Medicaid: CMS Needs to Better Target Risks to Improve Oversight of Expenditures
Fast Facts
The Centers for Medicare & Medicaid Services (CMS) review state spending reports to verify that states appropriately spent their federal Medicaid funds.
CMS reviewers have saved over $5 billion in the past 4 years by identifying errors in state spending reports—finding expenditures that lacked supporting data or were not allowed under Medicaid rules.
Could they be finding more? CMS may be missing chances to save because of how it targets its reviews. For example, CMS has 1 staff member reviewing Arkansas reports and only 2.2 staff reviewing California, which spends 15 times as much. Our recommendations address this and other issues we found.
State documentation used to review California's Medicaid spending for three months.
Photo of dozens of binders piled on a desk
Highlights
What GAO Found
The Centers for Medicare & Medicaid Services (CMS), which oversees Medicaid, has various review processes in place to assure that expenditures reported by states are supported and consistent with Medicaid requirements. The agency also has processes to review that the correct federal matching rates were applied to expenditures receiving a higher than standard federal matching rate, which can include certain types of services and populations. These processes collectively have had a considerable federal financial benefit, with CMS resolving errors that reduced federal spending by over $5.1 billion in fiscal years 2014 through 2017.
However, GAO identified weaknesses in how CMS targets its resources to address risks when reviewing whether expenditures are supported and consistent with requirements.
CMS devotes similar levels of staff resources to review expenditures despite differing levels of risk across states. For example, the number of staff reviewing California's expenditures—which represent 15 percent of federal Medicaid spending—is similar to the number reviewing Arkansas' expenditures, which represents 1 percent of federal Medicaid spending.
CMS cancelled in-depth financial management reviews in 17 out of 51 instances over the last 5 years. These reviews target expenditures considered by CMS to be at risk of not meeting program requirements.
CMS told GAO that resource constraints contributed to both weaknesses. However, the agency has not completed a comprehensive assessment of risk to (1) determine whether oversight resources are adequate and (2) focus on the most significant areas of risk. Absent such an assessment, CMS is missing an opportunity to identify errors in reported expenditures that could result in substantial savings to the Medicaid program.
GAO also found limitations in CMS's processes for reviewing expenditures that receive a higher federal matching rate.
Internal guidance for examining variances in these expenditures was unclear, and not all reviewers in the three CMS regional offices GAO reviewed were investigating significant variances in quarter-to-quarter expenditures.
Review procedures for expenditures for individuals newly eligible for Medicaid under the Patient Protection and Affordable Care Act were not tailored to different risk levels among states. For example, in its reviews of a sample of claims for this population, CMS reviewed claims for the same number of enrollees—30—in California as for Arkansas, even though California had 10 times the number of newly eligible enrollees as Arkansas.
Without clear internal guidance and better targeting of risks in its review procedures for expenditures receiving higher matching rates, CMS may overpay states.
Why GAO Did This Study
Medicaid has grown by over 50 percent over the last decade, with about $370 billion in federal spending in fiscal year 2017. CMS is responsible for assuring that expenditures—reported quarterly by states—are consistent with Medicaid requirements and matched with the correct amount of federal funds. CMS's review of reported expenditures has become increasingly complex due to variation in states' Medicaid programs and an increasing number of different matching rates.
GAO was asked to examine CMS's oversight of state-reported Medicaid expenditures. In this report, GAO examined how CMS assures that (1) expenditures are supported and consistent with requirements; and (2) the correct federal matching rates were applied to expenditures subject to a higher match. GAO also examined the financial impact of resolved errors. GAO reviewed documentation for the most recently completed quarterly reviews by 3 of CMS's 10 regional offices for six states that varied by Medicaid program expenditures and design. GAO also reviewed policies, procedures, and data on resolved errors; and interviewed CMS and state officials. GAO assessed CMS's oversight processes against federal standards for internal control.
Recommendations
GAO is making three recommendations, including that CMS improve its risk-based targeting of oversight efforts and resources, and clarify related internal guidance. The Department of Health and Human Services concurred with these recommendations.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Medicare & Medicaid Services |
Priority Rec.
The Administrator of CMS should complete a comprehensive, national risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated based on areas of highest risk. (Recommendation 1) |
Although CMS suspended implementation of the tool the agency developed in October 2019 to assess risk and staff capacity, the agency has taken steps to strengthen financial oversight. In November 2019, the agency reorganized its regional office functions, including financial oversight. According to CMS, the reorganization is intended to improve coordination between central and regional offices so that financial operations are consistent across the nation. In February 2024, agency officials told us that the reorganization had increased staff resources for financial reviews and allowed the agency to work towards reducing the backlog of financial management reviews, which are in-depth reviews of higher-risk expenditures. We maintain that a risk assessment is still necessary to ensure that resources are allocated based on identified risks, and we will continue to monitor CMS's action to target identified risks. We will update the status of this recommendation when we receive additional information
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should clarify in internal guidance when a variance analysis on expenditures with higher match rates is required. (Recommendation 2) |
In January 2022, CMS shared updated agency guidance for staff on conducting the quarterly review. The guidance clarified the requirements for conducting a variance analysis for expenditures receiving a higher match rate.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should revise the sampling methodology for reviewing expenditures for the Medicaid expansion population to better target reviews to areas of high risk. (Recommendation 3) |
CMS has not revised the sampling methodology as GAO recommended in August 2018. In December 2021, CMS indicated that it continues to believe the sampling methodology is sufficient and has no plans to revise it, noting that the agency's current methodology requires a minimum sample size but gives reviewers the flexibility to expand the sample size if warranted by risk and as resources permit. In 2019 the agency noted that it revised requirements for focused financial management reviews to better target expenditures for the expansion population. According to the agency, these revised requirements are intended to augment the sampling methodology. As of February 2024, CMS has not informed GAO of any further actions taken. Although the changes to the requirements for financial reviews represent an important step in targeting risk, such reviews can be infrequent and take years to complete. In addition, although reviewers have the flexibility to expand the sample size, our report found that CMS was facing resource constraints that make it difficult for reviewers to expand their review in the quarterly review's timeframes. GAO continues to believe that the current methodology does not sufficiently target areas of high risk. As a result of the inconsistency in reviews and a sampling methodology that does not consider program risk, errors may be going undetected, resulting in CMS providing federal funds at higher federal matching rates than is allowable. GAO will continue to monitor CMS's efforts to target this high-risk area with the various tools currently available, including the sampling methodology and financial management reviews.
|