Recommendation: The Administrator of CMS should develop formal procedures that include specific steps to be taken in the APD review process, including how CMS will document the review (including the name of the reviewer, date of review, and what was reviewed); what documentation should be retained after the review; as well as decision-making criteria for approval or denial decisions for state Medicaid IT funding requests. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should, as part of the APD review process and prior to approval, verify that all of the required information (e.g. alternatives analysis, feasibility study, and cost benefit analysis) is included in the funding request. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should ensure that all APD-related artifacts are retained within the designated CMS document management system, including documentation of key information from meetings and email communications with the states, the MITA self-assessment and independent verification and validation reports, when creating APD decision packages. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should require analysts to maintain relevant MMIS and E&E system artifacts based on the entire system life cycle instead of individual APDs. (Recommendation 4)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should, in consultation with the HHS and CMS CIOs, develop a documented, comprehensive, and risk-based process for how CMS will select IT projects for technical assistance and provide recommendations to states to assist them in improving the performance of the systems, with consideration to those that are high-cost and performing poorly. (Recommendation 5)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should encourage state Medicaid program officials to consider involving state CIOs in overseeing Medicaid IT projects. (Recommendation 6)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should establish a timeline for implementing the outcome-based certification process for MMIS and E&E systems. (Recommendation 7)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should establish documented procedures for how the results of the outcome-based certification process will be used for conducting oversight and making funding decisions. The procedures should include specific steps that CMCS will take to oversee individual state MMIS and E&E projects and how it will demonstrate that the steps have been taken. (Recommendation 8)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: Prior to approving funding for MMIS and E&E systems, the Administrator of CMS should identify areas of duplication or common functionality, such as core MMIS modules, in order to facilitate sharing, leveraging, or reusing Medicaid technologies. CMS should share the results of the review with the state or territory requesting federal funding for a duplicative or similar project and take steps to encourage states to share, leverage, or reuse Medicaid technologies, where possible. (Recommendation 9)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: When we confirm what actions the agency has taken in response to this recommendation, we will provide updated information.

Recommendation: The Administrator of CMS should expand its review of states' implementation of the provider screening and enrollment requirements to include states that have not made use of CMS's optional consultations. Similar to CMS's contractor site visits, such reviews should include any necessary steps to address areas of noncompliance for all types of enrolled providers, including those under contract with managed care organizations. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS concurred with our recommendation. In February 2020, CMS told us that it plans to reach out to states that have not yet participated in its optional consultations to discuss their progress towards implementing provider screening and enrollment requirements, and outline steps that the states should take to come into full compliance with them. In order to fully address this recommendation CMS would need to review all states' implementation of the provider screening and enrollment requirements, including states that have not made use of CMS's optional consultations. As such, this recommendation remains open until CMS provides evidence that it has assessed the compliance of all states; we will continue to monitor CMS's progress.

Recommendation: The Administrator of CMS should annually monitor progress toward addressing any areas of noncompliance related to the provider screening and enrollment requirements for any state with one or more corrective action plans. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: As of February 2020, HHS officials have not informed us of any actions taken to implement this recommendation. We will update the status of this recommendation when we receive additional information

Recommendation: The Administrator of CMS should require states to submit and make public projections of administrative costs when seeking approval of demonstrations, including those with work requirements and all other demonstrations. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: HHS did not concur with this recommendation in its September 2019 comments on the report. We maintain that the recommendation is valid because requiring states to make public information about administrative costs would help to ensure that demonstration proposals provide sufficient information to ensure meaningful public input.

Recommendation: The Administrator of CMS should account for the administrative costs of demonstrations, including those with work requirements and all other demonstrations, when assessing whether demonstrations are budget neutral. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: HHS did not concur with this recommendation in its September 2019 comments on the report. We maintain that the recommendation is valid because including administrative costs in its assessments will help HHS ensure that demonstrations are budget neutral.

Recommendation: The Administrator of CMS should assess the risks of providing federal funds for costs to administer work requirements that are not allowable and should respond to risks by improving oversight procedures, as warranted. This assessment should consider risks related to costs for information systems, beneficiary supports, and managed care. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: HHS did not concur with this recommendation in its September 2019 comments on the report. We maintain that the recommendation is valid and that assessing these risks of providing federal funds for costs that are not allowable and improving oversight, as warranted, would help HHS to ensure the integrity of the Medicaid program.

Recommendation: The Administrator of CMS should ensure the agency's Medicaid third-party liability guidance is consistent with federal law related to

• the requirement for states to apply cost avoidance procedures to claims for labor, delivery, and postpartum care services,
• the requirement for states to make payments without regard to potential third-party liability for pediatric preventive services unless the state has made a determination related to cost-effectiveness and access to care that warrants cost avoidance for 90 days, and
• state flexibility to make payments without regard to potential third-party liability for pediatric services provided to child support enforcement beneficiaries. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: On November 14, 2019, CMS issued an Informational Bulletin providing further guidance to Medicaid Bipartisan Budget Act (BBA) of 2018 and changes to Medicaid Provisions Passed in April 2019-Third Party Liability in Medicaid and CHIP. The intent of the information Bulletin is to further clarify CMS guidance issued in the agency's June 2018 Bulletin on key provisions related to third party liability in Medicaid and CHIP. The Bulletin also addresses April 2019 changes to the Bipartisan Budget Act of 2013. The bulletin clarifies CMS guidance on two of the three issues we identified in our 2019 report. The bulletin notes that (1) effective February 9, 2018 a state is required to use standard coordination of benefits cost avoidance when processing claims for prenatal services which now includes labor and delivery and postpartum care claims, and (2) effective October 1, 2019, a state is required to make payments without regard to third party liability for pediatric preventive services unless the state has made a determination related to cost-effectiveness and access to care that warrants cost avoidance for 90 days. However, with regard to the third issue, the bulletin notes that, effective April 18, 2019, a state is allowed 100 days to pay claims related to child support enforcement, but does not note that states may choose to make payment within 30 days, if the state determines doing so is cost-effective and necessary to ensure access to care. We will continue to monitor CMS guidance on payments related to child support enforcement to assess whether the recommendation is fully implemented.

Recommendation: The Administrator of CMS should determine the extent to which state Medicaid programs are meeting federal third-party liability requirements and take actions to ensure compliance as appropriate. Such actions can include ensuring that state plans reflect the law. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: As of February 2020, we are unaware of any actions taken by CMS to implement this recommendation.

Recommendation: The Administrator of CMS should complete a comprehensive, national risk assessment and take steps, as needed, to assure that resources to oversee expenditures reported by states are adequate and allocated based on areas of highest risk. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS has taken steps to conduct a comprehensive national risk assessment. As of October 2019, CMS had developed a standard tool to assess risk and staff capacity. The agency indicated that once the assessment is complete, CMS will identify opportunities to increase resources, review the current allocation of financial staff, and determine the appropriate allocation of staff by state. We will continue to monitor CMS's action to complete this assessment.

Recommendation: The Administrator of CMS should clarify in internal guidance when a variance analysis on expenditures with higher match rates is required. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In October 2019, CMS indicated that the agency held meetings to clarify internal guidance on the variance analysis and is the process of drafting updated guidance for the CMS-64 review. We will continue to monitor CMS's actions to update the guidance.

Recommendation: The Administrator of CMS should revise the sampling methodology for reviewing expenditures for the Medicaid expansion population to better target reviews to areas of high risk. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: In October 2019, CMS indicated that given their current resources, they believe the sampling methodology is sufficient and have no plans to revise it. The agency noted that the current methodology requires a minimum sample size but gives reviewers the flexibility to expand the size of the sample if warranted by risk and as resources permit. We continue to believe that the current methodology does not sufficiently target areas of high risk.

Recommendation: The Administrator of CMS should eliminate impediments to collaborative audits in managed care conducted by audit contractors and states, by ensuring that managed care audits are conducted regardless of which entity--the state or the managed care organization--recoups any identified overpayments. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS agreed with and has taken some steps to address this action, as recommended by GAO in July 2018. In September 2019, CMS reported that in July 2019 CMS held a meeting with states and collaborative audit contractors to discuss coordination of managed care audits, including a wide range of challenges with managed care audits. As result of the feedback and recommendations received, CMS is evaluating several process improvements and reiterated that audit contractors will continue to work with states to provide support and assistance in Medicaid managed care, and that Medicaid managed care audits should not be limited by MCO contract language. Although CMS has communicated to states the need to increase audits in managed care and address identified issues, it is unclear if these actions will remove known impediments to managed care audits or result in an increase in the number of collaborative audits. Implementing GAO's July 2018 recommendation is needed because few audits of Medicaid managed care have been conducted and overpayments can be significant based on the findings from federal and state audits and investigations that have been completed. .

Recommendation: The Administrator of HRSA should require covered entities to register contract pharmacies for each site of the entity for which a contract exists. (Recommendation 1)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS does not concur with this recommendation and, as of July 2020, did not plan to take any actions to implement the recommendation. As noted in our report, without complete information on contract pharmacy arrangements--including information on with sites of a covered entity have contracts with a contract pharmacy--HRSA cannot ensure that it is optimally targeting the limited number of audits done each year. Additionally, manufacturers lack important information to help ensure that 340B discounted drugs are only provided to pharmacies with a valid 340B contract with the covered entity site for which the drug is being dispensed.

Recommendation: The Administrator of HRSA should issue guidance to covered entities on the prevention of duplicate discounts under Medicaid managed care, working with CMS as HRSA deems necessary to coordinate with guidance provided to state Medicaid programs.(Recommendation 2)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of HRSA should incorporate an assessment of covered entities' compliance with the prohibition on duplicate discounts, as it relates to Medicaid managed care claims, into its audit process after guidance has been issued and ensure that identified violations are rectified by the entities. (Recommendation 3)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of HRSA should issue guidance on the length of time covered entities must look back following an audit to identify the full scope of noncompliance identified during the audit.(Recommendation 4)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of HRSA should require all covered entities to specify their methodology for identifying the full scope of noncompliance identified during the audit as part of their corrective action plans, and incorporate reviews of the methodology into their audit process to ensure that entities are adequately assessing the full scope of noncompliance. (Recommendation 5)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS does not concur with this recommendation and, as of July 2020, did not plan to take any actions to implement the recommendation. HHS noted that requiring all covered entities subject to an audit to specify their methodology for identifying the full scope of noncompliance identified during the audit would create a significant burden for covered entities. However, as noted in our report, HRSA already requires covered entities with audit findings to determine the full scope of noncompliance and requires entities subject to a targeted audit to provide their methodology for such assessments to HRSA. Thus, it is unclear how requiring covered entities subject to risk-based, as opposed to targeted, audits to provide HRSA with a written description of methodologies that they are already required to formulate and implement would create a significant additional burden. Without this information, HRSA does not have reasonable assurance that the majority of covered entities have adequately identified all instances of noncompliance.

Recommendation: The Administrator of HRSA should require all covered entities to provide evidence that their corrective action plans have been successfully implemented prior to closing audits, including documentation of the results of the entities' assessments of the full scope of noncompliance identified during each audit.(Recommendation 6)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS does not concur with this recommendation and, as of July 2020, did not plan to take any actions to implement the recommendation. HHS stated that requiring all covered entities with audit findings to provide evidence that their corrective action plans have been successfully implemented would create an undue burden for covered entities. However, HRSA already requires such evidence from covered entities subject to targeted audits, and it is unclear how providing evidence of implementation of corrective actions that entities developed and are required to implement would create significant additional burden for these entities. Additionally, without such evidence HRSA does not have a reasonable assurance that the majority of covered entities audited have corrected the issues identified in the audit, and are not continuing practices that could lead to noncompliance.

Recommendation: The Administrator of HRSA should provide more specific guidance to covered entities regarding contract pharmacy oversight, including the scope and frequency of such oversight. (Recommendation 7)

Agency: Department of Health and Human Services: Public Health Service: Health Resources and Services Administration
Status: Open

Comments: HHS concurred with this recommendation. In July 2020, HHS indicated that it believes that guidance does not provide HRSA appropriate enforcement capability and that this recommendation can only be accomplished after policy is issued. HRSA has requested regulatory authority for all aspects of the 340B Program in the FY 2021 President's Budget.

Recommendation: The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS concurred with this recommendation. In October 2018, it reported that it was developing a plan to address the recommendation. CMS also reported that it has published several guidance documents and is in the process of finalizing others. In addition, it reported that it continues to develop educational strategies (such as a recent course managed care offered by CMS' Medicaid Integrity Institute) and oversight and audit strategies and mechanisms related to managed care. CMS communicated that it initiated 32 audits involving Medicaid managed care network providers in 6 states and an audit of a managed care plan in another state in FY 2018. For FY 2019, CMS stated that it will be establishing a medical loss ratio examination process and initiating such audits of managed care organizations in California. CMS also stated that it will be developing guidance for states and managed care plans on managed care delivery and oversight to develop program integrity capacity and reduce program risks. As of December 2019, CMS has not taken any additional steps; we will continue to monitor CMS's progress to mitigate the managed care program risks not measured in the PERM.

Recommendation: To achieve a better understanding of the effect of certain Personal care services (PCS) services on beneficiaries and a more consistent administration of policies and procedures across PCS programs, the Acting Administrator of CMS should collect and analyze states' required information on the impact of the Participant-Directed Option and Community First Choice programs on the health and welfare of beneficiaries as well as the state quality measures for the Participant-Directed Option and Community First Choice programs.

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Centers for Medicare & Medicaid Services (CMS) concurred with GAO's recommendation. On December 30, 2016, the agency issued guidance on the Community First Choice program to assist states in submitting information to CMS on the health and welfare of beneficiaries. In March 2019, CMS officials stated that the agency is currently developing the process for states to report this information to CMS. Agency officials also stated they are exploring the value of collecting this information for the Participant-Directed Option program given the limited number of states currently operating under this authority. In February 2020, CMS officials stated that the agency continues to develop policy related to this recommendation.