Medicaid Program Integrity: Improved Guidance Needed to Better Support Efforts to Screen Managed Care Providers

GAO has reported that Medicaid remains a high-risk program, partly due to concerns about improper payments. Screening of providers is important to help prevent improper payments. Under managed care, states contract with plans to provide services to beneficiaries.

GAO was asked to examine the screening of managed care providers. GAO examined (1) states' and plans' experiences using federal databases to screen providers; and (2) how states and plans share data about ineligible providers. GAO interviewed officials from 10 states, selected generally based on enrollment and geography, and representatives from 16 plans from among these states. GAO reviewed those states' Medicaid program websites and plan contracts, and relevant federal laws, regulations, and guidance; and interviewed officials from CMS and the Department of Health and Human Services' Office of Inspector General.

GAO found that the selected states and Medicaid managed care plans face significant challenges in screening providers for eligibility to participate in the Medicaid program. Based on information we received from two selected states and 16 selected plans, GAO found that the states and plans used information that was fragmented across 22 databases managed by 15 different federal agencies to screen providers. These databases included databases that the Centers for Medicare & Medicaid Services (CMS) had not identified for use in screening providers. Officials from some states noted that these additional databases provided better assurance they would not enroll ineligible providers—i.e., providers who have been barred from participating in federal health care programs. Federal internal control standards stress the importance of collecting quality information to achieve objectives and assess risks. However, the variety of databases used for screening purposes beyond those identified by CMS, along with the current rate of improper payments to Medicaid providers, suggests that CMS might not have identified all reliable sources of information about ineligible providers that could help states and plans achieve program objectives. State officials and plan representatives also said that accessing and using fragmented information from multiple and disparate federal databases challenged their screening efforts. For example, they reported difficulties accessing certain databases, such as the Social Security Administration's Death Master File, and conducting and confirming identified provider matches across databases, particularly those not based on a unique national provider identifier. CMS has not coordinated with other agencies to address these challenges. Federal internal control standards state that agencies should use quality data that are complete, current, accurate, and accessible—and have a logical connection to the program—to achieve agency goals to reduce fraud. However, the difficulties states and plans experienced accessing databases and confirming matches could result in provider screening efforts that do not ensure that ineligible providers are accurately and consistently identified.

GAO also found that the selected states reviewed used inconsistent practices to make data on ineligible providers publicly available. States must ensure that none of their providers has been determined to be ineligible anywhere in the United States. Although CMS has issued guidance encouraging states to share data on ineligible providers through its Medicaid provider termination notification system, doing so is optional, not all states are using the list, and it is not available to Medicaid managed care plans. Moreover, CMS has not provided states with guidance on other ways to share their data on ineligible providers or how to access other states' data on ineligible providers. The 10 states GAO selected varied in how they shared data on ineligible providers. Plans are not required to make their own data on ineligible providers publicly available, and the 16 selected plans shared their data with states at differing intervals and, in rare cases, with other plans. The inconsistency with which this information is shared across states and plans creates the potential that providers could be ineligible in some states while still receiving payments from Medicaid in other states.

GAO recommends that CMS (1) consider additional databases used in screening, (2) collaborate with the Social Security Administration to improve access to the Death Master File, (3) coordinate with other agencies to develop a common identifier across databases, and (4) provide state Medicaid programs with guidance that establishes expectations and best practices on sharing provider screening data among states and plans. HHS concurred with our recommendations.

The Medicaid program financed health care coverage for an estimated 69  million beneficiaries with estimated expenditures of $529 billion in fiscal  year 2015. This federal-state health care program for low-income and  medically needy individuals finances the delivery of health care services  to beneficiaries through fee-for-service (FFS) payments to participating  providers and capitated payments to Medicaid managed care (MMC)  plans under the terms of their contracts with the state. Under the  managed care delivery model, states typically contract with MMC plans to  provide a specific set of Medicaid-covered services to beneficiaries and  pay the MMC plans a set amount per beneficiary per month—referred to  as capitation payments—to provide those services. The Centers for  Medicare & Medicaid Services (CMS), within the Department of Health  and Human Services (HHS), is responsible for broad oversight of the  Medicaid program, while states are responsible for the daily  administration of their individual Medicaid programs, including program  integrity activities. In its broad oversight role, CMS develops guidance  and provides assistance to the states in administering their Medicaid  programs. In February 2015, we reported that Medicaid remains a high- risk program because of concerns about the adequacy of fiscal oversight,  including improper payments to Medicaid providers. CMS estimated that  $29.12 billion, or 9.78 percent, of federal Medicaid expenditures for fiscal  year 2015 were improper payments.

Because provider actions can be a major factor behind improper  payments, the integrity of the Medicaid program depends, in large part,  on ensuring that only eligible providers participate in the program.  Consequently, screening providers is important in helping prevent  improper payments, including fraud and abuse. In 2000, we raised  concerns about the effectiveness of states’ screening and enrollment  processes in preventing potentially fraudulent providers from enrolling in  the Medicaid program. More recently, we examined approximately  881,000 Medicaid providers in four states and found that in fiscal year  2011 hundreds of these providers were potentially receiving improper  Medicaid payments. The providers had suspended or revoked medical  licenses, had invalid addresses, were identified as deceased in federal  death files, or had been excluded from federal health care programs,  including Medicaid. Our prior work has also concluded that  comprehensive state screening and enrollment processes that prevent  fraudulent providers from billing Medicaid are more efficient in protecting  Medicaid funds than attempting to recover these funds once payments  have been made.  For the purposes of this report, an “ineligible or  potentially ineligible provider” means a provider who has been, or could  be, excluded by HHS’s Office of Inspector General (HHS-OIG) or  terminated by a state from participating in Medicaid under any applicable  requirements.

As states move their Medicaid programs to managed care, the screening  of MMC plan providers becomes increasingly important and increasingly  complex.  As of July 2013, the date of the most recent enrollment data  available, about 55 percent of total Medicaid enrollment was in managed  care, a percentage that has likely grown since. In addition, MMC  expenditures are growing at a faster rate than FFS expenditures because  of the Medicaid expansions under the Patient Protection and Affordable  Care Act (PPACA). Further, the HHS-OIG has noted the emergence of  MMC fraud, citing the increase in the agency’s workload on MMC fraud  cases, some of which resulted in inflated payments to MMC plans. The  flexibility states have in setting up their Medicaid programs—in the case  of screening MMC plan providers, states either screen providers, or they  delegate screening to plans, or use a combination of both approaches— makes identifying ineligible providers across multiple states a complex  task.  According to a 2016 estimate by the Congressional Budget Office,  managed care providers who have been determined to be ineligible for  the Medicaid program, but continue to participate, receive $3 million in  federal Medicaid payments annually.

You asked us to examine the availability and use of databases and  information necessary to screen MMC plan providers. This report  examines   1.  selected states’ and MMC plans’ experiences using federal databases  to screen providers; and   2.  how states and MMC plans share data about ineligible providers.

To obtain information on the federal databases that states and MMC  plans use to screen providers and their experiences using these  databases, we first selected 10 states—California, Florida, Illinois,  Minnesota, Missouri, New Jersey, New York, Tennessee, Texas, and  Washington—generally based on MMC beneficiary enrollment and  geographic distribution. We contacted Medicaid program officials in these  states to discuss whether the state or the MMC plans primarily screen  MMC plan providers. We determined that 2 states conduct their own  provider screening and 8 states primarily delegate provider screening to  MMC plans. We then contacted state Medicaid officials in the two states  that primarily screen providers, and representatives from the 16 plans in  states where plans primarily screen providers. We discussed which  federal databases they use to screen providers in order to help prevent  ineligible providers from enrolling and their experiences with using the  databases. The experiences of the Medicaid officials in the selected  states and the representatives in the selected MMC plans are not  generalizable to all plans in the states or to other states. In addition, we  reviewed applicable federal laws and regulations; CMS reviews of state  program integrity activities; CMS guidance on database use for the  screening of MMC plan providers; and Medicaid managed care contracts  in the 10 states. Further, we evaluated the sufficiency of CMS guidance  related to provider screening against our fraud prevention framework and  relevant federal internal control standards. Finally, we interviewed CMS  and HHS-OIG officials to obtain information about their databases, and  obtained and reviewed documentation on the various federal databases  identified by the states and plans.

To obtain information about how states and MMC plans share information  and data on ineligible providers with other MMC plans and states, we  contacted Medicaid officials in all 10 selected states and plan  representatives from the 16 selected plans. In addition, we searched the  Medicaid program websites in each of the 10 states to determine whether  state data on terminated providers were publicly available; the type of  information provided; and the ease of searching, finding, and  downloading state information. The experiences of the Medicaid officials  in the selected states and the representatives in the selected MMC plans  are not generalizable to all plans in the states or to other states. We also  reviewed CMS guidance on sharing data regarding these providers and  relevant federal internal control standards.

We conducted this performance audit from March 2015 to April 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Federal laws require both state and federal entities to protect the  Medicaid program from fraud, waste, and abuse. States have primary  responsibility for reducing, identifying, and recovering improper payments.  Federal entities typically provide oversight, guidance, and program and  law enforcement support.

States’ program integrity activities include a screening process to help  ensure that ineligible providers do not participate in the Medicaid  program. Federal regulations establish screening requirements that apply  when states enroll FFS providers into their Medicaid program. Because  states are required to enroll FFS providers, but have discretion on  whether to enroll MMC plan providers, MMC plan providers would not be  subject to the same screening requirements as FFS providers unless the  state opted to enroll them. States that do not enroll MMC plan providers  have flexibility in how they screen them. This occurs when states  require the MMC plans to screen and enroll providers directly into their  networks by delegating these responsibilities to the plans in their  contracts. In past work, we concluded that states that maintain centralized  control over the provider screening process and require MMC plan  providers to enroll with the state Medicaid agency may be better  positioned to ensure the integrity of their Medicaid programs.

Federal health programs, including Medicaid, are prohibited from paying  for any items or services rendered by an ineligible provider. The HHS- OIG determines which providers are excluded from the federal health  programs, and thus ineligible, and maintains the List of Excluded  Individuals and Entities (LEIE). Grounds for exclusion include  convictions for program-related fraud and patient abuse, and suspension  or revocation of a medical license for reasons bearing on professional  competence or performance. While states may delegate provider  screening to the MMC plans, the states remain responsible for ensuring  that they do not pay ineligible providers for Medicaid health care items  and services. CMS is prohibited by federal law from making payments to  states for any amount expended for items or services provided by an  ineligible provider.  Any such payments constitute overpayments and  are therefore subject to recoupment. In addition, civil monetary penalties  may be imposed against MMC plans that employ or enter into contracts  with ineligible providers.

Further, PPACA and its implementing regulations require state Medicaid  agencies to terminate the participation of any provider that has been  terminated on or after January 1, 2011, under Medicare or under any  other state Medicaid program or Children’s Health Insurance Program.  CMS defines termination to mean that a state Medicaid program,  Children’s Health Insurance Program, or the Medicare program has taken  action to revoke a provider’s billing privileges for cause, and the provider  has exhausted all applicable appeal rights or the timeline for appeal has  expired. A termination for cause may include, but is not limited to,  terminations based upon fraud, integrity, or quality issues. Prior to  PPACA, if one state terminated a provider from its Medicaid program, the  provider could potentially enroll in or continue participation in another  state’s Medicaid program, leaving the latter state’s program vulnerable to  potential fraud, waste, and abuse. In response to the PPACA requirement  for CMS to establish a process for sharing information about terminated  providers with state agencies, CMS established a web-based portal—the  Medicaid provider termination notification system—where CMS and state  Medicaid agencies can submit information about providers that meet  CMS’s criteria for having been terminated for cause from Medicare,  Medicaid, or the Children’s Health Insurance Program. However,  according to CMS officials, states’ use of this portal to report terminations  is voluntary.

In response to PPACA’s requirement to establish procedures for  screening providers, CMS issued regulations that set forth minimum  requirements applicable to the screening of Medicaid FFS providers,  although states have flexibility to establish more stringent screening  requirements. Among other requirements, CMS designated four federal  databases that states must use to screen providers: (1) the Social  Security Administration’s (SSA) Death Master File (DMF), (2) HHS’s  National Plan and Provider Enumeration System (NPPES), (3) the LEIE,  and (4) the Excluded Parties List System (EPLS) maintained by the  General Services Administration. In December 2014, CMS issued  guidance to assist states when conducting required federal database  checks on FFS providers. In the guidance, CMS noted that MMC plans  are not mandated by regulation to screen providers who enroll in their  networks. However, CMS stated that it considered the requirements  under its regulation to be program safeguards that would be prudent in  managed care settings. CMS also noted that states may delegate these  requirements to their MMC plans through their contracts with them. In  guidance issued to MMC plans, CMS recommended that plans use the  LEIE and EPLS to identify ineligible providers.

Selected States and Medicaid Managed Care Plans Face Significant Challenges Screening Providers

According to two selected states and 16 selected MMC plans that screen  MMC plan providers, their efforts are challenged by fragmented  information and difficulty accessing and using particular databases.

Efforts to Screen Providers Are Based on Information that Is Fragmented across Multiple and Disparate Federal Databases

According to the two selected state officials and 16 selected MMC plan  representatives we contacted, the information they use to screen MMC  plan providers is fragmented across multiple and disparate federal  databases. Overall, these two selected states and 16 selected plans  identified a total of 22 databases managed by 15 different federal  agencies. Representatives from 13 of the 16 plans reported using  between 5 and 8 of these federal databases, while officials from the two  states that directly screen managed care providers reported using 5 and 6  databases. Table 1 lists the 22 databases that these selected state  officials and plan representatives said they used in their screening of  MMC plan providers, the agencies that managed them, and the role the  databases play in the screening of providers. (See appendix I for  additional details on each of these federal databases.)

According to state Medicaid officials in the two selected states that do  their own screening of providers, both states used the LEIE, EPLS, and  NPPES, and one also used the DMF. In addition, both states checked  CMS’s Medicare Exclusions Database and its Provider Enrollment, Chain  and Ownership System (PECOS).

Almost all of the selected MMC plans reported using three databases— NPPES, DMF, and HHS’s National Practitioner Data Bank—in addition to  the two databases recommended by CMS guidance. Plans also reported  using several other of the federal databases identified in table 1. Officials  from some states noted that plans checking more databases than  recommended by CMS provided better assurance they would not enroll  ineligible providers and helped provide a more comprehensive  background on a provider. For example, by checking federal databases  beyond the two recommended by CMS for MMC plans (LEIE and EPLS),  plans may find background on a provider’s termination or identify a past  administrative action taken against the provider by the Drug Enforcement  Administration. However, this also means that provider screenings within  a state may not always be conducted consistently, as the additional  databases checked may vary by plan.

Additionally, all 10 selected states use the health plan accreditation  requirements of the National Committee for Quality Assurance (NCQA) in  their monitoring of state MMC plans, because it includes provider  screening guidelines, such as assessing providers’ practice history,  verifying their credentials, education, training, malpractice history and  disciplinary actions, and monitoring providers’ sanctions, complaints, and  quality issues. Half of the states require that their plans be accredited by  NCQA, and the rest recognize NCQA accreditation as compliance with  federal guidance for screening MMC plan providers. In particular, to meet  the NCQA accreditation requirements, plans need to obtain information  beyond what the LEIE and EPLS provide. For example, to meet NCQA’s  requirement that they verify provider history and other disciplinary actions,  plans must check the National Practitioners’ Data Bank, a large central  federal data bank of all reports made against all health care  professionals, including fraud, abuse, licensure actions, or malpractice  reports.

Federal internal control standards stress the importance of collecting  quality information to achieve objectives and assess risks. To do this, the  standards state that it is necessary to identify information requirements  and use data from reliable sources.  However, the variety of databases  checked by states and MMC plans beyond those specified by CMS, the  use of NCQA’s accreditation requirements in all 10 states, along with the  current rate of improper payments to Medicaid providers, suggests that  CMS might not have identified all reliable sources of information about  ineligible providers. This makes it difficult for the states and MMC plans to  achieve the Medicaid program’s objectives. Moreover, the variety of  databases that the states and MMC plans have chosen to check raises  the possibility that they might be using information of varying quality to  screen providers. All of the states and MMC plans that screened  providers checked more databases than are currently specified by CMS  for this purpose, but CMS has not assessed whether there are benefits to  checking the additional databases.  Without an assessment of these  additional databases and their potential contribution to improving the  effectiveness of screening providers, and ultimately reducing improper  Medicaid payments, CMS cannot be certain that states and MMC plans  are using information of sufficient quality to screen providers.

Screening Efforts Are Hampered by Difficulties Accessing and Using Databases

State Medicaid officials and MMC plan representatives said that  accessing and using information that is fragmented across multiple and  disparate federal databases hampered them in their efforts to screen  providers. CMS has not collaborated with other agencies to explore  options for enhancing the ability of states and plans to access and use  comprehensive information during the screening process, including  information about deceased providers, and thus better ensure that  ineligible or potentially fraudulent providers do not bill Medicaid.

State officials and plan representatives noted problems accessing two  specific databases. Officials from one state and representatives from one  plan identified cost as a challenge to using the DMF, which is only  available with a paid subscription. CMS officials told us that they are  interested in collaborating with SSA to facilitate sharing DMF data with  states. Additionally, representatives from one plan said that having  access to PECOS—a CMS database currently unavailable to plans— would help improve their screening process because it would help  corroborate information from providers.

Representatives from two plans said that they experienced challenges  obtaining assistance when they had general problems using federal  databases. For example, representatives from one plan said that it could  be difficult to identify an individual at a federal agency who could not only  assist them, but also who understands Medicaid. Plan officials said that if  they were able to contact someone, the agency might be hesitant to  provide the plan with additional information about a provider termination,  because MMC plans are not government entities.

Representatives from seven selected plans said that the technical  process of conducting the matches and confirming identified matches was  challenging. For example, some plan representatives said they check the  eligibility status of thousands of providers at regular intervals, typically  monthly, and said that these checks can be particularly challenging if the  database does not allow the user to compare multiple provider names at  one time.

Plan representatives said that confirming the accuracy of identified  matches was also challenging, because some databases contained  limited provider data, particularly if a match is not based on a unique  identifier, such as the national provider identifier (NPI). The lack of a  consistent, unique identifier meant that it could be difficult to accurately  match a potentially ineligible provider across databases. Relying solely  on basic information for matching, such as providers’ names and  addresses, can cause additional problems; for example, false positive  matches for common names such as John Smith. In these instances,  plans may have to take additional steps to confirm the match, such as  contacting the provider or federal agency managing the database to  obtain additional information that is not included in the database. Several  plans told us that they would prefer to use the NPI to search the  databases, because most providers are required to have an NPI.  However, because NPI is a health-care specific unique identifier, it may  not be used in databases external to HHS. Other unique identifiers that  state officials and plan representatives suggested could be used across  databases include Social Security numbers and taxpayer identification  numbers, although the officials noted the sensitivity involved with using  these numbers.

These challenges affect states’ ability to ensure that only eligible  providers in good standing participate in the Medicaid program. Federal  internal control standards state that agencies should use quality data that  are complete, current, accurate, and accessible, and have a logical  connection to the program, such as the data regarding deceased  individuals in the DMF, to achieve agency goals to reduce fraud.  Without consistent access to the DMF, states and plans risk paying  deceased providers—a potential concern that we have identified in prior  work. The use of a consistent identifier would also help states and plans  ensure that they are accurately identifying ineligible providers. However,  CMS officials said they have not coordinated with other agencies to  address these challenges. For example:

Sharing CMS’s DMF data: SSA officials told us that they recently  received a request from CMS asking for permission to share DMF  information with states and said that they are willing to work with CMS  to develop a process to do so. CMS officials told us that they have  had preliminary conversations with SSA and are interested in  collaborating with SSA to develop a process to share the DMF with  states. In addition to helping to ensure that states have access to  DMF data and protecting the federal government from fraudulent  payments to deceased providers, this arrangement could decrease  federal and Medicaid expenditures. For example, SSA officials told us  that in fiscal year 2014 CMS paid nearly $25,200 for the DMF data,  including weekly updates, and states reported annual DMF  subscription and implementation costs ranging from about $2,700 to  $67,000. Since one state and most of the plans reported using the  DMF, CMS sharing its DMF subscription would likely produce state  and federal savings for Medicaid.

Collaborating with other agencies to use a unique identifier: CMS  officials said that they have not considered collaborating with other  agencies to explore using a unique identifier—such as the NPI—that  would serve to improve the ability of states and plans to confirm the  accuracy of matches across databases. Such collaboration could help  to mitigate challenges experienced by states and MMC plans in  confirming database matches efficiently and effectively, which  potentially place federal dollars at risk for waste, fraud, and abuse.

Recent legislation has the potential to address some—but not all—of the  challenges related to states’ and health plans’ use of federal databases.  The Department of Treasury’s Do Not Pay database is designed to  reduce improper payments in federal programs and incorporates  information from several of the federal databases states and plans use to  screen providers. The Do Not Pay database is a source of centralized  data that agencies must use to verify eligibility for federal payments and  awards. The Do Not Pay database provides access to—among other data  sources—EPLS, and the public version of the DMF. Officials from one  state that delegates provider screenings to MMC plans said that having  access to the Do Not Pay database would streamline their screening  process. While the Do Not Pay database is currently only available to  federal agencies, a recently enacted law will allow states and state  contractors, including MMC plans, to access the database. Other states  and plans also indicated that a centralized database would be ideal,  although they did not refer directly to the Do Not Pay database. CMS  officials told us they are considering suggesting to states and plans that  they use the Do Not Pay database for Medicaid managed care provider  screening.

Selected States and Medicaid Managed Care Plans Use Inconsistent Practices to Make Data on Ineligible Providers Publicly Available

States must ensure that none of their providers has been determined to  be ineligible anywhere in the United States.  CMS issued guidance in  2012 encouraging states to share data on ineligible providers through its  Medicaid provider termination notification system; however, doing so is  optional, not all states are using the list, and the list is not available to  MMC plans. In addition, CMS officials said they have not provided  states with guidance on other ways to share their data on ineligible  providers or how to access other states’ data on ineligible providers.

Our 10 selected states varied in how they shared data on ineligible  providers, the location and usability of the data they shared, and the type  of information they shared. All of our 10 selected states made data on  their ineligible providers publicly available. Specifically, they made their  data available online, although they varied in where they posted these  data on their websites and in the consistency of the information posted.  For example, our review of the states’ websites found that 5 states made  the data available through their state’s Office of Inspector General’s  website, while the 5 other states had these data on their Medicaid  websites. Within these two groups, the data were sometimes displayed  on a homepage and other times required users to click through a number  of webpages to locate the data. All the states provided at least some  export function as part of accessing their data on ineligible providers,  which can facilitate the ease with which other states can access and use  the information on the website. However, 2 states limited their data  exports to PDF files, which have less search functionality than other  formats like Microsoft Excel, which was used by the other 8 states. Eight  of the selected states had a database search feature as part of their  website and an export function, which allowed users to search for  individual providers.  Two websites allowed for verification of a Social  Security number online. (See fig. 1.)

The 10 selected states also varied in the types of data they made  available about their ineligible providers. All 10 states included providers’  first names, last names, and middle names or initials. Seven states  included providers’ NPI in their information on ineligible providers. Seven  states included a category for a medical license number in their  information on ineligible providers, but these data were not consistently  presented across states. Four states included provider addresses, and  seven states included provider type or specialty. One state included alias’  that the ineligible providers might be using, and one state provided  information on ineligible providers’ affiliations with other provider groups  or practices. (See fig. 2.)

The 10 states also varied in the information they provided about why  providers became ineligible and in the terminology they used. All 10  states included the effective date providers became ineligible. Five states  provided information on the action type that led to the provider becoming  ineligible, which included, among other things, the terms “exclusion,”  “terminated,” and “voluntary withdrawal.” While the HHS-OIG defines  excluded providers as those providers it has determined to be ineligible  for participation in federal health programs, states used varying  terminology. Six states also included the reason for the exclusion. (See  fig. 3.)

Unlike states, MMC plans are not required to make their data on ineligible  providers publicly available. The 16 selected MMC plans reported  sharing these data with their state Medicaid agencies at varying intervals  and in rare cases, with other plans. Representatives from the 16 selected  plans said they might share their data on ineligible providers with their  states during periodic meetings that covered a variety of issues. However,  the frequency and scope of these meetings varied. According to plan  representatives, 1 plan met with the state at least monthly, 3 plans met  with the state quarterly, 7 plans met with the state annually, and 3 plans  met with the state biennially; officials from 1 plan said they met with the  state frequently but did not provide a specific frequency for the meetings;  and 1 plan did not provide this information. Representatives from the  MMC plans said they generally did not share these data with other plans,  with a few exceptions. For example, representatives from 1 plan said that  they share information on ineligible providers with another plan they  contract with in their state. Similarly, representatives from 3 MMC plans  that were subsidiaries of large health care corporations with MMC plans  in multiple states told us that they shared data on ineligible providers with  the other plans in their networks. However, there is no process or  requirement from CMS for them to share on a consistent basis.

Because states and MMC plans are prohibited from paying federal funds  to providers that have been determined to be ineligible anywhere in the  United States, sharing data on ineligible providers is an important control  activity for preventing providers who are ineligible to participate in  Medicaid in one state from enrolling in or billing Medicaid programs in  other states.  Federal internal control standards emphasize the  importance of performing control activities routinely and consistently.  The inconsistency with which this information on ineligible providers is  shared across states and MMC plans creates the potential that providers  could be determined to be ineligible in some states, while still receiving  payments from Medicaid in other states.

States and MMC plans rely on fragmented information from multiple and  disparate databases to screen managed care providers to ensure that  they are not paying providers determined to be ineligible to do business  with the federal government. Currently, CMS guidance to states and  MMC plans only touches upon a small subset of the 22 disparate  databases that states and MMC plans check when screening providers,  and does not provide information on what other databases would be  helpful for screening providers. Because MMC plans we reviewed are  using a variety of databases beyond those specified by CMS, it suggests  that CMS might not have identified all reliable sources of information  about ineligible providers that would be helpful to meet program  objectives and assess risks. Without an assessment of these additional  databases and their potential contribution to improving the effectiveness  of screening providers, CMS cannot be certain that its guidance to states  and MMC plans is comprehensive for screening providers.

States and plans have also been hampered in their efforts to access and  use databases maintained by various federal agencies, because of  differences in the characteristics of the databases, including difficulty  accessing databases and conducting provider matches. CMS has not  coordinated with other agencies to explore what options may exist to  address these challenges.

CMS guidance on how states should share data on ineligible providers is  also limited, resulting in significant inconsistency in how such information  is shared across states. All 10 selected states made their data on  ineligible providers publicly available, although they varied in where they  posted the data on their websites and the consistency of the information  posted. While all 10 states included providers’ names, other data—such  as NPI or other identifiers—were not consistently available.  Anyone  checking these data would be required to do additional work to confirm a  provider match and state websites would require that the states  conducting the screenings know how to locate the ineligible provider list.  The inconsistency with which this information is shared across states and  MMC plans creates the potential that providers could be determined to be  ineligible in some states, while still receiving payments from Medicaid in  other states.

To improve the effectiveness of states’ and plans’ MMC plan provider  screening efforts, we recommend that the Acting Administrator of CMS  take the following three actions:  1.  Consider which additional databases that states and MMC plans use  to screen providers could be helpful in improving the effectiveness of  these efforts and determine whether any of these databases should  be added to the list of databases identified by CMS for screening  purposes.  2.  Collaborate with SSA to facilitate sharing CMS’s DMF subscription  with state Medicaid programs.  3.  Coordinate with other federal agencies, as necessary, to explore the  use of an identifier that is relevant for the screening of MMC plan  providers and common across databases used to screen MMC plan  providers.  4.  Provide state Medicaid programs with guidance that establishes  expectations and best practices on sharing provider screening data  among states and MMC plans.

Agency and Third- Party Comments and Our Evaluation

We provided a draft copy of this report to HHS. HHS provided written  comments, which are reprinted in appendix II. In its written comments,  HHS described the actions it will take to address our first three  recommendations. In response to our fourth recommendation to provide  state Medicaid programs with guidance that establishes expectations and  best practices on sharing provider screening data among states and  Medicaid managed care plans, HHS commented that it developed the  Medicaid provider termination notification database to assist states with  the requirement to deny or terminate the enrollment of any provider that  has been terminated for cause under Medicare or another state’s  Medicaid program or CHIP. It added that its Medicaid managed care  proposed rule, issued in June 2015, if finalized, will require that state  Medicaid programs enroll providers participating in Medicaid managed  care. HHS stated that this will help ensure that all Medicaid managed  care providers are screened against the Medicaid provider termination  notification database. However, states’ use of the Medicaid provider  termination notification database is not required, not all states are using it,  plans do not have access to the database, and the proposed rule does  not address use of the database. Therefore, HHS’s reported actions will  not address these specific issues. HHS also provided technical  comments, which we incorporated as appropriate.

We also provided relevant draft portions of this report to SSA, state  Medicaid program offices for California, Florida, Illinois, Minnesota,  Missouri, New Jersey, New York, Tennessee, Texas, and Washington,  and representatives of the MMC plans. SSA provided technical comments  which we incorporated as appropriate. States and plans were also in  agreement with the draft portions they received, and provided some  technical comments, which we incorporated as appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to our  requestor, the Secretary of Health and Human Services, the Acting  Commissioner of Social Security, officials from the states and plans  included in our study, and other interested parties. In addition, the report  will be available at no charge on GAO’s website at http://www.gao.gov  If you or your staffs have any questions about this report, please contact  me at (202) 512-7114 or at YocomC@gao.gov. Contact points for our  Office of Congressional Relations and Office of Public Affairs can be  found on the last page of this report. Other major contributors to this  report are listed in appendix III.

Appendix I: Descriptions of Federal Databases Selected States and Medicaid Managed Care Plans Use to Screen Providers

Database Administrative Actions Against Registrants

Description  The Drug Enforcement Administration (DEA) administers a provision of the Controlled  Substances Act of 1970 that, among other things, requires all health care providers  entitled to dispense, administer, or prescribe controlled pharmaceuticals; and all  pharmacies entitled to fill prescriptions to register with the DEA. The Controlled  Substances Act authorizes the DEA to take enforcement actions, such as administrative  actions, against the registrant, for various reasons, such as materially falsifying the  registration application filed; having been convicted of a felony relating to a controlled  substance; having had its state license or registration suspended, revoked, or denied; or  having been excluded from participation in a Medicaid or Medicare program. DEA’s  Administrative Actions Against Registrants shows, by year, DEA’s administrative actions.

DEA Number is DEA’s complete official database of persons and organizations certified to  handle controlled substances under the Controlled Substances Act. DEA authorizes the  use of this database, and the inclusion of any individual or organization in the database,  as proof of that entity's registration with the DEA.

Designated Foreign Terrorist Organizations

The Department of State compiles a list of foreign organizations that are designated by  the Secretary of State as Foreign Terrorist Organizations, in accordance with section 219  of the Immigration and Nationality Act, as amended.

The Social Security Administration (SSA) compiles death information about Social  Security number-holders in order to ensure it does not pay Social Security benefits to  deceased individuals and to establish benefits for survivors. This information is in the  agency’s DMF. SSA obtains death reports from a variety of sources, including family  members, funeral directors, post offices, financial institutions, other federal agencies, and  states. To get death reports from the states, SSA has established formal agreements that  set forth a payment structure for the states’ death reports and limit SSA’s ability to share  this information. However, the Social Security Act requires SSA to share death  information, to the extent feasible, including data reports by the states, with federal  agencies to ensure proper payment of benefits to individuals. The act also prohibits SSA  from sharing state-reported death information for any other purposes. As a result, SSA  maintains two versions of the DMF. The full DMF, which contains all death records, is  available to federal benefit payment agencies. The partial DMF, which excludes state- reported death information, is available publicly.

The list identifies individuals and entities that have been denied export privileges, by  written order to the Department of Commerce.

The Export Administration Regulations (EAR) contain licensing requirements for the  export, re-export and/or transfer (in-country) of specified items. The Entity List contains  names of certain foreign persons—including businesses, research institutions,  government and private organizations, individuals, and other types of legal persons—that  are subject to the EAR. On an individual basis, the persons on the Entity List are subject  to licensing requirements and policies supplemental to those found in the EAR. The list is  found on the Department of Commerce’s Bureau of Industry and Security website.

Excluded Parties List System (EPLS)/ System of Award Management (SAM)

The General Services Administration (GSA) maintains the EPLS, an online system that  includes information regarding parties debarred, suspended, proposed for debarment,  excluded, or otherwise disqualified from receiving federal funds; in 2012, GSA migrated  the EPLS into SAM. All federal agencies are required to send information to the EPLS on  parties they have debarred or suspended. The EPLS provides only the name and address  of excluded entities, but no other unique identifiers. The HHS-OIG also sends GSA  monthly updates of the LEIE for inclusion in the EPLS, but the LEIE information included  in EPLS does not provide all of the information from LEIE. For example, EPLS does not  provide more details on LEIE excluded providers, such as the statutory basis for the  exclusion action, date of birth, and address.

Federal Employees Health Benefits Program (FEHBP) Administrative Sanctions

The FEHBP provides coverage to federal employees, retirees, and their dependents  through health insurance carriers that contract with the federal government. The Office of  Personnel Management (OPM) negotiates these contracts and requires that each of these  carriers establish a program to prevent, detect, and eliminate fraud and abuse. OPM’s  Office of Inspector General suspends and debars health care providers from the FEHBP  who have, among other things, lost professional licenses, been convicted of a crime  related to the delivery of or payment for health care services, violated provisions of a  federal program, or been debarred by another federal agency. The names of such  providers are available through the secure OPM Debar Webpage. The list of sanctioned  providers is also available to the public through SAM—GSA’s government-wide list of  exclusions.

List of Excluded Individuals and Entities (LEIE)

The Department of Health and Human Services Office of Inspector General (HHS-OIG)  maintains and updates monthly the LEIE, a database of providers it has excluded. The  LEIE includes information on excluded providers, such as providers’ names, addresses,  dates of birth, occupation at the time of exclusion, provider type, and the statutory basis  for the exclusion. The LEIE is publicly available to search or download on the HHS-OIG  website, and available in two formats: online and downloadable. The online search engine  identifies currently excluded individuals and entities. When a match is identified, it is  possible to verify the accuracy of the match using a Social Security number or employer  identification number. The downloadable version of the database may be compared  against state enrollment files. However, unlike the online version, the downloadable  version does not include Social Security number or employer identification number.

A United States Postal Service website that allows zip code searches by address, city,  and state.

CMS developed the MED in 2002 to collect and retrieve information that aided in ensuring  that no payments are made to excluded individuals and entities for services furnished  during the exclusion period. According to CMS, MED files contain a variety of identifiable  and general information including names, Social Security numbers, National Provider  Identifiers, addresses, exclusion types, and reinstatement dates, if applicable. CMS uses  the HHS-OIG’s LEIE to populate the MED; the HHS-OIG sends monthly updates of the  LEIE to CMS.

The Medicare Opt-out List is a list of physicians and practitioners who do not wish to enroll  in the Medicare program and have “opted-out” of Medicare. This means that neither the  provider, nor the beneficiary submits the bill to Medicare for services rendered. Instead,  the beneficiary pays the provider out-of-pocket and neither party is reimbursed by  Medicare.

National Plan and Provider Enumeration System (NPPES)

The National Provider Identifier (NPI) is a national, unique 10-digit identification number  assigned to health care providers that CMS adopted to be used in specified administrative  and financial transactions for its health care providers and suppliers in accordance with  the Health Insurance Portability and Accountability Act. CMS uses NPPES to assign NPIs  to providers.

NPDB, maintained by the Health Resources and Services Administration, an agency  within HHS, is an information clearinghouse containing information related to the  professional competence and conduct of healthcare providers. The NPDB is intended to  facilitate a comprehensive review of professional credentials of health care providers and  collects information on adverse licensing and certification actions, criminal convictions  (health care related), civil judgments, exclusions from federal or state health care  programs, and other adjudicated actions or decisions, medical malpractice payments, and  any negative actions or findings taken by peer review organizations. It includes LEIE  exclusions and related reinstatement actions taken by the HHS-OIG. However, because  the criteria for inclusion in the NPDB are different than the criteria for inclusion in the LEIE,  not all LEIE exclusions are listed in the NPDB.

This HHS-OIG webpage includes the names of its most wanted fugitives on charges  related to health care fraud and abuse.

This is the Federal Financial Institutions Examination Council’s list of current, senior  foreign political figures, their immediate family, and their close associates, who potentially  pose a risk that their funds may be the proceeds of foreign corruption.

Provider Enrollment, Chain and Ownership System (PECOS)

PECOS is an Internet-based system to which Medicare providers submit and update their  enrollment data. In response to the Patient Protection and Affordable Care Act’s  requirement for CMS to establish a process for sharing information about terminated  Medicare providers with state agencies, CMS provided states direct access to PECOS,  where they can view specific enrollment data for each provider including identifying  information such as National Provider Identifiers, tax identification numbers (TINs), and  legal business names. PECOS also includes information on revoked licenses and  terminated Medicare providers. While the data stored in the system are specific to  Medicare providers, they are useful to state Medicaid programs. For example, states may  use the data when screening providers during enrollment processes to determine whether  a provider has ever been excluded from participation in Medicare and, thus, whether they  should be allowed to participate in Medicaid. They also use PECOS data during provider  screening to determine whether a Medicare screening has already taken place, thus  eliminating the need to screen further for Medicaid participation.

Public Access to Court Electronic Records (PACER)

PACER is an electronic public access service that allows users to obtain case and docket  information online from federal appellate, district, and bankruptcy courts, and the PACER  Case Locator. PACER is provided by the federal judiciary in keeping with its commitment  to providing public access to court information via a centralized service.

As part of its enforcement efforts, the Office of Foreign Assets Control, within the  Department of Treasury, publishes a list of individuals and companies owned or controlled  by, or acting for or on behalf of, targeted countries. It also lists individuals, groups, and  entities—such as terrorists and narcotics traffickers—designated under programs that are  not country-specific. Collectively, such individuals are blocked and U.S. persons are  generally prohibited from dealing with them.

The Internal Revenue Service’s TIN Matching is part of a suite of Internet based pre-filing  e-services that allows “authorized payers” the opportunity to match 1099 payee  information against Internal Revenue Service records prior to filing information returns. An  authorized payer is one who has filed forms 1099-B, 1099-DIV, 1099-INT, 1099-K, 1099- MISC, 1099-OID, or 1099-PATR with the Internal Revenue Service in at least one of the  two past tax years. Interactive TIN Matching will accept up to 25 payee TIN/name  combinations on-screen, while Bulk TIN Matching will allow up to 100,000 payee  TIN/name combinations to be matched via a text file submission. Both programs will  match the payee name and TIN with Internal Revenue Service records; decrease backup  withholding and penalty notices; and reduce the error rate in TIN validation.

Parties listed on the Department of Commerce’s Unverified List are ineligible to receive  items subject to the Export Administration Regulations by means of a license exception. In  addition, exporters must file an Automated Export System record for all exports to parties  listed on the Unverified List and obtain a statement from such parties prior to exporting,  re-exporting, or transferring to such parties any item subject to the Export Administration  Regulations that is not subject to a license requirement.

This is the Federal Bureau of Investigation’s list of wanted fugitives.

Appendix II: Agency Comments from the Department of Health and Human Services

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Thomas Conahan, Assistant  Director; Pauline Adams; Drew Long; Reed Meyer; Dawn Nelson; and  Jennifer Whitworth made key contributions to this report.

Question: How is the plan data fragmented?

Answer: Based on information we received from two selected states and 16 selected plans, GAO found that the states and plans used information that was fragmented across 22 databases managed by 15 different federal agencies to screen providers.

Question: How do these additional databases help ensure proper vetting?

Answer: Officials from some states noted that these additional databases provided better assurance they would not enroll ineligible providers—i.e., providers who have been barred from participating in federal health care programs.

Question: To what extent did CMS identify all reliable sources of provider information?

Answer: However, the variety of databases used for screening purposes beyond those identified by CMS, along with the current rate of improper payments to Medicaid providers, suggests that CMS might not have identified all reliable sources of information about ineligible providers that could help states and plans achieve program objectives.

Question: How does the diversity of data sources affect screening efforts?

Answer: State officials and plan representatives also said that accessing and using fragmented information from multiple and disparate federal databases challenged their screening efforts.

Question: How does this compare to federal standards?

Answer: Federal internal control standards state that agencies should use quality data that are complete, current, accurate, and accessible—and have a logical connection to the program—to achieve agency goals to reduce fraud.

Question: What could happen as a result of states’ difficulty to access databases?

Answer: However, the difficulties states and plans experienced accessing databases and confirming matches could result in provider screening efforts that do not ensure that ineligible providers are accurately and consistently identified.

Efforts to Screen Providers Are Based on Information that Is Fragmented across Multiple and Disparate Federal Databases

Screening Efforts Are Hampered by Difficulties Accessing and Using Databases

Question: How consistent were the data practices of the reviewed states?

Answer: GAO also found that the selected states reviewed used inconsistent practices to make data on ineligible providers publicly available.

Question: How must states vet their providers?

Answer: States must ensure that none of their providers has been determined to be ineligible anywhere in the United States.

Question: To what extent does CMS guidance help states vet their providers?

Answer: Although CMS has issued guidance encouraging states to share data on ineligible providers through its Medicaid provider termination notification system, doing so is optional, not all states are using the list, and it is not available to Medicaid managed care plans.

Question: Why is there a lack of consistent data sharing between programs?

Answer: Plans are not required to make their own data on ineligible providers publicly available, and the 16 selected plans shared their data with states at differing intervals and, in rare cases, with other plans.

Question: Why are these inconsistencies a cause for concern?

Answer: The inconsistency with which this information is shared across states and plans creates the potential that providers could be ineligible in some states while still receiving payments from Medicaid in other states.

Selected States and Medicaid Managed Care Plans Use Inconsistent Practices to Make Data on Ineligible Providers Publicly Available

Question: What was GAO asked to examine?

Answer: GAO was asked to examine the screening of managed care providers.

Question: What did GAO examine?

Answer: GAO examined (1) states' and plans' experiences using federal databases to screen providers; and (2) how states and plans share data about ineligible providers.

Question: What officials did GAO interview for the report?

Answer: GAO interviewed officials from 10 states, selected generally based on enrollment and geography, and representatives from 16 plans from among these states.

Question: How did GAO collect additional data?

Answer: GAO reviewed those states' Medicaid program websites and plan contracts, and relevant federal laws, regulations, and guidance; and interviewed officials from CMS and the Department of Health and Human Services' Office of Inspector General.