, § 2001(a)(1), as 
amended by § 10201. CMS's Office of the Actuary (OACT) estimated that 
this will result in 18 million individuals receiving primary coverage 
and 2 million individuals receiving supplemental coverage through 
Medicaid. 

[3] Throughout this report, the term "managed care" refers only to 
capitated managed care arrangements. States may also have primary care 
case management (PCCM) programs under which a primary care provider is 
paid a nominal monthly, per person, case management fee to coordinate 
care for beneficiaries, in addition to fee-for-service (FFS) 
reimbursement for any health care services they provide. While some 
consider PCCM programs to be managed care, we consider those programs 
to be FFS-based arrangements because participating providers are 
predominately paid on a FFS basis. 

[4] Incentives regarding the provision of services can exist under 
both capitated and FFS payment systems. Under capitated payment 
systems, health plans and, in some cases, providers can profit from 
not delivering services for which they have already received payment. 
In contrast, beneficiaries in FFS systems may be at risk for the 
overprovision of services as providers seek to increase revenue. 
However, if FFS payment levels are too low, physicians may underserve 
their patients or be unwilling to participate at all. 

[5] See Social Security Act §1903(m)(2)(A). 

[6] See 42 CFR §438.6(c)(1)(i)(2009). 

[7] In this report, we refer to capitation rate setting for Medicaid 
managed care as "rate setting" and managed care capitation rates as 
"rates." 

[8] See Pub. L. No. 111-3, §617, 123 Stat. 8, 103. 

[9] The CMS regional offices selected were the offices located in 
Atlanta, Chicago, Kansas City, New York City, Philadelphia, and San 
Francisco. We limited our review to CMS's oversight of rate setting 
for comprehensive managed care programs that involve risk contracts, 
i.e., contracts under which the health plan assumes risk for the cost 
of providing services. In addition to managed care programs that 
provide comprehensive services, some states have also implemented 
managed care for targeted categories of services. These include 
programs such as prepaid ambulatory health plans that provide a 
limited range of services and coverage. These programs were not 
included in the scope of our work. 

[10] Several states overseen by the selected CMS regional offices have 
multiple comprehensive managed care programs that have separate rate- 
setting processes, each of which is subject to CMS review. Thus, for 
some states, we reviewed more than one CMS rate-setting review file. 

[11] The 11 states were Arizona, California, Florida, Indiana, 
Maryland, Nebraska, New Jersey, New York, Pennsylvania, South 
Carolina, and Tennessee. In some of our interviews, the state included 
members of the state-contracted actuarial firm in the conversation. 

[12] We contacted all of the state auditor's offices describing the 
scope of our work and asking whether they had completed any related 
studies. The Washington State Auditor's Office was the only office 
that reported having completed related work. 

[13] The health plans contacted varied in size, whether they served 
only Medicaid clients, and whether they were nonprofit. 

[14] Base-year data may include FFS claims data, encounter data, or 
health plan financial data. FFS claims data are the record of services 
provided to recipients in the FFS program and the cost of those 
services. Provided by health plans, encounter data are the primary 
record of, and include detailed information on, services provided to 
Medicaid beneficiaries enrolled in capitated managed care. Health plan 
financial data may include aggregate spending by category of service, 
but do not include information on individual encounters or claims. 

[15] See 42 CFR §438.6(c)(2). The regulations included in the final 
rule were effective on August 13, 2002, and states had until June 16, 
2003, to bring their managed care programs into compliance. 

[16] A CMS workgroup developed the checklist, which was finalized July 
22, 2003. Prior to the July 2003 checklist, officials used a number of 
different tools when reviewing rate setting for compliance with the 
actuarial soundness requirements. 

[17] For example, a state may adjust its rates to reflect a midyear 
program change, such as adding a service to the program's list of 
covered benefits, or a state may use an inflation factor to adjust 
rates from a prior year. 

[18] ASOPs and practice notes do not have the same standing in 
determining what constitutes generally accepted actuarial principles 
and practices. ASOPs are considered part of actuaries' professional 
code of conduct and have the highest standing. In contrast, practice 
notes are not a definitive statement as to what constitutes generally 
accepted practice. 

[19] The ASOP on data quality provides actuaries with guidance on 
selecting underlying data for an actuarial product, relying on data 
supplied by others, reviewing and using data, and making appropriate 
disclosures regarding data quality. ASOP No. 23, Data Quality (Doc. 
No. 097; December 2004). 

[20] State officials indicated that they hired an actuarial firm to 
produce the state's managed care rates, but the state did not have the 
firm provide an actuarial certification of the rates. 

[21] As of June 2010, CMS was in the process of reviewing Tennessee's 
rate setting for health plans participating in the state's managed 
long-term care program. These rates, which are effective August 1, 
2010, were certified by an actuary. 

[22] As of 2008, the most recent year for which CMS data are 
available, about 33,000 individuals--or 16 percent of Nebraska's 
Medicaid population--were enrolled in comprehensive managed care. 

[23] A CMS official in the Kansas City regional office told us that 
the state submitted rates for review a number of times after 2002; 
however, those submissions did not trigger a full review by CMS. 
Rather, according to the regional official, CMS completed a number of 
partial reviews, which would have ensured that an actuary certified 
the rates but would not have assured compliance with other 
requirements. 

[24] The 28 CMS files that we reviewed did not include files related 
to Tennessee or Nebraska, because CMS had not reviewed Tennessee's 
rate setting for the most recent contract and had not completed a full 
review of Nebraska's rate setting since the actuarial soundness 
requirements became effective. 

[25] For example, if a state were to start paying rates in October, 
the beginning of the first quarter of the federal fiscal year, then, 
according to CMS officials, its rates would need to be approved by the 
end of December to be in compliance with the actuarial soundness 
requirements. 

[26] Of the 13 files, 8 showed evidence of CMS approving rates more 
than 6 months after state implementation, with 3 of those indicating 
CMS approval more than 9 months later. 

[27] The regulations require assurances that rates are based only upon 
services covered under the state Medicaid plan or costs related to 
providing these services, such as health plan administration, and 
provided under the contract to Medicaid-eligible individuals. 

[28] Officials from five of the regional offices we spoke with 
indicated that they looked at states' rate-setting submissions for 
information on the age or number of years of data, although some of 
the officials indicated that there was no standard for the age or 
amount of data. 

[29] According to actuarial standards of practice, actuaries are not 
required to audit the data used to set rates and may rely on those 
providing the data, in these cases the state and health plans, to 
ensure the data's accuracy and completeness. 

[30] State of Washington, Office of Financial Management, Single Audit 
Report for the Fiscal Year Ended June 30, 2007 (March 2008). 

[31] The validation study of health plan data for one of the state's 
managed care programs for contract year 2007--the contract year at 
issue in the CMS file we reviewed for this state program--found error 
rates that were above the limits set by the state. The state was 
planning a number of steps to reduce those error rates. 

[32] This state operates its Medicaid managed care program under an 
1115 waiver. Under section 1115 of the Social Security Act, the 
Secretary of Health and Human Services may waive certain federal 
requirements for demonstrations the Secretary deems likely to promote 
Medicaid objectives. The terms of such a waiver can include such 
reporting requirements as were discussed above. 

[33] According to CMS officials, under the terms of Arizona's current 
waiver, the state is not required to provide CMS the results of 
validation studies for health plans already participating in the 
state's Medicaid managed care programs. However, the state must submit 
validation studies to CMS when a new health plan begins participating 
in the state's programs. CMS officials confirmed that the results of 
any validation studies are not considered when reviewing the state's 
rate-setting methodology. 

[34] The PERM program attempts to measure improper payments in the 
Medicaid program using contractors to perform statistical 
calculations, medical records collection, and medical/data processing 
review of selected state Medicaid FFS and managed care claims. The 
program annually reviews 500 FFS and 250 managed care payments from 17 
states. Its fiscal year 2007 review found a national error rate of 8.9 
percent for FFS data and 3.1 percent for managed care data. 

[35] See Social Security Act § 1857(d)(1). The contract year 2006 
audits for the Medicare Advantage program, which serves as an 
alternative to Medicare's traditional FFS program, included reviewing 
the accuracy of the data used to develop contract bids and ensuring 
that plans' rates were developed consistent with the ASOPs specified 
by CMS. These audits are arranged by OACT. 

[36] In its comments, HHS refers to PPACA as the Affordable Care Act. 

[37] In comprehensive managed care programs, health plans provide a 
full range of health care services. In addition to managed care 
programs that provide comprehensive services, some states have also 
implemented managed care for targeted categories of services. 

[38] Full reviews are those that cover all of the sections of CMS's 
checklist. Officials may also conduct partial reviews, which focus on 
a narrower set of the requirements covered in the checklist. We did 
not review any files that documented only a partial review. 

[39] There was one exception to this rule. Florida had two programs 
that underwent separate CMS reviews. Because CMS indicated that one 
program was larger in terms of expenditures and the other was larger 
in terms of the number of enrollees, we included the files for both 
programs in our review. 

[40] While we did not review CMS rate-setting review files for 
Nebraska and Tennessee, we asked CMS officials about their oversight 
of those states' rate setting and reviewed relevant documents the 
states submitted to CMS. 

[41] The checklist includes citations to, and a description of, each 
regulatory requirement; guidance on what constitutes state compliance 
with the requirement; and spaces for the CMS official to check whether 
each requirement was met and cite evidence from the state's submission 
for compliance with the requirement. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site [hyperlink, http://www.gao.gov]. Each 
weekday, GAO posts newly released reports, testimony, and 
correspondence on its Web site. To have GAO e-mail you a list of newly 
posted products every afternoon, go to [hyperlink, http://www.gao.gov] 
and select "E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO’s actual cost of
production and distribution and depends on the number of pages in the
publication and whether the publication is printed in color or black and
white. Pricing and ordering information is posted on GAO’s Web site, 
[hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card,
MasterCard, Visa, check, or money order. Call for additional 
information. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]: 
E-mail: fraudnet@gao.gov: 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Ralph Dawn, Managing Director, dawnr@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, D.C. 20548: 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, D.C. 20548: