Skip to main content

Patient Protection and Affordable Care Act: Final Results of Undercover Testing of the Federal Marketplace and Selected State Marketplaces for Coverage Year 2015

GAO-16-792 Published: Sep 09, 2016. Publicly Released: Sep 12, 2016.
Jump To:
Skip to Highlights


What GAO Found

Under the Patient Protection and Affordable Care Act (PPACA), health-insurance marketplaces are required to verify application information to determine eligibility for enrollment and, if applicable, determine eligibility for income-based subsidies or Medicaid. Verification steps include reviewing and validating an applicant's Social Security number, if one is provided; citizenship, status as a U.S. national, or lawful presence; and household income and family size.

GAO's undercover testing for the 2015 coverage year found that the health-care marketplace eligibility determination and enrollment process for qualified health plans—that is, coverage obtained from private insurers—remains vulnerable to fraud. The federal Health Insurance Marketplace (Marketplace) or selected state marketplaces approved each of 10 fictitious applications GAO made for subsidized health plans. Although 8 of these 10 fictitious applications failed the initial online identity-checking process, all 10 were subsequently approved. Four applications used Social Security numbers that, according to the Social Security Administration, have never been issued, such as numbers starting with “000.” Other applicants obtained duplicate enrollment or obtained coverage by claiming that their employer did not provide insurance that met minimum essential coverage.

For eight additional fictitious applications, initially made for Medicaid coverage, GAO was approved for subsidized health-care coverage in seven of the eight cases, through the federal Marketplace and the two selected state marketplaces.

Three of GAO's applications were approved for Medicaid, which was the health-care program for which GAO originally sought approval. In each case, GAO provided identity information that would not have matched Social Security Administration records. For two applications, the marketplace or state Medicaid agency directed the fictitious applicants to submit supporting documents, which GAO did (such as a fake immigration card), and the applications were approved. For the third, the marketplace did not seek supporting documentation, and the application was approved by phone.

For four, GAO was unable to obtain approval for Medicaid but was subsequently able to gain approval of subsidized health-plan coverage. In one case, GAO falsely claimed that it was denied Medicaid and was able to obtain the subsidized health plan when in fact no Medicaid determination had been made at that time.

For one, GAO was unable to enroll into Medicaid, in California, because GAO declined to provide a Social Security number. According to California officials, the state marketplace requires a Social Security number or taxpayer-identification number to process applications.

For both sets of testing, GAO submitted fictitious documentation as part of the application and enrollment process. According to officials from the Centers for Medicaid & Medicare Services (CMS), California, Kentucky, and North Dakota, the marketplace or Medicaid office only inspect for supporting documentation that has obviously been altered. Thus, if the documentation submitted does not show such signs, it would not be questioned for authenticity.

Why GAO Did This Study

PPACA provides for the establishment of health-insurance marketplaces where consumers can, among other things, select private health-insurance plans or apply for Medicaid. The act requires verification of applicant information to determine enrollment or subsidy eligibility. In addition, PPACA provided for the expansion of the Medicaid program. GAO was asked to examine enrollment and verification controls for the marketplaces.

This report, which follows earlier testimony, provides final results of GAO testing and describes (1) undercover attempts to obtain health-plan coverage from the federal Marketplace and selected state marketplaces for 2015, and (2) undercover attempts to obtain Medicaid coverage through the federal Marketplace and the selected state marketplaces. GAO submitted, or attempted to submit, 18 fictitious applications by telephone and online. Ten applications tested controls related to obtaining subsidized coverage available through the federal Marketplace in New Jersey and North Dakota, and through state marketplaces in California and Kentucky. GAO chose these states based partly on range of population and whether the state had expanded Medicaid eligibility under PPACA. The other 8 applications tested controls for determining Medicaid eligibility. The results, while illustrative, cannot be generalized. GAO discussed results with CMS and state officials to obtain their views. The states identified several actions being taken in response to GAO's findings.

For more information, contact Seto Bagdoyan at (202) 512-6722 or

Full Report

Office of Public Affairs


Government subsidiesSubsidiesHealth careConsumersMedicaidSocial security numbersTax creditSocial security numberChildren's health insuranceIdentity verificationHealth insuranceMedicaid eligibilityInternal controlsHealth care programsEligibility determinationsFraudEmployer-sponsored health plansImmigration status