Recommendation: The Director of OCC should establish internal written policies to effectively implement and document the State Plan review and approval process for future review and approval periods. (Recommendation 1)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it has been working on establishing written policies (e.g., internal guidance documents and checklists) to implement and document the State Plan review and approval process. OCC expects to complete this work for the FY2022-2024 Plan period. We will continue to monitor OCC's efforts to implement this recommendation.

Recommendation: The Director of OCC should define the informational needs related to the results of program-integrity activities. (Recommendation 2)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to incorporate its information needs regarding the results of program integrity into the Preprint document as it develops the document. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should communicate externally to the states its informational needs related to the results of states' program-integrity activities. (Recommendation 3)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to communicate its information needs regarding the results of program integrity activities to states and territories as part of the Preprint Training activities - including webinars and peer-to-peer virtual meetings - so Lead Agencies understand what is expected for them to address in the CCDF Plan. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should communicate internally to staff its informational needs related to the results of states' program-integrity activities. (Recommendation 4)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us that it is developing the next CCDF State/Territory Plan Preprint due for submission by states and territories July 1, 2021. According to OCC, it plans to communicate its information needs regarding the results of program integrity activities to staff in both regional and central offices as part of the Preprint Training activities so staff understand what is expected for Lead Agencies to address in the CCDF Plan. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should develop documented criteria to guide the review of CAPs submitted by states to ensure that proposed corrective actions are aimed at root causes of improper payments and are effectively implemented. (Recommendation 5)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it revised the CAP Review Tool to in response to our recommendation. OCC also told us that it plans to implement the revised CAP Review Tool beginning September 2020 to document the review of CAPs submitted for the most recent ACF-404 reporting cycle (June 2020). We asked OCC to provide documentation showing the revised CAP Review Tool is responsive to our recommendation. We will update this recommendation status after reviewing the documentation OCC provides.

Recommendation: The Director of OCC should timely complete its effort to develop established written policies for the CAP follow-up process to ensure that OCC's oversight and monitoring of CAPs is carried out consistently. (Recommendation 6)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it developed draft written policies for the CAP follow-up process to ensure that OCC's oversight and monitoring of CAPs is carried out consistently. However, due to the impact of the COVID-19 on staffing capacity, OCC has not presented the draft policies to regional offices for feedback. OCC told us it plans to finalize the written policies for the CAP follow-up process by December 2020. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Director of OCC should develop and document criteria to assess the effectiveness of states' program-integrity control activities. (Recommendation 7)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it analyzed information gathered from federal and state resources to develop and document criteria to be used to assess the effectiveness of states' program integrity control activities. We asked OCC to provide us the document showing all criteria to be used to assess the effectiveness of states' program integrity control activities. We will update this recommendation status after reviewing the documentation OCC provides.

Recommendation: The Director of OCC should evaluate the feasibility of collecting information from the Grantee Internal Controls Self-Assessment Instrument (Self-Assessment Instrument) and Fraud Toolkit, such as during its Monitoring System process, to monitor the effectiveness of states' program-integrity control activities. (Recommendation 8)

Agency: Department of Health and Human Services: Administration for Children and Families: Office of the Child Care Bureau
Status: Open

Comments: In September 2020, OCC told us it is working to make the Self-Assessment Instrument and Fraud Toolkit more user-friendly to encourage increased use within the state CCDF program. With increased usage, OCC believes it will be in a better position to assess how the collection of data from these two instruments can be incorporated into the Onsite Monitoring System or other oversight activity. OCC told us it anticipates completing work to implement this recommendation by December 2020. We will continue to monitor OCC's progress in implementing this recommendation.

Recommendation: The Assistant Secretary for ACF should ensure that ACF conducts a fraud risk assessment to provide a basis for the documentation and development of an antifraud strategy that describes the CCDF program's approach to address prioritizing fraud risks identified. (Recommendation 9)

Agency: Department of Health and Human Services: Administration for Children and Families
Status: Open

Comments: In September 2020, HHS told us it anticipates completing the initial fraud risk assessment for the CCDF program by December 2020. We will continue to monitor HHS's efforts to implement this recommendation.

Recommendation: The Administrator of CMS should institute a process to routinely assess, and take steps to ensure, as appropriate, that Medicare and Medicaid documentation requirements are necessary and effective at demonstrating compliance with coverage policies while appropriately addressing program risks. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: The Department of Health and Human Services concurred with this recommendation. In February 2020, the Centers for Medicare & Medicaid Services (CMS) noted that it had clarified and amended several Medicare documentation requirements as part of an agency initiative to assess such requirements. CMS further stated that Medicaid documentation requirements are generally established at the state level, and that the agency has taken steps to identify best practices for documentation requirements and share them with states. However, we believe that CMS still needs to take steps to assess documentation requirements in both programs to better understand how the variation in the programs' requirements affects estimated improper payment rates. Without an assessment of how the programs' documentation requirements affect estimates of improper payments, CMS may not have the information it needs to ensure that Medicare and Medicaid documentation requirements are effective at demonstrating compliance and appropriately address program risks.

Recommendation: The Administrator of CMS should take steps to ensure that Medicaid medical reviews provide robust information about and result in corrective actions that effectively address the underlying causes of improper payments. Such steps could include adjusting the sampling approach to reflect state-specific program risks, and working with state Medicaid agencies to leverage other sources of information, such as state auditor and the Department of Health and Human Services' Office of the Inspector General findings. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Department of Health and Human Services (HHS) did not concur with this recommendation. As of September 2020, HHS has stated that it does not plan to implement this recommendation because the agency believes the resource requirement is not justified based on the potential improper payment findings. HHS further stated that the agency already uses a variety of sources to identify and take corrective actions to address underlying causes of improper Medicaid payments. However, we found that the Centers for Medicare & Medicaid Services (CMS) and state Medicaid agencies are expending time and resources developing and implementing corrective actions that may not be representative of the underlying causes of improper payments in their states. Without robust information to effectively identify the underlying causes of improper payments, CMS and state Medicaid agencies may not develop corrective actions that effectively address Medicaid program risks.

Recommendation: The Administrator of CMS should take steps to minimize the potential for Payment Error Rate Measurement (PERM) medical reviews to compromise fraud investigations, such as by directing states to determine whether providers selected for PERM medical reviews are also under fraud investigation and to assess whether such reviews could compromise investigations. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In October 2019, the Centers for Medicare & Medicaid Services (CMS) updated Medicaid Payment Error Rate Measurement (PERM) program guidance to strongly encourage state Medicaid agencies to proactively review providers selected for the state's PERM review; determine whether any of the selected providers are subjects of current or impending fraud investigations; and assess whether a PERM review could compromise the fraud investigation. CMS included this clarification in updated contractor guidance and in information provided to state Medicaid agencies. CMS plans to include the updated guidance in the fiscal year 2019 PERM program manual, which CMS anticipates completing by the end of 2019. Such revisions to the PERM manual will further codify and encourage state efforts to prevent PERM reviews from potentially compromising ongoing fraud investigations. As of September 2020, CMS has not informed us of any additional actions taken to implement this recommendation, including of any revisions to the PERM manual; we will update the status of this recommendation when we receive additional information.

Recommendation: The Administrator of CMS should address disincentives for state Medicaid agencies to notify the PERM contractor of providers under fraud investigation. This could include educating state officials about the benefits of reporting providers under fraud investigation, and taking actions such as revising how claims from providers under fraud investigation are accounted for in state-specific FFS improper payment rates, or the need for corrective actions in such cases. (Recommendation 4)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The Department of Health and Human Services (HHS) concurred with this recommendation. In October 2019, the Centers for Medicare & Medicaid Services (CMS) noted that the agency updated Medicaid Payment Error Rate Measurement (PERM) guidance regarding state Medicaid agencies' corrective action plans for providers under fraud investigation. If a state Medicaid agency opts to remove a provider from the state's PERM review due to a fraud investigation, claims associated with the provider are determined to be improper, due to no documentation. Under the updated guidance, states are no longer required to develop a corrective action plan for such claims, since the state is already addressing the issue through a fraud investigation. CMS included this updated guidance in the fiscal year 2017 PERM corrective action plan template, and plans to include the updated guidance in the fiscal year 2019 PERM program manual, which CMS anticipates completing by the end of 2019. Such revisions to the PERM manual will remove a disincentive for state Medicaid agencies to notify the PERM contractor of providers under fraud investigation. As of September 2020, CMS has not informed us of any additional actions taken to implement this recommendation, including of any revisions to the PERM manual; we will update the status of this recommendation when we receive additional information.

Recommendation: The Administrator of FNS should present the uncertainty around its retailer trafficking estimates in future reports by, for example, including the full range of the estimates in the report body and executive summary. (Recommendation 1)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: FNS generally agreed with this recommendation, and stated that it will present the uncertainty around the retailer trafficking estimates in the executive summary and main body of all future trafficking reports, instead of presenting the information in appendices, as it did in past reports. In August 2020, FNS stated that it has made this change to the next trafficking report, which is in clearance at USDA. GAO will consider this recommendation implemented when FNS issues its this report.

Recommendation: The Administrator of FNS should continue efforts to improve the agency's retailer trafficking estimates by evaluating (1) whether the factors used to identify stores for possible investigation could help address the bias in its sample, and (2) the accuracy of its assumption of the percentage of SNAP benefits that are trafficked by different types of stores. (Recommendation 2)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: FNS generally agreed with this recommendation. FNS stated that it will evaluate whether incorporating additional factors, such as the Watch List score used to identify stores for possible investigation, could improve its estimation methodology. FNS also stated that it will work with the USDA OIG to better understand the methodology the OIG uses to estimate the share of benefits that are trafficked by a retailer who is prosecuted for trafficking, and determine whether it is feasible to apply a similar methodology to the transaction data maintained by FNS in order to improve the accuracy of its assumptions about the percentage of SNAP benefits that are trafficked. In August 2020, FNS noted that it will evaluate the feasibility of this revised methodology for the trafficking estimates covering years 2018 through 2020. GAO will consider this recommendation implemented when FNS provides information on the results of this evaluation.

Recommendation: The Administrator of FNS should assess the benefits and costs of reauthorizing a sample of high-risk stores more frequently than other stores, use the assessment to determine the appropriate scope and time frames for reauthorizing high-risk stores moving forward, and document this decision in policy and on its website. (Recommendation 3)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: FNS generally agreed with this recommendation. In August 2020, FNS stated that it included a sample of 471 high-risk stores that had not yet reached their 5-year reauthorization cycle in its fiscal year 2020 reauthorization pool. Once fiscal year 2020 reauthorizations are complete, FNS will analyze the outcomes of these reauthorizations to determine the benefits and costs of reauthorizing some high-risk stores more frequently. At that point, FNS will determine the appropriate scope and time frames for reauthorizing high-risk stores moving forward. GAO will consider this recommendation implemented when FNS completes this work.

Recommendation: The Administrator of FNS should move forward with plans to increase penalties for retailer trafficking. (Recommendation 4)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: FNS generally agreed with this recommendation. In August 2020, FNS reported that it has developed a proposed rule to accomplish this change. The agency expects the proposed rule to be published in December 2020.

Recommendation: The Administrator of FNS should establish performance measures for its trafficking prevention activities. (Recommendation 5)

Agency: Department of Agriculture: Office of the Secretary: Food, Nutrition and Consumer Services: Food and Nutrition Service
Status: Open

Comments: FNS generally agreed with this recommendation. In August 2020, FNS reported that the agency has assessed existing data to develop strategies for trafficking prevention, and is taking a two-pronged approach. First, the agency stated that it has updated training materials and guidance to make them more accessible for staff. Second, the agency stated that it is continuing to assess store applications and reauthorizations for business integrity, including prior fraud and other criminal offenses by store owners or managers, as described in regulations and policy. However, FNS did not indicate whether the agency currently has plans to establish performance measures for its trafficking prevention activities.

Recommendation: The Administrator of CMS should eliminate impediments to collaborative audits in managed care conducted by audit contractors and states, by ensuring that managed care audits are conducted regardless of which entity--the state or the managed care organization--recoups any identified overpayments. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS agreed with and has taken some steps to address this action, as recommended by GAO in July 2018. In September 2019, CMS reported that in July 2019 CMS held a meeting with states and collaborative audit contractors to discuss coordination of managed care audits, including a wide range of challenges with managed care audits. As result of the feedback and recommendations received, CMS is evaluating several process improvements and reiterated that audit contractors will continue to work with states to provide support and assistance in Medicaid managed care, and that Medicaid managed care audits should not be limited by MCO contract language. Although CMS has communicated to states the need to increase audits in managed care and address identified issues, it is unclear if these actions will remove known impediments to managed care audits or result in an increase in the number of collaborative audits. Implementing GAO's July 2018 recommendation is needed because few audits of Medicaid managed care have been conducted and overpayments can be significant based on the findings from federal and state audits and investigations that have been completed. .

Recommendation: The Administrator of CMS should consider and take steps to mitigate the program risks that are not measured in the PERM, such as overpayments and unallowable costs; such an effort could include actions such as revising the PERM methodology or focusing additional audit resources on managed care. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: CMS concurred with this recommendation. In October 2018, it reported that it was developing a plan to address the recommendation. CMS also reported that it has published several guidance documents and is in the process of finalizing others. In addition, it reported that it continues to develop educational strategies (such as a recent course managed care offered by CMS' Medicaid Integrity Institute) and oversight and audit strategies and mechanisms related to managed care. CMS communicated that it initiated 32 audits involving Medicaid managed care network providers in 6 states and an audit of a managed care plan in another state in FY 2018. For FY 2019, CMS stated that it will be establishing a medical loss ratio examination process and initiating such audits of managed care organizations in California. CMS also stated that it will be developing guidance for states and managed care plans on managed care delivery and oversight to develop program integrity capacity and reduce program risks. As of December 2019, CMS has not taken any additional steps; we will continue to monitor CMS's progress to mitigate the managed care program risks not measured in the PERM.

Recommendation: The Administrator of CMS, in partnership with the states, should take additional steps to expedite the use of T-MSIS data for program oversight. Such steps should include, but are not limited to, efforts to (1) obtain complete information from all states on unreported T-MSISdata elements and their plans to report applicable data elements; (2) identify and share information across states on known T-MSIS datalimitations to improve data comparability; and (3) implement mechanisms, such as the Learning Collaborative, by whichstates can collaborate on an ongoing basis to improve thecompleteness, comparability, and utility of T-MSIS data.(Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open
Priority recommendation

Comments: HHS concurred with this recommendation. As of February 2020, CMS has taken steps to improve T-MSIS data quality, but further efforts are needed to expedite the data's use in oversight. With regard to obtaining complete information from all states, CMS released additional guidance in March 2019, on state compliance with T-MSIS requirements. This guidance includes the need to resolve data issues associated with 12 top priority items and missing data elements, both of which are key for using T-MSIS data. Further, CMS identified an additional 11 top priority items, noting it also expected states to resolve data issues with these items. CMS reports that it has helped resolve data issues related to these 23 top priority items by sending states summary data on compliance with associated reporting requirements. CMS has notified states of their compliance status and asked non-compliant states to submit corrective action plans. However, CMS reports that the level of states' T-MSIS data completeness varies and agency state liaisons and technical assistants continue to work individually with states to identify, prioritize, and resolve key missing data elements. With regard to identifying and sharing information, CMS has made some T-MSIS data available for use through five T-MSIS analytical files, which include data on Medicaid and CHIP enrollment, demographics, service utilization, and payments. Further, CMS has created resources to support researchers in their use of these analytical files, including information on the completeness and accuracy of certain data elements. With regard to implementing mechanisms for collaboration across states, additional CMS action is needed. In particular, CMS's efforts to create a mechanism for states to disseminate information about T-MSIS data and its comparability across states remain limited and the agency has not launched its proposed Learning Collaborative to facilitate ongoing feedback and collaboration. While progress has been made, additional actions, such as establishing mechanisms for ongoing feedback and collaboration across states, are needed to consider this recommendation implemented.

Recommendation: The Administrator of CMS should articulate a specific plan and associated time frames for using T-MSIS data for oversight. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: HHS concurred with this recommendation. As of February 2020, CMS has taken steps to articulate guidance to states, but has not outlined a specific plan and associated time frames for using T-MSIS data for oversight. Until CMS takes these actions, the recommendation remains open.

Recommendation: The Administrator of CMS should provide fraud-awareness training relevant to risks facing CMS programs and require new hires to undergo such training and all employees to undergo training on a recurring basis. (Recommendation 1)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: The agency agreed with this recommendation. In July 2018, CMS reported that it is strengthening its efforts to ingrain fraud risk management principles throughout the Agency and is developing a training video, module, and curriculum to train staff agency-wide on fraud risks. In November 2019, CMS provided fraud-awareness training videos for new and current CMS employees. GAO requested and is awaiting documentation to show mandatory nature and annual frequency of the training in order to assess the extent to which the training is consistent with leading practices in fraud risk management.

Recommendation: The Administrator of CMS should conduct fraud risk assessments for Medicare and Medicaid to include respective fraud risk profiles and plans for regularly updating the assessments and profiles. (Recommendation 2)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: Agency agreed with this recommendation. In July 2018, CMS reported that it has initiated the fraud risk assessment for some programs in Medicare, including the Medicare Diabetes Prevention Program expanded model. CMS also reported that it is also continuing to draft fraud risk profiles for the Comprehensive End-Stage Renal Disease (ESRD) Care model, the Comprehensive Primary Care Plus model, the permanent Medicare Shared Savings Program, and the new Medicare Beneficiary Identifier. Additionally, CMS reported that it is assessing the Quality Payment Program, established by the Medicare Access and CHIP Reauthorization Act of 2015 (MACRA), utilizing the GAO fraud risk assessment framework. We will continue to monitor CMS's progress in this area. In November 2019, CMS provided a diagram depicting CMS approach to assessing fraud risks and a document for Home Health Request for Anticipated Payment, stating that fraud risk assessments on Medicare Diabetes Prevention Program and Quality Payment Program are under development. We requested and are awaiting additional information on CMS's approach and plans for conducting fraud risk assessments in Medicare programs, including the reasoning for program selection, overall order, and anticipated timeframes.

Recommendation: The Administrator of CMS should, using the results of the fraud risk assessments for Medicare and Medicaid, create, document, implement, and communicate an antifraud strategy that is aligned with and responsive to regularly assessed fraud risks. This strategy should include an approach for monitoring and evaluation. (Recommendation 3)

Agency: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Open

Comments: Agency agreed with this recommendation. In November 2019, CMS reported on activities to conduct fraud risk assessments in Medicare programs (see Recommendation 2), however this work is ongoing and the recommendation remains open. Because completion of a fraud risk assessment is necessary before developing an antifraud strategy, this recommendation also remains open. We will continue to monitor CMS's progress in this area.

Recommendation: To ensure states have appropriate and current guidance to assist them in designing and administering Medicaid NEMT, the Secretary of HHS should direct CMS to assess current Medicaid NEMT guidance and update that guidance as needed.

Agency: Department of Health and Human Services
Status: Open

Comments: As of July 2019, HHS officials reported that they are waiting for a policy decision from leadership concerning non-emergency medical transportation. GAO will continue to monitor and update the status of this recommendation.