Summary
The Medicaid program spent more than $200 billion in fiscal year 2000 to meet the health care needs of nearly 34 million poor, elderly, blind, and disabled persons. States are responsible for making proper payments to Medicaid providers, recovering misspent funds, and accurately reporting costs for federal reimbursement. At the federal level, the Centers for Medicare and Medicaid Services (CMS) oversee state financial activities and ensure the propriety of expenditures reported for federal reimbursement. GAO found that weak financial oversight by CMS leaves the program vulnerable to improper payments. The Comptroller General's Standards for Internal Control in the Federal Government requires that agency managers perform risk assessment, take steps to mitigate identified risks, and monitor the effectiveness of those actions. The standards also require that authority and responsibility for internal controls be clearly defined. CMS oversight had weaknesses in each of these areas. As a result, CMS did not know if its control efforts were focused on areas of greatest risk. CMS also was not effectively implementing the controls it had in place. Furthermore, managers had not established performance standards for financial oversight activities, particularly their expenditure review activity. Limited data were collected to assess regional financial analyst performance in overseeing state internal controls and expenditures. In addition, the CMS audit resolution procedures did not collect enough information on the status of audit findings or ensure that audit findings were resolved promptly. CMS' current organizational structure lacks clear lines of authority and responsibility between the regions and headquarters.
Recommendations
Our recommendations from this work are listed below with a Contact for more information. Status will change
from "In process" to "Implemented" or "Not implemented" based on our follow up work.
Director:
Team:
Phone:
No director on record
No team on record
No phone on record
Recommendations for Executive Action
Recommendation: The CMS administrator should revise current risk assessment efforts in order to more effectively and efficiently target oversight resources towards areas most vulnerable to improper payments by collecting, summarizing, and incorporating profiles of state financial oversight activities, that include information on state prepayment edits, provider screening procedures, postpayment detection efforts, and payment accuracy studies.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: CMS currently collects some information on state program integrity efforts as part of compliance reviews that are conducted to assess whether state Medicaid program integrity efforts comply with federal requirements. Also, CMS is starting to develop strategies as part of the recently created Medicaid Integrity Program that include proposals for hiring contractors to assess states' program integrity activities. Because CMS is just starting these efforts and results are not known yet, we reiterated this recommendation in our June 2006 report (GAO-06-705). We will continue to follow up on this recommendation.
Recommendation: The CMS administrator should revise current risk assessment efforts in order to more effectively and efficiently target oversight resources towards areas most vulnerable to improper payments by incorporating information from reviews of state initiatives to prevent Medicaid fraud and abuse.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: CMS currently collects some information on state program integrity efforts as part of compliance reviews that are conducted to assess whether state Medicaid program integrity efforts comply with federal requirements. Also, CMS is starting to develop strategies as part of the recently created Medicaid Integrity Program that include proposals for hiring contractors to assess states' program integrity activities. Because CMS is just starting these efforts and results are not known yet, we reiterated this recommendation in our June 2006 report (GAO-06-705). We will continue to follow up on this recommendation.
Recommendation: The CMS administrator should revise current risk assessment efforts in order to more effectively and efficiently target oversight resources towards areas most vulnerable to improper payments by developing and instituting feedback mechanisms to make risk assessment a continuous process and to measure whether risks have changed as a result of corrective actions taken to address them.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: CMS has processes in place to identify risks, and management has established procedures to mitigate important risks, such as detailed reviews of certain high-risk issues. However, CMS's processes still do not have the elements of risk management that are key to assessing whether actions to mitigate risks need to be adjusted either because (1) they are not effective, (2) they are effective but need to be expanded, or (3) they are no longer needed because the risks have been resolved or reduced to a tolerable level. Therefore, we reiterated this recommendation in our June 2006 report (GAO-06-705). We will continue to follow up on this recommendation.
Recommendation: The CMS administrator should revise current risk assessment efforts in order to more effectively and efficiently target oversight resources towards areas most vulnerable to improper payments by completing efforts to develop an approach to payment accuracy reviews at the state and national levels.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Implemented
Comments: In July 2001, CMS initiated the Payment Accuracy Measurement (PAM) pilot project, now called the Payment Error Rate Measurement (PERM) project, to comply with the Improper Payments Information Act of 2002. Under the PERM program, states use a CMS-developed methodology to measure state Medicaid payment errors. By fiscal year 2007, CMS plans to have a national Medicaid payment error rate based on a sample of states and claims within those states. States will be expected to ultimately reduce their payment error rates over time by better targeting their activities to prevent and detect improper payments made to providers. These actions, which we consider substantially underway, help improve CMS's ability to ensure payment accuracy and address our recommendation.
Recommendation: The CMS administrator should restructure oversight control activities by increasing in-depth oversight of areas of higher risk as identified from the risk assessment efforts and applying fewer resources to lower risk areas.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Implemented
Comments: During our review in 2000-2001, CMS began a risk analysis process to identify Medicaid issues that put federal dollars at risk and address those issues by conducting focused financial reviews or referring the issues to HHS's OIG for review. We reported that in fiscal year 2000, CMS had only performed 8 focused financial reviews of high risk issues and identified about $45 million in disallowed costs. CMS has since taken several actions to increase in-depth oversight of high risk areas. CMS increased the number of focused financial reviews of high risk areas performed by its staff--about 57 reviews were conducted in fiscal years 2003-2005. The reviews conducted in fiscal years 2003 and 2004 resulted in CMS questioning or disallowing about $2.3 billion. Also, in 2004/2005, CMS hired about 90 new funding specialists who are helping CMS collect and summarize more information on states' Medicaid programs to further help CMS target its oversight efforts to high-risk issues such as certain payment arrangements that have been problematic in the past. A major activity of the funding specialists during their first year was the completion of state funding profiles to help CMS in its review and oversight of the states' financial issues. For example, the profiles include a "watch list" section where the funding specialists can highlight significant funding-related concerns that may need to be addressed in the future. These actions, which we consider substantially underway, address this recommendation.
Recommendation: The CMS administrator should restructure oversight control activities by incorporating advanced control techniques, such as data mining, data sharing, and neural networking, where practical to detect potential improper payments.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Implemented
Comments: CMS developed and implemented the Medicare-Medicaid (Medi-Medi) data match project. Under this data match program, CMS facilitates the sharing of information between the Medicaid and Medicare programs by matching Medicare and Medicaid claims information on providers and beneficiaries to identify improper billing and utilization patterns which could indicate fraudulent schemes. This project, which we consider substantially underway, has improved CMS's ability to oversee state Medicaid finances and specifically addresses this recommendation.
Recommendation: The CMS administrator should restructure oversight control activities by using comprehensive Medicaid payment data that states must provide in the legislatively mandated national Medicaid Statistical Information System database.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: CMS has not yet developed the ability to make MSIS data available for use by the financial analysts and funding specialists in their oversight activities. The MSIS database is very voluminous as it contains data on billions of claims. CMS officials said they plan to make these data more accessible in the future. Because CMS has not yet incorporated use of MSIS in its oversight activities, we reiterated this recommendation in our June 2006 report (GAO-06-705). We will continue to follow up on this recommendation.
Recommendation: The CMS administrator should develop mechanisms to routinely monitor, measure, and evaluate the quality and effectiveness of financial oversight, including audit resolution, by collecting, analyzing, and comparing trend information on the results of oversight control activities particularly deferral and disallowance determinations, focused financial reviews, and technical assistance.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Implemented
Comments: CMS improved and expanded the tools that it uses to track the results of its financial management activities. CMS uses several tracking reports--the Financial Management Activities Report (FMAR), the Financial Issues Report, and the Financial Performance Spreadsheet. The FMAR, which CMS has used since we last reported, tracks the amount of regional office resources (staff time, personnel costs, and travel costs) spent on the various categories of activities in the financial management workplans. In fiscal year 2005, CMS revised its Financial Issues Report to improve its ability to track all questionable state claims identified by regional financial analysts and funding specialists in financial management reviews and any other activities that resulted in a disallowance or deferral of state claims, including findings from OIG reports. In addition, in fiscal year 2006, CMS created the Financial Performance Spreadsheet, which is the CMS tool for tracking its progress toward a newly established performance goal for fiscal year 2006 to resolve 10 percent of the cumulative amount of questioned claims for federal reimbursement. These actions, which we consider substantially underway, help improve CMS's ability to monitor, measure, and evaluate its financial oversight activities and address this recommendation.
Recommendation: The CMS administrator should develop mechanisms to routinely monitor, measure, and evaluate the quality and effectiveness of financial oversight, including audit resolutions, by using the information collected above to assess overall quality of financial management oversight.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Implemented
Comments: In fiscal year 2006, CMS established a mechanism for using the information collected on its financial management activities to assess the overall effectiveness of its oversight. For example, CMS established a goal for fiscal year 2006 aimed at reducing questionable federal reimbursement--the goal is to resolve 10% of the cumulative amount of questioned state claims. The Financial Issues Report which tracks all questionable state claims identified by regional financial analysts and funding specialists in financial management reviews and any other activities that resulted in a disallowance or deferral of state claims, including findings from OIG reports and the Financial Performance Spreadsheet, will help CMS track its progress in achieving the goal and provide a quantifiable measure to evaluate its oversight activities. These actions, which we consider substantially underway, help improve CMS's ability to monitor, measure, and evaluate its financial oversight activities and address this recommendation.
Recommendation: The CMS administrator should develop mechanisms to routinely monitor, measure, and evaluate the quality and effectiveness of financial oversight, including audit resolution, by identifying standard reporting formats that can be used consistently across region for tracking open audit findings and reporting on the status of corrective actions.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: CMS did not agree with this recommendation on audit tracking. During the course of our 2005/2006 audit, we coordinated with CMS regional office staff on open audit findings and the status of corrective actions for fiscal year 2004 OIG audits completed under the interagency agreement. The staff provided us with a current status on open audit findings that we inquired about. We will continue to follow up on this recommendation.
Recommendation: The CMS administrator should develop mechanisms to routinely monitor, measure, and evaluate the quality and effectiveness of financial oversight, including audit resolution, by revising Division of Audit Liaison audit tracking reports to ensure that all audits with Medicaid related findings are identified and promptly reported to the regions for timely resolution.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: CMS did not agree with this recommendation. During the course of our 2005/2006 audit, we coordinated with CMS regional office staff on open audit findings and the status of corrective actions for fiscal year 2004 OIG audits completed under the interagency agreement. The staff provided us with a current status on open audit findings that we inquired about. We did not obtain updated information from the Division of Audit Liaison in CMS's central office as to whether they have changed their audit tracking processes. We will continue to follow up on this recommendation.
Recommendation: The CMS administrator should establish mechanisms to help ensure accountability and clarify authority and internal control responsibility between regional office and headquarters financial managers by including specific Medicaid financial oversight performance standards in senior managers' performance agreements.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: Implemented
Comments: CMS provided us with senior CMSO managers' performance plans for fiscal year 2006 and they include goals for improving financial management. They specifically state that managers are responsible for achieving the goal of reducing by 10 percent the amount of cumulative, questioned federal reimbursement. According to CMS, it will continue to hold managers accountable for the goal of reducing questionable reimbursement each fiscal year. During our review, CMS also provided us with copies of performance plans for regional financial managers. Their plans included specific goals and performance standards, such as assuring completion of a specified number of focused financial reviews and funding source reviews. These actions, which we consider substantially underway, address this recommendation.
Recommendation: The CMS administrator should establish mechanisms to help ensure accountability and clarify authority and internal control responsibility between regional office and headquarters financial managers by developing a written plan and strategy, which clearly defines and communicates the goals of Medicaid financial oversight and responsibilities for implementing and sustaining improvements.
Agency Affected: Department of Health and Human Services: Centers for Medicare and Medicaid Services
Status: In process
Comments: Medicaid officials said that they have several documents that articulate their plans and strategy. However, CMS still lacks a published, comprehensive plan that describes the many aspects of its Medicaid Financial Management strategy and its plans for continuing and sustaining its recent improvement efforts. Therefore, we reiterated this recommendation in our June 2006 report (GAO-06-705). We will continue to follow up on this recommendation.
