Objective

To assess the extent of implementation of the 10 recommendations included in our initial audit report, Medicaid Program – Managed Care Payments to Unenrolled Providers (Report 2021-S-6).

About the Program

Managed care organizations (MCOs) establish provider networks by contracting with physicians, hospitals, and other health care providers to provide medical care to their members. The 21st Century Cures Act (Act) mandated that all managed care in-network providers, with certain exceptions, enroll as participating providers in the state Medicaid program by January 1, 2018. Through the screening and provider enrollment process, DOH gains some assurance over the provider’s validity to provide Medicaid services. Additionally, DOH must verify that the federal government has not prohibited providers from participating in Medicaid. DOH’s Provider Network Data System (PNDS) maintains information about providers and service networks contracting with MCOs. MCOs are required to submit their contracted provider information to the PNDS quarterly. MCOs also separately submit encounter claims to DOH, which detail member health care services and payments to providers.

The objective of our initial audit, issued on June 4, 2024, was to determine whether Medicaid MCOs violated federal and State regulations by making payments to unenrolled providers. The audit covered the period from January 2018 through June 2022. The audit found that DOH did not monitor encounter claims to identify inappropriate managed care payments to providers who were not enrolled in Medicaid. Additionally, although DOH developed PNDS controls and error reports to assist MCOs in complying with the Act, the audit found weaknesses in these controls. These problems led to over $1.5 billion in improper and questionable payments.

Key Findings

DOH officials made some progress in addressing the problems we identified in the initial audit report. For example, DOH improved monitoring of MCO compliance with the provisions of the Act and resolved a system error that had been preventing the identification of inappropriate providers. However, further action is still necessary. DOH has not utilized encounter data to identify payments made to unenrolled providers and has not enhanced processes to identify and recover managed care payments to providers who are excluded or who otherwise require further review by DOH due to past misconduct. Of the initial report’s 10 audit recommendations, two were implemented, five were partially implemented, and three were not implemented.

Key Recommendation

DOH officials are requested, but not required, to provide information about any actions planned to address the unresolved issues discussed in this follow-up within 30 days of the report’s issuance.