Medicaid: CMS Oversight and Guidance Could Improve Recovery Audit Contractor Program
Fast Facts
Medicaid has been on GAO's High Risk List since 2003, partly due to concerns about its fiscal oversight.
Medicaid has a program to identify and recoup overpayments. But Medicaid hasn't studied whether including managed care payments in this program would be cost effective—even though managed care makes up more than half of Medicaid expenditures. Managed care plans use federal and state Medicaid funds to pay providers for services.
Agency officials said there aren't plans to include managed care payments because states individually decide if such audits would be cost effective for them. Our recommendations address this issue.
Participation in the Medicaid Recovery Audit Contractor Program in FY 2021
Highlights
What GAO Found
The Patient Protection and Affordable Care Act established the Medicaid Recovery Audit Contractor (RAC) program to identify overpayments and underpayments and recoup overpayments. The act allowed the Centers for Medicare & Medicaid Services (CMS) to permit exceptions and exemptions to Medicaid RAC program requirements. GAO's review found that 34 states and the District of Columbia did not participate in this program during fiscal year 2021. Most states cited having other program-integrity initiatives as the reason for requesting an exemption, as shown in the table.
Reasons for State Exemption from the Medicaid Recovery Audit Contractor Program in Fiscal Year 2021
|
Reasons for exemption approved by Centers for Medicare & Medicaid Services |
Number of states not-participating in the program for exemption reason (population: 35 states)a |
|---|---|
|
State has other program integrity initiatives |
25 |
|
State could not procure a recovery audit contractor |
22 |
|
State Medicaid population is predominantly enrolled in managed care |
20 |
Source: GAO analysis of the 50 states' and the District of Columbia's state plan amendments. | GAO-23-106025
aStates include the District of Columbia. In addition, states may have more than one reason for exemption, but any single approved reason could result in a full exemption.
CMS did not consistently establish or communicate the expiration of its approvals for full exemption from the Medicaid RAC program. CMS officials stated that it is their process to not give states a permanent full exemption, but instead include a 2-year expiration date on their approval. However, CMS does not have written procedures for documenting and monitoring expiration dates. GAO found nine states without a CMS-documented expiration date, and an additional 18 nonparticipating states with expired approvals. As a result, CMS may not be determining whether states warrant full exemptions and may be missing opportunities to collect overpayments.
CMS has an opportunity to improve the program by conducting a cost-effectiveness study on including managed care, which is a system in which states make fixed payments to managed-care plans to provide health care services. Since 2011, CMS has not determined whether the inclusion of managed care payments in the Medicaid RAC program would be cost effective. However, states that have elected to use recovery audit contractors to review managed care have reported collecting overpayments, including one selected state that reported collecting more than $177 million in overpayments in 1 year. This suggests that RACs' review of managed care claims could result in recoveries. If CMS were to conduct a study to determine the cost-effectiveness of expanding the program to include managed care, the federal government may identify additional opportunities to recover Medicaid overpayments.
Why GAO Did This Study
Medicaid has been on GAO's High Risk List since 2003, in part due to concerns about the adequacy of fiscal oversight.
GAO was asked to review the Medicaid RAC program. This report (1) describes the status of states' use of the program, (2) evaluates CMS's oversight of states' Medicaid RAC programs, and (3) evaluates any opportunities for CMS to improve the program.
To do so, GAO analyzed statutes, regulations, policies, guidance, and CMS reports related to recovery audit contractors. GAO examined certain documents covering the Medicaid RAC program for all states and the District of Columbia, during fiscal year 2021 and interviewed CMS and state officials from a nongeneralizable sample of 11 states.
Recommendations
GAO is making four recommendations, including that CMS establish and implement written policies and procedures to document and communicate an expiration date for full exemption from the Medicaid RAC program, and conduct a cost-effectiveness study to determine whether states should include payments to managed care organizations as part of the program. CMS concurred with two, partially concurred with one, and disagreed with one of GAO's recommendations. GAO continues to believe that all of the recommendations are warranted.
Recommendations for Executive Action
| Agency Affected | Recommendation | Status |
|---|---|---|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should establish and implement written policies and procedures to document and communicate an expiration date when approving SPAs that have a full exemption from the RAC program. (Recommendation 1) |
In its comments on our draft report, the Department of Health and Human Services (HHS) stated that it concurred with the recommendation and that its Centers for Medicare & Medicaid Services (CMS) will work to establish and implement written policies and procedures to document and communicate an expiration date to Recovery Audit Contractor (RAC) programs exemption state plan amendments (SPA). In January 2024, HHS provided us a copy of CMS's new procedures (dated October 3, 2023) for documenting timeframes for RAC SPAs. These new procedures state that CMS will grant full RAC program exceptions for a two-year period to states that submit requests to CMS to completely waive the RAC program requirement. In addition, these new procedures state that CMS will communicate to states the expiration date (i.e., the two-year period) when approving SPAs for those states that have requested a full exemption from the RAC program. Specifically, CMS will confirm that the timeframe of the expiration date is included in the states' SPA pages. We believe CMS's corrective actions address our recommendation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should establish and implement written policies and procedures for the agency to monitor SPA expiration dates. (Recommendation 2) |
In its comments on our draft report, the Department of Health and Human Services (HHS) stated that it concurred with this recommendation and that its Centers for Medicare & Medicaid Services (CMS) will work to establish and implement written policies and procedures for the agency to monitor state plan amendment (SPA) expiration dates. In January 2024, HHS provided us a copy of CMS's new procedures (dated October 3, 2023) for monitoring SPA expiration dates. As part of their monitoring activities, CMS staff are required to (1) initiate an outreach process for states with expiring Recovery Audit Contractor (RAC) programs six months prior to the expiration to allow states enough time to prepare for the submission and to forward reminders to the states; (2) copy the branch manager on all related emails; and (3) request a meeting with the state if the RAC SPA is not submitted timely, with additional follow up as needed. We believe CMS's corrective actions address our recommendation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS, in collaboration with the states, should describe the effectiveness of the RAC program and include recommendations, if any, for expanding or improving the program in their annual report to Congress. (Recommendation 3) |
In its comments on our draft report, HHS stated that it partially concurred with this recommendation. Specifically, CMS stated that it concurs with the recommendation to make information available to expand or improve the Recovery Audit Contractor (RAC) program. CMS stated it plans to add certain information to the annual Medicare and Medicaid Program Integrity Report to Congress. This added information includes a breakdown of the states with full or partial exemptions, and promising state practices in RAC administration that other states may use when determining if and how to administer a RAC program. CMS further stated its current identification of RAC overpayment recoveries in the report already satisfies the statutory requirement to report on the effectiveness of states' Medicaid RAC programs. We agree that the reporting of RAC overpayment recoveries is important for determining the effectiveness of the Medicaid RAC program. However, Congress and other external stakeholders do not have other important information that would help them monitor how well the Medicaid RAC program is identifying and reducing improper payments. One such metric is a breakout of overpayments collected, underpayments restored, and amounts overturned on appeal. CMS's planned actions would help meet the intent of our recommendation, if effectively implemented. In November 2023, CMS issued its fiscal year 2022 report to Congress that included information on the number of states with CMS approved exceptions to Medicaid RAC implementation as well as information on the recovery of overpayments. Additionally, in January 2024, HHS stated that beginning with the fiscal year 2023 report to Congress, CMS is planning to include a breakdown of the states with full or partial exemptions, and promising state practices, if any. HHS stated that CMS is tentatively targeting to release the fiscal year 2023 report to Congress in fall of 2024. We will continue to monitor CMS's actions to address this recommendation.
|
| Centers for Medicare & Medicaid Services | The Administrator of CMS should conduct a study to determine whether it is cost effective to require states to include payments to managed care organizations and their providers as part of the RAC program. (Recommendation 4) |
In its comments on our draft report, CMS stated that it disagreed with this recommendation. CMS said that states are permitted to tailor their Recovery Audit Contractor (RAC) programs to their specific needs and environment. In addition, CMS said states have many other ways to oversee managed care improper payments. While CMS suggested that we remove our recommendation, we stand by our suggested course of action. CMS already has established a framework that allows states to request exemptions from the RAC program to address their specific needs and environment, irrespective of whether managed care is required to be included in Medicaid RAC program. CMS further stated that it must be mindful of time and resources, and that conducting a study regarding the cost-effectiveness of requiring all states to include managed care in their RAC programs may not be the most efficient use of time and resources. CMS stated that many states with large managed care populations have reported that the contingency fee payment methodology is not financially feasible for managed care encounters. While it is important that CMS use its resources efficiently, it is also essential that states use Medicaid funds effectively. CMS plays a key role in helping ensure that states make Medicaid payments appropriately. As part of this role, CMS can determine whether including managed care payments in the RAC program would be cost effective for the overall program. If the RAC scope was to include managed care claims, this could generate sufficient revenue to support a RAC program. Therefore, we continue to believe that our recommendation for CMS to conduct a cost-effectiveness study is valid. In March 2024, HHS reiterated its position and stated the current regulatory flexibility allows states to review managed care encounters if they determine it to be appropriate, and HHS believes this flexibility is critical to the Medicaid RAC framework. We will continue to monitor CMS's actions to address this recommendation.
|