GAO audit finds CMS oversight of $171B in Medicaid managed care payments lacking

The Centers for Medicare & Medicaid Services (CMS) isn’t doing enough to prevent payment risks in Medicaid managed care organizations (MCOs), according to a new report from the Government Accountability Office (GAO).

According to the report (PDF), CMS hasn't initiated a single audit in the last two years. The absence of audits is likely tied to the fact that state MCO contracts often lack provisions around the identification of overpayments. MCO officials also blamed "a lack of consistent guidance" from states, and one state auditor said sanctions against MCOs were used infrequently.  

Auditors also criticized the agency for failing to release timely guidance to states and account for improper payments. These gaps in oversight are inconsistent with CMS’ goals and federal internal control standards, GAO says.

In 2017, the federal government spent $171 billion on services paid for through Medicaid managed care—nearly half of all Medicaid expenditures that year. But Medicaid oversight has disproportionately focused on fee-for-service arrangements, according to the GAO.

Incorrect payments from MCOs to providers—especially for durable medical equipment and psychiatric or behavioral health services—and inaccurate payments from states to MCOs pose the greatest risks to program integrity, according to stakeholders who were interviewed for the report.

RELATED: CMS launches slate of initiatives aimed at curbing fraud, waste in Medicaid

“Without taking action to address these issues, CMS is missing an opportunity to develop more robust program integrity safeguards that will help mitigate payment risks in Medicaid managed care,” the report reads.

GAO recommended CMS issue expedited guidance on program integrity, address impediments to managed care audits and ensure states account for overpayments in setting future payment rates. In addition, stakeholders recommended that state Medicaid offices work with MCOs to avoid improper payments, impose sanctions on MCOs that do not comply with requirements, monitor providers more closely, and improve oversight of plans, providers and resources.

CMS concurred with all three of the GAO's recommendations. Last month, the agency launched several new program integrity initiatives, including additional audits of Medicaid managed care plans.