Medicaid Financial Management
Better Oversight of State Claims for Federal Reimbursement Needed Gao ID: GAO-02-300 February 28, 2002The Medicaid program spent more than $200 billion in fiscal year 2000 to meet the health care needs of nearly 34 million poor, elderly, blind, and disabled persons. States are responsible for making proper payments to Medicaid providers, recovering misspent funds, and accurately reporting costs for federal reimbursement. At the federal level, the Centers for Medicare and Medicaid Services (CMS) oversee state financial activities and ensure the propriety of expenditures reported for federal reimbursement. GAO found that weak financial oversight by CMS leaves the program vulnerable to improper payments. The Comptroller General's Standards for Internal Control in the Federal Government requires that agency managers perform risk assessment, take steps to mitigate identified risks, and monitor the effectiveness of those actions. The standards also require that authority and responsibility for internal controls be clearly defined. CMS oversight had weaknesses in each of these areas. As a result, CMS did not know if its control efforts were focused on areas of greatest risk. CMS also was not effectively implementing the controls it had in place. Furthermore, managers had not established performance standards for financial oversight activities, particularly their expenditure review activity. Limited data were collected to assess regional financial analyst performance in overseeing state internal controls and expenditures. In addition, the CMS audit resolution procedures did not collect enough information on the status of audit findings or ensure that audit findings were resolved promptly. CMS' current organizational structure lacks clear lines of authority and responsibility between the regions and headquarters.
RecommendationsOur recommendations from this work are listed below with a Contact for more information. Status will change from "In process" to "Open," "Closed - implemented," or "Closed - not implemented" based on our follow up work.
Director: Team: Phone:GAO-02-300, Medicaid Financial Management: Better Oversight of State Claims for Federal Reimbursement Needed
This is the accessible text file for GAO report number GAO-02-300
entitled 'Medicaid Financial Management: Better Oversight of State
Claims for Federal Reimbursement Needed' which was released on
February 28, 2002.
This text file was formatted by the U.S. General Accounting Office
(GAO) to be accessible to users with visual impairments, as part of a
longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the
printed version. The portable document format (PDF) file is an exact
electronic replica of the printed version. We welcome your feedback.
Please E-mail your comments regarding the contents or accessibility
features of this document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States General Accounting Office:
GAO:
Report to the Subcommittee on Government Efficiency, Financial
Management and Intergovernmental Relations, Committee on Government
Reform, House of Representatives:
February 2002:
Medicaid Financial Management:
Better Oversight of State Claims for Federal Reimbursement Needed:
GAO-02-300:
Contents:
Letter:
Results in Brief:
Background:
Objectives, Scope, and Methodology:
CMS Had Not Implemented a Risk-Based Approach and Effective Control
Activities for Financial Oversight:
Monitoring Activities Were Limited in Scope and Effectiveness:
Organizational Structure Impedes Effective Oversight:
Conclusion:
Recommendations for Executive Action:
Agency Comments and Our Evaluation:
Appendix:
Appendix I: Comments from the U.S. Department of Health and Human
Services' Centers for Medicare and Medicaid Services:
Related GAO Products:
Tables:
Table 1: Expenditure and Budget Forms Submitted by States:
Table 2: External Oversight Activities by Entity:
Table 3: Examples of State Medicaid Prepayment Reviews and Other
Prevention Efforts:
Table 4: Examples of State Postpayment Detection Activities and
Payment Accuracy Studies:
Table 5: Regional Office Oversight Activities :
Figures:
Figure 1: CMS Organization Chart:
Figure 2: Medicaid Financial Management and Oversight Process:
Figure 3: Change in Financial Analysts (FrEs) versus Change in Federal
Medicaid Expenditures 1992 and 2000:
Abbreviations:
CMS: Centers for Medicare and Medicaid Services:
CMSO: Center for Medicaid and State Operations:
DAL: Division of Audit Liaison:
DFM: Division of Financial Management:
DSH: Disproportionate Share Hospital:
FTE: full time equivalent:
HCFA: Health Care Financing Administration:
HHS: Department of Health and Human Services:
MCO: Managed Care Organization:
MSIS: Medicaid Statistical Information System:
OIG: Office of Inspector General:
OMB: Office of Management and Budget:
PARIS: Public Assistance Reporting Information System:
RO: Regional Office:
SCRIP: State Children's Health Insurance Program:
SSA: Social Security Administration:
[End of section]
United States General Accounting Office:
Washington, D.C. 20548:
February 28, 2002:
The Honorable Stephen Horn:
Chairman:
The Honorable Janet D. Schakowsky:
Ranking Member:
Subcommittee on Government Efficiency, Financial Management and
Intergovernmental Relations:
Committee on Government Reform:
House of Representatives:
The federal government and states share responsibility for the fiscal
integrity and financial management of the jointly funded Medicaid
program. During fiscal year 2000, the Medicaid program served about
33.4 million low-income families as well as certain elderly, blind,
and disabled persons at a cost of $119 billion to the federal
government and $88 billion to the states for program payments and
administrative expenses. States are the first line of defense in
safeguarding Medicaid financial management, as they are responsible
for making proper payments to Medicaid providers, recovering misspent
funds, and accurately reporting costs for federal reimbursement. At
the federal level, the Centers for Medicare and Medicaid Services
(CMS) is responsible for overseeing state financial activities and
ensuring the propriety of expenditures reported by states for federal
reimbursement.[Footnote 1]
How well states manage Medicaid finances and how well CMS oversees
state financial management are important concerns because of the size
and nature of the program. Audits of state Medicaid finances conducted
in accordance with the Single Audit Act of 1984, as amended, annually
identify millions of dollars in questionable or unallowable costs
incurred by state Medicaid agencies. In addition, annual financial
statement audits required under the Chief Financial Officers Act have
identified many internal control weaknesses in regards to CMS's
oversight of state Medicaid financial operations. In light of these
concerns, you requested that we review the adequacy of CMS's financial
oversight process for Medicaid. Our review assesses whether (1) CMS
has an adequate oversight process to help ensure the propriety of
Medicaid expenditures, (2) CMS adequately evaluates and monitors the
results of its oversight process and makes adjustments as warranted,
and (3) the current CMS organizational structure for financial
management is conducive to effectively directing its oversight process
and sustaining future improvements. This report responds to your
request.
Results in Brief:
Although CMS is responsible for overseeing the more than $100 billion
that the federal government expends annually for Medicaid, its
financial oversight has weaknesses that leave the program vulnerable
to improper payments. The comptroller general's Standards for Internal
Control in the Federal Government[Footnote 2] requires that agency
managers perform risk assessments, take actions to mitigate identified
risks, and then monitor the effectiveness of those actions. In
addition, the standards provide that agencies should ensure that the
organizational structure is designed so that authority and
responsibility for internal controls are clear. CMS oversight had
weaknesses in each of these areas.
Our review found that CMS had only recently begun to assess areas of
greatest risk for improper payments, and thus did not have controls in
place that focused on the highest risk areas. As a result, CMS did not
have the requisite assurance that its control activities were focused
on areas of greatest risk. CMS also was not effectively implementing
the controls it had in place. For example, analysts across the 10
regions did not consistently conduct focused financial reviews that
are beneficial in identifying unallowable costs in specific Medicaid
service areas; only 8 such reviews were conducted in fiscal year 2000
as compared to 90 reviews in fiscal year 1992, which CMS attributes to
lack of resources. Recognizing its oversight deficiencies and resource
constraints, CMS began efforts in April 2001 to develop a risk-based
approach and revise its control activities. These efforts did not,
however, integrate information available from state financial
oversight program activities or consider other control techniques that
could enable CMS to more efficiently and effectively carry out its
oversight responsibilities.
Our review also found that CMS had few mechanisms in place to
continuously monitor the effectiveness of its oversight. Managers had
not established performance standards for financial oversight
activities, particularly their expenditure review activity. Limited
data were collected to assess regional financial analyst performance
in overseeing state internal controls and expenditures. In addition,
the CMS audit resolution procedures did not collect sufficient
information on the status of audit findings or ensure that audit
findings were resolved promptly.
The current organizational structure of CMS has created challenges to
effective oversight because of unclear lines of authority and
responsibility between the regions and headquarters. Although the 10
regional offices are the CMS frontline defense in overseeing state
financial management and Medicaid expenditures, there are no reporting
relationships to the headquarters unit responsible for Medicaid
financial management. As a result, CMS lacks consistency in its
approach to establish and enforce standards, evaluate regional office
oversight, and implement changes to improve financial oversight.
Improving the oversight of Medicaid finances will require commitment
from top-level managers to formulate a workable financial management
strategy, ensure accountability for its implementation, and allocate
sufficient resources. This report makes recommendations on ways CMS
can revise its risk assessment efforts, restructure its financial
control activities, improve monitoring, and address accountability and
authority issues posed by its organizational structure.
In written comments on a draft of this report, CMS outlined a series
of actions it has planned or recently begun to address its Medicaid
financial management challenges. CMS stated that these efforts
substantially address, within current resource constraints, the four
areas of our recommendations. In supplementary oral comments, however,
CMS did not agree with our recommendations related to audit tracking
and resolution reports, stating that the current reports are adequate.
We disagree that the reports are adequate given the omission of
information from the reports on the status of numerous audit findings
and believe that CMS needs to work cooperatively with the HHS-OIG to
ensure that its audit tracking information is current and complete.
Accordingly, we continue to believe that CMS should take steps to
ensure that tracking reports provide agency management with the
necessary information to determine that actions are taken promptly to
prevent Medicaid financial management weaknesses from continuing.
Additional details on CMS comments and our assessment of its position
appear in the Agency Comments and Our Evaluation section at the end of
this report.
Background:
CMS, a component of the Department of Health and Human Services (HHS),
administers the Medicaid program. Medicaid is the third largest social
program in the federal budget and is one of the largest components of
state budgets. Although it is one federal program, Medicaid consists
of 56 distinct state-level programs-one for each state, territory,
Puerto Rico, and the District of Columbia.[Footnote 3]
Each of the states has a designated Medicaid agency that administers
the Medicaid program. The federal government matches state Medicaid
spending for medical assistance according to a formula based on each
state's per capita income. The federal share can range from 50 to 83
cents of every state dollar spent.
In accordance with the Medicaid statute and within broad federal
guidelines, each state establishes its own eligibility standards;
determines the type, amount, duration, and scope of covered services;
sets payment rates; and develops its administrative structure. Each
state Medicaid agency is also responsible for establishing and
maintaining an adequate internal control structure to ensure that the
Medicaid program is managed with integrity and in compliance with
applicable law. States are required to describe the nature and scope
of their programs in comprehensive written plans submitted to CMS-with
federal funding for state Medicaid services contingent on CMS approval
of the plans. This approval hinges on whether CMS determines that
state Medicaid plans meet all applicable federal laws and regulations.
At the federal level, the Center for Medicaid and State Operations
(CMSO) within CMS is responsible for approving state Medicaid plans,
working with the states on program integrity and other program
administration functions, and overseeing state financial management
and internal control processes. CMSO shares Medicaid program
administration and financial management responsibilities with the 10
CMS regional offices (RO). The Division of Financial Management (DFM),
within CMSO's Finance, Systems and Quality Group, has primary
responsibility for Medicaid financial management. DFM, in conjunction
with the 10 regions, establishes and maintains the internal control
structure for Medicaid financial management and state oversight.
As is the case for all major federal agency programs, the internal
control structure established by CMS for Medicaid should meet
requirements of Office of Management and Budget (OMB) Circular A-123,
Management Accountability and Control, and the Standards for Internal
Control in the Federal Government. According to Circular A-123,
management controls are the organization policies and procedures used
to reasonably ensure that programs are protected from waste, fraud,
and mismanagement and achieve their intended results. Establishing
good management controls requires, according to the circular, that
agency managers take systematic and proactive measures to implement
appropriate management controls, assess the adequacy of the controls,
identify needed improvements, and take corresponding corrective
action. The Standards for Internal Control in the Federal Government
includes five standards that provide a roadmap for agencies to
establish control for all aspects of their operations and a basis
against which agencies' control structures can be evaluated. The
standards are defined as follows:
* Control environment”creating a culture of accountability by
establishing a positive and supportive attitude toward improvement and
the achievement of established program outcomes.
* Risk assessment”performing comprehensive reviews and analyses of
program operations to determine if risks exist and the nature and
extent of the risks identified.
* Control activities”taking actions to address identified risk areas
and help ensure that management's decisions and plans are carried out
and program objectives are met.
* Information and communication”using and sharing relevant, reliable,
and timely financial and nonfinancial information in managing
operations.
* Monitoring”tracking improvement initiatives over time, and
identifying additional actions needed to further improve program
efficiency and effectiveness.
The internal control structure and financial oversight process that
CMS has designed for Medicaid includes activities for (1) approving
and awarding grants to make funds available to the states for the
efficient operation of the Medicaid program, (2) overseeing state
financial management and internal control processes, (3) ensuring the
reasonableness of budgets reported to estimate federal funding
requirements, and (4) ensuring the propriety of expenditures reported
for federal matching funds. DFM shares these responsibilities with
about 76 regional financial analysts and branch chiefs, who report to
their respective regional administrators. Figure 1 outlines CMS's
organizational structure related to Medicaid.
Figure 1: CMS Organization Chart:
[Refer to PDF for image]
Top level:
Department of Health and Human Services: Tommy Thompson, Secretary.
Second level, reporting to Department of Health and Human Services:
* Centers for Medicare and Medicaid Services: Thomas A. Scully,
Administrator;
* Center for Medicaid and State Operations: Dennis G. Smith, Director;
- Policy Coordination and Planning Group;
- Intergovernment and Tribal Affairs Group;
- Private Health Insurance Group.
Third level, reporting to Center for Medicaid and State Operations:
* Family and Childrens Health Program Group;
* Disabled and Elderly Health Program Group;
* Survey and Certification Group;
* Financial Systems and Quality Group;
- Division of Financial Management.
Fourth level, reporting to Centers for Medicare and Medicaid Services:
* Northeastern Consortium:
- New York Region;
- Philadelphia Region;
- Boston Region;
* Southern Consortium:
- Atlanta Region;
- Dallas Region;
* Western Consortium:
- Seattle Region;
- Denver Region;
- San Francisco Region;
* Midwestern Consortium
- Chicago Region;
- Kansas City Region.
[End of figure]
Regional financial analysts are key to CMS financial management
activities, as they are responsible for performing frontline
activities to oversee state financial management and internal control
processes. Some of the key oversight activities performed by regional
analysts are (1) reviewing state quarterly budget estimates and
expenditure reports, (2) preparing decision reports that document
approvals for federal reimbursement and reimbursement deferral
actions, (3) providing technical assistance to states on financial
matters, and (4) serving as liaison to the states and audit entities.
DFM staff in headquarters rely on regional decision reports to help
determine and issue state grant awards.
States submit various federal reporting forms that provide regional
financial analysts with the budget and expenditure data to execute
their financial management and oversight responsibilities. When the
State Children's Health Insurance Program (SCHIP) was created through
the Balanced Budget Act of 1997 to provide health insurance to
children of low-income families who would not qualify for Medicaid,
states have been required to submit expenditure and budget data on
both Medicaid and SCRIP. The Medicaid and SCRIP forms are submitted
quarterly through the Medicaid and SCRIP Budget and Expenditure System
(MBES). See table 1 below for a brief description of the contents of
the reporting forms.
Table 1: Expenditure and Budget Forms Submitted by States:
Form: CMS 64 ” Quarterly Medicaid State Expenditures Report;
Description: The accounting statements that the state agency, in
accordance with 42 CFR 430.30(c), submits each quarter under Title XIX
of the Social Security Act. The expenditure report shows how the state
expended its federal Medicaid grant funds for the quarter being
reported as well as any adjustments to expenditures, which relate to
previous quarters. It is a summary of actual expenditures derived from
source documents including invoices, cost reports, and eligibility
records.
Form: CMS 37 ” Quarterly Medicaid Program Budget Report;
Description: A financial report submitted by the state in accordance
with 42 CFR 430.30(b). The report provides the state's Medicaid
funding requirements for a certified quarter and estimates the
underlying assumptions for 2 fiscal years, current and budget. In
order to receive the federal share of state Medicaid expenditures,
referred to as the Federal Financial Participation (FFP), the state
must verify that the requisite matching state and local funds are, or
will be, available for the certified quarter.
Form: CMS 21 ” State Children's Health Insurance Program (SCHIP)
Statement of Expenditures for Title XXI;
Description: The accounting statement that the state submits each
quarter in accordance with Sections 2105 (e) and 2107 (b)(1) of the
Social Security Act. The statement is a summary of actual expenditures
derived from source documents including invoices, cost reports, and
eligibility reports.
Form: CMS 21 B ” State Children's Health Insurance Program (SCHIP)
Budget Report for Title XXI;
Description: A financial report submitted by the state in accordance
with Sections 2105 (e) and 2107 (b) of the Social Security Act. The
report provides a statement of the state's expenditure plan and
funding requirements for a certified quarter and estimates for 2
fiscal years, current and budget. States must verify that the
requisite matching state and local funds are, or will be, available
for the certified quarter.
[End of table]
Reviews of the Medicaid and SCRIP expenditure reports (CMS 64 and 21)
are the primary oversight control activities performed by regional
financial analysts. These reviews are used to determine if Medicaid
expenditures are complete, properly supported by the state's
accounting records, claimed at appropriate federal matching rates, and
allowable in accordance with existing federal laws and regulations.
Regional analysts are expected to obtain knowledge about state
financial management and internal control processes to aid in
assessing the expenditures reported for federal reimbursement. Figure
2 shows an overview of the financial management and oversight process.
Figure 2: Medicaid Financial Management and Oversight Process:
[Refer to PDF for image: illustration]
State Medicaid Agency:
* Administers the program;
* Pays providers for Medicaid services.
* CMS 64 and CMS 21 expenditure reports to CMS;
* CMS 37 and CMS 21G budget reports to CMS.
CMS:
* Administers the program
* Awards matching payment grants to states for federal portion of
program funding ” initial, supplemental and final grant awards[A].
CMS Regional Offices (10):
* Review state budget reports;
* Review state expenditure reports for accuracy;
* Identify unallowable costs;
* Issue disallowance letters.
CMS Central Office CMSO-DFM:
* Approve and award grants after RO review of budget;
* Reconcile grant awards to expenditures after RO review of
expenditures;
* Award supplemental and final grants;
* Report financial data to CMS chief financial officer.
Health Care Providers:
* Health care providers[B] submit claims to state Medicaid agencies
for services provided to Medicaid beneficiaries.
[A] CMS transmits award amounts to HHS's Program Support Center.
States withdraw funds to pay the expenses of the Medicaid program.
[B] Health care providers include physicians, dentists, nurses, home
health care providers, rural health clinics, and nursing facilities.
[End of figure]
Oversight of state expenditures and internal controls by CMS regional
financial analysts is not the only federal oversight mechanism for
ensuring the propriety of Medicaid finances. Medicaid expenditures and
requisite internal controls are reviewed annually by auditors under
requirements of the Single Audit Act of 1984. The Congress established
the Single Audit Act to gain reasonable assurance that federal
financial assistance programs are managed in accordance with
applicable laws and regulations. The Single Audit Act requires audits
of state and local government entities that expend at least $300,000
in federal awards annually.[Footnote 4] The results of these audits
are provided to the state and responsible federal agency. The federal
agency is responsible for following up with the state to ensure that
the state takes action to correct the deficiencies identified from the
audit.
Other entities have responsibilities for routinely reviewing Medicaid
finances and Medicaid internal controls. Table 2 explains various
oversight activities by entities outside of CMS.
Table 2: External Oversight Activities by Entity:
Entity: HHS Office of Inspector General (HHS/0IG);
Oversight activity:
* HHS/OIG oversees the annual CFO financial statement audit of CMS,
which includes an audit of the Medicaid program's financial statements;
* HHS/OIG performs program and financial audits;
* HHS/OIG tracks open recommendations and performs follow-up inquiries.
Entity: State auditors;
Oversight activity:
* State auditors perform the state single audit in accordance with the
Single Audit Act;
* The auditors perform state audits and reviews.
Entity: State Medicaid agencies;
Oversight activity:
* State Medicaid agencies administer the Medicaid program to local
beneficiaries;
* The agencies pay the providers for Medicaid services;
* The agencies ensure proper payment and recovery of funds paid for
unallowable claims.
Entity: State Medicaid Fraud Control Units;
Oversight activity:
State Medicaid Fraud Control Units are responsible for investigating
and ensuring prosecution of Medicaid fraud.
Objectives, Scope, and Methodology:
Our objectives were to determine if (1) CMS has an adequate oversight
process to help ensure the propriety of Medicaid expenditures, (2) CMS
adequately evaluates and monitors the results of its oversight process
and makes adjustments as warranted, and (3) the current CMS
organizational structure for financial management is conducive to
effectively directing its oversight process and sustaining future
improvements.
To evaluate CMS financial oversight, the control activities used to
help ensure the propriety of Medicaid expenditures, and CMS's efforts
to monitor its financial oversight, we performed work at CMS regional
and headquarters offices, surveyed financial management staff, and
reviewed CMS manuals and other documentation, as well as audit reports.
* As agreed with your offices, we visited 5 of the 10 CMS regional
offices (Atlanta, Boston, Chicago, New York, and San Francisco) to
observe and interview the financial management staff. We selected the
five regions based on geographical dispersion across the country and
based on the total amount of Medicaid expenditures processed by each
region. The five regions were collectively responsible for overseeing
more than half of the total Medicaid expenditures for fiscal year
2000. We discussed recent program changes, which significantly
increased financial management oversight activities for regional
analysts. We questioned staff about the extent to which certain
activities, such as focused financial management reviews, were
conducted and reviewed any reports and corresponding workpapers that
were available. Key CMS financial managers at headquarters in
Baltimore were also interviewed to gain a comprehensive understanding
of overall financial management objectives for the Medicaid program.
We also discussed performance and budget reporting as well as efforts
to coordinate with state auditors.
* We administered a Web-based survey to regional financial management
members to gain a better understanding of the control activities being
performed by regional offices. The survey was sent to all regional
office branch chiefs and staff classified as financial analysts who
are responsible for overseeing state financial management and internal
controls for Medicaid. All of the 11 branch chiefs responded and 59 of
the 65 analysts responded, for a 92 percent response rate”the 6
analysts who did not respond were from one regional office. The survey
obtained information on how oversight for Medicaid financial
management is designed and implemented, as well as the frontline staff
perspective on effectiveness. Survey respondents answered questions
relating to review procedures performed, use of state single audits,
follow-up of audit findings, and communications with state auditors
and offices of inspectors general. Many of the questions asked the
analysts to respond based on their performance of activities for the
period from October 1, 1999, through the date of the survey. The
practical difficulties in conducting any survey can introduce errors,
commonly referred to as nonsampling errors. We included steps in both
the data collection and data analysis to minimize such nonsampling
errors. Multiple versions of the questionnaire were pretested with
regional financial analysts before the final survey was administered.
A 92 percent response rate was achieved, and the respondents directly
entered the responses into the database via the Internet survey. Data
checks were performed and a second independent analyst reviewed
computer analyses.
* We obtained and reviewed CMS documents and manuals that described
current financial oversight activities and performance reporting
previously used to monitor oversight. We reviewed audit reports that
included findings related to Medicaid financial management, including
the CMS/HCFA financial reports for fiscal years 1998 through 2000 and
Single Audit Act reports for fiscal years 1999 and 2000. To help judge
the adequacy of CMS's Medicaid financial management oversight process,
we evaluated CMS oversight against the comptroller general's Standards
for Internal Control in the Federal Government. We also consulted with
state auditors during our regional site visits to obtain an
understanding of their oversight activities for the Medicaid program,
including the level of audit coverage given to Medicaid financial
operations and the control techniques used.
To determine whether CMS's organizational structure for financial
management is conducive to effectively directing its oversight process
and sustaining future improvements, we interviewed the director and
deputy director of the CMSO Finance Systems and Quality Group as well
as managers within the Division of Financial Management. We also
conducted interviews with managers at the five regional offices. In
addition, we compared information that we gathered about the current
organizational structure, regional and central office communications,
and improvement initiatives with the standards for control environment
and information and communication components of internal control as
described in the Standards for Internal Control in the Federal
Government.
We performed our fieldwork from October 2000 through September 2001,
at the CMS central office in Baltimore, Md., and the five regional
offices mentioned above. We focused on the internal control processes
in place during fiscal years 2000 and 2001. All work was performed in
accordance with generally accepted government auditing standards. We
requested written comments on a draft of this report from the
administrator of CMS. These comments are reprinted in appendix I. We
also received supplementary oral comments from the Director of the CMS
Division of Audit Liaison.
CMS Had Not Implemented a Risk-Based Approach and Effective Control
Activities for Financial Oversight:
Although CMS is responsible for ensuring the propriety of over $100
billion expended annually by the federal government for Medicaid, its
financial oversight process did not incorporate key standards for
internal control necessary to reduce the risk of inappropriate
expenditures. The comptroller general's Standards for Internal Control
in the Federal Government requires that agency managers perform risk
assessments and then take actions to mitigate identified risks that
could impede achievement of agency objectives. However, until
recently, the oversight process that CMS used for Medicaid
expenditures did not include assessments that identified the areas of
greatest risk of improper payments. Therefore, CMS did not have the
requisite assurance that its control activities were focused on areas
of greatest risk. In addition, the controls that were in place were
not effectively implemented. As a result, CMS was not deploying its
limited oversight resources efficiently and effectively to detect
improper expenditures. CMS managers recognized the deficiencies of its
oversight and began efforts in April 2001 to develop a risk-based
approach and revise control activities. However, these efforts did not
specifically consider information on state financial oversight and
program integrity activities such as pre- and postpayment detection
methods, and payment accuracy studies and initiatives to prevent fraud
and abuse, or consider advanced control techniques for detecting
improper Medicaid payments.
CMS Did Not Use a Risk-Based Approach in Reviewing Expenditures:
Federal internal control standards require managers to perform risk
assessments to identify areas at greatest risk of fraud, waste, abuse,
and mismanagement. The standards require that once risks are
identified, they should be analyzed for their possible effect by
estimating their significance and assessing the likelihood of losses
due to the risks identified. Despite repeated auditor recommendations,
CMS had not developed and implemented a systematic risk assessment
method in its oversight process to help ensure that states expend
federal funds in accordance with laws and to identify amounts
inappropriately claimed for federal reimbursement. In April 2001, CMS
took action to develop a risk assessment; however, this analysis has
not yet been used to deploy resources to areas of greatest risk and
requires several improvements to enhance its usefulness in the
oversight process.
Since 1998, financial auditors responsible for the annual financial
statement audit of Medicaid expenditures have recommended that CMS
implement a risk-based approach for overseeing state internal control
processes and reviewing expenditures. In performing audits of CMS's
financial statements for fiscal years 1998, 1999, and 2000, auditors
have noted that CMS failed to institute an oversight process that
effectively reduced the risk that inappropriate expenditures could be
claimed and paid.[Footnote 5] In addition, the auditors identified
internal control weaknesses that increased the risk of improper
payments. These weaknesses included (1) a significant reduction in the
level of detailed analysis performed by regional financial analysts in
reviewing state Medicaid expenses, (2) minimal review of state
Medicaid financial information systems, and (3) lack of a methodology
for estimating the range of Medicaid improper payments on a national
level.
CMS Medicaid officials attributed most of the weaknesses identified by
the auditors to reductions in staff resources and the multiple
oversight activities that its staff is responsible for carrying out.
According to Medicaid financial managers, changes in the Medicaid
program since fiscal year 1998, specifically the addition of SCRIP,
created additional oversight responsibilities for CMS financial
management staff. Particularly, financial analysts are required to
handle more state inquiries regarding technical financial issues that
must be addressed promptly. At the same time, however, financial
analyst resources previously devoted to oversight activities declined.
Medicaid financial managers provided us with data to show that from
fiscal year 1992 to September 2000, full-time equivalent (FIT)
positions for regional financial staffs declined by 32 percent from 95
to approximately 65 FTEs. At the same time, federal Medicaid
expenditures increased 74 percent from $69 billion to $120 billion. On
average, each of the 64 regional financial analysts is now responsible
for reviewing almost $1.9 billion in federal Medicaid expenditures
each fiscal year as compared to an average of about $0.7 billion a
decade ago. Figure 3 depicts the decrease in financial analysts (i.e.,
FrEs) and the increase in Medicaid expenditures between the years 1992
and 2000.
Figure 3: Change in Financial Analysts (FTEs) versus Change in Federal
Medicaid Expenditures 1992 and 2000[A]:
[Refer to PDF for image: vertical bar graph]
Federal expenditures:
1992: $69 billion;
2000: $120 billion.
Number of analysts:
1992: 95 FTEs;
2000: 65 FTEs.
[A] The $120 billion in expenditures in 2000 is equal to $97.8 billion
in 1992 dollars when adjusted for inflation.
Source: CMS.
[End of figure]
Until recently, Medicaid financial managers had not taken action to
implement a risk-based approach for Medicaid financial oversight.
Managers stated that the Medicaid financial oversight process had been
based on the presumption that financial analysts adequately applied
the inherent knowledge of program risks acquired from years of
experience in reviewing state Medicaid expenditures and providing
technical assistance to states in operating their Medicaid programs.
However, as Medicaid program expenditures have increased, CMS managers
acknowledged that they needed to revise their oversight approach. As a
result, during our review, CMS began in April 2001 to develop a risk-
based approach for determining how best to deploy its resources in
reviewing Medicaid expenditures.
The Medicaid risk assessment effort required each regional office to
provide data on the states and territories in its jurisdiction based
on regional analyst experience and knowledge. For each type of
Medicaid service and administrative expense, the Medicaid risk
analysis estimates the likelihood of risk based on the dollar amount
expended annually and measures the significance of risk based on
factors such as unclear federal payment policy, state payment
involving county and local government, and results of federal audits.
The risk analysis provides a risk score for each state that is
intended to specify the Medicaid service and administrative expense
categories that are of greatest risk for improper payments in the
state.
Medicaid financial managers also tabulated a national risk score for
each type of Medicaid service and administrative expense using the
state risk scores. However, CMS had not taken steps to use the risk
analysis in deploying its regional financial oversight resources.
Medicaid financial managers in headquarters and the regional offices
plan to develop work plans that will allocate resources based on the
risks identified from its analysis. CMS expects to implement these
work plans in reviewing the state's quarterly expenditure reports for
fiscal year 2003.
In evaluating the Medicaid risk analysis, we considered strategies
that leading organizations used in successfully implementing risk
management processes. Two such strategies, which are included in our
executive guide, Strategies to Manage Improper Payments[Footnote 6]
are as follows.
* Information developed from risk assessments should help form the
foundation or basis upon which management can determine the nature and
type of corrective actions needed, and should give management baseline
data for measuring progress in reducing payment inaccuracies and other
errors.
* Management should reassess risks on a recurring basis to evaluate
the impact of changing conditions, both external and internal, on
program operations.
While the Medicaid risk analysis is a good start, we identified
several improvements that should be made to the assessment before it
is used in deploying resources. The issues we identified could hinder
the quality of baseline information gathered and, accordingly, affect
management's ability to thoroughly reassess risks and measure the
impact of corrective actions on a recurring basis. First, the analysis
does not sufficiently take into account state financial oversight
activities in assessing the risks for improper payments in each state.
Regional financial analysts were instructed to rate the adequacy of
each state Medicaid agency's financial oversight as one of the risk
factors in determining the likelihood and significance of risk in each
state. The analysts were instructed to consider whether a state
regularly reviews claims submitted by local government entities that
provide Medicaid services and whether state audits were conducted
regularly. However, the analysts were not specifically instructed to
consider states' use of (1) prepayment edits and reviews to help
prevent improper payments, (2) screening procedures to prevent
dishonest providers from entering the Medicaid program, (3)
postpayment reviews to detect inappropriate payments after the fact,
and (4) payment accuracy studies to measure the extent of improper
payments.
Several states have implemented cost-effective prevention efforts to
protect Medicaid program dollars, such as prepayment computer "edits,"
manual reviews of claims before payment, and thoroughly checking the
credentials of individuals applying to be program providers. Table 3
shows examples of prepayment reviews currently being used by some
states.
Table 3: Examples of State Medicaid Prepayment Reviews and Other
Prevention Efforts:
State: California;
State effort: Bars providers with previously questionable billing
patterns from submitting claims electronically and performs a manual
review before making payment. This saved more than $17 million in
fiscal years 1998 and 1999.
State: New Jersey;
State effort: Uses off-the-shelf software to analyze claims for
aberrant patterns before payments are made.
State: Washington;
State effort: Uses an on-line drug claims management system to
finalize pharmaceutical claims when the pharmacist fills the
beneficiary's prescription. The system screens for duplicate claims
and drugs requiring prior authorization, and provides alerts to such
factors as insufficient or excessive dosages and interactions with
other drugs. If appropriate, it approves payment.
State: Florida;
State effort: Requires providers such as physicians, pharmacists,
dentists, and others who are not employees of institutions like
hospitals to undergo fingerprinting and criminal background screening.
All officers, directors, managers, and owners of 5 percent or more of
a provider business must be screened. Fingerprints are checked with
both state and federal law enforcement agencies.
State: Connecticut, Florida, Georgia, and Texas;
State effort: Structure provider agreements so that they can terminate
providers from their program without cause, allowing for more
expeditious removal of providers who are billing inappropriately.
State: Florida and Texas;
Implement tighter enrollment standards”through enhanced background
checks. Recently required existing providers to reenroll under
stricter new standards.
State: New Jersey;
State effort: Institutes more stringent enrollment procedures for
provider categories with higher risk of payment problems, such as
pharmacies, independent laboratories, and transportation companies.
State: Florida, Georgia, and New Jersey;
State effort: Conduct preenrollment site visits, usually to higher-
risk provider types, such as pharmacies and durable medical equipment
suppliers.
Source: U.S. General Accounting Office, Medicaid: State Efforts to
Control Improper Payments Vary, GA0-01-662 (Washington D.C.: 2001).
[End of table]
Many states have also developed postpayment detection systems and
payment accuracy studies to improve their ability to detect,
investigate, and measure potential improper payments. Kentucky and
Washington, for example, have hired private contractors to develop or
use advanced computer systems to analyze claims payment data that
identified several million dollars in overpayments. Table 4 describes
these and other state postpayment efforts and related program savings.
Table 4: Examples of State Postpayment Detection Activities and
Payment Accuracy Studies:
Action: Automated claims processing systems;
State: Texas;
State effort: Uses a state-of-the-art system intended to integrate
detection and investigation capabilities, including "neural
networking," which helped identify potentially fraudulent patterns
from large volumes of medical claims and patient and provider history
data. In the first year of operation,Texas collected $2.2 million in
overpayments.
Action: Automated claims processing systems;
State: Kentucky;
State effort: Uses an advanced computer system to analyze claims
payment data. Using claims data from January 1995 through June 1998,
the contractor identified $137 million in overpayments.
Action: Automated claims processing systems;
State: Washington;
State effort: Uses an advanced computer system to analyze data. Since
the program started, the state has identified overpayments totaling
more than $2.95 million.
Action: Advanced technology and special investigative protocols;
State: New Jersey;
State effort: Conducted special audits of transportation services,
cross-matching data on transportation claims to beneficiary medical
appointments. Also audited pharmacies with abnormally large numbers of
claims for a newly covered, high-priced drug; audited the pharmacies'
purchases from wholesalers; and discovered pharmacies were billing for
larger amounts of this drug than had been shipped to them.
Action: Beneficiary alerts;
State: Multiple states;
State effort: Established hotlines that beneficiaries can use to
report suspected improprieties. Mail explanation-of-benefit statements
to beneficiaries to increase awareness of the services being billed.
Action: Payment accuracy studies;
State: Illinois;
State effort: Implemented payment accuracy studies that involved
reviewing medical records and interviewing patients to verify that
services were rendered and medically necessary. As a result, the state
identified key areas of weakness and targeted several areas needing
improvement. For example, because the Illinois payment accuracy review
indicated that nearly one-third of payments to nonemergency
transportation providers were in error, the Illinois Medicaid program
has taken a number of steps to improve the accuracy of payments to
this provider type.
Action: Payment accuracy studies;
State: Texas;
State effort: Developed a methodology for estimating payment accuracy
for acute medical care. In doing so, the state identified ways to
reduce improper payments through expanded use of computerized fraud
detection tools, such as matching Medicaid eligibility records with
vital statistics databases to avoid payments for deceased
beneficiaries.
Action: Payment accuracy studies;
State: Kansas;
State effort: Implemented payment accuracy studies that involved
reviewing medical records and interviewing patients to verify that
services were rendered and medically necessary. The payment accuracy
study recommended increased provider and consumer education, as well
as improvements to computerized payment systems. In addition, Kansas
officials undertook focused reviews of certain types of claims that
were identified as vulnerable to abuse.
Source: U.S. General Accounting Office, Medicaid: State Efforts to
Control Improper Payments Vary, GA0-01-662 (Washington D.C.: 2001).
[End of table]
While regional financial analysts may know about many activities like
these from performing their oversight responsibilities, analysts or
staff in the Division of Financial Management did not collect and
document information on the nature and results of each state's
financial oversight activities. Without such information being
documented, CMS did not have a complete picture or profile of the
level of risk for improper payments in each state and thus did not
have comprehensive information to determine the appropriate level of
federal oversight that should be applied.
A second deficiency we found in the Medicaid risk analysis is that it
did not specifically integrate information about state fraud and abuse
prevention efforts in making risk assessments for each state. Regional
financial analysts were instructed to report on the level of regional
oversight of each state's Medicaid finances as one of the risk factors
in determining the likelihood and significance of risk in each state.
Specifically, analysts were instructed to consider the last time the
regional office or HHS/OIG conducted a review or audit. However, the
analysts were not specifically instructed to consider results from
reviews of state efforts to prevent fraud and abuse recently conducted
under the CMS Medicaid Alliance for Program Safeguards.[Footnote 7]
In 1997, CMS established the Medicaid Alliance for Program Safeguards
staffed with program analysts from the 10 CMS regions and staff within
the Policy Coordination and Planning Group of the Center for Medicaid
and State Operations. The initiative was started to aid states in
their program integrity efforts. Since its inception, a fraud statute
Web site has been established and seminars on innovations and
obstacles in safeguarding Medicaid have been developed. In fiscal year
2000, regional staff conducted structured site reviews of program
safeguards in eight states, and in fiscal year 2001 reviews were
conducted in another eight states. Plans are to perform reviews in
additional states until all states are covered. These reviews examined
how state Medicaid agencies identify and address potential fraud or
abuse, whether state agencies are complying with appropriate laws and
regulations”such as how they check to ensure that only qualified
providers participate in the program”and potential areas for
improvement. CMS would gain valuable information from these reviews to
more accurately assess the level of risk for improper payments in
these 16 states and the appropriate level of federal oversight
required.
A third deficiency we found is that the Medicaid risk analysis did not
include mechanisms to ensure that such analysis would be conducted
continuously in directing financial oversight. Agency managers should
have methods in place to revisit risk analysis to determine where
risks have decreased and where new risks have emerged, as identified
risks are addressed and control activities are changed. As such, risk
analysis should be iterative. Medicaid financial managers had not
determined how they would continuously revise and update their
Medicaid risk analysis.
Finally, the Medicaid risk analysis would be strengthened if states
were systematically estimating the level of improper payments in their
programs. Identifying the dollar amount of improper payments is a
critical step in determining where the greatest problems exist and the
most cost-beneficial approach to addressing the problems. CMS
management has recognized this and has begun efforts to develop an
approach for estimating improper Medicaid payments. In September 2001,
nine states responded to a CMS solicitation to participate in pilot
studies to develop payment accuracy measurement methodologies. The
objective is to assess whether it is feasible to develop a single
methodology that could be used by the diverse state Medicaid programs
and to explore the feasibility of estimating the range of improper
Medicaid payments on a national level. Each of the nine states
involved is developing a different measurement methodology. CMS has
assigned a senior Medicaid manager with responsibility for directing
this effort. According to this manager, CMS has hired a consultant
experienced in program integrity reviews to oversee the state pilots.
CMS managers expect the states to complete the pilots during fiscal
year 2003, after which time the consultant and the Medicaid manager
plan to select several of the state methodologies as test cases for
fiscal year 2004. It is important that CMS continues to place emphasis
on development of these payment accuracy reviews on a state-by-state
basis and ultimately on a national level, since this is a key baseline
measure for managing improper payments in the Medicaid program.
Control Activities Were Not Effectively Implemented:
The comptroller general's Standards for Internal Control in the
Federal Government states that managers must establish adequate
control activities to address identified risks and ensure that program
objectives are met. Internal control activities are the policies,
procedures, techniques, and mechanisms that help ensure that
management's directives to mitigate risk are carried out. Control
activities are an integral part of an organization's efforts to
address risks that lead to fraud and error. For the Medicaid program,
both the states and federal government share responsibility for
ensuring that adequate control activities are in place. The control
activities that CMS had in place to oversee state internal controls
and help ensure the propriety of Medicaid expenditures were not
effectively implemented. Given the current level of resources and the
size and complexity of the program, a different approach is needed
that incorporates new oversight techniques and strategies, as well as
the results of the risk assessment discussed previously.
CMS regional financial analysts are tasked with performing multiple
control activities designed to (1) oversee state financial management
and internal control processes, (2) help ensure that states expend
federal funds in accordance with laws, and (3) identify amounts
inappropriately claimed for federal reimbursement. These activities
include providing technical assistance to states on a variety of
financial issues to help improve state accountability and help prevent
payment inaccuracies as well as examining state expenditures to defer
improperly supported payments and disallow those payments[Footnote 8]
that do not comply with Medicaid regulations. Analysts also are
responsible for following up on and resolving findings from audits
related to improper or questionable payments and weaknesses in state
internal controls. Table 5 summarizes the control activities that
regional analysts are responsible for carrying out.
Table 5: Regional Office Oversight Activities:
Financial analysis and review activities:
* Review state expenditure and budget reports.
* Prepare and submit regional decision reports summarizing the results
of expenditure and budget reviews.
* Identify, defer, and disallow unsupported and unallowable
expenditures.
* Perform focused financial management reviews of specific Medicaid
service and administrative expenditures.
* Perform audit resolution tasks and coordinate with state auditors
and HHS/OIG.
Technical assistance activities:
* Meet and interact with state Medicaid agency officials to provide
technical assistance on a variety of financial and administrative
policy issues.
* Review and assist CMS program analysts with analyzing the financial
aspects of plans submitted by states to amend their Medicaid program
or to obtain waivers of certain Medicaid provisions.
* Review plans submitted by states indicating how overhead and other
administrative costs are allocated (cost allocation plans) and plans
explaining state methodologies for claiming certain administrative
costs.
Note: Activities are performed for both Medicaid and SCHIP programs.
[End of table]
As Medicaid expenditures have grown and resources devoted to Medicaid
financial oversight have decreased, regional financial analysts have
faced significant challenges in monitoring state internal controls,
providing technical assistance, scrutinizing expenditures, and
following up on audit findings for all state Medicaid programs. In an
attempt to address these challenges, in 1994 regional offices began
refocusing oversight activities from emphasizing detailed review of
Medicaid expenditure data to increasing the level of technical
assistance provided to states. However, auditors of CMS financial
statements found that, as a result, regional offices were not
providing appropriate review and oversight of state Medicaid programs.
As mentioned previously, auditors have reported since 1998 that
regional offices significantly reduced or inconsistently performed
control activities to detect potential errors and irregularities in
state expenditures, thus increasing the risk that errors and
misappropriation could occur and go undetected. In our review, we
found that these weaknesses were still present.
In August 2001, we conducted a survey of regional financial analysts
to obtain their perspectives on the design and implementation of the
Medicaid financial oversight process, covering the period from October
1, 1999, through the date of the survey. In comments to the survey,
some regional analysts indicated that they were inundated with
responsibility for multiple control activities and unable to perform
them effectively. Our survey asked the analysts to rate each of the
control activities that they perform in terms of how important they
believe the activity is in overseeing state Medicaid programs. The
activity rated most important was quarterly expenditure reviews
performed on-site at state Medicaid agencies; 89 percent rated the
activity as having the "highest" or "high" level of importance-83
percent "highest" and 6 percent "high." However, when asked about the
adequacy in which they performed on-site expenditure reviews, almost
36 percent rated the adequacy of their performance "inadequate" or
"marginal"-13 percent inadequate and 23 percent marginal. In
discussions with regional financial analysts during our site visits
and in comments to our survey, many financial analysts attributed
deficiencies in quarterly reviews to inadequate staff resources, the
low priority placed on financial management oversight, lack of
training, and conflicting priorities.
During our site visits we interviewed 11 regional financial analysts
responsible for overseeing the five states that accounted for over $70
billion in Medicaid expenditures in fiscal year 2000. We reviewed
these analysts' workpapers related to their review of quarterly
expenditure reports submitted for the quarter ended December 31, 2000.
Workpapers prepared for three of the states to document their reviews
did not contain sufficient evidence that expenditures had been traced
to original documents. Instead, the analysts had checked information
against summary schedules prepared by the states. Without proper
documentation, there is little assurance that these reviews are being
adequately performed.
Survey respondents also rated activities to (1) defer and disallow
Medicaid expenditures and (2) perform in-depth analysis of specific
Medicaid costs where problems have been found (i.e., focused financial
management reviews) as important in overseeing the propriety of
Medicaid expenditures. Some 89 percent of analysts rated deferral and
disallowance determinations as having "highest" or "high" level of
importance and focused financial management reviews were rated by 77
percent as "highest" or "high." Data provided by CMS indicate,
however, that the amount of Medicaid expenditures disallowed by
regional analysts has declined in years after 1996, when oversight
emphasis shifted from detailed reviews, and so did the number of
focused financial management reviews conducted each year. For example,
from 1990 through 1993, analysts disallowed on average $239 million
[Footnote 9] annually in expenditures reported by states for federal
reimbursement. However, from fiscal years 1997 through 2000, analysts
disallowed on average about $43 million annually, which represents an
82 percent decline from previous years. Also, during these periods,
Medicaid expenditures went from an average of $58 billion annually to
$106 billion annually”an increase of 83 percent.[Footnote 10]
Similarly, focused financial management reviews have declined. Focused
financial management reviews generally involve selecting a sample of
paid claims for review related to certain types of Medicaid services
provided. These reviews have been useful in identifying unallowable
costs outside of those detected through the review of quarterly
expenditure reports as well as deficiencies in states' financial
management policies. According to CMS managers, in fiscal year 1992,
analysts performed approximately 90 in-depth reviews of specific
Medicaid issues that identified approximately $216 million in
unallowable Medicaid costs. In fiscal year 2000, analysts only
performed eight focused financial management reviews, but these
reviews resulted in almost $45 million in disallowed costs”an average
of about $5.6 million per review. As demonstrated, this control
activity is effective in detecting unallowable Medicaid costs;
however, it must be consistently performed for cost savings to be
discovered.
According to the director of DFM, the division is taking actions to
improve oversight by beginning a comprehensive assessment of CMS's
Medicaid oversight activities. The division would like to increase
several oversight activities, such as focused financial management
reviews, to address the risks identified in CMS's new risk-based
approach. However, Medicaid financial managers are concerned that
efforts to effectively address identified risks may be hindered
without additional oversight resources. In the interim, CMS plans to
use the current oversight process (i.e., quarterly expenditure reviews
and technical assistance) for targeting those Medicaid issues that the
new risk analysis identifies.
In assessing what steps CMS could take to more efficiently and
effectively carry out its responsibility on the federal level for
helping ensure the propriety of Medicaid finances, we considered
strategies that other entities have used in successfully addressing
risks that lead to fraud, error, or improper payments. As discussed in
our executive guide on strategies to manage improper payments, key
strategies include taking action to:
* select appropriate control activities based on an analysis of the
specific risks facing the organization, taking into consideration the
nature of the organization and the environment in which it operates;
* perform a cost-benefit analysis of potential control activities
before implementation to ensure that the cost of the activities is not
greater than the benefit; and;
* contract out activities to firms that specialize in specific areas
like neural networking, where in-house expertise is not available.
Our executive guide points out that many organizations have
implemented control techniques, including data mining, data sharing,
and neural networking, to address identified risk areas and help
ensure that program objectives are met. These techniques could help
CMS better utilize its limited resources in applying effective
oversight of Medicaid finances at the federal level.
Some state Medicaid agencies have already implemented data mining,
data sharing, and neural networking techniques to carry out their
responsibilities on the state level for ensuring Medicaid program
integrity.
State auditors and HHS/OIG staff have also had success using these
techniques in overseeing state Medicaid programs. However, resources
devoted to protecting Medicaid program integrity and the use of these
techniques varies significantly by state. From a federal standpoint,
CMS should take into consideration the control activities performed at
the state level in designing its Medicaid financial oversight control
activities. CMS should use the results from states that are already
using data mining, data sharing, and neural networking techniques in
determining the extent and type of control techniques that its
regional financial analysts should use in overseeing each state. And,
for states where these techniques are not being used, CMS should
consider using these tools in its oversight process.
As illustrated in the following examples, data mining, data sharing,
and neural networking techniques have been shown to achieve
significant savings by identifying and detecting improper payments
that have been made.
* Data mining is a technique in which relationships among data are
analyzed to discover new patterns, associations, or sequences. The
incidence of improper payments among Medicaid claims can, if
sufficiently analyzed and related to other Medicaid data, reveal a
correlation with a particular health care provider or providers. Using
data mining software, the Illinois Department of Public Aid, in
partnership with HHS/OIG, identified 232 hospital transfers that may
have been miscoded as discharges, creating a potential overpayment of
$1.7 million.
* Data sharing allows entities to compare information from different
sources to help ensure that Medicaid expenditures are appropriate.
Data sharing is particularly useful in confirming the initial or
continuing eligibility of participants and in identifying improper
payments that have already been made. We recently reported on a data
sharing project called the Public Assistance Reporting Information
System interstate match (PARIS) that has identified millions of
dollars in costs savings for states.[Footnote 11] PARIS helps states
share information on public assistance programs, such as Food Stamps
and eligibility data for Medicaid, to identify individuals who may be
receiving benefits in more than one state simultaneously. Using the
PARIS data match for the first time in 1997, Maryland identified
numerous individuals who no longer lived in the state but on whose
behalf the state was continuing to pay a Medicaid managed care
organization (MCO) as part of the MCO's prospective monthly payment.
The match identified $7.3 million in savings for the Medicaid program.
* Neural networking is a technique used to extract and analyze data. A
neural network is intended to simulate the way a brain processes
information, learns, and remembers. For example, this technique can
help identify perpetrators of both known and unknown fraud schemes
through the analysis of utilization trends, patterns, and complex
interrelationships in the data. In 1997, the Texas legislature
mandated the use of neural networks in the Medicaid program. Large
volumes of medical claims and patient and provider history data are
examined using neural network technology to identify fraudulent
patterns. The Texas Medicaid Fraud and Abuse Detection System used
neural networking to recover $3.4 million in fiscal year 2000.
Based on consultations with state auditors, we noted that some
auditors are performing audits that incorporate the advanced oversight
techniques described above. New York and Texas are instituting data
sharing and matching techniques at the state level to confirm initial
eligibility of Medicaid participants and to identify improper payments
that have already been made. Texas is using private contractors to
design, develop, install, and train staff to use a system intended to
integrate detection and investigation capabilities. This system
includes a neural network that will allow the state to uncover
potentially problematic payment patterns.
Similarly, a large portion of the audit work that the HHS/OIG conducts
to oversee the Medicaid expenditures for Massachusetts, Ohio, and
Maine is conducted through electronic data matches of Medicaid claims
data contained in the Medicaid Statistical Information System (MSIS).
MSIS is the primary source of Medicaid program statistical
information. As of the date of our report, 47 states were submitting
Medicaid data electronically to MSIS. Information that the HHS/OIG
finds as a result of electronic data matches is subsequently made
available to regions and states for additional detailed work.
CMS managers acknowledge that systems like MSIS could provide them
with the capabilities to implement more advanced control techniques.
While implementing control techniques such as data sharing, data
mining, and neural networking may require up-front investment of
resources, use of these techniques has the potential to result in
significant savings to the Medicaid program.
Monitoring Activities Were Limited in Scope and Effectiveness:
Having mechanisms in place to monitor the quality of an agency's
performance in carrying out program activities over time is critical
to program management. The federal internal control standard for
monitoring requires that agency managers implement monitoring
activities to continuously assess the effectiveness of control
activities put in place to address identified risks. Monitoring
activities should include procedures to ensure that findings from all
audits are reviewed and promptly resolved. The standards also state
that pertinent information should be recorded and communicated to
managers and staff promptly, to allow effective monitoring of events
and activities as well as to allow prompt reactions. However, CMS had
few mechanisms in place to continuously monitor the effectiveness of
its control activities in overseeing the Medicaid program and
collected limited information on the quality of Medicaid financial
oversight performance. Specifically, CMS had not established
performance standards to measure the effectiveness of its control
activities, in particular its expenditure review activity. In
addition, the CMS audit resolution process did not ensure that audit
findings were resolved promptly and did not collect sufficient
information on the status of audit findings. Without effective
monitoring, CMS did not have the information needed to help assure the
propriety of Medicaid expenditures.
Few Steps Were Taken to Monitor Performance:
DFM financial managers responsible for monitoring the effectiveness of
Medicaid internal control processes had established few mechanisms to
do so. CMS did not establish performance standards and did not analyze
or compare trend information on the results of its control activities,
including the amount and type of Medicaid expenditures deferred and
disallowed by regional analysts across all 10 regions.
Medicaid financial managers told us that, before 1993, CMS collected
information to monitor the performance of its oversight process. The
performance reporting process required each region to submit quarterly
data on:
* the amount of expenditures disallowed;
* the number of focused financial management reviews conducted, and
the related expenditures identified and recovered as a result of the
reviews;
* the amount of inappropriate expenditures averted by providing
technical assistance to states before payment;
* the number of regional financial analysts and related salary costs
devoted to financial oversight; and;
* the amount of travel dollars devoted to Medicaid financial oversight.
Medicaid financial managers in DFM used this information to prepare
national performance reports that calculated a return on investment
for each region and a national return on investment. CMS managers said
that they discontinued efforts to collect, analyze, and maintain
performance data after 1993 because of staff reductions in the regions
and headquarters.
DFM managers currently collect some performance information, but it is
not used to evaluate regional performance. For example, staff in DFM
collect information on the amount of expenditures deferred and
disallowed each quarter by each region. These data are used to adjust
total expenditures for financial reporting purposes but not to assess
regional oversight activities. DFM also maintains a spreadsheet that
includes information on the types of expenditures disallowed. This
information is not distributed to regional analysts. In addition,
information on the types of expenditures deferred by each regional
analyst is not consolidated and disseminated across regions. Regional
analysts include the types of expenditures deferred in their own
regional decision reports, but do not have the benefit of nationwide
information because DFM does not prepare summary reports.
Comprehensive information on the type of expenditures deferred and
disallowed would help identify the types of Medicaid expenditures for
which improper payments commonly occur and measure whether corrective
actions or control techniques applied to certain Medicaid expenditures
are effective in reducing improper payments.
The director of DFM told us that steps would be taken within the next
year to begin monitoring the effectiveness of the Medicaid financial
oversight process. Medicaid financial managers plan to reinstitute the
performance reporting process that was in place prior to 1993. While
this is a good step, the previous performance reporting process lacked
several elements necessary for effective internal control monitoring.
For example, the performance reporting process did not establish
agency-specific goals and measures for evaluating regional performance
in reducing payment errors and inaccuracies. In addition, there were
no formal criteria or standard estimation methodologies for regions to
use in measuring the amount of unallowable costs that the states
avoided because of technical assistance provided before payment. As
discussed in our executive guide, Strategies to Manage Improper
Payments, establishing such goals and measures is key to tracking the
success of improvement initiatives.
Audit Resolution Activities Are Not Effective:
Standards for Internal Control in the Federal Government requires that
agencies' internal control monitoring activities include policies and
procedures to ensure that audit and review findings are promptly
resolved. According to the standards, agency managers should implement
policies and procedures for reporting findings to the appropriate
level of management, evaluating the findings, and ensuring that
corrective actions are taken promptly in response to the findings. In
our review, we found that the audit resolution and monitoring
activities performed by CMS and its regional offices were limited. In
addition, we found that audit resolution activities were
inconsistently performed across regions. Further, pertinent
information was not identified, documented, and distributed among
those responsible for audit resolution. These conditions hamper CMS's
ability to resolve audit findings promptly and slow the recovery of
millions of dollars in federal funds due from the states.
Within CMS, three units share responsibility for audit resolution
activities related to the Medicaid program. These are regional
administrators and regional financial analysts, the Division of Audit
Liaison (DAL), and DFM.
Regional administrators and regional financial analysts have
responsibility to perform the following audit resolution activities
required by the HHS Grants Administration Manual:[Footnote 12]
* coordinate resolution of findings with the pertinent auditee (i.e.,
state Medicaid agency or providers);
* ensure that the related questioned costs due the federal government
are recovered within established timeframes;
* verify that corrective actions have been developed and implemented
for each finding; and;
* prepare quarterly reports documenting the status of audit resolution.
DAL is responsible for maintaining a tracking system for each audit
report and related findings, monitoring the timeliness and adequacy of
audit resolution activities, distributing all audit clearance
documents, and preparing monthly reports on the status of audit
resolution and collection activities. DFM has one headquarters staff
person responsible for coordinating and interacting with DAL and
regional analysts to ensure that Medicaid related findings are
resolved.
An important part of regional analyst audit resolution activities
involves following up on state Single Audit Act reports. Under the
Single Audit Act, state auditors issue reports that include
assessments of the internal controls related to major federal
programs, including the Medicaid program, and compliance with laws,
regulations, and provisions of contract or grant agreements. These
reports generally include findings related to weaknesses identified in
the financial management of state Medicaid programs as well as
expenditures deemed erroneous or improper (e.g., questioned costs) for
which states may owe money back to the federal government.
Regional analysts are responsible for resolving audit findings,
including determining whether the questioned costs related to audit
findings reported by state auditors represent actual costs to be
recovered from the state, and ensuring that they are actually
recovered. In our discussions with regional staff during our review of
state single audit findings, analysts admitted that they spend very
little time on resolving state audit findings due to competing
oversight responsibilities. Audit follow-up is one step of many
performed during their quarterly state Medicaid expenditure reviews.
As a result, state single audit findings are not always resolved, and
related questioned costs are not promptly recovered.
For example, we identified questioned costs totaling $24 million that
had not been recovered. The audit reports that included the $24
million in questioned costs had been issued for years prior to fiscal
year 1999. However, as of September 30, 2001, regional analysts had
not completed actions to recover these costs.
In addition, we found that, as of September 30, 2001, regional
analysts had not determined whether corrective actions had been
developed and/or implemented to resolve 85 of a total of 288 Medicaid
findings included in state single audit reports for fiscal year 1999.
These findings related to problems with state financial reporting,
computer systems, and cash management. Lack of timely follow-up on
financial management and internal control issues increases the risk
that corrective actions have not been taken by the auditee and
erroneous or improper payments are continuing to be made.
In our review, we also found that the regional financial analysts
inconsistently followed procedures for monitoring, tracking, and
reporting on the resolution of Single Audit Act and HHS/OIG audit
findings. For example, 3 of the 10 regions had not prepared quarterly
status reports that are intended to provide information on corrective
actions that states have taken to resolve audit findings.
Further, pertinent information was not identified, documented, and
distributed among those responsible for audit resolution. The internal
control standard related to information and communication provides
that pertinent information be identified, captured, and distributed to
the appropriate areas in sufficient detail and at the appropriate time
to enable the entity to carry out its duties and responsibilities
efficiently and effectively.
In our review, we found that the monthly report prepared by DAL that
is intended to provide a complete list of all audits with unresolved
Medicaid findings did not meet this standard. We analyzed a list
provided by the HHS/OIG, which included 23 Medicaid related reports
issued by the HHS/OIG and state auditors in fiscal year 2001. We found
four reports from the HHS/OIG list that were not included in DAL
monthly reports related to the second, third, and fourth quarters of
that year. This information is critical and must be distributed to the
regions to ensure that they are taking action to resolve all Medicaid
related findings.
We also found that the regions did not document information critical
to tracking unresolved audits in their regional quarterly status
reports. The regions reported which audits had been resolved. They did
not report information on audits that they were reviewing that had not
yet been resolved. This makes it difficult to track audit status.
Organizational Structure Impedes Effective Oversight:
A sound organizational structure is a key factor that contributes to
whether agency management can establish a positive control
environment. Standards for Internal Control in the Federal Government
provides that managers should ensure that an agency organizational
structure is appropriate for the nature of its operations and designed
so that authority and internal control responsibility is defined and
well understood. Although CMS's 10 regional offices are the federal
government's frontline for overseeing state Medicaid financial
operations and expenditures, there are no reporting lines to the
headquarters unit responsible for Medicaid financial management and
few other mechanisms to ensure performance accountability. This
structural relationship has created challenges in (1) establishing and
enforcing minimum standards for performing financial oversight
activities, (2) routinely evaluating the regional office oversight,
and (3) implementing efforts to improve financial oversight. As a
result, CMS lacks a consistent approach to monitor and improve
performance among the units that share responsibility for financial
management and ingrain a sound internal control environment for
Medicaid finances throughout CMS.
Many Oversight Weaknesses Are a Result of Current Structure:
During the time of our review, there were no formal reporting
relationships between the regional financial analysts and CMSO's DFM
or any other division or unit within CMSO. Regional offices reported
directly to the CMS administrator through their respective regional
administrators. This structural relationship does not lend itself to
instituting standards for oversight control activities that can be
consistently and effectively implemented.
To illustrate, the CMS financial management strategy workgroup, headed
by the director of DFM, updated guidance for expenditure reviews in
September 2000 to provide uniform review procedures and address
concerns raised by auditors about the inconsistency in expenditure
reviews across regions. While the guide strongly encouraged regional
analysts to complete all of its procedures, it did not mandate that
analysts do so. Headquarters financial managers do not have direct
authority to enforce such a directive and regional managers have
discretion in how resources are utilized. Similarly, the guide allowed
regional branch managers wide discretion in performing supervisory
review of regional analysts' expenditure review workpapers. The guide
provides that a supervisor can assure that the analysts' work measures
up to CMS requirements in the review guide by either directly and
selectively reviewing the work papers or by obtaining written or
verbal assurance from the reviewer that the procedures have been
completed. Supervisory reviews are a key internal control activity. By
allowing supervisors to satisfy this responsibility merely with verbal
assurance, CMS is minimizing the effectiveness of this basic control.
During our site visits, we found evidence that supervisory reviews
were not conducted. We reviewed regional analysts' workpapers related
to reviews of quarterly expenditure reports for five states submitted
for the quarter ended December 31, 2000. These five states represent
the largest states within the regions visited. Analysts' workpapers
for three of the five state quarterly expenditure reviews had no
evidence of supervisory "sign off' and, when asked if the supervisors
had reviewed the workpapers or discussed the results of the review,
the analysts said they had not.
The CMS organizational structure also hindered efforts to evaluate and
monitor regional office performance. Currently, there are few formal
requirements for regions to report to headquarters and CMS does not
collect, analyze, or evaluate consistent information on the quality of
regional financial oversight for Medicaid across the country. As
mentioned previously, efforts to monitor performance were discontinued
because regional staff resources were not available to collect and
submit the data to headquarters managers. Headquarters managers did
not have the authority to require regions to collect such data. As a
result, Medicaid financial managers in headquarters were not in a
position to provide formal feedback to region financial management
staff to improve their performance and therefore have not been in a
position to assess the effectiveness of Medicaid oversight activities.
The current organizational structure also poses challenges to
implementing corrective actions aimed at addressing oversight
weaknesses and improving accountability. Over the past 2 years,
headquarters financial managers have taken steps to develop and
implement improvements to the financial oversight process. As
previously mentioned, Medicaid staff are currently:
* developing risk analysis to identify expenditures of greatest risk,
* working with states to develop methodologies for estimating Medicaid
improper payments,
* developing work plans that guide efforts to allocate financial
oversight staff and travel resources based on the risk analysis, and;
* developing performance-reporting mechanisms.
Medicaid staff have also recently:
* formed a financial management strategy workgroup of headquarters and
regional financial management staff members to review the entire
Medicaid financial oversight process and determine the proper
structure for an adequate oversight process,
* updated its expenditure and budget review guides, and,
* gathered information on how regional financial analyst staff time is
allocated between oversight responsibilities.
Headquarters DFM managers recognize that regional office commitment is
critical to successfully implementing and sustaining its improvement
initiatives. The current structural relationship could diminish the
chances of such success. Headquarters managers expressed concern that
despite recent efforts to develop risk analysis and implement work
plans that allocate resources based on identified risks, regional
managers will still have the authority to decide how oversight
resources are used. Given the multiple oversight activities that
regional financial analysts are responsible for, headquarters managers
have no assurance that review areas included in the work plans will be
given priority in each region. Headquarters managers may experience
similar difficulties in reestablishing performance reporting.
According to one senior Medicaid manager, some regions have already
petitioned headquarters managers not to use data on the amount of
expenditures deferred and disallowed in gauging performance.
During our review, we asked regional financial analysts about several
recent improvement initiatives to gauge their knowledge of and
participation in such initiatives. Several analysts we spoke with
during site visits did not think the risk assessment effort was useful
because they felt that they were already aware of the risks within the
states that they were responsible for and did not need a formal
assessment to identify the risks. In addition, some said that they
resented the headquarters managers trying to tell them where they
needed to focus their efforts. In our survey, we asked regional
financial analysts to rate the importance of the risk assessment,
staff time allocation effort, and review guide updates to overall
financial oversight. Approximately 50 percent of survey respondents
thought the initiatives were of marginal or little importance. During
pretests of our survey, several analysts said they did not understand
the purpose of the initiatives, even though they had provided input.
According to the analysts, no one had communicated to them how the
information was going to be used.
In discussions with headquarters managers, they acknowledged that a
written plan or strategy, which describes the initiatives and the
responsibility for implementing them, is currently being drafted. Such
a plan or strategy could be very useful in soliciting regional analyst
support. More important, headquarters managers acknowledged that
performance accountability mechanisms for the regions are needed to
implement improvements successfully. CMS is currently planning some
changes that may improve mechanisms to hold CMS financial managers,
including regional managers and administrators, accountable for
critical tasks. A Restructuring and Management Plan recently developed
by the CMS chief operating officer seeks to add specific
responsibilities that are tied to specific agency goals into senior
managers' performance agreements. CMS has not determined how Medicaid
financial management oversight and the various aspects of oversight
responsibilities that can be evaluated will be included in the plan.
Inclusion of such information is key to establishing a sound internal
control environment for Medicaid finances throughout CMS.
Conclusion:
While CMS is taking steps to improve its financial oversight of the
Medicaid program, the increasing size and complexity of the program,
coupled with diminishing oversight resources, requires a new approach
to address these challenges. Developing baseline information on
Medicaid issues at greatest risk for improper payments and measuring
improvements in program management against that baseline are key to
achieving effective financial oversight. Determining the level of
state activities to monitor and control Medicaid finances is also
critical to CMS determining the extent and type of control techniques
as well as the amount of resources it must apply at the federal level
to adequately oversee the program. Establishing clear lines of
authority and performance standards for CMS oversight would also
provide for a more efficient, effective, and accountable Medicaid
program. CMS's ability to make the kind of changes that are needed
will require top-level management commitment, a comprehensive
financial oversight strategy that is clearly communicated to all those
responsible for program oversight, and clear expectations for
implementation of the changes.
Recommendations for Executive Action:
To strengthen Medicaid internal controls and the financial oversight
process that CMS has in place to ensure the propriety of Medicaid
finances, we make the following recommendations to the CMS
administrator.
Risk Assessment:
We recommend that the CMS administrator revise current risk assessment
efforts in order to more effectively and efficiently target oversight
resources towards areas most vulnerable to improper payments by:
* collecting, summarizing, and incorporating profiles of state
financial oversight activities, that include information on state
prepayment edits, provider screening procedures, postpayment detection
efforts, and payment accuracy studies;
* incorporating information from reviews of state initiatives to
prevent Medicaid fraud and abuse;
* developing and instituting feedback mechanisms to make risk
assessment a continuous process and to measure whether risks have
changed as a result of corrective actions taken to address them; and;
* completing efforts to develop an approach to payment accuracy
reviews at the state and national levels.
Financial Oversight Control Activities:
In addition, we recommend that the CMS administrator restructure
oversight control activities by:
* increasing in-depth oversight of areas of higher risk as identified
from the risk assessment efforts and applying fewer resources to lower
risk areas;
* incorporating advanced control techniques, such as data mining, data
sharing, and neural networking, where practical to detect potential
improper payments; and;
* using comprehensive Medicaid payment data that states must provide
in the legislatively mandated national MSIS database.
Monitoring Performance:
We also recommend that the CMS administrator develop mechanisms to
routinely monitor, measure, and evaluate the quality and effectiveness
of financial oversight, including audit resolution, by:
* collecting, analyzing, and comparing trend information on the
results of oversight control activities particularly deferral and
disallowance determinations, focused financial reviews, and technical
assistance;
* using the information collected above to assess overall quality of
financial management oversight;
* identifying standard reporting formats that can be used consistently
across regions for tracking open audit findings and reporting on the
status of corrective actions; and;
* revising DAL audit tracking reports to ensure that all audits with
Medicaid related findings are identified and promptly reported to the
regions for timely resolution.
Organizational Structure:
Finally, we recommend that the CMS administrator establish mechanisms
to help ensure accountability and clarify authority and internal
control responsibility between regional office and headquarters
financial managers by:
* including specific Medicaid financial oversight performance
standards in senior managers' performance agreements; and;
* developing a written plan and strategy, which clearly defines and
communicates the goals of Medicaid financial oversight and
responsibilities for implementing and sustaining improvements.
Agency Comments and Our Evaluation:
CMS provided written comments on a draft of this report (reprinted in
appendix I), as well as supplementary oral comments. In its written
comments, CMS outlined a series of actions it has begun to take to
address its Medicaid financial management challenges. In supplementary
oral comments, CMS disagreed with our recommendations related to its
audit tracking and resolution reports.
In outlining actions taken to address Medicaid financial management
challenges, CMS stated that its efforts substantially address, within
current resource constraints, the four areas of our recommendations.
CMS improvement efforts include (1) a structured financial workplan
process that has been incorporated into its formal Restructuring and
Management Plan, (2) actions to strengthen exchange of information
with state oversight agencies, and (3) pilot projects aimed at
clarifying authority and internal control responsibility between
regional and headquarters managers. As many of these efforts are in
the planning or early implementation stages, it is too soon to
conclude whether they will effectively address our recommendations and
improve Medicaid financial management. Additionally, given CMS
concerns about resource constraints, prioritizing the planned actions
and developing projected implementation schedules is key to ensuring
that progress is made toward improving Medicaid financial management.
In oral comments, CMS disagreed with our recommendations for
strengthening its audit tracking and resolution functions. Regarding
our recommendation to standardize the audit tracking reports among CMS
regions, CMS stated that although the current format of audit tracking
reports is not consistent across regions, the reports provide agency
management with sufficient information to ensure that audit findings
are resolved in a timely manner. We disagree. As stated in our report,
the current reporting formats did not provide CMS with sufficient
information to determine whether action had been taken to recover
approximately $24 million in questioned costs identified in audit
reports more than 2 years ago.
Regarding our recommendation to revise its audit tracking reports, CMS
stated that the reports are as complete as they can be given the
information that they receive from the HHS-OIG. CMS offered a number
of reasons for lack of complete data. CMS stated that the HHS-OIG does
not consistently provide timely copies of Medicaid audit reports or
make audit reports available on-line in a timely manner. Further, CMS
said that the reports do not contain the information it needs to enter
the report and related findings into the CMS tracking system properly,
such as audit findings categorized by type (i.e., questioned cost or
management related).
HHS/OIG officials acknowledged that they sometimes fail to send some
audit reports that CMS is responsible for tracking and resolving but
said that they attempt to provide reports promptly when CMS contacts
them. In our view, CMS and the HHS-OIG share responsibility in audit
resolution. Accordingly, we continue to believe that CMS needs to be
proactive in ensuring its tracking mechanisms promptly identify
Medicaid findings for resolution and in following up to ensure that
actions are taken to prevent Medicaid financial management weaknesses
from continuing.
As agreed with your office, unless you publicly announce the contents
of this report earlier, we plan no further distribution until 30 days
from its date. At that time, we will send copies to the chairmen and
ranking minority members of the Senate Committee on Governmental
Affairs and House Committee on Government Reform. We are also sending
copies of this report to the secretary of health and human services,
administrator of CMS, inspector general of HHS, and other interested
parties. Copies will also be made available to those who request them.
Please contact me or Kimberly Brooks at (202) 512-9508 if you or your
staff have any questions about this report or need additional
information. W. Ed Brown, Lisa Crye, Carolyn Frye, Chanetta Reed, Vera
Seekins, Taya Tasse, and Cynthia Teddleton made key contributions to
this report.
Sincerely yours,
Signed by:
Linda M. Calbom:
Director, Financial Management and Assurance:
[End of section]
Appendix I: Comments from the U.S. Department of Health and Human
Services' Centers for Medicare and Medicaid Services:
Department of Health and Human Services:
Centers for Medicare and Medicaid Services:
Administrator:
Washington, DC 20201:
February 4, 2002:
T0: Linda M. Calbom:
Director, Financial Management and Assurance:
General Accounting Office:
From: [Signed by] Thomas A. Scully:
Administrator:
Subject: General Accounting Office (GAO) Draft Report, Medicaid
Financial Management: Better Oversight Needed of State Claims for
Federal Reimbursement (GAO-02-300).
Thank you for the opportunity to review and comment on the above-
referenced report. We appreciate the work the GAO has done over a
period of a year in examining the financial oversight function in the
Medicaid program.
This report for the most part accurately reflects the information and
concerns that the Centers for Medicare & Medicaid Services (CMS):
conveyed to the GAO reviewers. It also appropriately highlights and
supports the actions in this area that CMS has initiated over the past
year. Over the past decade, the emphasis of CMS financial oversight
has shifted from reviews and disallowances to technical assistance on
collaborative program development efforts. Several years ago, CMS
recognized the need to strengthen our Medicaid financial management
program. We believe that CMS's efforts described below substantially
address, within current CMS resource constraints, the four areas of
GAO's recommendation.
Recommendation:
To strengthen Medicaid internal controls and the financial oversight
process that CMS has in place to ensure the propriety of Medicaid
finances, we recommend that the CMS Administrator:
1) Revise current risk assessment efforts in order to more effectively
and efficiently target oversight resources towards areas most
vulnerable to improper payments,
2) Restructure oversight control activities,
3) Develop mechanisms to routinely monitor, measure, and evaluate the
quality and effectiveness of financial oversight, including audit
resolution; and,
4) Establish mechanisms to help ensure accountability and clarify
authority and internal control responsibility between regional office
and headquarters financial managers.
CMS Response:
CMS has taken the following steps towards addressing this
recommendation.
Structured Financial Management (FM) Workplan Process. Beginning with
fiscal year (FY) 2002, CMS has instituted a structured FM work
planning process. Under the process, each regional office (RO) will
propose an annual FM Workplan describing the specific activities which
it will perform and be held accountable for throughout the fiscal
year. Each RO's workplan will be reviewed and approved through the
Regional Administrator, Consortium Administrators, and the Director of
the Center for Medicaid and State Operations (CMSO). The process
incorporates a comprehensive resource assessment effort and risk
assessment and analysis. Once the FM Workplan is established for each
year, each RO will submit a quarterly report to central office (CO)
that tracks FM activities and accomplishments. These reports will help
us evaluate how well the ROs are succeeding in meeting the workplan
objectives. The explicit goal in establishing the FM fiscal year
workplan is to strengthen CMS's Medicaid financial oversight by
establishing specific RO performance expectations, tracking related
actions and their results, and improving RO-CO communications and
consistency among ROs in financial oversight. This process will
facilitate the alignment of CO and RO management priorities in this
area, which in turn will strengthen accountability.
Focused financial reviews of identified high risk areas are a key
element of the new FM strategy. In the spring of 2001, CMS formally
assessed the risk of improper claiming of Federal Medicaid funds on a
state-specific, service-by-service basis. This formal risk assessment
provides a useful baseline and documents in a structured manner what
CMS already knew to be areas of risk. The FM strategy now being
implemented will emphasize focused FM reviews of high-risk areas;
onsite reviews of state quarterly expenditure reports where justified
by the magnitude of state spending or a history of claiming issues;
partnering with state and Federal audit agencies; and taking
additional steps to ensure that Federal reimbursement policies are
clearly articulated and understood. The CMS is updating FM review
guides on selected topics that will be shared with states as well as
used by our own RO staff. In this and other ways, CMS will emphasize
the states' own responsibility for ensuring the financial integrity of
their Medicaid programs and claims for Federal reimbursement.
As part of the continuing FM workplan process, risk assessment, and
analysis, we also intend to explore the use of data analysis
techniques and opportunities to maximize and incorporate the use of
the different data sources available. This would include the FM budget
and expenditure information as well as information obtained through
the Medicaid Statistical Information System (MSIS). Our goal would be
twofold: 1) to use such techniques and analysis as a tool to better
understand the FM environment and provide an improved oversight
mechanism; and 2) to better educate the staff both at the RO and
national levels regarding the FM activities, so that they may maximize
the use of scarce resources.
The structured FM workplan process described above has been
incorporated into CMS's formal Restructuring and Management Plan.
Relevant elements that are explicitly identified in the Plan include:
* improving coordination, consistency, and accountability between CO
and the ROs,
* implementing a CMSO pilot to improve CO/RO goal and resource
coordination,
* implementing a CMSO pilot to improve national reimbursement policy
consistency; and,
* improving the Medicaid and State Children's Health Insurance Program
(SCHIP) FM review process, including establishing specific RO workload
objectives and developing updated review protocols.
The Organizational Structure concerns expressed in the GAO report will
be addressed through these activities. We expect to continuously
evaluate the FM oversight function as we proceed in implementing these
initiatives.
FM Technical Advisory Group. In partnership with the National
Association of State Medicaid Directors, CMS is establishing a joint
state-Federal FM technical advisory group (TAG). Key TAG functions
will be working with CMS to improve current Medicaid FM strategies and
practices; identifying and following-up on cross-cutting issues which
require coordination with the Fraud and Abuse, Third Party Liability,
and other TAGs; and working with CMS to identify significant trends in
Medicaid financing and expenditures. To the extent feasible within
existing resource constraints, we also expect the FM TAG to explore
the use of data analysis techniques and opportunities in order to
maximize use of MSIS data.
Payment Accuracy Measurement. The CMS is committed to developing
methodologies for measuring Medicaid program improper payments on a
state-specific and national basis. The Medicare program has
systematically measured payment accuracy for several years, and the
GAO among others, has recommended systematic measurement of payment
accuracy in all major Federally assisted programs. The CMSO is
currently working with a technical consultant and 9 pilot states - to
be expanded to 15 in FY 2003 - to develop and test methodologies that
might be used by all states despite the wide variations in the program
from state to state.
Fraud and Abuse Activities. Under our National Medicaid Fraud and
Abuse Initiative (recently re-named the Medicaid Alliance for Program
Safeguards, or "Alliance"), the CMS ROs conduct program integrity
reviews of state fraud and abuse activities. These reviews focus on
state compliance with applicable program integrity statutes and
regulations and may also include a detailed assessment of the states'
strengths and vulnerabilities in this area. The information obtained
from these reviews may be relevant to the FM work planning process
described above, particularly with respect to risk assessment and
analysis. Therefore, we will ensure that the information and findings
obtained through these program integrity reviews are considered as
annual RO and national FM workplans are developed.
Partnership with State and Federal Financial Oversight Agencies. Every
state has one or more audit entities responsible for ensuring that
state expenditures, including those in the Medicaid and State Children
Health Insurance Program programs, are properly made and documented.
Furthermore, every Medicaid agency has a surveillance and utilization
review staff to pinpoint and pursue questionable provider claims and
agency payments. Finally, virtually all states operate a Medicaid
Fraud Control Unit, typically housed in the Attorney General's office,
to pursue instances of suspected Medicaid fraud. A key element of our
new FM strategy is to strengthen our working relationship and exchange
of information with these state entities.
In addition, over the last several years, we have developed a close
collaboration with the Department of Health and Human Services Office
of Inspector General. We intend to continue this relationship.
Finally, in cooperation with the American Public Human Services
Association, we plan to survey state Medicaid agencies this year in
order to identify specific ways to improve the usefulness of the
annual Single Audits performed by every state pursuant to the Single
Audit Act of 1984.
The new CMS FM strategy is comprehensive and explicitly addresses the
basic concerns described by the GAO in this report, notably risk
assessment and analysis, RO consistency and accountability, focused
financial reviews, and consideration of state audit, fraud and abuse,
and other pertinent activities. We intend to carefully consider the
GAO recommendations and will address them to the extent we can subject
to resource limitations.
We look forward to working with GAO on this and other issues.
[End of section]
Related GAO Products:
Strategies to Manage Improper Payments: Learning From Public and
Private Sector Organizations [hyperlink,
http://www.gao.gov/products/GAO-02-69G], Oct. 2001.
Public Assistance: PARIS Project Can Help States Reduce Improper
Benefit Payments [hyperlink, http://www.gao.gov/products/GAO-01-935],
Sept. 2001.
Internal Control Management and Evaluation Tool [hyperlink,
http://www.gao.gov/products/GAO-01-1008G], Aug. 2001.
Medicaid: State Efforts to Control Improper Payments Vary [hyperlink,
http://www.gao.gov/products/GAO-01-662], June 2001.
Medicaid in Schools: Improper Payments Demand Improvements in HCFA
Oversight [hyperlink, http://www.gao.gov/products/GAO/HEHS/OSI-00-69],
Apr. 2000.
Standards for Internal Control in the Federal Government [hyperlink,
http://www.gao.gov/products/GAO/AIMD00-21.3.1], Nov. 1999.
Medicaid Enrollment: Amid Declines, State Efforts to Ensure Coverage
After Welfare Reform Vary [hyperlink,
http://www.gao.gov/products/GAO/HEHS-99-163], Sept. 1999.
[End of section]
Footnotes:
[1] Until June 2001, CMS was known as the Health Care Financing
Administration (HCFA).
[2] U.S. General Accounting Office, Standards for Internal Control in
the Federal Government, [hyperlink,
http://www.gao.gov/products/GAO/AIMD-00-21.3.1] (Washington D.C.:
1999).
[3] Hereafter, all will be referred to as states.
[4] In some instances, states hire independent public accounting firms
to perform the state single audit.
[5] In some instances, these findings were included in the management
letters that accompanied the audited financial statements in fiscal
years 2000, 1999, and 1998.
[6] U.S. General Accounting Office, Strategies to Manage Improper
Payments: Learning From Public and Private Sector Organizations,
[hyperlink, http://www.gao.gov/products/GAO-02-69G] (Washington D.C.:
2001).
[7] Formally known as the National Medicaid Fraud and Abuse Initiative.
[8] A deferral is an action taken to withhold funds from the states
until additional clarification or documentation is received from the
states regarding Medicaid costs claimed. A disallowance is a
determination by CMS that a claim or portion of a claim by a state for
federal funds is unallowable.
[9] The calculation of this amount does not include $1.15 billion in
disallowances of Medicaid amounts for Disproportionate Share Hospital
(DSH) claims in fiscal year 1992 that resulted from a change in the
legislation related to DSH. Including this amount would increase the
average disallowance to $527 million for fiscal years 1990 through
1993.
[10] Expenditure and disallowance data provided by CMS.
[11] U.S. General Accounting Office, Public Assistance: PARIS Project
Can Help States Reduce Improper Benefit Payments (Washington D.C.:
2001).
[12] The Grants Administration Manual, issued by HHS, provides
guidance on implementing HHS policies on the administration of HHS
grants. Chapter 1-105 of the manual addresses the resolution of audit
findings.
[End of section]
GAO‘s Mission:
The General Accounting Office, the investigative arm of Congress,
exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO‘s commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO‘s Web site [hyperlink,
http://www.gao.gov] contains abstracts and full text files of current
reports and testimony and an expanding archive of older products. The
Web site features a search engine to help you locate documents using
key words and phrases. You can print these documents in their entirety,
including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as ’Today‘s Reports,“ on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
[hyperlink, http://www.gao.gov] and select ’Subscribe to daily E-mail
alert for newly released products“ under the GAO Reports heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. General Accounting Office:
441 G Street NW, Room LM:
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs Contact:
Web site: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]:
E-mail: fraudnet@gao.gov:
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director, NelliganJ@gao.gov:
(202) 512-4800:
U.S. General Accounting Office:
441 G Street NW, Room 7149:
Washington, D.C. 20548:
