GAO-23-105577: Payment Integrity: Additional Coordination Is Needed for Assessing Risks in the Improper Payment Estimation Process for Advance Premium Tax Credits
Summary
GAO report GAO-23-105577, "Payment Integrity: Additional Coordination Is Needed for Assessing Risks in the Improper Payment Estimation Process for Advance Premium Tax Credits," a report to congressional requesters dated March 2023. It states that for fiscal year 2022 the Department of Health and Human Services reported an estimated $256 million in improper payments for the federally facilitated marketplace. GAO found that all five selected state-based marketplaces exercised certain flexibilities in verifying eligibility for advance premium tax credits, but that the Centers for Medicare & Medicaid Services did not coordinate with the states to assess the risk of improper eligibility determinations. The report also examines whether CMS developed a reliable methodology to estimate improper payments in the program.
Summary drafted by a model from the document's text below and checked by script against that text before publication. It is a navigation aid, not a reading of what the document proves. Where AI is used
Cite this document
“GAO-23-105577: Payment Integrity: Additional Coordination Is Needed for Assessing Risks in the Improper Payment Estimation Process for Advance Premium Tax Credits.”
Original at www.gao.gov. Archived at Pandemic Darlings, https://pandemicdarlings.com/source-documents/gao-23-105577-payment-integrity-additional-coordination-is-needed-for-8052a995de/
, SHA-256 4028fed6cfee75d11291775c887235931e496a3e174d74f4fe070a8ffe867160.Full text
United States Government Accountability Office
Report to Congressional Requesters
PAYMENT
March 2023
INTEGRITY
Additional
Coordination Is
Needed for Assessing
Risks in the Improper
Payment Estimation
Process for Advance
Premium Tax Credits
GAO-23-105577
March 2023
PAYMENT INTEGRITY
Additional Coordination Is Needed for Assessing
Risks in the Improper Payment Estimation Process
Highlights of GAO-23-105577, a report to
for Advance Premium Tax Credits
congressional requesters
Why GAO Did This Study What GAO Found
To help taxpayers cover the cost of Control activities for preventing improper advance premium tax credit eligibility
health insurance premiums, PPACA determinations varied among the selected state-based marketplaces. Selected
provides advance premium tax credits states verified most key eligibility criteria for enrollment in the program using the
for individuals who meet certain Centers for Medicare & Medicaid Services’ (CMS) Federal Data Services Hub.
eligibility requirements. For fiscal year The Patient Protection and Affordable Care Act (PPACA) and CMS’s regulations
2022, the Department of Health and grant marketplaces flexibilities in the eligibility verification process. GAO found
Human Services (HHS) reported an that all five selected states exercised certain flexibilities in their eligibility-
estimated $256 million in improper verification processes, as detailed in the table below. However, CMS did not
payments for the federally facilitated
coordinate with the states to conduct a risk assessment to evaluate the likelihood
marketplace.
of improper eligibility determinations when exercising these flexibilities. As such,
GAO was asked to review advance states were not aware of residual risks—risks that remain after existing control
premium tax credit payment integrity activities have mitigated inherent risks—or whether additional risk-mitigation
efforts. This report examines (1) key strategies were needed. Until CMS coordinates with the states to identify any
control activities selected states and residual risks, neither CMS nor the states will know if additional guidance or other
CMS implemented to prevent providing actions are needed to mitigate these potential residual risks.
advance premium tax credits to
ineligible individuals through the state- State-Based Marketplaces’ Key Control Activities for Verifying Eligibility Requirements for the
based marketplaces and (2) the extent Advance Premium Tax Credit beyond Self-Attestation
to which CMS developed a reliable Key control activities beyond New
methodology to estimate improper self-attestation California Colorado Nevada Jersey Pennsylvania
Verifying identity on mail
payments in the program.
applications N Y Y Y Y
GAO analyzed policies and procedures Verifying residency N N N N N
for determining eligibility in plan year Identifying duplicate coverage
2022 from CMS, and selected states to through nonfederal employer-
sponsored insurance N N N N N
include those with the highest average
Identifying duplicate coverage
monthly payment amounts and those through Medicaid in other
with new and more established states N N N N N
marketplaces (California, Colorado,
Legend: N = Did not perform additional verifications; Y = Performed additional verifications
Nevada, New Jersey, and
Source: GAO analysis of the selected state’s information. | GAO-23-105577
Pennsylvania). GAO also reviewed
CMS’s improper payment estimation
methodology for the advance premium Although CMS has developed a reliable methodology to estimate improper
tax credit for fiscal year 2022. advance premium tax credit payments, it was limited to the 33 states that use the
federally facilitated marketplace and did not consider the 18 states that operate
What GAO Recommends their own. CMS has a process to engage with the states on the best way to
GAO is making two recommendations incorporate them into the improper payment measurement program and on the
to CMS to coordinate with the states to related requirements. However, CMS’s process does not consider residual risks
assess residual risks when estimating in the state-based marketplaces’ processes for verifying and determining
improper payments, and to determine if eligibility. Without additional coordination with these marketplaces that includes
additional guidance or actions are assessing and identifying any residual risks to which they may be vulnerable,
needed. HHS disagreed with GAO’s CMS’s process for estimating improper payments may not reflect significant
recommendations. GAO continues to program risks. As such, the resulting improper payment estimate may be
believe the recommendations are valid, incomplete and provide a less useful basis for developing effective corrective
as discussed in the report. action plans.
View GAO-23-105577. For more information,
contact Hannah Padilla at (202) 512-5683 or
padillah@gao.gov.
United States Government Accountability Office
Contents
Letter 1
Background 4
Selected States’ Control Activities Related to Preventing Ineligible
APTC Vary Due to Flexibility in CMS’s Regulations 9
CMS Has Not Developed a Comprehensive Methodology for
Estimating Improper APTC Payments, Identifying Root Causes,
and Developing Corrective Actions 19
Conclusions 23
Recommendations for Executive Action 23
Agency Comments and Our Evaluation 23
Appendix I Objectives, Scope, and Methodology 27
Appendix II Comments from the Department of Health and Human Services 31
Appendix III GAO Contact and Staff Acknowledgments 36
Table
Table 1: State-Based Marketplaces’ Key Control Activities for
Verifying Eligibility Requirements for the Advance
Premium Tax Credit beyond Self-Attestation 12
Figures
Figure 1: Eligibility Requirements for the Advance Premium Tax
Credit 5
Figure 2: Roles and Responsibilities for Operating the Advance
Premium Tax Credit (APTC) in State-Based
Marketplaces 6
Figure 3: Key Advance Premium Tax Credit (APTC) Eligibility
Information Available in the Federal Data Services Hub
(Hub) 10
Page i GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Abbreviations
APTC advance premium tax credit
CHIP Children’s Health Insurance Program
CMS Centers for Medicare & Medicaid Services
FFM federally facilitated marketplace
FTI Federal Tax Information
Hub Federal Data Services Hub
HHS Department of Health and Human Services
IRS Internal Revenue Service
OMB Office of Management and Budget
PIIA Payment Integrity Information Act of 2019
PPACA Patient Protection and Affordable Care Act
QLE qualifying life event
ROP reasonable opportunity period
SBM state-based marketplace
This is a work of the U.S. government and is not subject to copyright protection in the
United States. The published product may be reproduced and distributed in its entirety
without further permission from GAO. However, because this work may contain
copyrighted images or other material, permission from the copyright holder may be
necessary if you wish to reproduce this material separately.
Page ii GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Letter
441 G St. N.W.
Washington, DC 20548
March 9, 2023
The Honorable Mike Crapo
Ranking Member
Committee on Finance
United States Senate
The Honorable Jason Smith
Chair
Committee on Ways and Means
House of Representatives
In the United States, one option for purchasing health-insurance plans is
through marketplaces. To help individuals and their dependents pay the
premiums for these plans, the Patient Protection and Affordable Care Act
(PPACA) provides a premium tax credit to individuals who meet certain
income and other eligibility requirements. 1 Individuals may have the
federal government pay this credit to their health insurance issuers in
advance on their behalf, known as advance premium tax credits (APTC),
which lowers their monthly premium payments. 2
Under PPACA, states may elect to operate their own state-based
marketplace (SBM), or to use the federally facilitated marketplace (FFM)
that the Department of Health and Human Services (HHS) operates. 3
These marketplaces help individuals compare and choose among
insurance plans that participating private health care coverage issuers,
such as health insurance companies, offer. The Centers for Medicare &
Medicaid Services (CMS) within HHS is responsible for overseeing the
establishment of these SBMs and maintaining the FFM.
For fiscal year 2021, HHS reported outlays of APTCs, of approximately
$57.7 billion, for the FFM and SBMs, representing a significant financial
1Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended by the Health Care and
Education Reconciliation Act of 2010, Pub. L. No. 111-152, 124 Stat 1029 (Mar. 30, 2010).
In this report, references to the Patient Protection and Affordable Care Act include any
amendments made by the Health Care and Education Reconciliation Act.
2We use “issuer” when referring to an insurance entity that a state has certified and
licensed to engage in the business of insurance in that state.
3For plan years beginning January 2022, 18 states were operating an SBM and 33 were
using the FFM.
Page 1 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
commitment for the federal government and risk for improper payments.
Although HHS assessed its APTC program as susceptible to significant
improper payments, 4 both the HHS Office of Inspector General and GAO
have previously reported that CMS has not met specific requirements for
assessing, estimating, and reporting on improper payments related to the
program. 5
We previously reviewed CMS’s key control activities related to preventing
and detecting improper APTC payments in the FFM. 6 Based on that
review, we made several recommendations that addressed improving
control activities related to eligibility determinations and calculations of
APTCs. We focused that report and its related recommendations on the
FFM, not SBMs.
You asked us to review issues related to APTC payment integrity efforts.
This report examines (1) what key control activities, if any, selected states
and CMS designed and implemented to prevent providing APTCs to
ineligible individuals through the SBMs and (2) the extent to which CMS
has developed a reliable methodology to estimate improper APTC
payments, identify their root causes, and develop corrective actions.
To address our first objective, we selected five states (see below for
selection methodology) for review. We examined PPACA and its
implementing regulations, examined relevant federal internal control
standards 7 and leading practices for managing fraud risks in federal
4Although APTC is one of many payment streams within CMS’s overall administration of
the health insurance marketplaces, HHS has assessed it as an independent program for
purposes of improper payment estimation and reporting. As such, we refer to APTC as a
program in this report.
5GAO, Improper Payments: Improvements Needed in CMS and IRS Controls over Health
Insurance Premium Tax Credit, GAO-17-467 (Washington, D.C.: July 13, 2017); GAO,
Financial Audit: FY 2021 and FY 2020 Consolidated Financial Statements of the U.S.
Government, GAO-22-105122 (Washington, D.C.: Feb. 17, 2022); and Department of
Health and Human Services, Office of Inspector General, Department of Health and
Human Services Met Many Requirements, but It Did Not Fully Comply With the Payment
Integrity Information Act of 2019 and Applicable Improper Payment Guidance for Fiscal
Year 2021, A-17-22-52000 (Washington, D.C.: May 2022).
6GAO-17-467.
7GAO, Standards for Internal Control in the Federal Government, GAO-14-704G
(Washington, D.C.: September 2014).
Page 2 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
programs, 8 and identified key risks for which states and CMS may need
control activities. We focused on key control activities related to selected
states’ SBMs for plan year 2022. We evaluated CMS’s and selected
states’ policies, procedures, and other relevant documents, such as
interagency agreements and standard operating procedures.
We analyzed the extent to which these documents aligned with relevant
principles in Standards for Internal Control in the Federal Government 9
and leading practices in the Fraud Risk Framework. 10 Specifically, we
assessed the extent to which these documents aligned with the principles
related to assessing risks, designing control activities, and providing
effective information and communication. 11 The relevant leading practices
from the Fraud Risk Framework relate to identifying and assessing fraud
risks and designing and implementing specific control activities to prevent
and detect fraud. 12 We compared the key risks with the control activities
we identified to evaluate whether CMS and the selected states’ design of
key controls sufficiently addressed each key risk area.
For our review, we selected a nongeneralizable sample of five states from
the 15 that were operating an SBM in plan year 2021. To make our
selection, we considered several factors, including average monthly
APTC payments, marketplace longevity, and which insurance providers
offered plans throughout each state. Based on those considerations, we
selected California, Colorado, Nevada, New Jersey, and Pennsylvania,
which collectively covered approximately 72 percent of approximately 2.9
million APTC consumers enrolled in SBMs for the 2021 annual open-
enrollment period.
To address our second objective, we reviewed federal laws, including the
Payment Integrity Information Act of 2019 (PIIA), and Office of
8GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP
(Washington, D.C.: July 2015). This benchmark is commonly known as the Fraud Risk
Framework.
9GAO-14-704G.
10GAO-15-593SP.
11See app. I for a full list of principles, as outlined in Standards for Internal Control in the
Federal Government, reviewed as part of this work.
12We selected the leading practices from the Fraud Risk Framework that are most
relevant to this objective based on a review of selected states’ and CMS’s documents and
discussions with selected state officials responsible for making APTC eligibility
determinations.
Page 3 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Management and Budget (OMB) guidance to identify key criteria
agencies must meet when addressing improper payments, including
developing estimation methodologies, identifying root causes, and
developing corrective action plans. We compared these requirements
with CMS’s Exchange Improper Payment Measurement Sampling and
Estimation Methodology Plan to determine if CMS had developed a
reliable estimation methodology and appropriately executed it. Appendix I
provides additional details on our scope and methodology.
We conducted this performance audit from November 2021 to March
2023 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusion based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
Under PPACA, qualified individuals may use health care marketplaces to
Background enroll in qualified health plans and apply for financial assistance to offset
the costs of their coverage, including APTCs. Marketplaces determine the
amount of APTC for which individuals are eligible based on projected
family size and estimated household income for the year of coverage.
Those who choose to have some or all of the premium tax credit paid to
issuers on their behalf must reconcile the amount of the APTC with the
actual premium tax credit for which they are eligible on their income tax
returns for the year of coverage. Individuals whose premium tax credit is
more than their APTC for the year of coverage may claim this amount on
their tax return as a refundable tax credit that reduces their income tax
liability and results in a refund to the extent it is more than their tax
liability.
APTC Eligibility and To be eligible for APTCs, individuals must meet certain criteria, as shown
Qualifications in figure 1. Additionally, according to CMS guidance, before submitting an
online or phone application, an applicant must complete identity
proofing. 13
13For online applications, marketplaces (including the FFM and SBMs) employ a process
known as remote identity proofing to verify an individual’s identity. The verification
performed uses personal and financial history on file with a contracted credit-reporting
agency. The marketplaces’ online application process generates questions for individuals
initiating an online application, based on information on file with the contractor, that only
each individual is believed to likely know.
Page 4 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Figure 1: Eligibility Requirements for the Advance Premium Tax Credit
a
In order to apply and qualify for the APTC, an individual must first be enrolled in a qualified health
plan offered through the individual’s respective marketplace. The eligibility requirements shown above
only reflect those that pertain to an individual applying during the open enrollment period, as there
may be additional requirements during special enrollment periods.
b
An incarcerated individual who is awaiting disposition of charges is eligible for a qualified health plan.
c
Tax return reconciliation is completed for the household of the individual receiving advance
payments toward insurance premiums. In response to the COVID-19 pandemic, CMS released
guidance in July 2021 that granted flexibilities to the marketplaces’ processes for individuals who
failed to file tax returns and reconcile a previous year’s APTC, as CMS’s regulations generally
require. This guidance allows marketplaces to opt out of actions taken to terminate an individual’s
APTC due to filing status.
Responsibilities for CMS, the Internal Revenue Service (IRS), and the marketplaces
Administering APTCs in themselves each have responsibilities in administering APTCs in SBMs.
As previously discussed, CMS is responsible for overseeing the
SBMs
establishment of SBMs. States that elect to operate an SBM must apply
to CMS for approval. CMS will grant conditional approval contingent on a
state demonstrating its ability to perform all required SBM activities—
including to confirm that APTC recipients are meeting a variety of
eligibility requirements—and ongoing compliance with future guidance
and regulations.
In order to qualify for the APTC, individuals must enroll in a qualified
health plan a marketplace offers. 14 The law requires marketplaces to
verify certain application information to determine applicant eligibility for
enrollment and, if applicable, the APTC. A key factor in administering the
credit effectively and efficiently is enrollment-control activities, which
reasonably assure that only qualified individuals receive the premium tax
credit and any advance payments toward their insurance premiums. As
such, PPACA requires that certain applicant-submitted information
14According to CMS, individuals can apply for APTC as part of the qualified health plan
enrollment process.
Page 5 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
undergoes verification through either an electronic verification system or
another CMS-approved method.
SBMs generate a data-matching issue when there is an inconsistency
between applicant-submitted information and information reported from
trusted data sources. In order to resolve the data-matching issue, an SBM
grants an applicant temporary eligibility based on the applicant’s self-
attestation, and asks the applicant to provide additional information or
documentation to support it within a reasonable opportunity period (ROP).
Under certain circumstances, when an applicant is unable to provide
supporting documentation necessary to resolve the data-matching issue
within the ROP provided, an SBM may redetermine or terminate the
APTC and health plan coverage.
IRS is responsible for ensuring that individuals for whom the APTCs are
paid comply with their tax-filing requirements, including reconciling their
APTCs with their allowed premium tax credit on their tax returns for the
year of coverage. (See fig. 2 for a summary of roles and responsibilities.)
Figure 2: Roles and Responsibilities for Operating the Advance Premium Tax Credit (APTC) in State-Based Marketplaces
Key Requirements and PIIA defines an improper payment as any payment that should not have
Guidance on Agency been made or that was made in an incorrect amount (including
overpayments and underpayments) under statutory, contractual,
Payment Integrity Efforts
administrative, or other legally applicable requirements. This includes any
payment to an ineligible recipient, any payment for an ineligible good or
Page 6 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
service, any duplicate payment, any payment for a good or service not
received (except for such payments where authorized by law), and any
payment that does not account for credit for applicable discounts. 15
Further, PIIA requires agencies to treat any payments for which they find
insufficient or no documentation as improper in the risk assessment and
estimation process.
Among other things, PIIA also requires federal executive agencies to (1)
estimate the annual amount of improper payments for those programs
and activities identified as susceptible to significant improper payments,
(2) implement actions to reduce improper payments and set reduction
targets with respect to the risk susceptible programs and activities, and
(3) report on the results of addressing the requirements. 16
PIIA and OMB guidance together provide the specific requirements for
assessing, estimating, and reporting on improper payments. PIIA requires
each executive agency to produce a statistically valid estimate, or an
estimate whose methodology OMB has approved, of improper payments
made under any program identified as susceptible to significant improper
payments. In addition, agencies must describe the causes of improper
payments they identify, actions they have planned or taken to correct
those causes, and the planned or actual completion date of their actions.
Internal Control Standards An effective internal control system improves accountability and
and Fraud Risk transparency, provides feedback on how effectively an entity is operating,
and helps reduce risks affecting the achievement of the entity’s
Management
objectives. Standards for Internal Control in the Federal Government
provides managers with criteria for designing, implementing, and
operating an effective internal control system. 17 Components and
principles define these standards and explain why they are integral to an
entity’s internal control system. Management’s ongoing monitoring of the
internal control system is essential in helping internal control remain
1531 U.S.C. § 3351(4).
16PIIA defines significant improper payments as the sum of a program’s improper
payments and payments whose propriety cannot be determined due to lacking or
insufficient documentation that may have exceeded either $10,000,000 and 1.5 percent of
program outlays; or $100,000,000.
17GAO-14-704G.
Page 7 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
aligned with changing objectives, environments, laws, resources, and
risks.
The Fraud Risk Framework provides a comprehensive set of leading
practices for agency managers to develop or enhance existing efforts to
combat fraud in a strategic, risk-based manner. 18 The Fraud Risk
Framework helps federal program managers, along with their
stakeholders, meet their responsibilities for assessing and managing
fraud risks, as federal internal control standards require. In its Circular A-
123 guidelines, OMB has directed agencies to adhere to the Fraud Risk
Framework’s leading practices as part of their efforts to effectively design,
implement, and operate an internal control system that addresses fraud
risks. 19 The Fraud Reduction and Data Analytics Act of 2015, and its
successor provisions in PIIA, require OMB and agencies to incorporate
the Fraud Risk Framework’s leading practices into their guidelines and
controls, respectively. 20
18GAO-15-593SP.
19Office of Management and Budget, Management’s Responsibility for Enterprise Risk
Management and Internal Control, OMB Circular A-123 (Washington, D.C.: July 15, 2016).
20The Fraud Reduction and Data Analytics Act of 2015 (FRDAA), enacted in June 2016,
required OMB to establish guidelines for federal agencies to create controls to identify and
assess fraud risks and to design and implement antifraud control activities. Pub. L. No.
114-186, 130 Stat. 546 (2016). The act further required OMB to incorporate the leading
practices from the Fraud Risk Framework into the guidelines. Although Congress repealed
FRDAA in March 2020, PIIA requires these guidelines to remain in effect, subject to
modification by OMB as necessary and in consultation with GAO. See 31 U.S.C. § 3357.
Page 8 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Selected States’
Control Activities
Related to Preventing
Ineligible APTC Vary
Due to Flexibility in
CMS’s Regulations
Selected States Used the In order to verify certain key eligibility criteria, all five selected states we
Federal Data Services reviewed used their respective Medicaid state agencies and the Federal
Data Services Hub (Hub), which CMS developed. CMS made the Hub
Hub and Medicaid State
available to all marketplaces, both the FFM and SBMs, so that they may
Agencies to Verify Most perform required eligibility verifications in an automated manner. 21
Eligibility Criteria Marketplaces send applicant data to the Hub, which verifies individuals’
data against information in existing secure and trusted federal and state
databases. To prevent unauthorized individuals from creating
marketplace accounts using identities other than their own, the Hub also
uses a remote identity-proofing service. As shown in figure 3, most key
eligibility information is available through trusted data sources partnered
with the Hub.
2142 U.S.C. § 18081; 45 C.F.R. §§ 155.315, 155.320.
Page 9 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Figure 3: Key Advance Premium Tax Credit (APTC) Eligibility Information Available in the Federal Data Services Hub (Hub)
a
Although the Hub provides information on certain government-sponsored programs, marketplaces
must coordinate with their respective Medicaid state agencies to verify whether individuals have been
determined eligible for Medicaid or Children’s Health Insurance Program coverage within the state
where the marketplace operates.
b
In response to the COVID-19 pandemic, CMS released guidance in July 2021 that granted
flexibilities to the marketplaces’ processes for individuals who failed to file tax returns and reconcile a
previous year’s APTC, as CMS’s regulations generally require. This guidance allows marketplaces to
opt out of actions taken to terminate an individual’s APTC due to filing status.
Selected states generally used Hub services to verify an applicant’s
identity for online and phone applications, citizenship or lawful presence,
and incarceration status; to check for duplicate government-sponsored
coverage through TRICARE, the Veterans Health Administration, the
Peace Corps, Medicare, 22 or federal employers; and to verify that
individuals meet income requirements and are in compliance with
22TRICARE is the Defense Health Agency’s regionally structured health care program for
eligible military members and their dependents. The Veterans Health Administration
operates the Department of Veterans Affairs health care system. The Peace Corps
provides health benefits to individuals who perform work overseas on behalf of the federal
government. Medicare is the federally financed health insurance program for people aged
65 or older, certain individuals with disabilities, and individuals with end-stage renal
disease.
Page 10 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
applicable tax-filing requirements. 23 All five selected states coordinated
directly with their respective Medicaid state agencies to determine if an
individual was receiving or was eligible for coverage through Medicaid or
Children’s Health Insurance Program (CHIP). 24
Flexibilities in Eligibility In an effort to minimize administrative costs and burdens on marketplaces
Verification Requirements and applicants, PPACA and CMS’s regulations grant marketplaces
flexibilities in the verification process for certain eligibility criteria, such as
Led to Differing
allowing SBMs to accept self-attestation or opt to perform additional
Verification Processes levels of verification, based on the state’s discretion. According to CMS
among Selected States officials, this is in part due to whether reliable data sources are available
that would allow a marketplace to conduct additional levels of verification.
Additionally, SBMs may propose alternative methods to CMS for meeting
the eligibility verification requirements. 25 CMS has the authority to
determine whether alternative methods that SBMs propose are allowable
based on criteria described in CMS’s regulations. 26 We found that all five
selected states exercised certain flexibilities in their eligibility-verification
processes. However, none of the selected states conducted risk
assessments to evaluate the likelihood of improper APTC eligibility
determinations by exercising these flexibilities. As such, states were not
aware of any residual risks or whether additional risk-mitigation strategies
were needed. 27
According to federal internal control standards, management should
identify, analyze, and respond to risks related to achieving the defined
objectives. As part of these efforts, management conducts a risk
assessment to identify risks throughout the entity to provide a basis for
designing risk responses. According to the Fraud Risk Framework, it is a
23Colorado did not use the Hub’s service to check for duplicate federal employer-
sponsored coverage. However, it is coordinating with CMS to determine an appropriate
verification process for this criterion. Although New Jersey received incarceration data via
the Hub, New Jersey did not generate an inconsistency if the information did not match an
applicant’s attestation.
24Medicaid is a joint federal-state program that finances health care coverage for low-
income and medically needy individuals. CHIP finances health care coverage for children
whose household incomes are too high for Medicaid eligibility but may be too low for their
families to afford private coverage.
2545 C.F.R. § 155.315 and 45 C.F.R. § 155.320.
2645 C.F.R. § 155.315(h).
27Inherent risk is the risk to an entity prior to considering management’s response to the
risk. Residual risk is the risk that remains after management’s response to inherent risk.
Page 11 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
leading practice to plan regular fraud risk assessments and examine the
suitability of existing controls and prioritize residual risks. CMS does not
coordinate with the states to perform such risk assessments to identify
any residual risks and determine the potential effect these flexibilities may
have on preventing APTCs to ineligible individuals.
According to CMS officials, states have the legal authority to use these
flexibilities, as detailed below. Given the differences among SBMs, CMS
believes that states must determine how to best operate within federal
requirements. CMS officials said that CMS requires SBMs to conduct a
defined set of oversight activities, and tracks and monitors how SBMs
establish program integrity standards that comply with marketplace-
related policy and operational requirements set forth in statute,
regulations, and guidance. According to CMS agency officials, CMS
monitors SBM compliance with program integrity standards, including any
flexibilities provided, through regularly scheduled calls with SBM
leadership and staff. Additionally, CMS developed annual audit and
reporting requirements, which direct that SBMs attest to their compliance
with federal requirements, and provide supporting documentation for
certain eligibility and enrollment policies and procedures, including those
related to eligibility verifications.
Table 1 illustrates the key eligibility criteria we identified for which CMS
provides flexibilities within the verification process, and whether selected
states designed additional control activities for verifying such criteria.
Table 1: State-Based Marketplaces’ Key Control Activities for Verifying Eligibility Requirements for the Advance Premium Tax
Credit beyond Self-Attestation
Key control activities related to eligibility requirements
for the advance premium tax credit eligibility beyond
self-attestation California Colorado Nevada New Jersey Pennsylvania
Verifying eligibility criteria using the Federal Data Services Y Y Y Y Y
Hub (i.e., citizenship or lawful presence, incarceration status,
household income and family size, and compliance with tax
filing requirements)
Verifying identity on mail applications N Y Y Y Y
Verifying residency N N N N N
Identifying duplicate coverage through nonfederal employer- N N N N N
sponsored insurance
Identifying duplicate coverage through Medicaid or N N N N N
Children’s Health Insurance Program (CHIP) in other states
Verifying qualifying life events N Y Y N Y
Page 12 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Key control activities related to eligibility requirements
for the advance premium tax credit eligibility beyond
self-attestation California Colorado Nevada New Jersey Pennsylvania
Reverifying eligibility for required criteria periodically and Y N N Y Y
annually
Reverifying all key eligibility criteria periodically and annually N N N N N
for criteria that regulations do not specifically require
Legend: N = Did not perform additional levels of verification; Y = Performed additional levels of verification
Source: GAO analysis of the selected states’ information. | GAO-23-105577
As detailed below, CMS regulations and guidance allow flexibilities
related to the eligibility-verification process.
Verifying Identity on Mail According to the Fraud Risk Framework, it is a leading practice to conduct
Applications data matching to verify key information, including self-reported data and
information necessary to determine eligibility. However, CMS guidance
allows marketplaces to accept an applicant’s signature as proof of identity
on mail applications.
In our review, we found that selected states had different control activities
for verifying identities on mail applications. One selected state—
California—accepted a signature as proof of identity on mail applications.
The remaining four states opted to implement additional controls. 28
Specifically, three states—Colorado, Pennsylvania, and Nevada—entered
mailed applications into their respective online application systems and
coordinated with the applicants to complete the identity proofing. New
Jersey required applicants to provide supporting documentation (e.g., a
copy of a driver’s license) along with their mail applications. If an
applicant did not provide such documentation, New Jersey coordinated
with the applicant to complete the identity-proofing process.
Until CMS coordinates with the states to identify any residual risks related
to validating the identities of individuals who apply by mail, SBMs may not
be aware of potential vulnerabilities associated with inadvertently
enrolling ineligible individuals in qualified health plans.
Verifying Residency Individuals must reside in the marketplace service area to be eligible to
enroll in a qualified marketplace health plan. 29 CMS regulations allow
28Selected states generally indicated that the number of mail applications received each
year is low.
2945 C.F.R. § 155.305(a)(3).
Page 13 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
marketplaces to accept an applicant’s attestation as verification of
residency unless the information the applicant provides is not reasonably
compatible with other information that individual has provided or with
records of the marketplace or databases available to the SBM. 30 All five
selected states accepted applicant attestations. Until CMS coordinates
with the states to identify any residual risks related to verifying the
residencies of individuals, SBMs may not be aware of potential
vulnerabilities associated with enrolling ineligible individuals in qualified
health plans. 31
Identifying Duplicate Coverage Individuals eligible to receive affordable minimum essential coverage
through Nonfederal Employer- through either federal or nonfederal employers are not eligible for
Sponsored Insurance APTCs. 32 According to CMS regulations, marketplaces must verify
whether an applicant is eligible for qualifying coverage or reasonably
expects to be enrolled in an eligible nonfederal employer-sponsored plan
during the plan year by using approved data sources that are available to
the marketplace. If there is no data source available, marketplaces must
accept the applicant’s attestation, unless it is not reasonably compatible
with information that the marketplace obtained or the applicant provided. 33
None of the selected states performed independent verification of
applicant eligibility for duplicate coverage; 34 rather, all the selected states
accepted attestations as verification that individuals were not receiving
3045 C.F.R. § 155.315(d).
31GAO previously recommended that CMS assess and document the feasibility and
availability of obtaining sufficiently reliable data to verify individuals’ residencies. To
address this recommendation, CMS completed a feasibility study and stated that the
verification of individuals’ residences is not feasible. See GAO-17-467.
32See 26 U.S.C. § 36B(c)(2)(B).
33See 45 C.F.R. § 155.320(d).
34Previously, marketplaces were required to select a statistically random sample of
applicants when no electronic data sources are available to verify employer-sponsored
insurance. In anticipation of finalizing an evaluation of its employer-verification study, CMS
did not take enforcement action against marketplaces that did not comply with the random
sampling requirements for plan years 2020 through 2022. As a result of its evaluation,
CMS updated the regulations to remove the random-sampling requirements for plan years
beginning in 2023. It permitted each marketplace to design a verification process for
enrollment in or eligibility for an employer-sponsored insurance plan based on the
marketplace’s assessment of risk for improper APTC payments.
Page 14 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
duplicate coverage through a nonfederal employer. 35 Until CMS
coordinates with the states to identify any residual risks related to
identifying individuals who have minimum essential coverage from
nonfederal employers, SBMs may not be aware of potential vulnerabilities
associated with enrolling ineligible individuals in qualified health plans.
Identifying Duplicate Coverage Individuals eligible to receive minimum essential coverage through a
through Medicaid or CHIP in government-sponsored program, such as Medicaid or CHIP, are not
Other States eligible for APTCs. 36 CMS regulations require the state marketplaces to
verify whether individuals have been determined eligible for coverage
through Medicaid and CHIP within the state by using information obtained
from the agencies administering such programs. 37 All five selected states
assessed for enrollment or eligibility for Medicaid or CHIP within their
respective states, as required, and did not assess eligibility in other
states. 38 Until CMS coordinates with the states to identify any residual
risks regarding detection of duplicate coverage by Medicaid and CHIP in
states other than those in which individuals applied for coverage and
attested to residing, SBMs may not be aware of potential vulnerabilities
associated with providing APTCs to ineligible individuals.
Verifying Qualifying Life Events Generally, individuals may only enroll in qualified health plans during the
open enrollment period. However, CMS regulations require the
marketplaces to provide special enrollment periods for individuals who
experience a triggering qualifying life event (QLE), such as the loss of
minimum essential coverage. 39 This provides an opportunity for
individuals who experience certain major life changes to enroll in a
qualified health plan through the marketplaces outside of the annual open
35During our previous audit, CMS officials informed us that they have explored other
possible data sources to identify individuals receiving minimum essential coverage
through nonfederal employers, but they have been unable to identify comprehensive
electronic data sources that are sufficiently current and accurate to verify this criterion.
See GAO-17-467.
3645 C.F.R. § 155.305(f)(1)(ii)(B).
3745 C.F.R. § 155.320(b)(1)(ii).
38We previously recommended that CMS assess the feasibility for the FFM to identify
duplicate coverage for individuals receiving Medicaid and CHIP in FFM states outside of
the states where applicants attest to residing. See GAO-17-467. CMS subsequently
evaluated the feasibility of implementing its periodic data-matching process to identify
these individuals and determined such expansion was not feasible.
3945 C.F.R. § 155.420(d).
Page 15 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
enrollment period. 40 CMS regulations grant marketplaces the option to
verify an individual is eligible for a special enrollment period prior to
processing an application, but marketplaces are not required to do so if
the verification process is determined to cause undue burden on the
individual. 41
All five selected states allowed applicants to enroll during special
enrollment periods. However, the states each had differing QLEs that
required supporting documentation. For example, although Nevada
generally verified all QLEs, Colorado and Pennsylvania had selected
specific QLEs that required verification. 42 Additionally, California and New
Jersey did not have a process to verify QLEs; however, New Jersey
required applicants to sign an attestation form as support for certain
QLEs. Until CMS coordinates with the states to identify any residual risks
related to verifying events that trigger eligibility for enrollment during
special enrollment periods, SBMs may not be aware of potential
vulnerabilities associated with providing health care coverage to
individuals who are not eligible to enroll outside of the annual open
enrollment period.
Monitoring Continued Eligibility CMS regulations require marketplaces to monitor continued eligibility
periodically and annually. Specifically, marketplaces are required to
periodically identify changes in death status, Medicare, and Medicaid or
CHIP eligibility or enrollment. Marketplaces are required to perform these
periodic examinations of data sources at least twice during the plan year.
Additionally, each state that has implemented a fully integrated eligibility
system with its respective state Medicaid program is deemed in
40Examples of major life changes include the loss of minimum essential coverage,
permanent move of residence, birth of a child, and marriage.
41See 45 C.F.R. § 155.420(g); 87 Fed. Reg. 27208 (May 6, 2022). Changes to these
regulations were made with the 2023 Notice of Benefit and Payment Parameters final rule,
whereby all marketplaces using the FFM were required to verify eligibility for special
enrollment periods based on loss of minimum essential coverage but otherwise retain the
flexibility to determine whether to perform preenrollment verification for other QLEs. SBMs
may opt to follow but are not subject to this requirement.
42According to Colorado officials, the marketplace uses a shared responsibility model for
its special enrollment period verifications. Under that model, either the Colorado Division
of Insurance, Colorado marketplace, or its issuers may verify certain QLEs and determine
whether to grant an applicant conditional eligibility if they determined additional verification
was necessary.
Page 16 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
compliance with the Medicaid requirement. 43 Selected states generally
used a periodic data matching Hub service and their respective Medicaid
state agencies for such periodic examinations and did not verify additional
eligibility criteria, such as incarceration status or employer-sponsored
insurance coverage, during such reviews. 44
CMS regulations generally require marketplaces to redetermine the
eligibility of a qualified individual annually by requesting an individual’s
updated tax return information and verifying any changes the individual
reports with respect to eligibility. 45 Selected states generally used an
annual redetermination Hub service that performs verifications of
Medicare coverage, death status, changes in income, and compliance
with tax filing requirements. 46 Four selected states did not verify any
additional eligibility criteria, such as lawful presence or employer-
sponsored insurance coverage. However, one of the selected states—
California—implemented additional measures to verify incarceration
status through the Hub during its annual review process. Until CMS
coordinates with the states to identify any residual risks related to
monitoring continued eligibility of key criteria, such as lawful presence or
employer-sponsored insurance, SBMs may not be aware of potential
vulnerabilities associated with continuing to provide health care coverage
to individuals who are no longer eligible.
As discussed earlier, PPACA and CMS regulations offer flexibilities in the
verification process, such as accepting applicant attestations, in order to
minimize administrative costs and burdens for marketplaces and
applicants. As such, CMS allows marketplaces to determine whether to
exercise these flexibilities. However, as discussed above, such flexibilities
may result in residual risks related to eligibility determinations, and CMS
has not coordinated with the states to identify any potential vulnerabilities
associated with using these flexibilities.
4345 C.F.R. § 155.330(d).
44Due to the public health emergency, neither Colorado nor Nevada used the Hub service
to perform periodic data examinations for plan year 2022. According to Nevada officials,
Nevada has implemented the service for plan year 2023.
4545 C.F.R. § 155.335.
46Colorado did not use the Hub’s annual redetermination service to redetermine the
eligibility of a qualified individual. Colorado officials informed us they are coordinating with
CMS to find a solution to verify information through the Hub for annual reenrollments.
Page 17 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Federal internal control standards state that management should consider
the potential for fraud when identifying, analyzing, and responding to risks
and design and implement control activities to respond to risks. As part of
these standards, management analyzes the identified fraud risks by
estimating their significance, both individually and in the aggregate, to
assess their effect on achieving the defined objectives. Until CMS
coordinates with the states to identify any residual risks regarding
improper APTC eligibility determinations by exercising these flexibilities,
neither CMS nor the states will know if additional guidance or other
actions, such as data matching or additional verification processes, are
needed to mitigate these potential residual risks.
Selected States Did Not SBMs generally must provide an applicant with a reasonable opportunity
Reduce or Terminate period (ROP) of 90 days to provide supporting documentation to resolve
inconsistencies. However, SBMs have legal authority to extend the ROP
APTC Benefits When They
in cases where applicants have demonstrated a good faith effort to obtain
Could Not Verify Eligibility the required documentation. In addition, CMS regulations permit
during the COVID-19 marketplaces to provide exceptions, excluding for inconsistencies related
Pandemic to citizenship or lawful presence status, to individuals who cannot
reasonably obtain the required documentation, and accept, on a case-by-
case basis, an individual’s attestation. 47 Throughout the COVID-19
pandemic, SBMs were able to use this legal authority to extend their ROP
for various eligibility criteria. Four of the five selected states—California,
Colorado, Nevada, and New Jersey—exercised this authority at some
point during the COVID-19 pandemic.
Two selected states—California and Colorado—continued to provide
ROP extensions into plan year 2022 for certain key eligibility criteria.
Specifically, beginning in March 2020, Colorado temporarily discontinued
terminations of the APTC in cases where applicants failed to provide
verification documentation. This discontinuation was for all eligibility
criteria and will last until 90 days after the end of the public health
emergency. 48
Beginning in June 2020, California also provided various extensions to its
SBM’s ROP for all eligibility criteria. According to California officials, in
April 2022, California reinstated the ROP for all eligibility criteria, with the
exception of individuals in households with Medicaid or CHIP members
4745 C.F.R. § 155.315(f)(3); 45 C.F.R. § 155.315(g).
48In January 2023, it was announced that the COVID-19 public health emergency will end
on May 11, 2023.
Page 18 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
(mixed households). In such cases, California officials said that the state
will continue to provide ROP extensions for all eligibility criteria, excluding
deceased and incarceration status, through the end of the public health
emergency and the subsequent unwinding of the Medicaid continuous
enrollment requirement.
CMS Has Not
Developed a
Comprehensive
Methodology for
Estimating Improper
APTC Payments,
Identifying Root
Causes, and
Developing
Corrective Actions
CMS’s APTC Improper CMS contracted with a statistician to develop an improper payment
Payment Estimation sampling and estimation methodology plan for its APTC program. For
fiscal year 2022, CMS reported an estimated $256 million in FFM
Methodology Excluded the
improper payments for the APTC program, with an improper payment rate
SBMs of 0.62 percent. Our review of the statistical approach in the improper
payment sampling and estimation methodology plan concluded that the
methodology was reliable to estimate improper APTC payments in the
FFM.
Our review, however, found that the methodology was not
comprehensive, due to limitations in its sample design and review
processes. Specifically, our review of the standard operating procedures
for the methodology found that CMS considered most, but not all, of the
key eligibility criteria, as the methodology did not include a review of
Page 19 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
electronic verifications for income 49 nor periodic data matching for death
status and Medicare enrollment. 50 In addition, CMS’s methodology was
limited to APTC payments related to the FFM, and excluded
consideration of APTC payments related to the SBMs.
According to CMS’s standard operating procedures, developing an
improper payment measurement program to account for the policies and
operations of each SBM is a time-consuming and resource-intensive
process, such that incorporating the SBMs into the improper payment
measurement would have substantially delayed the implementation of the
measurement program. In the interest of accelerating the timing of the
improper payment measurement, and therefore of public reporting of
improper payments and corrective action implementation, CMS resolved
to develop and pilot test the measurement for the APTC program that
SBMs administered under a separate continuing effort.
Further, agency officials informed us that they plan to commence a pilot
program to estimate improper payments for SBMs. CMS intends to
establish an improper payment pretesting and assessment program in the
future to prepare the SBMs for the planned measurement of improper
payments. CMS also intends to establish the improper payment
measurement program subsequent to completing the pretesting and
assessment program. CMS provided us a draft of its State Exchange
Improper Payment Measurement Preparation Engagement Plan. The
draft includes planned communication with the states regarding their
requirements and the best way to incorporate the SBMs into the improper
payment measurement program. However, the draft did not include a
49The household income and family size review consists of ensuring each application has
(1) an annual household income verification date occurring on or before the application
submission date, (2) the amount the individual attested to, and (3) whether income
verification data were found in IRS records. The process does not include a review of the
actual income amount that IRS provided to ensure that the electronic verification was
concluded correctly, as this information is considered Federal Tax Information (FTI).
According to CMS officials, CMS does not have authority to review FTI for purposes of the
APTC estimated improper payment measurement program because of statutory
constraints of section 6103 of the Internal Revenue Code.
50For the fiscal year 2022 reporting, CMS had not developed a process to test the periodic
data-matching results for death status and Medicare enrollment due to resource
constraints and cost-benefit considerations. However, CMS has since developed this
process and is executing review modules to test these areas for subsequent reporting
years.
Page 20 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
process to identify and consider residual risks that may result from SBMs’
eligibility determinations. 51
OMB guidance states management must perform an assessment to
identify and evaluate the potential payment integrity risks the agency
faces and that identification of payment integrity risks should be a
continuous process. 52 Further, OMB encourages agencies to ensure that
significant payment integrity risks are part of the estimation methodology
so that estimates can be used to assist in identifying root causes.
Additionally, federal internal control standards state that management
should identify, analyze, and respond to risks related to achieving the
defined objectives. As part of these standards, management identifies
risks throughout the entity to provide a basis for analyzing risks.
According to CMS officials, they have not completed developing an
improper payment estimate that includes consideration of payments
related to the SBMs because developing an effective and efficient
improper payment measurement program requires multiple time-intensive
steps, which CMS has not yet completed. These steps include procuring
a contractor; developing measurement policies, procedures, and tools
(including identifying payment integrity risks within SBMs); and
conducting extensive pilot testing to ensure an accurate improper
payment estimate.
Estimation of improper payments for SBMs is key to understanding the
extent of any problems within the marketplaces and to developing
effective corrective actions to address them. As previously mentioned,
CMS is making efforts to engage with the states regarding improper
payment measurement requirements and the best approach to
incorporate the states into the measurement program. However, without
additional coordination with the SBMs to assess and identify any residual
risks to which SBMs may be vulnerable related to eligibility
determinations within their respective marketplaces, CMS’s process for
estimating improper APTC payments may not reflect significant risks in
the program. As such, the resulting improper payment estimate may be
51As explained earlier, exercising flexibilities in the eligibility-verification process may
result in residual risks related to eligibility determinations.
52Office of Management and Budget, Transmittal of Appendix C to OMB Circular A-123,
Requirements for Payment Integrity Improvement, OMB Memorandum M-21-19
(Washington, D.C.: Mar. 5, 2021). In this report, references to OMB guidance refer to this
OMB memorandum and the guidance contained therein.
Page 21 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
incomplete and provide a less useful basis for developing effective
corrective action plans.
CMS Does Not Have For programs that are reporting improper payment estimates, PIIA
Documented Policies and requires agencies to determine the root causes of improper payments
and develop corrective action plans to reduce them. 53 According to OMB
Procedures to Identify the
guidance, as part of this process agencies should ensure they have
Root Causes of Improper identified a true root cause of an improper payment in order to formulate
APTC Payments and effective corrective actions. CMS officials informed us that they do not
Develop Corrective have documented policies and procedures for identifying root causes of
Actions to Address Them improper APTC payments and developing corrective actions to address
them; however, they stated that the process will be consistent with other
programs for which there is an improper payment estimate.
Specifically, although not documented in policies and procedures, CMS
officials explained that the agency will determine root causes as part of a
detailed review of the findings from their annual improper payment
estimation process, and that the root causes will be based on the
professional judgment of reviewers and the specific facts and
circumstances of each finding. Therefore, as discussed above, when
CMS begins estimating improper payments related to the SBMs, if it does
not identify potential residual risks related to eligibility determinations
within the SBMs, there may be an increased risk that CMS may not
develop effective corrective action plans, such as additional guidance or
other actions, to mitigate such risks.
We previously recommended that HHS document in policies and
procedures its improper payment corrective action plan process. 54 As part
of these procedures, HHS should include its process for measuring the
effectiveness of corrective actions. The process also should clearly
demonstrate the effect HHS’s corrective actions have on reducing
improper payments. HHS disagreed with the recommendation, which
remains open as of February 2023. Until HHS implements this
recommendation and documents its processes in policies and
procedures, there are risks that CMS will not develop corrective action
plans that correspond to the root causes of improper payments, or that
53See 31 U.S.C. § 3352(d).
54GAO, Payment Integrity: Selected Agencies Should Improve Efforts to Evaluate
Effectiveness of Corrective Actions to Reduce Improper Payments, GAO-20-336
(Washington, D.C.: Apr. 1, 2020).
Page 22 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
CMS will not implement processes to effectively monitor progress and
measure plans’ effectiveness.
Federal law and regulations require SBMs, in coordination with CMS and
Conclusions other federal sources, to determine eligibility to enroll in a qualified health
plan and receive APTCs. For some eligibility criteria, SBMs have the
flexibility to accept an applicant’s self-attestation in certain circumstances
or to opt to conduct further verification. CMS and SBMs have not
conducted a risk assessment to determine if these flexibilities make
SBMs more susceptible to enrolling ineligible individuals in qualified
health plans and making APTC payments on their behalf. With such
considerable flexibilities, it is important that CMS, in coordination with
SBMs, evaluate the risks in making improper eligibility determinations and
establish strategies to mitigate those risks.
Estimating and reporting improper payments and developing corrective
actions to reduce such payments is critical to agency accountability—
particularly for new programs that make large expenditures in a given
year. While CMS has made considerable progress in developing an
estimating methodology for payments in the FFM program, CMS has not
developed an improper payment estimation plan to address SBMs or their
associated risks. Until HHS finalizes and implements its improper
payment estimation measurement program for the SBMs, HHS will likely
understate its overall improper payment estimate for the APTC program.
We are making the following two recommendations to CMS:
Recommendations for
Executive Action The Administrator for CMS should, in coordination with the states, assess
and identify residual risks to which the SBMs may be vulnerable related to
eligibility determinations and take these risks into account when
developing and implementing the improper APTC payment estimation
methodology for the SBMs. (Recommendation 1)
The Administrator for CMS should, in coordination with the states, assess
and identify residual risks to which the SBMs may be vulnerable related to
eligibility determinations and identify any additional guidance or other
actions, as needed, to mitigate any residual risks within the SBMs.
(Recommendation 2)
We provided a draft of this report to HHS, IRS, and selected states for
Agency Comments review and comment. We received written comments from HHS, which
and Our Evaluation are reproduced in appendix II and summarized below. We received
technical comments from IRS, California, Colorado, Nevada, and New
Page 23 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Jersey, which we incorporated as appropriate. Pennsylvania officials
informed us that they had no comments on the report.
In its written comments, HHS stated that it does not concur with our two
recommendations. HHS stated that in 2019 HHS developed an initiative
to provide SBMs with an opportunity to voluntarily engage with HHS to
prepare for future measurement of improper APTC payments. In our
report, we acknowledge CMS’s planned communication with the states
regarding their improper payment estimation requirements and the best
approach to incorporate the states into the improper payment
measurement program. However, CMS’s plan did not include a process
to identify and consider residual risks that may result from SBMs’
eligibility determinations.
HHS did not concur with our first recommendation to coordinate with the
states to assess and identify residual eligibility determination risks to
which the SBMs may be vulnerable and take those risks into account
when developing and implementing the improper APTC payment
estimation methodology for the SBMs. In response to this
recommendation, HHS stated that PIIA and OMB guidance in Appendix C
to Circular A-123 do not reference any requirements related to the
assessment of residual risk. In addition, HHS stated the recommendation
to assess and identify residual risks would be redundant with CMS’s
existing approach to developing the improper payment measurement
methodology.
However, as discussed in our report, OMB guidance states management
must perform an assessment to identify and evaluate the potential
payment integrity risks the agency faces and that the identification of
payment integrity risks should be a continuous process. Further, OMB
encourages agencies to ensure that significant payment integrity risks are
part of the estimation methodology so that estimates can be used to
assist in identifying root causes. Without first identifying residual risks,
there is an increased likelihood that CMS’s estimation methodology may
not address key risks of improper payments, such as those related to
eligibility determinations. This could possibly result in incomplete
improper payment estimates that provide a less useful basis for
developing effective corrective action plans. Therefore, we continue to
believe that our recommendation is valid.
HHS also did not concur with our second recommendation to identify any
additional guidance or other actions, as needed, to mitigate any residual
risks within the SBMs. Specifically, HHS stated that PPACA provides
Page 24 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
states with flexibility in the design and operation of their marketplaces,
within federal rules, to best meet the unique needs of their residents and
insurance markets. HHS further stated that CMS regulations specify a set
of eligibility verification requirements that all marketplaces, including
SBMs, must follow and allow flexibility for how certain eligibility
verification requirements should be met. In addition, HHS provided
examples of the flexibilities allowed for certain eligibility verification
requirements, specifically residency and duplicate coverage through
Medicaid in other states.
HHS stated that in response to a prior GAO audit recommendation, the
agency assessed and documented its options for verifying residency and
concluded that accepting an applicant’s attestation was the most practical
option. 55 Also, HHS stated that identification or verification of dual
Medicaid coverage across state lines is not a regulatory requirement for
SBMs. HHS noted that a comprehensive, national electronic data source
is currently not available for marketplaces to use in verifying dual
Medicaid coverage in all other states outside of the service area of each
marketplace.
We acknowledge in the report that PPACA and CMS regulations provide
flexibilities related to certain eligibility verification requirements, in part
due to whether reliable data sources are available that would allow a
marketplace to verify eligibility criteria. Although HHS previously
assessed and documented its options for verifying residency in response
to a GAO recommendation related to the FFM, this does not account for
potential data that may be available at the individual state level for the
SBMs. If the residencies of individuals are not verified, there is a risk of
enrolling ineligible individuals in qualified health plans and improperly
providing APTC payments to issuers on their behalf. Further, without a
process to identify duplicate coverage by Medicaid and CHIP in states
other than those in which individuals applied for coverage and attested to
residency, there is a risk that enrollees may apply for and receive
duplicate coverage, specifically, Medicaid managed care in one state and
APTC coverage in another state.
With such considerable flexibilities, it is important that CMS, in
coordination with SBMs, evaluates the risks in making improper eligibility
determinations and identifies any additional guidance or actions, if
needed, to mitigate those risks. Therefore, we continue to believe that our
55See GAO-17-467.
Page 25 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
recommendation to CMS is valid to help ensure that CMS addresses
improper payment risks related to eligibility determinations.
We are sending copies of this report to the appropriate congressional
committees, the Department of Health and Human Services, the Internal
Revenue Service, and other interested parties. In addition, this report is
available at no charge on the GAO website at https://www.gao.gov.
If you or your staffs have any questions about this report, please contact
me at (202) 512-5683 or padillah@gao.gov. Contact points for our Offices
of Congressional Relations and Public Affairs may be found on the last
page of this report. GAO staff who made key contributions to this report
are listed in appendix III.
M. Hannah Padilla
Director, Financial Management and Assurance
Page 26 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix I: Objectives, Scope, and
Appendix I: Objectives, Scope, and
Methodology
Methodology
This report examines (1) what key control activities, if any, selected states
and the Centers for Medicare & Medicaid Services (CMS) have designed
and implemented to prevent providing the advance premium tax credit
(APTC) to ineligible individuals through the state-based marketplaces
(SBM) and (2) the extent to which CMS has developed a reliable
methodology to estimate improper APTC payments, identify the root
causes of improper payments, and develop corrective actions to address
such root causes.
For our first objective, we selected a nongeneralizable sample of
approximately one-third (or five states) from the population of 15 SBMs
operating for plan year 2021. To select the states for our review, we
considered the following factors: monthly APTC payment data available
from each state, marketplace longevity to review both established and
new SBMs, and which major insurance providers were offered throughout
each state. Specifically, in order to maximize our coverage, we primarily
considered the amount of average monthly APTC payments by state
because if deficiencies are identified within a state’s processes, the
overall effect may be greater for states with higher monthly payments
than for those with lower monthly payments. 1 Two states—California and
Pennsylvania—reported average monthly APTC payment amounts
greater than $100 million; therefore, we included them in our review.
Next, we considered the timing of when states transitioned from the
federal marketplace to begin operating their own SBM in order to include
both newly transitioned and more established marketplaces. This allowed
us to consider the potential for increased payment integrity risks as newly
transitioned marketplaces establish appropriate control activities. We
noted that three states—Nevada, New Jersey, and Pennsylvania—had
recently transitioned to an SBM; therefore, we included Nevada and New
Jersey in our review to cover all the newly transitioned marketplaces.
Lastly, we considered the major health insurance issuers that were
offered in the marketplaces. Issuers may have different processes and
reporting mechanisms to exchange information with the SBMs. Therefore,
in order to maximize our audit coverage, we ensured that the SBMs in the
states we selected provided coverage from the major health insurance
issuers offered in the SBMs for 2021. Specifically, we found that Cigna
was the only major provider offered in the marketplaces in 2021 not
1We were unable to calculate the average monthly APTC payment amounts for Idaho and
Nevada, as those states reported they were unable to report the average monthly APTC
payment amount on the individual level.
Page 27 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix I: Objectives, Scope, and
Methodology
included in our selection thus far. From the remaining states, we noted
that Colorado was the state with the largest average monthly APTC
payments that offered Cigna; therefore, we included Colorado in our
review.
The SBMs from the five selected states—California, Colorado, Nevada,
New Jersey, and Pennsylvania—covered approximately 72 percent of
APTC consumers enrolled in SBMs for the 2021 open enrollment period.
Our findings are limited to the five selected states included in our review
and cannot be generalized to all states operating SBMs.
To assess what key control activities the selected states and CMS
designed and implemented to prevent providing the APTC to ineligible
individuals, we reviewed the Patient Protection and Affordable Care Act
and its implementing regulations. 2 Based on this review, we identified key
criteria that SBMs must consider when making APTC eligibility
determinations. We also reviewed relevant internal control standards 3 and
leading practices for measuring fraud risks in federal programs to
determine the relevant control activities needed to help prevent improper
APTC eligibility determinations. 4
As part of this work, we determined that internal controls were significant
to our objectives. Specifically, we determined that the control activities
component of internal control, along with the underlying principles that
management should design control activities to achieve its objectives and
respond to risks, were significant to our first objective. Additionally, we
determined that the risk assessment component of internal control and
the principles that management should (1) identify, analyze, and respond
to risks related to achieving the defined objectives and (2) consider the
potential for fraud when identifying, analyzing, and responding to risks
were significant to our objective. Also significant to our objective were the
information and communication component and the principles that
management should (1) use quality information to achieve the entity’s
2Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended by the Health Care and
Education Reconciliation Act of 2010, Pub. L. No. 111-152, 124 Stat. 1029 (Mar. 30,
2010).
3GAO, Standards for Internal Control in the Federal Government, GAO-14-704G
(Washington, D.C.: September 2014).
4GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP
(Washington, D.C.: July 2015).
Page 28 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix I: Objectives, Scope, and
Methodology
objectives and (2) externally communicate the necessary quality
information to achieve the entity’s objectives.
We determined the leading practices from the Fraud Risk Framework
relevant to our objective were related to (1) identifying and assessing
fraud risks and (2) designing and implementing specific control activities
to prevent and detect fraud. These leading practices include
1. planning to conduct fraud risk assessments at regular intervals and
when there are changes to the program or operating environment, as
assessing fraud risks is an iterative process;
2. examining the suitability of existing fraud controls and prioritizing
residual fraud risks; and
3. conducting data matching to verify key information, including self-
reported data and information necessary to determine eligibility.
We interviewed officials from the five selected states’ SBMs and CMS
regarding their roles in administering the APTC program and making
eligibility determinations. We obtained selected states and CMS’s written
policies and procedures, cycle memos, and other supporting
documentation, such as interagency agreements and computer-matching
agreements, in place for plan year 2022. We analyzed the documentation
provided from CMS and the selected SBMs to determine whether the
control activities aligned with relevant federal internal control standards
and leading practices in the Fraud Risk Framework and sufficiently
addressed the key eligibility determination risk areas we identified. We
also interviewed key agency officials from the Internal Revenue Service to
gain an understanding of their roles in the APTC payment-reconciliation
process.
To address our second objective, we reviewed agency payment integrity
requirements in the Payment Integrity Information Act of 2019 (PIIA); 5 the
related guidance in the Appendix C to Office of Management and Budget
(OMB) Circular A-123, Requirements for Payment Integrity Improvement; 6
and relevant internal control standards. We reviewed these documents to
identify key criteria agencies must meet when developing improper
5Pub L. No. 116–117, 134 Sat. 113 (Mar. 2, 2020).
6Office of Management and Budget, Appendix C to Circular No. A-123, Requirements for
Payment Integrity Improvement, OMB Memorandum M-21-19 (Washington, D.C.: Mar. 5,
2021). In this report, references to OMB guidance refer to this OMB memorandum and the
guidance contained therein.
Page 29 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix I: Objectives, Scope, and
Methodology
payment estimation methodologies, identifying root causes of improper
payments, and developing corrective action plans to reduce improper
payments. Based on this review, we determined that the risk assessment
component of internal control, along with the principle that management
should identity, analyze, and respond to risks related to achieving the
defined objectives, were significant to this objective. Additionally, we
determined that the control activities component of internal control, along
with the principles that management should (1) design control activities to
achieve objectives and respond to risks and (2) implement control
activities through policies, were significant to our objective.
We interviewed relevant CMS officials regarding their roles in estimating
improper APTC payments, identifying root causes of improper payments,
and developing corrective action plans to address root causes. We also
obtained CMS’s sampling and estimation methodology plan for fiscal year
2022 reporting and relevant policies and procedures. We then analyzed
the provided documents against relevant PIIA requirements, OMB
guidance, and relevant federal internal control standards. From our
analysis, we assessed whether (1) CMS’s estimation methodology was
reasonably sufficient to produce a reliable estimate of improper APTC
payments and (2) CMS designed and implemented a process to identify
root causes of improper APTC payments and develop corrective actions
that correspond to the identified root causes in accordance with
applicable laws and guidance.
We conducted this performance audit from November 2021 to March
2023 in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to
obtain sufficient, appropriate evidence to provide a reasonable basis for
our findings and conclusion based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objectives.
Page 30 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix II: Comments from the Department
Appendix II: Comments from the Department
of Health and Human Services
of Health and Human Services
Page 31 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix II: Comments from the Department
of Health and Human Services
Page 32 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix II: Comments from the Department
of Health and Human Services
Page 33 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix II: Comments from the Department
of Health and Human Services
Page 34 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix II: Comments from the Department
of Health and Human Services
Page 35 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
Appendix III: GAO Contact and Staff
Appendix III: GAO Contact and Staff
Acknowledgments
Acknowledgments
M. Hannah Padilla, (202) 512-5683 or padillah@gao.gov
GAO Contact
In addition to the contact named above, Matthew Valenta (Assistant
Staff Director), Stephanie Adams (Auditor in Charge), Carl Barden, Anthony
Acknowledgments Clark, Jason Kelly, Mike LaForge, Diana Lee, Christina Skinner, Angela
Wills, and Emily Wilson Schwark made key contributions to this
engagement.
Page 36 GAO-23-105577 Advance Premium Tax Credit Payment Integrity
The Government Accountability Office, the audit, evaluation, and investigative
GAO’s Mission arm of Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability of the
federal government for the American people. GAO examines the use of public
funds; evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make informed
oversight, policy, and funding decisions. GAO’s commitment to good government
is reflected in its core values of accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at no cost is
Obtaining Copies of through our website. Each weekday afternoon, GAO posts on its website newly
GAO Reports and released reports, testimony, and correspondence. You can also subscribe to
GAO’s email updates to receive notification of newly posted products.
Testimony
Order by Phone The price of each GAO publication reflects GAO’s actual cost of production and
distribution and depends on the number of pages in the publication and whether
the publication is printed in color or black and white. Pricing and ordering
information is posted on GAO’s website, https://www.gao.gov/ordering.htm.
Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.
Orders may be paid for using American Express, Discover Card, MasterCard,
Visa, check, or money order. Call for additional information.
Connect with GAO on Facebook, Flickr, Twitter, and YouTube.
Connect with GAO Subscribe to our RSS Feeds or Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.
Contact FraudNet:
To Report Fraud,
Website: https://www.gao.gov/about/what-gao-does/fraudnet
Waste, and Abuse in
Automated answering system: (800) 424-5454 or (202) 512-7700
Federal Programs
A. Nicole Clowers, Managing Director, ClowersA@gao.gov, (202) 512-4400, U.S.
Congressional Government Accountability Office, 441 G Street NW, Room 7125, Washington,
Relations DC 20548
Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800
Public Affairs U.S. Government Accountability Office, 441 G Street NW, Room 7149
Washington, DC 20548
Stephen J. Sanford, Managing Director, spel@gao.gov, (202) 512-4707
Strategic Planning and U.S. Government Accountability Office, 441 G Street NW, Room 7814,
External Liaison Washington, DC 20548
Please Print on Recycled Paper.
File and source
- File
- gao-23-105577.pdf
- Size
- 1,501,109 bytes
- SHA-256
- 4028fed6cfee75d11291775c887235931e496a3e174d74f4fe070a8ffe867160
- Our copy
- gao-23-105577.pdf
- Original
- www.gao.gov