Skip to main content

Medicaid Assisted Living Services: Improved Federal Oversight of Beneficiary Health and Welfare is Needed

GAO-18-179 Published: Jan 05, 2018. Publicly Released: Feb 05, 2018.
Jump To:

Fast Facts

Older people and people with disabilities receiving Medicaid assisted living services—over 330,000 in 2014—can be vulnerable to abuse, neglect or exploitation. The Centers for Medicare & Medicaid Services oversees how states monitor such incidents, but its guidance has been unclear.

More than half of the 48 states providing these services couldn’t tell us the number or nature of critical incidents in assisted living facilities. In addition, states may not be monitoring things you might expect them to. For example, 3 states don’t monitor unexpected or unexplained deaths.

We recommended that CMS take steps to improve state reporting.

Types of Incidents in Assisted Living Facility Services Monitored by 48 States in 2014


Graph showing types of incidents and numbers of states that defined or did not define them as critical.


Skip to Highlights


What GAO Found

State Medicaid agencies in 48 states that covered assisted living services reported spending more than $10 billion (federal and state) on assisted living services in 2014. These 48 states reported covering these services for more than 330,000 beneficiaries through more than 130 different programs. Most programs were operated under Medicaid waivers that allow states to target certain populations, limit enrollment, or restrict services to certain geographic areas.

With respect to oversight of their largest assisted living programs, state Medicaid agencies reported varied approaches to overseeing beneficiary health and welfare, particularly in how they monitored critical incidents involving beneficiaries receiving assisted living services. State Medicaid agencies are required to protect beneficiary health and welfare and operate systems to monitor for critical incidents—cases of potential or actual harm to beneficiaries such as abuse, neglect, or exploitation.

Twenty-six state Medicaid agencies could not report to GAO the number of critical incidents that occurred in assisted living facilities, citing reasons including the inability to track incidents by provider type (9 states), lack of a system to collect critical incidents (9 states), and lack of a system that could identify Medicaid beneficiaries (5 states).

State Medicaid agencies varied in what types of critical incidents they monitored. All states identified physical, emotional, or sexual abuse as a critical incident. A number of states did not identify other incidents that may indicate potential harm or neglect such as medication errors (7 states) and unexplained death (3 states).

State Medicaid agencies varied in whether they made information on critical incidents and other key information available to the public. Thirty-four states made critical incident information available to the public by phone, website, or in person, while another 14 states did not have such information available at all.

Oversight of state monitoring of assisted living services by the Centers for Medicare & Medicaid Services (CMS), an agency within the Department of Health and Human Services (HHS), is limited by gaps in state reporting. States are required to annually report to CMS information on deficiencies affecting beneficiary health and welfare for the most common program used to provide assisted living services. However, states have latitude in what they consider a deficiency. States also must describe their systems for monitoring critical incidents, but CMS does not require states to annually report data from their systems. Under federal internal control standards, agencies should have processes to identify information needed to achieve objectives and address risk. Without clear guidance on reportable deficiencies and no requirement to report critical incidents, CMS may be unaware of problems. For example, CMS found, after an in-depth review in one selected state seeking to renew its program, that the state lacked an effective system for assuring beneficiary health and welfare, including reporting insufficient information on the number of unexpected or suspicious beneficiary deaths. The state had not reported any deficiencies in annual reports submitted to CMS in 5 prior years.

Why GAO Did This Study

The number of individuals receiving long term care services from Medicaid in community residential settings is expected to grow. These settings, which include assisted living facilities, provide a range of services that allow aged and disabled beneficiaries, who might otherwise require nursing home care, to remain in the community.

State Medicaid programs and CMS, the federal agency responsible for overseeing the state programs, share responsibility for ensuring that beneficiaries' health and welfare is protected. GAO was asked to examine state and federal oversight of assisted living services in Medicaid. This report (1) describes state spending on and coverage of these services, (2) describes how state Medicaid agencies oversee the health and welfare of beneficiaries in these settings, and (3) examines the extent that CMS oversees state Medicaid agency monitoring of assisted living services.

GAO surveyed all state Medicaid agencies and interviewed officials in a nongeneralizeable sample of three states with varied oversight processes for their assisted living programs. GAO reviewed regulations and guidance, and interviewed CMS officials.


GAO recommendations to CMS include clarifying state requirements for reporting program deficiencies and requiring annual reporting of critical incidents. HHS concurred with GAO's recommendations to clarify deficiency reporting and stated that it would consider annual reporting requirements for critical incidents after completing an ongoing review.

Recommendations for Executive Action

Agency Affected Recommendation Status
Centers for Medicare & Medicaid Services The Administrator of CMS should provide guidance and clarify requirements regarding the monitoring and reporting of deficiencies that states using home and community-based services (HCBS) waivers are required to report on their annual reports. (Recommendation 1)
CMS concurred with this recommendation and indicated the agency would provide guidance and clarify requirements regarding the monitoring and reporting of deficiencies in states' annual reports. In January 2023, CMS reported the agency has completed the process to renew the HCBS annual report for release in coordination with other automated enhancements in 2023. According to the agency, the new report will require states to provide data on every performance measure, including remediation efforts. Further, CMS reported that the agency is in the process of updating the Technical Guide to specify what will be required in the reporting. As of January 2024, CMS continued to work on enhancements to the annual report template and Technical Guide. When the technical guidance is complete and the updated annual report released, GAO will review and determine whether this recommendation can be considered implemented.
Centers for Medicare & Medicaid Services
Priority Rec.
The Administrator of CMS should establish standard Medicaid reporting requirements for all states to annually report key information on critical incidents, considering, at a minimum, the type of critical incidents involving Medicaid beneficiaries, and the type of residential facilities, including assisted living facilities, where critical incidents occurred. (Recommendation 2)
HHS neither agreed nor disagreed with this recommendation. As of January 2023, CMS had provided states with technical assistance on critical incident reporting, including providing training and an optional incident reporting template. CMS published a proposed rule in May 2023 that included provisions to standardize critical incident oversight, including requirements to report data to CMS. As of February 2024, CMS was reviewing public comments on the proposed rule. To fully implement this recommendation, CMS should establish standard Medicaid reporting requirements for all states to report critical incidents annually. If CMS finalizes the proposed rule, GAO will review and determine whether the recommendation has been implemented.
Centers for Medicare & Medicaid Services The Administrator of CMS should ensure that all states submit annual reports for HCBS waivers on time as required. (Recommendation 3)
CMS concurred with this recommendation and stated that it will review and update its communications with states to reaffirm reporting requirements and ensure that all HCBS annual reports are submitted on time. As of January 2024, CMS reported that it has updated the online system that states use to complete and submit their annual HCBS waiver reports to incorporate automatic reminders to states about due dates for submitting their annual reports. CMS indicated that the agency had also completed outreach to states to remind them of annual reporting requirements resuming after the end of the public health emergency, and states had begun submitting outstanding reports. To the extent that automated reminders of due dates are being sent to states and CMS is receiving timely reports from states, GAO will consider closing this recommendation as implemented.

Full Report

GAO Contacts

Office of Public Affairs


Assisted livingBeneficiariesCompliance oversightHealth careLong-term careMedicaidMedicareMedicaid community-based servicesMonitoringNursing homesQuality of careReporting requirements