Key Issues > High Risk > Strengthening Medicaid Program Integrity
High Risk Medallion

Strengthening Medicaid Program Integrity

The Centers for Medicare & Medicaid Services (CMS) has taken steps, but further efforts are needed to reduce improper payments, ensure the appropriate use of program dollars, and improve program data.

View the 2019 Report

  1. Share with Facebook 
  2. Share with Twitter 
  3. Share with LinkedIn 
  4. Share with mail 

The size, growth, and diversity of the joint federal-state Medicaid program present oversight challenges and we designated Medicaid a high-risk program in 2003. Since then, we have made more than 270 recommendations related to the program.

In fiscal year 2018, Medicaid covered an estimated 75 million low-income and medically needy individuals at a cost of $629 billion, of which $393 billion was financed by the federal government. Services are increasingly delivered through managed care, under which organizations are paid a set amount per beneficiary for care.

Our recent work highlights oversight challenges in three areas: improper payments, appropriate use of program dollars, and data. First, Medicaid improper payments represented about 9.8 percent of federal program spending—$36.2 billion—in fiscal year 2018. Second, CMS can waive certain Medicaid requirements and authorize states to incur new types of expenditures through demonstrations; as of November 2016, CMS had done so for nearly three-quarters of states. Supplemental payments—made to providers, such as local government hospitals and not linked to specific beneficiary services—grew to over $48 billion in 2016, the most recent year for which data are available. Third, CMS’s oversight of Medicaid often relies on state-reported expenditure and utilization data. Incomplete and inconsistent state data complicate program oversight.

Enforcement of Tax LawsSince our 2017 High-Risk Report, CMS has taken important steps to strengthen Medicaid program integrity. Further, leadership has demonstrated a commitment to continuing these efforts by outlining a high-level program integrity strategy.  Still, work remains to fully “meet” all of the high-risk criteria.

As of November 2018, more than 70 of our recommendations related to Medicaid remain open, and several major steps remain to improve Medicaid program integrity. For example, more efforts are needed to mitigate the risks not captured in CMS’s improper payment estimate—particularly for managed care. CMS can also do more to target risk in overseeing the use of program dollars and to expedite the use of improved Medicaid data in program oversight.  For this report, we are rating three segments of the Medicaid program, all of which are priority areas identified by CMS. CMS has met our criteria for leadership commitment for improper payments, the one segment we rated in 2017, and the other four criteria remain partially implemented.  For the remaining two segments—the appropriate use of Medicaid dollars and Medicaid data—CMS partially meets nearly all criteria.



Improper Payments

Enforcement of Tax LawsSince our 2017 High-Risk Report, we have increased one of the five criteria.

Leadership commitment: met. CMS has shown an increased commitment to oversight of improper payments. In June 2018, CMS communicated the agency’s strategy for improving program integrity, including plans for a number of new and enhanced efforts to detect and respond to improper payments. For example, the strategy highlighted a commitment to enhanced auditing efforts and monitoring compliance with new managed care rules established in 2016. Further, CMS has taken important steps towards coordinating oversight with state auditors as a means of expanding its oversight of improper payments.

Capacity: partially met. CMS has taken actions to enhance the resources and guidance available to states for program integrity purposes. Based on its reviews of states’ program integrity activities, CMS has targeted high-risk areas in each state, including managed care, and expanded federal-state collaborative audits to include Medicaid managed care organizations (MCO). In 2018, CMS reported working to improve federal-state collaborative audits, such as by meeting with all states to discuss how operational audit issues will be handled moving forward, including planning for new collaborative audits. However, efforts to date do not ensure CMS can estimate an improper payment rate for managed care that reflects all program risks. Additionally, as we reported in July 2018, impediments to conducting audits of managed care—such as a focus on states with certain provisions around overpayments in MCO contracts—continue.

Action plan: partially met. In June 2018, CMS outlined a strategy to reduce Medicaid improper payments, including plans to check the accuracy of MCO’s financial statements, assist states with screening Medicaid providers, and initiate audits of certain state beneficiary eligibility determinations. If fully implemented, these steps could address some of the concerns we raised in January 2017 and May 2018. However, CMS has not detailed the scope and timing of this strategy. For example, the strategy does not include how many states will be part of the targeted audits for MCO financial statements nor does it specify implementation dates.

Monitoring: partially met. Our work has detailed concerns related to the accuracy of provider eligibility and beneficiary enrollment, both of which can have an impact on CMS’s ability to monitor improper payments. To improve the effectiveness of managed care provider screening, CMS analyzed 22 databases used by MCOs and formally incorporated 6 into the agency’s provider screening process. However, efforts to enhance screening are ongoing and the agency does not require states to report MCO overpayments. Gaps also remain in CMS’s efforts to ensure that only eligible individuals are enrolled and expenditures for enrollees, mainly those eligible through the Patient Protection and Affordable Care Act expansion, are matched appropriately by the federal government.

Demonstrated progress: partially met. CMS’s overall estimated Medicaid improper payment rate declined from 10.5 percent in fiscal year 2016 to 9.8 percent in fiscal year 2018. This rate is comprised of three components: (1) fee-for-service (FFS) payments to providers, (2) payments to MCOs, and (3) the accuracy of beneficiary eligibility determinations.  The FFS component of the error rate is 14.3 percent, primarily due to state’s non-compliance with provider screening, enrollment, and identification requirements. The reduction in the overall error rate occurred as spending shifted from FFS to managed care, where estimates of improper payments—at 0.22 percent in 2018—do not account for all program risks.  In particular, CMS’s estimates of MCO improper payments do not include a medical review of services or reviews of MCO records or data, which likely minimizes the appearance of program risks in Medicaid managed care. The beneficiary eligibility component of the error rate is 3.1 percent, a rate that CMS has not updated since 2014, raising further questions regarding the accuracy of the overall rate. CMS plans to resume eligibility component measurement in 2019.

Appropriate Use of Medicaid Dollars

Enforcement of Tax LawsWe are rating this segment for the first time. CMS has taken important steps—such as improved reporting of payments and steps to mitigate federal financial exposure—to better ensure the appropriate use of Medicaid dollars. Our work has identified risks—and potential actions to mitigate these risks—related to oversight of demonstration spending under section 1115 of the Social Security Act, supplemental payments, and Medicaid expenditures more broadly.

Leadership commitment: partially met. With respect to demonstrations, CMS began implementing a policy in 2016 that significantly improves efforts to assure demonstrations are budget neutral—that is, that the demonstration does not increase federal costs. Further, as we previously recommended in June 2013 and April 2017, the agency issued guidance to states in August 2018 articulating the agency’s budget neutrality policy, which improves transparency in how CMS approves demonstration spending limits and consistency in oversight of demonstration spending. However, additional policy changes are needed to address other questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set spending limits and to provide policymakers with timely findings from evaluations of demonstrations. 

With regard to supplemental payments—payments made to providers such as local government hospitals and other providers in addition to claims-based payments—CMS anticipates issuing a proposed rule in early 2019 designed to increase transparency by establishing new requirements for states. However, until CMS issues a final rule, its potential effect on program integrity efforts will remain unclear.

Capacity: partially met. With regard to demonstrations, CMS actions show promise, but are, to date, incomplete. As of November 2018, CMS had developed a standard reporting tool to ensure that states consistently report the data elements needed for CMS to assess compliance with demonstration spending limits and was beginning to test this tool. The agency also was developing procedures for CMS staff to consistently track spending compared with spending limits. Until these procedures are fully implemented, the impact on oversight of demonstrations remains unclear.

With regard to supplemental payments, as of November 2018, CMS had issued letters to some states clarifying that the distribution of supplemental payments must be linked to the provision of Medicaid-covered services. Because supplemental payments are not linked directly to services for beneficiaries, there is risk that they may not be made for Medicaid activities or services. CMS has not taken action on our recommendation that the agency issue guidance on the appropriate distribution of supplemental payments to all states, nor has it issued other needed guidance, including criteria to assure that payments meet statutory requirements.

With regard to oversight of states’ reported expenditures and in response to our findings, CMS plans to conduct a national assessment of whether oversight resources are adequate and target areas of greatest risk. This is critical, as the complexity of expenditure reporting has increased while staff resources used to review states’ expenditures has decreased, thus hindering CMS’s ability to target risk and protect federal and state dollars.

Action plan: partially met. With respect to demonstrations, the agency has issued guidance to states in 2017 and 2018 with the intent to improve efforts to ensure demonstrations are budget neutral and effectively evaluated. However, this guidance addresses some, but not all, of the concerns we raised in January 2018 about how CMS sets spending limits and evaluates demonstrations. For example, CMS has not yet implemented its plan to establish written procedures for all states to submit a final evaluation report at the end of each demonstration cycle, nor has it established criteria for when the agency will allow limited evaluations. Further, CMS has not made progress with regard to an action plan for improving its oversight of supplemental payments.

Monitoring: partially met. For demonstrations, CMS has begun assessing the effect of its new budget neutrality policy with the renewal of each demonstration. Agency officials told us that CMS has developed a reporting tool for states that will allow for monitoring of the policy over time. Until CMS implements the tool, it will lack the data it needs to effectively monitor this new policy.

For supplemental payments, CMS has taken action when we and others identified questionable payments (payments where the appropriateness of the amounts or use of funds were questionable). CMS reviewed excessive payments we identified in April 2015 in New York and made retroactive payment reductions totaling more than $1.5 billion, of which the federal share was about $771 million. However, CMS continues to lack a strategy for systematically identifying questionable payments.

Demonstrated progress: partially met. CMS has not made significant progress towards improving its oversight of supplemental payments, for which reporting remains incomplete. With regard to oversight of demonstration spending, CMS estimated its budget neutrality policy reduced total demonstration spending limits by $109 billion for 2016 through 2018, the federal share of which is $62.9 billion. Another component of that policy does not take effect until 2021 and will be implemented as demonstrations come up for renewal—which should further reduce federal liabilities.

Medicaid Data

Enforcement of Tax LawsWe are rating the Medicaid data segment for the first time. CMS has taken steps to improve data quality across the Medicaid program, primarily through a re-envisioning of states’ data reporting. However, CMS needs to take additional steps to ensure data quality and specify how and when it will use improved data for oversight. Accurate and complete data on beneficiary access and use of services and the costs of providing such services are critical to effectively managing and overseeing this multibillion dollar program.

Leadership commitment: partially met. CMS has made progress in improving Medicaid data through the ongoing implementation of the Transformed Medicaid Statistical Information System (T-MSIS). As of June 2018, all states, the District of Columbia, and Puerto Rico were submitting at least some T-MSIS data. However, we reported in December 2017 that these data were not complete, nor were they comparable across states. We recommended CMS take steps to expedite the use of T-MSIS data for oversight. CMS noted in July 2018 that its primary goal is to improve data quality, and more work is needed before it can use these data for oversight.

Capacity: partially met. The 2016 managed care final rule includes several requirements that could improve the reliability of state-collected MCO utilization data, known as encounter data. These requirements include requiring states to conduct an independent audit of the encounter data reported by each MCO, providing CMS with an annual assessment of these data, and validating data reliability. However, it remains unclear whether state efforts to validate encounter data will be sufficient, in part because CMS has not provided minimum standards to states for doing so.

Action plan: not met. CMS needs to develop an action plan for using quality program data for program oversight. In December 2017, we recommended CMS articulate a plan and associated time frames for using T-MSIS data for oversight. The agency concurred, but has yet to specify such a plan. It notes the use of these data for oversight is contingent upon ongoing CMS and state efforts to ensure their quality. Similarly, in January 2017, we recommended CMS develop a plan for using data on personal care services (PCS)—assistance with activities of daily living such as bathing, dressing, and toileting, for beneficiaries with limited ability to care for themselves—to inform oversight efforts. CMS has yet to develop this plan.

Monitoring: partially met. In February 2018, CMS issued guidance on Medicaid PCS reported by states, which suggests that states include key data elements in PCS claims reported through T-MSIS and could address information gaps we identified. T-MSIS also includes data elements for states to report provider-specific supplemental payments, which CMS did not previously collect. However, we reported in December 2017 that several selected states were not reporting all these data elements. Without complete information, CMS’s oversight of PCS and supplemental payments will be limited.

Demonstrated progress: partially met. The ongoing implementation of T-MSIS has been a significant, multi-year effort. With all states now reporting at least some T-MSIS data, CMS is focused on assessing and improving data quality. CMS identified 12 top priority items and issued a State Health Official letter in August 2018 that informed states they are expected to resolve data quality issues related to these priority items within 6 months. CMS stated that it will request states that do not meet this time frame to submit a corrective action plan. CMS also noted that it intends to expand data reviews beyond the 12 top priority items, but has not specified a time frame for completing this and other data quality efforts or its plans for using these data for oversight.

Improper Payments

Since designating Medicaid as a high-risk area in 2003, we have made at least 45 recommendations related to improper payments, 17 of which were open as of November 2018. To reduce improper payments, CMS needs to:  

  • mitigate program risks not measured through its estimate of MCO improper payments, such as overpayments and unallowable costs—such efforts could include actions such as revising the payment error rate methodology or focusing additional audit resources on managed care;
  • expedite the issuance of planned guidance on MCO program integrity, address impediments to MCO audits, and ensure states account for overpayments when setting future payment rates; and
  • review federal determinations of Medicaid eligibility for accuracy, use the information obtained from the eligibility reviews to inform expenditure reviews, and increase assurances that expenditures for different eligibility groups are correctly reported and appropriately matched.

Appropriate Use of Medicaid Dollars

Since designating Medicaid as a high-risk area in 2003, we have made at least 55 recommendations related to the appropriate use of program dollars, 18 of which were open as of November 2018. CMS needs to take the following steps to better assure the appropriate use of Medicaid dollars:

  • address questionable methods—particularly relying on hypothetical rather than actual expenditures—used to set demonstration spending limits, develop and document standard operating procedures for monitoring spending under demonstrations, assure timely state evaluation of demonstrations, and develop a policy for publicly releasing findings from federal evaluations of demonstrations;
  • ensure complete and accurate reporting on supplemental payments made to individual hospitals and institutional providers, as well as the sources of funds states use to finance their share of Medicaid payments; outline clear criteria, data, and a review process to ensure supplemental payments are economical and efficient; and write guidance clarifying its policy that requires a link between the distribution of supplemental payments and Medicaid-covered services; and
  • complete a risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated according to risk.

Congressional Actions Needed

Congressional action could improve oversight of Medicaid expenditures, particularly related to supplemental payments and demonstrations:

  • Congress should consider establishing statutory requirements for the Secretary of the Department of Health and Human Services to improve the demonstration review process to more clearly outline the methods used to demonstrate budget neutrality, and
  • Congress should consider broadening supplemental payment requirements around reporting and auditing to include all types of supplemental payments.

Medicaid Data

Since designating Medicaid as a high-risk area in 2003, we have made over 35 recommendations related to Medicaid data, 13 of which were open as of November 2018. To improve the quality of Medicaid data for use in program oversight, CMS needs to:

  • provide states with guidance that includes minimum standards for encounter data validation procedures;
  • provide states with information on scope and methodology requirements for MCO encounter data audits, required content of the annual  assessment report, and circumstances for deferring or disallowing matching funds in response to noncompliant encounter data submissions; and
  • continue efforts to assess and improve T-MSIS data, such as refining the overall data priority areas to identify those variables most critical for reducing improper payments, and articulate specific plans and associated timeframes for using T-MSIS data.
Looking for our recommendations? Click on any report to find each associated recommendation and its current implementation status.
  • portrait of Carolyn L. Yocom
    • Carolyn L. Yocom
    • Director, Health Care
    • (202) 512-7114