Medicaid Program Integrity and Current Issues

What is Program Integrity in Medicaid?

Program integrity refers to the proper management and function of the Medicaid program to ensure it is providing quality and efficient care while using funds–taxpayer dollars–appropriately with minimal waste. Program integrity efforts work to prevent and detect waste, fraud, and abuse, to increase program transparency and accountability, and to recover improperly used funds. The goal of program integrity initiatives is to help ensure that: eligibility decisions are made correctly; prospective and enrolled providers meet federal and state participation requirements; services provided to enrollees are medically necessary and appropriate; and provider payments are made in the correct amount and for appropriate services.¹

There are an array of challenges associated with implementation of an effective and efficient Medicaid program integrity strategy. Some challenges cited by MACPAC include: overlap between federal and state responsibilities; lack of collaboration and information sharing among federal agencies and states; lack of information on the effectiveness of program integrity initiatives and appropriate performance measures; lower federal matching rates for state activities not directly related to fraud control; incomplete and outdated data; and few program integrity resources.

Improper payments are often cited when discussing program integrity, but they are not the same as fraud and abuse. The GAO reports improper payments across all government programs, including Medicaid. There are also other audits specific to Medicaid that measure errors and improper payments. These improper payment and error measures are often cited when discussing program integrity. However, improper payments may result from a variety of circumstances including errors, waste, abuse, and fraud. Errors and waste may result in unnecessary expenditures or improper payments, but are not criminal activities like fraud and abuse (see Box 1 for definitions).

One of CMS’s primary enforcement mechanisms to support program integrity is disallowance. CMS has the ability to work with states regarding the repayment of the federal share of improper payments. When an improper payment is identified, states can voluntarily return federal funds or CMS can issue a disallowance. CMS has been working through backlogs of potential disallowances. However, corrective action plans, rather than disallowances, are the typical enforcement mechanism for dealing with error rates found through the PERM process.

How have Program Integrity Efforts Evolved over Time?

Ensuring program integrity in Medicaid is the responsibility of both the federal government and the states. State Medicaid agencies manage the day-to-day operations of Medicaid (conducting enrollment and eligibility verification; licensing and enrolling providers; setting rates and paying providers; monitoring quality of care and provider claims (“data-mining”); conducting audits; detecting improper payments and recovering overpayments; and investigating and prosecuting provider fraud and patient abuse or neglect).² In addition, states are required to have a Medicaid Fraud Control Unit (MFCU) that is separate from the Medicaid agency to conduct criminal investigations and prosecutions related to fraud. The federal government oversees and helps finance state program integrity efforts and monitors and enforces state compliance with federal rules; reviews state agency performance; audits, evaluates, and investigates individuals or organizations suspected of fraud; imposes sanctions; and provides training and guidance to the states.³ For more information on responsibilities of each agency, see Appendix A.

Since the enactment of Medicaid in 1965, the statute has evolved to promote program integrity. Key recent program integrity legislative milestones include the following:

• The Deficit Reduction Act of 2005 (DRA) included new initiatives and funding to focus on four key program integrity priority areas: prevention, detection, transparency and accountability, and recovery.⁴ The DRA contained several Medicaid provisions designed to improve the ability of both the states and federal government to address program integrity issues and directed CMS to establish the Medicaid Integrity Program (MIP) and to develop a Comprehensive Medicaid Integrity Plan (CMIP).
• The ACA of 2010 marked another major investment in program integrity efforts in Medicare and Medicaid, providing an additional $350 million in resources over ten years.⁵ The ACA provided new resources for provider screening and data-matching efforts, established new authorities to federal and state agencies and contractors to take action against suspected program abusers, and created new program coordination and state-to-state collaboration opportunities.⁶ The ACA also increased the emphasis on collaboration efforts across payers and states to make sure efforts are not duplicated and that a provider found to be fraudulent in one state does not attempt to practice in another state or in another public program.⁷
• The 21^st Century Cures Act of 2016 extended screening and enrollment requirements to providers in Medicaid managed care and required states to submit information to CMS regarding provider termination as well as creating a centralized and uniform database of terminated Medicaid and the Children’s Health Insurance Program (CHIP) providers with reason for termination.⁸

The focus of program integrity efforts have also evolved at CMS in response to changing legislation, policy developments and priorities. Program integrity efforts historically focused on the recovery of misspent funds, but initiatives included in the ACA attempted to move beyond “pay and chase” models to focus more heavily on prevention and early detection of fraud and abuse and other improper payments.

What are CMS’s current Medicaid program integrity priorities?

Recent actions by CMS to promote program integrity have focused on federal audit and oversight functions. CMS released a program integrity strategy in June 2018 and a notice in June 2019 highlighting program integrity as a priority and emphasizing new and planned actions centered on stronger audit and oversight functions, increased beneficiary eligibility oversight, and enhanced enforcement of state compliance with federal rules. Specifically, CMS points to initiatives focused on audits of state claiming for federal match and rate setting, including high-risk vulnerabilities identified by the GAO and OIG, which include improper payment rates, state use of supplemental payments, and oversight of waiver demonstration programs.⁹ It also indicates that it will conduct new audits of state beneficiary eligibility determinations with a focus on the impact of changes to state eligibility policy as a result of the ACA Medicaid expansion. Below are a range of recent CMS program integrity efforts and initiatives, including those highlighted in its recent guidance. This is not necessarily a comprehensive list of all current CMS program integrity strategies, but highlights recent areas of focus and new or planned future actions. Moreover, the list does not capture the full range of program integrity efforts of states and other federal agencies. Outside of CMS, other federal agencies, including the OIG and GAO, also are engaged in program integrity and oversight efforts.

Payment Error Rate Measurement (PERM)

The PERM program measures improper payments in Medicaid and CHIP and produces error rates for each program.¹⁰ The error rates are based on reviews of the fee-for-service and managed care claims and eligibility determinations in the fiscal year under review. The error rate is not a “fraud rate” but a measurement of payments made that did not meet statutory, regulatory or administrative requirements. Each state is audited on a rolling three year basis and annually produces national and state-specific improper payments. In light of the major changes to the way states determine eligibility for Medicaid and CHIP under the ACA, the eligibility determinations component of PERM was temporarily suspended between 2015 and 2018.

In November 2019, CMS released the first PERM estimates with eligibility determinations reintegrated into the review since implementation of the ACA. Estimated improper payments for Medicaid were 14.9% or $57.36 billion in 2019 across all three components included in the PERM review (fee-for-service, managed care, and eligibility).¹¹ Given the reintegration of the eligibility component, the overall rates and payments are not comparable with prior years.¹² In a separate report, HHS released estimates for each component in PERM, showing a 16.30% rate for fee-for-service, 0.12% rate for managed care, and 8.36% rate for eligibility.¹³ These data show that the fee-for-service component accounted for the highest improper payment rate (Figure 2). GAO has reported that the managed care component does not fully account for all program risks in managed care, and points to overpayments and unallowable costs that have not been accounted for by previous estimates.¹⁴

HHS reports that the majority of improper payments do not necessarily represent expenses that should not have occurred. HHS identified a range of factors contributing to improper payments, including the reintegration of the eligibility component, improper payments due to insufficient documentation, and noncompliance with screening and enrollment of providers.¹⁵ HHS finds that over three-quarters (77%) of Medicaid improper payments were due to instances where information was missing and/or states did not follow the appropriate process for enrolling providers and/or determining beneficiary eligibility, which do not necessarily represent payments for ineligible providers or beneficiaries.¹⁶ HHS notes that if the missing information had been on the claim and/or had the state complied with the enrollment or redetermination requirements, then the claims may have been payable. It finds that 8% of improper payments were for ineligible providers or beneficiaries.

Figure 2: National Estimates of Medicaid Improper Payments, FY2019

Beneficiary Eligibility

In June 2019 guidance, CMS reminded states about program integrity obligations particularly related to expenditures claimed at the enhanced match for the ACA Medicaid expansion group. The guidance details a program readiness checklist to ensure accurate eligibility determinations and claiming at the appropriate match rate. The guidance encouraged states to use periodic data matching to identify beneficiaries who may have had a change in circumstance that affects their eligibility. The guidance also indicated that state program integrity reviews, PERM, Medicaid Eligibility Quality Control (MEQC) and other audit findings will be part of oversight activities. Additionally, CMS noted plans to propose regulations to make changes to eligibility rules to increase requirements around verification, monitoring of changes in beneficiary circumstances, and eligibility redeterminations.

As noted, PERM measures eligibility determinations as one component of improper payments in Medicaid. As described above, CMS resumed the eligibility component of PERM reviews in 2019. For the eligibility component, a federal contractor assesses states’ application of federal rules and the state’s documented policies and procedures related to beneficiary eligibility. Examples of noncompliance with eligibility requirements include a state: enrolling a beneficiary when he or she is ineligible for Medicaid; determining a beneficiary to be eligible for the incorrect eligibility category, resulting in an ineligible service being provided; not conducting a timely beneficiary redetermination; or not performing or completing a required element of the eligibility determination process, such as income verification.¹⁷ While PERM payment errors may capture over and underpayments and errors in eligibility determinations, they do not capture errors associated with eligible people being disenrolled or denied enrollment.

The MEQC program uses state directed reviews in the two off-cycle PERM years to conduct eligibility reviews. Under the MEQC program, states design and conduct projects, known as pilots, to evaluate the processes that determine an individual’s eligibility for Medicaid and CHIP. States have great flexibility in designing pilots to identify vulnerable or error-prone areas. The MEQC program does not generate an error rate.

Based on audits from the OIG, CMS is conducting eligibility audits in select states. As a result of OIG findings tied to eligibility, CMS is conducting additional audits in California, New York, Kentucky, and Louisiana.¹⁸ These audits will be in addition to PERM and MEQC reviews.

State Claiming of Federal Matching Dollars

CMS has issued guidance related to oversight of federal matching funds provided to states through Section 1115 waivers. Specifically, in guidance, CMS has noted oversight concerns related to states obtaining federal Medicaid matching funds under waivers for Designated State Health Programs that previously were fully state-funded and described several actions it is taking to increase documentation and review of claiming of federal funds for these programs. CMS also noted that it will no longer accept state proposals for new or renewing Section 1115 demonstrations that rely on federal matching funds for these programs. In separate guidance, CMS outlined recent changes to its approach to calculating budget neutrality for Section 1115 waiver extensions that are intended to strengthen fiscal accountability and prevent the federal government’s exposure to excessive expenditures.

In November 2019, CMS proposed regulations to make changes to supplemental payments that it indicates are designed to promote program integrity and increase transparency. The proposed rule would establish new reporting requirements for states to provide CMS with certain information on supplemental payments to Medicaid providers and applicable upper payment limits. The proposed rule also places new limits on supplemental payments (up to 150% of fee-for-service base rates or 175% of base rates in rural areas) and adds new requirements for states to use financing mechanisms such as intergovernmental transfers (IGTs), certified public expenditures (CPEs), and provider taxes and donations.

CMS plans to conduct additional audits of high-risk areas. CMS has indicated plans to conduct additional audits of state claiming of federal matching dollars to address areas that have been identified as high-risk by GAO and OIG, as well as other behavior previously found detrimental to the Medicaid program.¹⁹

Managed Care Rates and Compliance with Federal Rules

Beginning in 2014, CMS implemented enhanced review of state capitation rates for coverage of the new expansion population.²⁰ CMS has since expanded that review to all managed care capitation rates and adopted a regulation providing more detailed requirements related to rate setting. All managed care rates are reviewed to ensure that the rates are actuarially sound and in compliance with Medical Loss Ratios (MLRs).²¹ CMS has indicated plans to release additional guidance on the Medicaid Managed Care Final Rule from 2016 to further state implementation and compliance with program integrity safeguards, such as reporting overpayments and possible fraud.²² In November 2019, CMS published an informational bulletin outlining changes to the Medicaid managed care contract approval process and future steps to streamline the process.

Provider Screening

Provider screening and enrollment is required for all providers in Medicaid fee-for-service or managed care networks. Additionally, the ACA requires states to terminate provider participation in Medicaid if the provider was terminated under Medicare or another state program, such as CHIP. CMS has multiple tools to assist states with provider screenings and enrollment compliance, including leveraging Medicare data. CMS pointed to additional provider screening efforts in its 2018 program integrity strategic plan and noted that it has released guidance regarding Medicaid provider screening and enrollment for Medicaid managed care organization network providers.²³ It also referenced plans to implement a pilot to screen Medicaid providers on behalf of states. CMS indicates that these actions are designed to improve efficiency and coordination across Medicare and Medicaid, reduce state and provider burden, and address one of the biggest sources of error included in the PERM rates.

Data Sharing

CMS is engaged in several efforts to increase access to data as part of program integrity and transparency efforts. CMS is developing enhanced administrative data through T-MSIS, which will provide increased eligibility, utilization and claims data that will be used broadly to monitor enrollment, payment, access, quality, and program integrity efforts.²⁴ CMS has released a Medicaid Scorecard that presents selected state performance measures related to their Medicaid programs. The CMS Medicaid program integrity strategy also highlights data analytic pilots and efforts to increase data sharing with states.

Education/Collaboration

Conducting outreach and education for states and providers is an additional component of program integrity efforts. The Medicaid Integrity Institute (MII) provides training and education to state Medicaid program integrity staff annually. CMS also has initiatives to collaborate with states and other entities to share best practices and conducts State Program Integrity Reviews to assess the effectiveness of states’ program integrity efforts. CMS has indicated plans for provider education efforts that will focus on providers who have high error rates and educate them on billing requirements as well as educating providers through Comparative Billing Reports, which show providers how their billing patterns compare to their peers.²⁵

What are current and emerging program integrity issues?

Through administrative actions related to program integrity, CMS is making policy changes that could have broader implications for eligibility and spending, particularly related to the ACA Medicaid expansion. Through guidance and regulation, CMS recently heightened the focus on federal oversight of state claiming for the ACA expansion, increased oversight of and made changes to state claiming for federal funds and budget neutrality for Section 1115 waivers, and proposed changes to supplemental payments and other financing mechanisms. CMS has also issued guidance to states on eligibility practices and indicated plans to issue regulations to make changes to eligibility rules to tighten standards for verification. While CMS has taken these actions as part of its goals to increase program integrity and transparency, these changes could have broader implications for eligibility and spending. For example, the changes to eligibility practices and rules could restrict enrollment in the program and the changes to state claiming for federal funds and budget neutrality rules for Section 1115 waivers and some of the proposed changes to supplemental payments and other financing mechanisms could reduce federal spending on the program and limit states ability to access federal matching funds. In some cases, reduced federal spending may be tied to additional oversight to ensure states are complying with current rules, while in other cases the reductions may be tied to CMS changes or proposed changes in policies.

CMS’s heightened focus on reducing errors in eligibility determinations could have trade-offs that make it more difficult for eligible people to obtain and maintain Medicaid coverage. CMS has increased its focus on beneficiary eligibility determinations as part of program integrity efforts, and indicated that it plans to take steps to change eligibility rules and tighten standards for eligibility verification to reduce improper payment rates associated with eligibility errors.²⁶ As noted, these errors do not necessarily reflect fraud and abuse or that the individual was not eligible for the program. Increased documentation and verification requirements could reduce instances of ineligible people being enrolled in the program and other eligibility errors, but also could result in greater enrollment barriers for people who are eligible for the program at the same time. Recent experiences in some states suggest that eligible individuals may be losing coverage due to increased periodic verification checks or because they failed to receive notices and/or did not provide documentation within required timeframes. While PERM error rates can measure under and over payments, they do not capture errors associated with eligible people being disenrolled or denied enrollment. States can adopt policies to streamline and simplify eligibility, which can reduce error rates and promote stable enrollment. For example, 24 states have adopted 12-month continuous eligibility for children in Medicaid, meaning they remain eligible for the 12-month period, even if they have small changes in income that increase above the eligibility limit. This policy helps reduce churn or people moving on and off the program due to small and/or temporary changes income, for example, due to seasonal work or overtime, as well as potential errors associated with fluctuating incomes.

Focusing program integrity efforts on areas identified as contributing to larger amounts of improper payments could yield greater returns on program integrity efforts. Improper payments are being largely driven by errors associated with screening and enrolling providers rather than beneficiary eligibility. In its program integrity strategy, CMS notes that its efforts to assist states with provider screening are designed to address one of the biggest sources of error measured by PERM.²⁷ As noted, the HHS report shows that the fee-for-service component of PERM accounted for the highest improper payment rate.²⁸ HHS further indicates that, since FY2014, Medicaid improper payment rates have been driven by errors associated with screening and enrollment of providers.²⁹ Moreover, PERM only represents one tool to measure improper payments and may not fully capture all losses associated with program waste, fraud, and abuse. For example, GAO has reported that the managed care component of PERM does not fully account for all program risks in managed care and points to overpayments and unallowable costs that previously have not been accounted for by the estimate.³⁰ Other reports point to losses specific to provider fraud.³¹ There may also be other program areas that are not currently a focus of program integrity efforts that are contributing to waste in the program. For example, the GAO recently found weaknesses in CMS’s oversight of the administrative costs of Section 1115 waiver demonstrations with work requirements, noting that CMS did not consider administrative costs during approval and that current procedures may be insufficient to ensure costs are allowable and matched at the correct rate, especially for administrative costs.