    [Senate Hearing 114-277]
    [From the U.S. Government Publishing Office]

                                                            S. Hrg. 114-277

                                   REVIEWING
                                 HEALTHCARE.GOV
                                    CONTROLS

    =======================================================================

                                    HEARING

                                   before the

                              COMMITTEE ON FINANCE
                              UNITED STATES SENATE

                        ONE HUNDRED FOURTEENTH CONGRESS

                                 FIRST SESSION
                                   __________

                                 JULY 16, 2015
                                   __________

       [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                Printed for the use of the Committee on Finance
                                       ______

                             U.S. GOVERNMENT PUBLISHING OFFICE

    20-377 PDF                     WASHINGTON : 2016
    -----------------------------------------------------------------------
      For sale by the Superintendent of Documents, U.S. Government Publishing
      Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
             DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
                              Washington, DC 20402-0001

                              COMMITTEE ON FINANCE

                         ORRIN G. HATCH, Utah, Chairman

    CHUCK GRASSLEY, Iowa                 RON WYDEN, Oregon
    MIKE CRAPO, Idaho                    CHARLES E. SCHUMER, New York
    PAT ROBERTS, Kansas                  DEBBIE STABENOW, Michigan
    MICHAEL B. ENZI, Wyoming             MARIA CANTWELL, Washington
    JOHN CORNYN, Texas                   BILL NELSON, Florida
    JOHN THUNE, South Dakota             ROBERT MENENDEZ, New Jersey
    RICHARD BURR, North Carolina         THOMAS R. CARPER, Delaware
    JOHNNY ISAKSON, Georgia              BENJAMIN L. CARDIN, Maryland
    ROB PORTMAN, Ohio                    SHERROD BROWN, Ohio
    PATRICK J. TOOMEY, Pennsylvania      MICHAEL F. BENNET, Colorado
    DANIEL COATS, Indiana                ROBERT P. CASEY, Jr., Pennsylvania
    DEAN HELLER, Nevada                  MARK R. WARNER, Virginia
    TIM SCOTT, South Carolina

                         Chris Campbell, Staff Director

                  Joshua Sheinkman, Democratic Staff Director

                                      (ii)

                                C O N T E N T S

                                  ----------

                               OPENING STATEMENTS

                                                                       Page
    Hatch, Hon. Orrin G., a U.S. Senator from Utah, chairman,
      Committee on Finance...........................................     1
    Wyden, Hon. Ron, a U.S. Senator from Oregon......................     3

                                    WITNESS

    Bagdoyan, Seto J., Director, Forensic Audits and Investigative
      Service,
      Government Accountability Office, Washington, DC...............     4

                   ALPHABETICAL LISTING AND APPENDIX MATERIAL

    Bagdoyan, Seto J.:
        Testimony....................................................     4
        Prepared statement...........................................    21
    Grassley, Hon. Chuck:
        Prepared statement...........................................    41
    Hatch, Hon. Orrin G.:
        Opening statement............................................     1
        Prepared statement...........................................    42
    Wyden, Hon. Ron:
        Opening statement............................................     3
        Prepared statement...........................................    43

                                     (iii)

                       REVIEWING HEALTHCARE.GOV CONTROLS

                                  ----------

                            THURSDAY, JULY 16, 2015

                                           U.S. Senate,
                                          Committee on Finance,
                                                        Washington, DC.
        The hearing was convened, pursuant to notice, at 10:02
    a.m., in room SD-215, Dirksen Senate Office Building, Hon.
    Orrin G. Hatch (chairman of the committee) presiding.
        Present: Senators Grassley, Crapo, Thune, Burr, Portman,
    Toomey, Coats, Heller, Scott, Wyden, Cantwell, Brown, Bennet,
    and Casey.
        Also present: Republican Staff: Chris Campbell, Staff
    Director; Kimberly Brandt, Chief Healthcare Investigative
    Counsel; Christine Brudevold, Detailee; and Jill Wright,
    Detailee. Democratic Staff: Joshua Sheinkman, Staff Director;
    Michael Evans, General Counsel; Elizabeth Jurinka, Chief Health
    Advisor; David Berick, Chief Investigator; and Juan Machado,
    Professional Staff Member.

     OPENING STATEMENT OF HON. ORRIN G. HATCH, A U.S. SENATOR FROM
                  UTAH, CHAIRMAN, COMMITTEE ON FINANCE

        The Chairman. The committee will come to order.
        Good morning, everybody. Today's hearing will address
    controls at the HealthCare.gov website. Specifically, the
    committee will hear from the Director of Audit Services at the
    Government Accountability Office, Seto Bagdoyan.
        Director Bagdoyan's team has led an undercover ``secret
    shopper'' investigation to test the Internet controls of
    HealthCare.gov and to review the Centers for Medicare and
    Medicaid Services' handling of this program. This investigation
    was designed to determine the degree to which the
    administration's Federal health insurance exchange can protect
    against fraudulent applications, what happens when applicants
    provide false information and documentation, and whether the
    controls are successful in dealing with irregularities once
    they are found.
        Perhaps I should say ``spoiler alert'' before this next
    part. Today, Director Bagdoyan will explain how the Federal
    exchange failed spectacularly on virtually all relevant
    accounts tested by GAO.
        For this investigation, GAO created fictitious identities
    to apply for premium tax subsidies through the Federal health
    insurance exchange. We learned last year that 11 out of 12 fake
    applications were approved, and CMS accepted fabricated
    documentation with these applications without attempting to
    verify its authenticity and enrolled fake applicants while
    handing out thousands of dollars in premium tax subsidies.
        Now, a year later, GAO has reported that nothing has
    changed and that, if anything, there are more problems. Worst
    of all, the administration has known about these problems for
    over a year now and has apparently not taken the necessary
    steps to rectify them. While CMS says that it is balancing
    consumer access to the system with program integrity concerns,
    I think it is pretty clear just what is going on here.
        Since the Federal exchange was first implemented, success
    has been measured by the number of applicants who have signed
    up for insurance. Indeed, last year when the administration
    reached its initial enrollment goal, critics of the law were
    told that we had been wrong all along and that the law was,
    despite all the evidence to the contrary, working just fine.
        However, with these findings from GAO, it seems obvious, at
    least to me, that the administration has been preoccupied with
    signing up as many applicants as possible, ignoring potential
    fraud and integrity issues along the way.
        Now, supporters of Obamacare often insist that it is ``the
    law of the land'' and that Congress should work to improve
    rather than repeal it. On the first point, these proponents are
    unfortunately correct. For the foreseeable future, the so-
    called Affordable Care Act is the law of the land. On the
    second point, Republicans in Congress continue to work toward
    repeal of the misguided law and its expensive mandates,
    regulations, penalties, and taxes, and replacement of it with
    patient-centered reforms that put patients, rather than
    Washington bureaucrats, in charge of their health care
    decisions.
        However, needless to say, that day will not come until
    there is a President who shares our goal. So until then,
    Obamacare will remain in place. In the meantime, Congress has
    an obligation to exercise rigorous oversight of the
    implementation of the law and to work to protect both
    beneficiaries and taxpayers from its negative consequences.
        That is what today's hearing is about. We are here today to
    get an account of how things are working on the Federal health
    insurance exchange, and, once again, what we have heard thus
    far is not reassuring and does not speak well for CMS's
    management of HealthCare.gov, the protection of taxpayer
    dollars, or the experience of enrollees.
        The GAO's investigation exposes not only huge gaps in
    Federal exchange program integrity, but also flaws in how the
    exchange and CMS contractors treat Americans who are trying to
    file or correct legitimate applications. Time after time, the
    GAO team sent information to the exchange for verification,
    only to have it ignored or have the exchange respond as if
    something entirely different had been sent in.
        The fact that GAO encountered mind-boggling levels of
    incompetence and inefficiency at nearly every turn does not
    bode well for the experience of your average honest enrollee. I
    look forward to today's hearing and what I hope will be a good
    discussion on program integrity at HealthCare.gov.
        Before I conclude, I want to note that, even though this
    GAO investigation was requested by this committee, CMS was less
    than cooperative. Indeed, throughout the entire endeavor,
    officials at CMS appeared to be dragging their feet, blowing
    past deadlines and good-faith attempts to carry out this
    important work.
        Put simply, when Congress asks GAO to conduct an inquiry,
    no Federal agency should stand in the way of that work. By
    delaying the GAO and hampering their efforts, CMS has also
    delayed this committee's work and hampered our efforts. This is
    unacceptable, and unfortunately, despite promises of increased
    transparency and cooperation from agencies throughout this
    administration, this type of stonewalling of legitimate
    oversight efforts is far, far too common.
        Acting CMS Administrator Andy Slavitt, who is now the
    President's nominee to run the agency, was personally involved
    in this process. As the committee considers his nomination, I
    look forward to asking Mr. Slavitt about this investigation and
    why CMS has been interfering with our oversight efforts. Of
    course, that will all have to wait for another day and another
    time.
        [The prepared statement of Chairman Hatch appears in the
    appendix.]
        The Chairman. Today we have our hands full as we hear
    testimony about this important GAO investigation. So with that,
    I will turn it over to our ranking member, Senator Wyden, for
    his opening remarks.

                 OPENING STATEMENT OF HON. RON WYDEN,
                       A U.S. SENATOR FROM OREGON

        Senator Wyden. Thank you very much, Mr. Chairman.
        On this side of the aisle, we do not take a back seat to
    anybody in fighting fraud and protecting taxpayer dollars. One
    dollar ripped off is one dollar too many. But let us be very
    clear this morning. The report up for discussion today is not
    about any real-world fraud. The study looks at a dozen
    fictitious cases, and not one of them was a real person who
    filed taxes or got medical services. No fast-buck fraudster got
    a government check sent to their bank account.
        Moreover, the government auditors acknowledge today, and I
    want to quote here, their work ``cannot be generalized to the
    full population of applicants or enrollees.'' None of the
    fictitious characters in this study stepped foot in a hospital
    or a doctor's office. The fact is, when you actually show up
    for medical services, it is a lot harder to fake your way into
    receiving taxpayer-subsidized care.
        Often, before any services are delivered, providers ask for
    a photo ID with an insurance card. If you have stolen an
    identity, there is probably a medical history belonging to
    somebody else that ought to set off alarm bells. If you are a
    real person signing up in the insurance marketplace, you have
    to attest, under penalty of perjury, that the information you
    provide is correct. If you falsify the application, you face
    the prospect of a fine of up to $250,000.
        Another major anti-fraud check went untested in this study:
    that is, squaring up tax returns with the information from your
    insurance application. The Government Accountability Office
    testimony today calls it ``a key element of back-end
    controls.''
        If your tax return and personal information do not match,
    the gambit is up. But the study before us today ignores that
    anti-fraud check. It only looks at a part of the picture when
    it comes to stopping fraud.
        As I noted at the beginning, there are always methods of
    strengthening any program and rooting out the fraudsters and
    the rip-off artists. Part of any smart, ferocious strategy
    against fraud, on one hand, is drawing a distinction between
    aggressively going after the rip-off artists and, on the other,
    not harming a law-
    abiding American who has made an honest, and often technical,
    mistake.
        A retiree nearing Medicare age should not get kicked to the
    curb because he or she accidentally submitted an incorrect
    document. A transgender American should not lose health
    coverage after a name change because some forms do not match. I
    cannot imagine that anyone in the Congress or on this committee
    wants a system that nixes the health insurance coverage of
    Americans because of those kinds of issues.
        I will wrap up by saying that a recent Gallup report stated
    that the rate of Americans without health insurance is now the
    lowest that they have ever measured. This is the first Finance
    Committee hearing on health care since the Supreme Court's
    landmark decision that upheld the law that made that possible.
        The fact is, the Affordable Care Act has extended health
    care coverage to more than 16 million real people who use their
    insurance coverage to see real doctors. Now at some point down
    the road, the GAO is expected to complete their report. At that
    time, let us work on a bipartisan basis to draw conclusions
    about how this committee can work together to improve American
    health care.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator. I appreciate it.
        [The prepared statement of Senator Wyden appears in the
    appendix.]
        The Chairman. Our witness today is Seto Bagdoyan, who is
    Director of Audit Services in GAO's Forensic Audits and
    Investigative Service mission team. During his GAO career, Mr.
    Bagdoyan has served in a variety of positions, including as
    Legislative Advisor in the Office of Congressional Relations,
    and as Assistant Director for Homeland Security and Justice. He
    has also served on congressional details with the Senate
    Finance Committee and the House Committee on Homeland Security.
        In his private-sector career, Mr. Bagdoyan has held a
    number of senior positions in consultancies, most recently
    focusing on political risk and homeland security. He earned a
    BA degree in international relations and economics at Claremont
    McKenna College and an MBA in strategy from Pepperdine
    University.
        We welcome you to the committee, and we are interested in
    your statement here today.

     STATEMENT OF SETO J. BAGDOYAN, DIRECTOR, FORENSIC AUDITS AND
       INVESTIGATIVE SERVICE, GOVERNMENT ACCOUNTABILITY OFFICE,
                             WASHINGTON, DC

        Mr. Bagdoyan. Thank you, Mr. Chairman.
        Chairman Hatch, Ranking Member Wyden, and members of the
    committee, I am pleased to be here today to discuss the final
    results of GAO's undercover tests assessing the enrollment
    controls of the Federal marketplace set up under the Affordable
    Care Act of 2010.
        As you mentioned, we reported our preliminary results
    during testimony in July of 2014. We performed 18 undercover
    tests, 12 of which involved phone or online applications. Our
    tests were designed specifically to identify indicators of
    potential control weaknesses in the marketplace's enrollment
    process, specifically for plan year 2014, and to inform our
    ongoing forensic audit of these controls.
        I would note that our test, while illustrative as Ranking
    Member Wyden mentioned, cannot be generalized to the population
    of applicants or enrollees. Further, we shared details of our
    observations with CMS during the course of our test to seek its
    responses to the issues we raised.
        In this regard, CMS officials stated that they had limited
    capacity to respond to attempts at fraud and they must balance
    consumers' ability to access coverage with program integrity
    concerns. Without providing details on how and when, these
    officials stated that they intend to assess the marketplace's
    eligibility determination process.
        In terms of context, health coverage offered through the
    marketplace is a significant expenditure for the Federal
    Government. Current levels of coverage involve several million
    enrollees, about 85 percent of whom are estimated to be
    receiving subsidies. CBO pegs subsidy costs for fiscal year
    2015 at $28 billion and a total of about $850 billion for
    fiscal years 2016 to 2025.
        A program of this scope and scale is inherently at risk for
    errors, including improper payments and fraudulent activity.
    Accordingly, it is essential that there are effective
    enrollment controls in place to help narrow the window of
    opportunity for such risks, hence the importance of our
    undercover tests.
        With this as backdrop, I will now discuss some of our
    test's principle results. The marketplace approved subsidized
    coverage for 11 of our 12 fictitious applicants. These
    applicants obtained about $30,000 in total annual advanced
    premium tax credits, plus eligibility for lower costs at time
    of service.
        For 7 of the 11 applicants, we intentionally did not submit
    all required verification documentation to the marketplace, but
    it did not cancel coverage or reduce or eliminate subsidies for
    these applicants. I would note that while subsidies, including
    those granted to our applicants, are not provided directly to
    enrollees, they nevertheless represent a financial benefit to
    consumers and a cost to the government.
        As part of its verification process, the marketplace did
    not accurately record all inconsistencies which occur when
    applicant information does not match information available from
    marketplace verification sources. Also, the marketplace
    resolved inconsistencies from our fictitious applications based
    on fabricated documentation we submitted. Further, the
    marketplace did not terminate any coverage for several types of
    inconsistencies, including Social Security data.
        We found errors in information reported by the marketplace
    for tax filing purposes for 3 of our 11 enrollees, such as
    incorrect coverage periods or subsidy amounts. Under the ACA,
    filing a Federal income tax return is a key control element
    designed to ensure that premium subsidies granted at time of
    application are appropriate based on reported applicant
    earnings during the coverage year.
        The marketplace automatically re-enrolled coverage for all
    11 applicants for plan year 2015. Later, based on what it said
    were new applications our enrollees had filed but which we had
    not actually made, the marketplace terminated coverage for 6 of
    the 11 enrollees, saying they had not provided necessary
    documentation. However, for 5 of the 6 terminations, we
    subsequently obtained reinstatements, including increases in
    monthly subsidies averaging about 10 percent.
        In closing, our test results highlight the need for CMS to
    have in place effective controls to help reduce the risks for
    potential improper payments and fraud, otherwise there is
    potential for such risks to be imbedded early in a major new
    benefits program. We plan to include initial recommendations
    regarding controls in a forthcoming report.
        Mr. Chairman, this concludes my statement. I look forward
    to the committee's questions.
        The Chairman. Thank you, sir.
        [The prepared statement of Mr. Bagdoyan appears in the
    appendix.]
        The Chairman. It has come to my attention that GAO had
    difficulty obtaining plan year 2015 enrollment and related data
    from CMS, data that would allow GAO to conduct a full analysis
    of what really happened to enrollees from 2014.
        Now, this would have been helpful to GAO in providing
    explanations for things like those who were supposed to get
    dropped for failing to provide documents, to clear
    inconsistencies, among other things. Can you provide us with
    more detail about the difficulties GAO had in obtaining that
    information from CMS? I expect GAO to have the most recent and
    relevant data to inform its analysis, and expect that CMS would
    work with you and the committee to make that happen.
        Any information you can provide as to the problems
    experienced and what the committee can do to help address them
    would be very helpful to us in the committee now.
        Mr. Bagdoyan. Thank you for your question, Mr. Chairman. I
    will just lay out, in a general sense, our experience in
    obtaining data. But in the beginning, I would like to establish
    a context in terms of--as I mentioned earlier, the reason why
    we did our undercover testing was to flag indicators of
    potential control weaknesses, and, at the same time, we had
    designed our forensic audit, which would have relied on the
    enrollee database, to map out what we were finding in the
    control environment against the actual enrollees that I believe
    Ranking Member Wyden mentioned earlier.
        That said, we began our informal meetings and consultations
    with CMS in April of 2014. We requested various data sets. We
    had some success obtaining some information in meetings over
    time. Then when we focused on the enrollee database, we
    submitted a written letter requesting that database in August
    of 2014, and then we subsequently engaged in additional
    discussions with CMS officials as they expressed some concerns
    about what we were asking, what we planned to do with the data,
    as well as how the data would be safeguarded.
        Upon subsequent discussions through the early part of 2015,
    we submitted another letter to the current Acting
    Administrator, Mr. Slavitt, in April of 2015. As of a couple of
    days ago, we have been in contact with CMS, which advised that
    we should expect the data sometime next week, which is very
    good news for us, for our ability to continue the work.
        We look forward to obtaining the data and seeing whether it
    is actually what we asked for, and then conducting additional
    tests to determine whether the data is actually usable for our
    purposes. I apologize for the long story, but that gives you a
    context of where we have been.
        The Chairman. Sure. That is fine. I understand that the
    marketplace invoked this so-called ``good faith exemption'' for
    plan year 2014 in not pursuing applicants who did not submit
    all of the requested documentation to reconcile inconsistencies
    between information they provided during the enrollment process
    and that available to the marketplace through government
    sources.
        Could you describe what the good faith exemption is all
    about, whether it has any basis in the Affordable Care Act or
    its implementing regulations, and the impact, if any, of its
    invocation on program controls and integrity?
        Mr. Bagdoyan. Sure. The good faith provision is basically
    an interpretation by CMS of certain provisions in the statute
    itself and in its implementing regulations. Essentially, under
    this implementation, CMS deemed that as long as an enrollee or
    an applicant submits at least one document to support their
    application, they would have engaged in a good faith effort to
    meet the documentary request and accordingly remain a
    participant in their coverage.
        In terms of whether this has an impact on the controls, it
    is essentially one of the back-end controls--the document
    verification process, that is--and, depending on your point of
    view of whether that is adequate if someone is asked for seven
    documents and they only submit one document, that can create a
    control gap and raise questions about their eligibility for
    participation.
        The Chairman. Well, thank you.
        Senator Wyden, my time is up.
        Senator Wyden. Thank you very much, Mr. Chairman.
        Mr. Bagdoyan, my time is short, so I would like you to give
    me ``yes'' or ``no'' answers to four questions.
        Mr. Bagdoyan. Sure.
        Senator Wyden. Mr. Bagdoyan, as of this morning, can you
    generalize from the 11 fictitious cases what the fraud rate
    would be for the more than 10 million real Americans who
    actually receive health care coverage under the law, yes or no?
        Mr. Bagdoyan. Not as of this morning.
        Senator Wyden. Mr. Bagdoyan, you said in your testimony
    that tax returns are a ``key element of back-end controls. It's
    a major check that would shut down the fraudsters.'' As of this
    morning, did you file tax returns for any of these individuals,
    yes or no?
        Mr. Bagdoyan. We did not.
        Senator Wyden. Mr. Bagdoyan, as of this morning, have you
    uncovered any real individuals who fraudulently obtained health
    coverage using GAO's techniques, yes or no?
        Mr. Bagdoyan. No.
        Senator Wyden. Mr. Bagdoyan, as of this morning, have you
    provided HHS with the fictitious identities from your inquiries
    so that they can address the problems that you say exist, yes
    or no?
        Mr. Bagdoyan. We have not.
        Senator Wyden. Mr. Bagdoyan and colleagues, I have reviewed
    this very carefully. Given the answers that we have just heard,
    it is clear to me that the auditors have much more work to do
    before the committee can draw useful conclusions on this
    matter.
        On this point with respect to the claims that the agency
    has not been responsive to the request for enrollment data, I
    very much respect the fact that Federal agencies need to be
    responsive to requests from Congress and the GAO for
    information. However, I also want to take note of the fact that
    these enrollment records contain personally identifiable
    information on more than 10 million Americans. Loss of their
    personally identifiable information is already becoming a
    nightmare for millions of Americans.
        Now, it is my understanding that the agency, CMS, and the
    auditors have worked out an agreement on how this information,
    (1) can be turned over to GAO and protected, and I think that
    is good; and (2) it is my understanding that the agency has
    turned over some 30,000 pages of documents to my colleague,
    Senator Portman, for his committee.
        So this notion that the government, the agency--in
    particular, CMS--is just spending its day, morning, noon, and
    night trying to stonewall the release of this information, I
    think, is not accurate, given the facts that I have just cited.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator.
        Senator Grassley, you are next.
        Senator Grassley. In deference to my colleagues, and there
    are a lot here who want to ask you questions--and of course
    that is because we have our pending six votes this morning--I
    am going to ask just one of three questions, and I am going to
    put the lead-in up to my questions in the record.
        [The prepared statement of Senator Grassley appears in the
    appendix.]
        Senator Grassley. You presented CMS with potential flaws.
    The flaws, as I understand what you said, did not get fixed. So
    my question is very simple: in your work with CMS, do you
    believe that CMS's attitude is, enroll people first and worry
    about eligibility later, if at all?
        Mr. Bagdoyan. Well, from where we stand currently, the CMS
    explanation has been that they have to balance the ease of
    access to coverage with program integrity controls. Based on
    our under-cover work, I would say that there are gaps in these
    controls that have yet to be addressed. We continue to look at
    it through our forensic work, but as of now I think the balance
    would probably favor access over program integrity.
        Senator Grassley. Yes. I yield back.
        Mr. Bagdoyan. As we stand today, Senator. As we stand
    today.
        Senator Grassley. Thank you. I yield back my time.
        The Chairman. Thank you.
        Senator Thune?
        Senator Thune. Thank you, Mr. Chairman. Thanks for holding
    the hearing. I think it is important--you were talking about
    taxpayer dollars here--that we make sure that we are doing
    everything to see that they are spent wisely and well.
        Mr. Bagdoyan, in your testimony you highlight that
    marketplaces are required by law to verify application
    information, yet it appears from your investigation and
    subsequent interactions with CMS that the buck stops with no
    one, especially since the very contractors hired to verify
    these documents are not required to detect fraud.
        So it begs the question of whether you are currently aware
    of any effective front- or back-end fraud detection program in
    use by the administration?
        Mr. Bagdoyan. Again, I would couch my response to you,
    Senator Thune, in terms of our ongoing work. The forensic part
    of our work should be able to give us a good idea of what the
    controls are. We will take what we have learned from the
    undercover tests, map that out against the forensic audit, and
    then apply appropriate criteria, such as the internal control
    standards of the Federal Government, as well as a forthcoming
    GAO framework to manage fraud risk. Then we will be able to
    have a more comprehensive view of what the control environment
    is like.
        Senator Thune. All right.
        Mr. Bagdoyan. It is premature for me to make a judgment
    like that.
        Senator Thune. You are not currently aware today, though,
    absent having completed your investigation, of any fraud
    detection program?
        Mr. Bagdoyan. Based on our work to date, I am not aware of
    that.
        Senator Thune. Additionally, has the administration
    provided you with any rationale as to why they would enter into
    contracts that do not require the contractors to have fraud
    detection capabilities?
        Mr. Bagdoyan. As best as I can tell, the arrangement with a
    contractor is to process documents that are submitted in
    support of applications. The contractor confirmed with us that
    they are not required to detect fraud. That would be a whole
    different transaction at greater cost.
        Senator Thune. So you said your work is ongoing.
        Mr. Bagdoyan. Yes.
        Senator Thune. But does GAO have any recommendations for
    how to improve the document verification process to actually
    sort out fraud as opposed to just accepting documents?
        Mr. Bagdoyan. Sure. As I mentioned in my opening statement,
    we are working on a forthcoming report sometime in the fall
    time frame where we hope to have some initial recommendations,
    and those recommendations might indeed cover the matter that
    you mentioned.
        Senator Thune. All right. But you do not now have any hard,
    fast information?
        Mr. Bagdoyan. Not right now. But as I mentioned earlier, we
    did speak with CMS officials about things that we were
    encountering. We had discussions about their view of that, and
    we continue to have those discussions and await some
    explanations in that regard.
        Senator Thune. My understanding is, from your work, that
    several of the fictitious applications were approved and
    subsequently reapproved without ever submitting documentation
    to the marketplace. How can this be?
        Mr. Bagdoyan. Well----
        Senator Thune. How can the marketplace continue disbursing
    taxpayer dollars without receiving any documentation in
    response to its request?
        Mr. Bagdoyan. Well, we were automatically re-enrolled
    without any action on our part for all 11 applicants, and then
    subsequently we found out that 6 of them, as I mentioned in my
    statement, had been indeed dropped from coverage because they
    had not submitted any documents in response to that. Then to
    carry that one step further, acting again as typical consumers,
    we sought to restore our coverage, and we were successful five
    out of six times.
        Senator Thune. Yes. All right.
        Mr. Chairman, I would just simply say that these, I think,
    are really troubling results, 11 out of 12. I would say to the
    Senator from Oregon, I mean, I think that we need to drill down
    and get to the bottom of this. I do not think you can discount
    or write off this kind of research and report.
        You couple that with, in June, the HHS OIG report revealed
    that the administration could not verify whether nearly $3
    billion in subsidies was properly disbursed to insurance
    companies during the first 4 months of 2014. These are
    significant failures in this system. They need to be addressed.
    I appreciate the hearing here, Mr. Chairman, and I hope that we
    can continue this dialogue with you, Mr. Bagdoyan, as you
    continue your work to determine how to stop this sort of waste
    of taxpayer dollars in the future.
        Thank you, Mr. Chairman.
        The Chairman. We are going to turn to Senator Wyden for a
    question, and after that will be Senator Portman.
        Senator Wyden. Mr. Chairman, I am not even going to ask a
    question. I just want to respond to my colleague, because he
    knows I am always willing to work with him, always willing to
    work in a bipartisan way. But let us review what has just
    happened. I asked Mr. Bagdoyan about whether he uncovered any
    real individuals who fraudulently obtained health coverage
    using these techniques. He answered ``no.''
        During the two previous enrollment periods, the agency
    rescinded a quarter of a million individuals' health insurance
    because they were not able to validate their documents. So we
    have to work together, there is no question here.
        I am willing to look at all the ramifications of these 11
    applicants, but let us do it in a bipartisan way, and let us do
    it when we actually have some recommendations. Once again, Mr.
    Bagdoyan said he does not have any recommendations to give us.
        The Chairman. Well, I want to announce we are doing it in a
    bipartisan way. I do not think we can ignore some of this
    testimony.
        Senator Portman?
        Senator Portman. Thank you, Mr. Chairman. Mr. Bagdoyan,
    thank you for your help on this and your work with us on the
    PSI Subcommittee looking into the same thing.
        My friend, the ranking member, talked about how HHS has
    been responsive. You have indicated they have not been
    responsive in providing information. Since you mentioned that I
    have gotten 30,000 pages of documents, I will tell you only
    2,000 of those pages are responsive to anything we asked about,
    and we are still getting delay, delay, delay.
        All we are asking for right now is just a schedule to
    submit documents. If we have time, I would like to hear your
    response to that, but I know from talking to your folks that
    you have the same frustration.
        With regard to this issue, there is clearly a policy
    problem here, not just the fact that 11 of 12 of these
    fictitious people got through and were automatically re-upped,
    and then when some were kicked out of the system, five out of
    six were brought back in after a phone call to HHS when they
    should not have been.
        So, clearly we have a problem here. But I think the
    statistical example of 12 might not be as significant as what
    you found out in terms of policy, so let me ask you a couple of
    questions about that. Your statement mentions that GAO failed
    an initial identity-proofing step in the application process.
    In other words, your people were fictitious so they could not
    get through the online application process.
        Mr. Bagdoyan. That is right.
        Senator Portman. But GAO was able to proceed past this step
    after calling HHS. Can you describe what GAO did to verify the
    identity for these applications and why that is significant?
        Mr. Bagdoyan. Well, as I mentioned earlier, we were able to
    obtain coverage by essentially following the system's own
    instructions. We failed the initial online test; we contacted
    the contractor who does the identity proofing, and they could
    not clear it; then they instructed us to call the marketplace,
    which we did; and then, based on self-attestation of
    information, we obtained coverage.
        Senator Portman. So it was a phone call after getting
    denied twice, and through the self-attestation, people got back
    in. So, I mean, this is a policy issue. This is not, again,
    just a statistical quirk that somehow your people snuck in.
    This is an HHS policy.
        Mr. Bagdoyan. Yes. We would view that, Senator, as at least
    an indicator of a control gap. I know it is a technical, nerdy
    kind of thing to say but----
        Senator Portman. Yes. Clearly a control gap. Self-
    attestation is a policy that they have. By a phone call, even
    though you get rejected, rejected, you can get in just by a
    self-attestation.
        Mr. Bagdoyan. That is correct.
        Senator Portman. With no proof.
        As another example, you noted that, in all 11 cases, GAO
    was asked to submit documents that showed eligibility for
    subsidies. In some cases, GAO submitted only some of the
    required documents but was nonetheless able to continue to
    receive coverage and subsidies. That was because of the so-
    called good faith exemption.
        Could you describe that rule--again, it is a policy--and
    why it enabled GAO to receive coverage and subsidies, even when
    it submitted only some of the required documents, and the legal
    basis that HHS used in implementing it?
        Mr. Bagdoyan. Right. In terms of the legal basis, Senator
    Portman, we are awaiting a response from CMS, and our attorneys
    have been in touch with their attorneys, have had some
    discussions. So, we are trying to get some clarity on that.
        So, under the good faith exemption or provision, whatever
    the term of art is, essentially the applicant is compliant with
    their obligation to submit documents as long as they submit one
    out of the however many they have been asked to submit.
        Senator Portman. So again, your results indicate, as these
    applications show, that this is not a result of a statistical
    quirk that you found, it is the result of HHS policy being
    implemented as planned. I think anybody who cares about the
    Affordable Care Act should be concerned about this policy,
    because it allows people to continue receiving subsidies
    without HHS making a serious attempt to verify eligibility. So
    I know we should do more research into this--we are looking
    forward to your report--but these are policy issues that are
    being applied today as we talk.
        Finally, your statement notes that this investigation was
    conducted with limited back-stopping. Can you describe what
    back-stopping is and why limited back-stopping is important?
        Mr. Bagdoyan. Sure. Limited back-stopping essentially
    involves the extent to which we employ investigative
    techniques. This was pretty much--I do not want to speak for my
    colleague, Director McElrath, who runs the investigative side
    of things, but basically it was a pretty simple thing to do
    using commonly available software, materials, and other
    approaches.
        Senator Portman. So in sum, you did not have any inside
    information that you used about how the ACA works or does not
    work. You came at it just as any consumer would----
        Mr. Bagdoyan. Right.
        Senator Portman [continuing]. Which makes your results,
    again, more troubling than they might otherwise be. I think
    these are really important aspects to your report, and I think
    from a legislative perspective, an oversight perspective, it
    makes this much more serious.
        The final thing I will say is, the amount of confusion this
    is causing people who legitimately are trying to get a subsidy
    is unbelievable. H&R Block says two-thirds of people are either
    having their tax refunds cut or getting a tax bill.
        IRS has told me that half of the people this year are in
    that situation. So this is not just about verification flaws.
    As you have said, the lack of controls and this lack of balance
    between accessibility, pushing people to get enrollment numbers
    up, versus the verification, is also causing a lot of confusion
    for consumers.
        Thank you, Mr. Chairman.
        The Chairman. Thank you.
        Senator Scott?
        Senator Scott. Thank you, Mr. Chairman.
        Good morning.
        Mr. Bagdoyan. Good morning, Senator.
        Senator Scott. I have a quick question for you: did you
    look for any real people who attempted to deceive the system?
        Mr. Bagdoyan. Good question. We did not, as I mentioned
    earlier.
        Senator Scott. Thank you.
        Is it your job to figure out the number of fraudulent
    accounts receiving subsidies and health care coverage on
    HealthCare.gov?
        Mr. Bagdoyan. Not at this stage of our work.
        Senator Scott. All right.
        Of the 50,000 taxpayers who filed returns based on
    inaccurate subsidy data, how many of those did you review?
        Mr. Bagdoyan. None.
        Senator Scott. Because you are not the IRS?
        Mr. Bagdoyan. That is correct.
        Senator Scott. All right.
        There is no doubt that HealthCare.gov, in 2013, was a
    disaster, a $400-million website that became synonymous with
    failure. We had a constituent in South Carolina who was trying
    to figure out how to get his information off the website that
    was used erroneously. We could not get a response from CMS. We
    finally had a committee hearing and Administrator Tavenner was
    there, and we were able to get some information and help solve
    that problem.
        One of the things that concerns me the most about the
    challenges that we face is that, when you combine the
    subsidies, including the Medicaid subsidies, we are talking
    about $1.7 trillion of subsidies. In the year 2025, we will
    have about 31 million Americans still without coverage.
    Perhaps, after billions and billions of dollars of subsidies
    that have been received by people who do not deserve them, it
    may indicate why we will still have 31 million Americans
    without insurance.
        My question to you is, outside of your investigation, how
    easy is it for most consumers to falsify their information in
    order to receive higher subsidies, based on your fictitious
    individuals?
        Mr. Bagdoyan. Well, as I mentioned earlier in response to
    Senator Portman, it was relatively straightforward for us. I
    certainly cannot project that to the typical consumer, but
    there is a lot of information out there available for people
    who are committed to performing fraudulent activities.
        Senator Scott. It appears to me that there seems to be
    almost a perverse incentive for relaxed accountability as it
    relates to internal controls because it seems to have led, and
    will continue to lead, towards higher enrollments. Thoughts?
        Mr. Bagdoyan. I would take you to my opening statement
    regarding the balance between access and control. It appears,
    based on our limited results from our undercover tests, that
    the balance is more towards access than control. Our work
    continues. We will have more definitive views on that in the
    future.
        Senator Scott. Said in fewer words, if it is tilted more
    towards access than controls, the chances are pretty high that
    someone will be able to get on, as you did with 11 fictitious
    individuals, and get coverage even if they were doing it at
    home on HealthCare.gov versus the GAO doing it. Basically the
    same result. Is there anything that would lead to a different
    conclusion, from your experience so far?
        Mr. Bagdoyan. Well, I think the forensic audit that we will
    conduct on the entire population will give us a complete
    picture of what happened, whether there were additional red
    flags that we need to follow up on. But at this point I cannot
    really project one way or the other.
        Senator Scott. I would appreciate a follow-up of that
    information in writing, then. That would be wonderful. Thank
    you.
        I would say to my colleagues that the reality of it is,
    what happens when you have individuals receiving subsidies that
    they have not earned, do not have a right to, when it is $1.7
    trillion over the next 8 or 9 years, what that results in in
    South Carolina, what we have seen this past year, is between a
    31-percent and as high on some plans as a 50-percent increase
    in premiums. That is astounding. It is ridiculous. It is
    unaffordable.
        As those premiums continue to climb, what we have also seen
    is your deductibles get higher, more expensive. Your out-of-
    pocket expenses are higher, more expensive. The number of
    facilities, whether it is hospitals or doctors, that are
    available to use that access card continues to dwindle down,
    and down, and down. I am not sure what good access is if you
    have a card when there is not a health care provider on the
    other side.
        Thank you, Mr. Chairman.
        The Chairman. Thank you, Senator.
        Senator Coats?
        Senator Coats. Thank you, Mr. Chairman.
        I am not surprised with anything I have heard here this
    morning. I go to the Senate floor once a week to share with my
    colleagues proven waste, fraud, and abuse in any number of
    ways, in any number of agencies.
        We have a bloated, bureaucratic, dysfunctional government
    that tries to do--with real intent, good intent--more than it
    can handle. Thank God for GAO and for the nonpartisan work that
    you do to help us point out ways in which we can help a
    struggling taxpayer not have to pay so much money in to
    Washington to fund something that does not work.
        So I really appreciate your being here; I appreciate your
    candidness. How we can take this for anything other than the
    canary in the mine, saying, hey, there is a problem here, let
    us get after it, I just don't know. What really is discouraging
    is, and I would like you to give me a little more detail on
    this, you take these findings to CMS, and CMS basically gives
    you a stall: we are waiting for the attorneys to respond.
        CMS should say, ``Thank you, thank you, you have pointed
    out some weaknesses here that we were not aware of. We want to
    be efficient. Actually, we want to implement the President's
    program, we want to sign up more people.'' I mean, they are
    obviously following that mandate. ``This will help us because,
    if this becomes public, the public is going to say it is just
    one more example of another government bloated, bureaucratic
    inefficiency, ineffectiveness, preventing people who need the
    insurance from getting the insurance, giving insurance to
    people who do not qualify, and it is fraudulent.''
        I hear that, ``Well, we have to go through all this process
    and so forth before we even implement things.'' They should not
    have to wait for you for recommendations. You have told them:
    here is the problem.
        I would think they would say, ``Thank you. We are going to
    go after this right now and try to fix some of these things.''
    You have pointed out something that obviously, sure, it is
    fictitious, but I mean, if this is not an alarm bell in terms
    of dysfunction, I do not know what is.
        So can you describe a little bit more your efforts with CMS
    to get them to say, ``Thank you, yes, we see the weaknesses
    here, and we are going to take steps to go forward,'' instead
    of some process that is going to go through the legal system
    and through the bureaucratic system that is going to take
    months, if not years, while more and more waste and fraud just
    continues.
        Mr. Bagdoyan. Sure. Thank you for your question, Senator
    Coats. Our exchanges with CMS have been fruitful at times, and
    we have gotten their attention on some of the key issues that--
    --
        Senator Coats. But what about this issue?
        Mr. Bagdoyan. Which one is that?
        Senator Coats. What you are presenting here. I wrote this
    down. You said you went to CMS and alerted them to the problem,
    and you are waiting for their response.
        Mr. Bagdoyan. Well, that actually refers to the good faith
    exemption. We are waiting for their legal analysis, for their
    basis----
        Senator Coats. Yes. Yes. Yes. We hear this all the time.
        Mr. Bagdoyan. Yes. They are working through the document
    verification process.
        Senator Coats. Yes.
        Mr. Bagdoyan. So that is just one matter. There are----
        Senator Coats. Well, did it ring any alarm bells over at
    CMS? Did anybody say, ``Wow, thanks so much for bringing this
    to our attention; we need to plug these holes right away''?
        Mr. Bagdoyan. I do not know whether ``thank you'' was used,
    but they are aware of the problems that we flagged.
        Senator Coats. But they did not just say, well, this is
    fictitious, so therefore what you are presenting us here is
    worthless?
        Mr. Bagdoyan. No, I cannot say that that is what they said.
        Senator Coats. Well, I am happy to hear that. I could point
    out waste of the day, waste of the hour, or waste of the
    minute, thanks to GAO and other investigative agencies that
    have pointed out that we have a dysfunctional government and we
    are wasting taxpayer dollars faster than we can send them to
    Washington.
        Mr. Chairman, thank you.
        The Chairman. Thank you, Senator.
        Senator Burr, you are next.
        Senator Burr. Thank you, Mr. Chairman. Let me say thank you
    to you and all the folks at GAO for the great work that you do
    and for the difficult task that you are asked to do.
        According to your testimony, people applying for coverage
    are required to attest that the documents they are providing
    are not false. CMS officials say that contractors processing
    these documents are not required to verify that these documents
    are authentic, and that the contractor is not equipped to
    identify fraud.
        CMS has also stated that there is no indication of
    meaningful levels of fraud. Do you think CMS made this
    statement because nobody is monitoring the enrollment process
    in a meaningful way to detect the fraud that is clearly
    occurring in the cases of fake GOA enrollees?
        Mr. Bagdoyan. Yes. I think the statement from CMS is based
    on the fact that the contractor itself has not reported any
    fraud. But as you pointed out, they are not tasked with looking
    for fraud. That is not in their work order, that is not----
        Senator Burr. So it is not dissimilar to the question that
    Senator Wyden asked you: how many people did you find? You had
    not been asked to go look, therefore you did not find any,
    right?
        Mr. Bagdoyan. At this stage, that is correct. But once we
    move over to the forensic look at the entire enrollee database,
    then that might yield different results.
        Senator Burr. Mr. Bagdoyan, who is ultimately in charge of
    ensuring enrollment program integrity? Is it the CMS
    Administrator? Is it the CMS Deputy Administrator? Is it the
    Chief Information Officer? Who is actually the one on the hook
    for ensuring that fraud is not occurring within the enrollment
    process?
        Mr. Bagdoyan. Sure. As a general proposition, I would say
    that the tone at the top is important, whether it is the
    Administrator who is responsible for CMS and his or her staff.
    It is leadership that sets the controls in place, ensures that
    they are working as intended, monitors their effectiveness, and
    then responds to any changes in the environment that may
    necessitate adjustments or changes.
        Senator Burr. Senator Wyden came to an interesting
    conclusion, that what you have testified on really is not valid
    because none of the individual enrollees filed an income tax
    return, therefore you did not allow the system as designed to
    catch that they should not be there.
        Mr. Bagdoyan. Yes.
        Senator Burr. Well, your own testimony says that, in
    correspondence between the applicant and the marketplace, on
    four of the individuals, the marketplace's correspondence to
    the applicant referred to their filed tax returns. In other
    words, the marketplace basically said four of your applicants
    filed income tax returns and that is what we make our judgment
    on, when in fact none of them filed tax returns.
        Mr. Bagdoyan. That is correct.
        Senator Burr. And you stated that in your testimony.
        So let me just say to my colleagues, what is my take-away
    here? Not only do we have policy deficiencies, but we certainly
    have indications of incompetence or intent to ignore the law.
    That should be the concern of this committee, it should be the
    concern of the American people, and I hope that GAO will
    continue with the instructions from the chair to look deeply
    into this. Thank you for your work.
        Mr. Bagdoyan. Thank you, Senator.
        The Chairman. Thank you, Senator.
        Senator Casey?
        Senator Casey. Mr. Chairman, thanks very much.
        I want to say first to Mr. Bagdoyan that, in my experience
    as an elected official in Pennsylvania, one of the most
    significant parts of that time as a public official was as the
    State Auditor General. It is an elected position. I was elected
    to two terms, so I spent 8 years doing it. I have some sense,
    even though I was overseeing a group of auditors or
    investigators, of the difficulty of your work and a good sense
    of the reaction you get when your work is completed. I respect
    and appreciate what you do; it is difficult.
        Mr. Bagdoyan. Thank you.
        Senator Casey. I want to ask you one question, more just to
    make sure the record is clear, and then I want to get into more
    of the specific health care issues. I want to make sure I have
    this right. Based upon your testimony, is it possible to make
    generalizations about the full population of applicants in the
    marketplace?
        Mr. Bagdoyan. No, it is not, and that was not the intent of
    our undercover tests.
        Senator Casey. I want to say, just preliminarily, we know,
    those of us who voted for the Affordable Care Act, that there
    are issues we have to correct. It is not perfect legislation,
    nor is any legislation of that complexity and impact on health
    care and our economy. A number of us have voted for, already,
    improvements to the law.
        I think what is indisputable, though, in addition to the
    fact that it is not perfect, is that there has been a
    substantial benefit conferred upon a lot of Americans that
    would not have it otherwise. I am not saying this for your
    benefit, really, just for the record: 16.4 million people
    gained health insurance coverage in the time since 2010.
        In Pennsylvania, for example, 472,697 Pennsylvanians
    selected plans or were automatically re-enrolled through the
    health insurance marketplace. About 81 percent of
    Pennsylvanians who selected health insurance plans were
    determined eligible for financial assistance. There are lots of
    examples of individuals----
        Two individuals from southeastern Pennsylvania, Jenny and
    David, are self-employed, have two sons in college. Jenny is a
    breast cancer survivor, worried about being denied health
    insurance because of her pre-existing condition. They were
    spending over $10,000 a year on health insurance. Thanks to
    their ACA plan purchased through HealthCare.gov, they now are
    spending about $3,000 per year, so the savings helps them on
    college costs. So that is just by way of background.
        But I want to ask you a specific question about your work.
    Do you think there are additional checks that can be imposed
    upon the system, so to speak, that could help identify fraud,
    which the GAO did not test?
        Mr. Bagdoyan. Sure. Thank you for your question. That would
    be part, a major part, of our focus for the ongoing work. As I
    mentioned earlier in response to another Senator's question, we
    will be applying a set of appropriate benchmarks to how we map
    out the current process with information that we obtained from
    our undercover work. The forensic work will inform that and go
    in tandem.
        Once we apply those criteria, we will be able to identify
    how to best respond to them: what are their risk assessments,
    their implementation of specific controls for specific parts of
    the enrollment process? That will be key, but that work is
    ongoing, so I cannot really say one way or the other which way
    it will go with the recommendations.
        Senator Casey. And part of that is, I guess--and I know
    this is always difficult in an auditing context--when you have
    a mandate but you also have limited resources, you cannot audit
    or review every transaction or every part of the system. So you
    do sometimes have to make a determination based upon risk: what
    is a higher risk, what is a----
        Mr. Bagdoyan. Sure. You prioritize where you attack first
    in terms of control gaps. Sure.
        Senator Casey. I want to ask you too to what extent you
    believe the IRS has the capacity to identify fraudulent, so-
    called advance premium tax credit or APTC claims? Do you have
    any sense of that?
        Mr. Bagdoyan. I do not. That is not part of our scope in
    this ongoing work, but I believe there are other mission teams
    within GAO that are taking a look at that. I do not know the
    specific aspects, but I believe IRS capacity and capability is
    part of that work.
        Senator Casey. Well, we are grateful for your work. It is
    difficult, but it is essential. We want to make sure that we
    get this right over time. One of the ways to inform how we do
    our work in terms of legislative change or corrections is to
    have information from GAO and other sources. So we appreciate
    your work. Thank you.
        Mr. Bagdoyan. Thank you, Senator.
        The Chairman. Senator Wyden would like to make a comment.
        Senator Wyden. One last ``yes'' or ``no'' question, Mr.
    Bagdoyan. Is it correct that CMS asked for these 11 fictitious
    cases and GAO did not give them to the agency?
        Mr. Bagdoyan. That is correct.
        Senator Wyden. I would again say, colleagues, it is pretty
    hard to evaluate something you are not told about. You
    certainly cannot fix something you do not know about. By the
    way, on Senator Burr's question, you could have gotten an
    answer to it if you had actually been able to get information
    about these 11 fictitious cases. And by the way, my staff asked
    for the information about these 11 fictitious cases.
        So to me the message here--and Chairman Hatch knows that I
    am interested in working with him in a bipartisan way. I think
    I am about as bipartisan on health care as anybody in the
    Senate. I just think that, without these recommendations--and
    we have been told they are not ready to go--this is premature.
        At some point, I believe GAO, because I have worked with
    them often in the past and admire their professionalism, will
    give us some recommendations. Then we can work in a bipartisan
    way. But I hope that people following this will recognize that,
    as of this morning, the Government Accountability Office has
    not uncovered any instances of real people committing fraud as
    part of this inquiry. I think that is the important take-away
    of this morning.
        Thank you, Mr. Chairman.
        The Chairman. Thanks.
        Mr. Bagdoyan, it is true that your job is to look for
    fraud. Your job is to look for misconceptions. Your job is to
    look for things that are wrong, or out of whack, or whatever
    you want to call it, and that is what you are doing, right?
        Mr. Bagdoyan. That is correct, Senator.
        The Chairman. And you have done it honestly, right?
        Mr. Bagdoyan. Yes.
        The Chairman. And you are disturbed by the fact that these
    discrepancies exist, even though it has been a limited
    investigation. Is that right?
        Mr. Bagdoyan. Well, we do have concerns about the red flags
    we have detected in terms of the control environment.
        The Chairman. Well, you are expressing those concerns here
    today. I have concerns too. A lot of people on our side do not
    believe that Obamacare is ever going to work and that it is
    just going to continue to take us downhill with more and more
    costs, more and more expenses, and more and more fraud. This is
    not the only instance of fraud either, is it?
        Mr. Bagdoyan. Well, I cannot comment on that.
        The Chairman. All right.
        Mr. Bagdoyan. That is out of our scope. But if I may, Mr.
    Chairman, try to explain our decision to decline----
        The Chairman. What I do not want is, I do not want people
    just slapping this off like this is not important. It is very
    important----
        Mr. Bagdoyan. Right. I would like to, if I may, again----
        The Chairman [continuing]. And I want you to tell us why it
    is so very important.
        Mr. Bagdoyan. It is important in terms of getting the
    responses that we need as our work is ongoing. I would
    respectfully ask that I might explain why we declined to
    provide the identities of our 11 applicants.
        The Chairman. Sure. I would like you to explain that.
        Mr. Bagdoyan. It is fully consistent with GAO policy,
    protocols, and practice that we do not divulge any information
    related to our sources, methods, and investigative techniques
    to any entity so that we protect those for future use. So that
    is our perspective on that issue.
        The Chairman. Well, why is that? I mean, why can you not
    divulge----
        Mr. Bagdoyan. Well, we cannot because we have the sources
    and methods that I mentioned that need to stay confidential,
    that are in general use by GAO in certain circumstances. So
    revealing those would basically give up the ghost.
        The Chairman. Well, my understanding, through my service in
    the Senate, is that the GAO does a very good job of trying to
    get to the bottom of problems in our society. I think you are a
    good illustration of that effort by GAO.
        Now, this does not mean that you are going to cease trying
    to find fraud and mismanagement and so forth in the future,
    does it?
        Mr. Bagdoyan. Well, this work is ongoing.
        The Chairman. Right.
        Mr. Bagdoyan. I think we are in it for the long term.
        The Chairman. And we will probably have you back again so
    that we can figure out, what is our job up here? What can we
    do? We cannot just dismiss these type of things; we have to do
    something about them. Hopefully we can do that with your help.
        Mr. Bagdoyan. Thank you.
        The Chairman. With that, we will recess until further
    notice.
        [Whereupon, at 11:05 a.m., the hearing was concluded.]

                                A P P E N D I X

                  Additional Material Submitted for the Record

                                  ----------

     Prepared Statement of Seto J. Bagdoyan, Director, Forensic Audits and
            Investigative Service, Government Accountability Office
                                 gao highlights
    Why GAO Did This Study
        PPACA provides for the establishment of health-insurance exchanges,
    or marketplaces, where consumers can compare and select private health-
    insurance plans. The act also expands the availability of subsidized
    health-care coverage. The Congressional Budget Office estimates the
    cost of subsidies and related spending under the act at $28 billion for
    fiscal year 2015. PPACA requires verification of applicant information
    to determine eligibility for enrollment or subsidies.

        GAO was asked to examine controls for application and enrollment
    for coverage through the federal Marketplace. This testimony describes
    (1) the results of GAO's undercover testing of the Marketplace's
    eligibility and enrollment controls, including opportunities for
    potential enrollment fraud, for the act's first open-enrollment period;
    and (2) additional undercover testing in which GAO sought in-person
    application assistance.

        This statement is based on GAO undercover testing of the
    Marketplace application, enrollment, and eligibility-verification
    controls using 18 fictitious identities. GAO submitted or attempted to
    submit applications through the Marketplace in several states by
    telephone, online, and in-person. Details of the target areas are not
    disclosed, to protect GAO's undercover identities. GAO's tests were
    intended to identify potential control issues and inform possible
    further work. The results, while illustrative, cannot be generalized to
    the full population of applicants or enrollees. GAO provided details to
    CMS for comment, and made technical changes as appropriate.
    _______________________________________________________________________
                   patient protection and affordable care act
    Observations on 18 Undercover Tests of Enrollment Controls for Health-
            Care Coverage and Consumer Subsidies Provided Under the Act
    What GAO Found
        To assess the enrollment controls of the federal Health Insurance
    Marketplace (Marketplace), GAO performed 18 undercover tests, 12 of
    which focused on phone or online applications. During these tests, the
    Marketplace approved subsidized coverage under the Patient Protection
    and Affordable Care Act (PPACA) for 11 of the 12 fictitious GAO
    applicants for 2014. The GAO applicants obtained a total of about
    $30,000 in annual advance premium tax credits, plus eligibility for
    lower costs due at time of service. For 7 of the 11 successful
    fictitious applicants, GAO intentionally did not submit all required
    verification documentation to the Marketplace, but the Marketplace did
    not cancel subsidized coverage for these applicants. While these
    subsidies, including those granted to GAO's fictitious applicants, are
    paid to health-care insurers, and not directly to enrolled consumers,
    they nevertheless represent a benefit to consumers and a cost to the
    government. GAO's undercover testing, while illustrative, cannot be
    generalized to the population of all applicants or enrollees. GAO
    shared details of its observations with the Centers for Medicare and
    Medicaid Services (CMS) during the course of its testing, to seek
    agency responses to the issues raised. Other observations included the
    following:

        The Marketplace did not accurately record all inconsistencies.
            Inconsistencies occur when applicant information does not match
            information available from Marketplace verification sources.
            Also, the Marketplace resolved inconsistencies from GAO's
            fictitious applications based on fictitious documentation that
            GAO submitted. Overall, according to CMS officials, the
            Marketplace did not terminate any coverage for several types of
            inconsistencies, including Social Security data or
            incarceration status.
        Under PPACA, filing a federal income-tax return is a key control
            element, designed to ensure that premium subsidies granted at
            time of application are appropriate based on reported applicant
            earnings during the coverage year. GAO, however, found errors
            in information reported by the Marketplace for tax filing
            purposes for 3 of its 11 fictitious enrollees, such as
            incorrect coverage periods and subsidy amounts.
        The Marketplace automatically reenrolled coverage for all 11
            fictitious enrollees for 2015. Later, based on what it said
            were new applications GAO's fictional enrollees had filed--but
            which GAO did not itself make--the Marketplace terminated
            coverage for 6 of the 11 enrollees, saying the fictitious
            enrollees had not provided necessary documentation. However,
            for five of the six terminations, GAO subsequently obtained
            reinstatements, including increases in premium tax-credit
            subsidies.

        For an additional six applicants, GAO sought to test the extent to
    which, if any, in-person assisters would encourage applicants to
    misstate income in order to qualify for income-based subsidies during
    coverage year 2014. However, GAO was unable to obtain in-person
    assistance in 5 of the 6 undercover attempts. For example, an assister
    told GAO that it only provided help for those applying for Medicaid and
    not health-care insurance applications. Representatives of these
    organizations acknowledged the issues GAO raised in handling of the
    inquiries. CMS officials said that their experience from the first
    open-enrollment period helped improve training for the 2015 enrollment
    period.

    _______________________________________________________________________

        Chairman Hatch, Ranking Member Wyden, and Members of the Committee:

        I am pleased to be here today to discuss enrollment for health-care
    coverage obtained through the federal health-insurance exchange
    established under the Patient Protection and Affordable Care Act
    (PPACA),\1\ and in particular, to discuss results of our undercover
    testing of eligibility and enrollment controls for the 2014 coverage
    year.\2\ We presented preliminary results in July 2014.\3\ Among other
    things, PPACA provides subsidies to those eligible to purchase private
    health-insurance plans who meet certain income and other requirements,
    and with those subsidies and other costs, represents a significant,
    long-term fiscal commitment for the federal government. According to
    the Congressional Budget Office, the estimated cost of subsidies and
    related spending under the act is $28 billion for fiscal year 2015,
    rising to $103 billion for fiscal year 2025, and totaling $849 billion
    for fiscal years 2016-2025. While subsidies under the act are not paid
    directly to enrollees, participants nevertheless benefit through
    reduced monthly premiums or lower costs due at time of service, such as
    copayments. Because subsidy costs are contingent on who obtains
    coverage, enrollment controls that help ensure only qualified
    applicants are approved for coverage with subsidies are a key factor in
    determining federal expenditures under the act.\4\
    ---------------------------------------------------------------------------
        \1\ Pub. L. No. 111-148, 124 Stat. 119 (Mar. 23, 2010), as amended
    by the Health Care and Education Reconciliation Act of 2010 (HCERA),
    Pub. L. No. 111-152, 124 Stat. 1029 (Mar. 30, 2010). In this testimony,
    references to PPACA include any amendments made by HCERA.
        \2\ Specifically, our review covered the first open-enrollment
    period, from October 1, 2013 to March 31, 2014, as well as follow-on
    work through 2014 and into 2015 after close of the open-enrollment
    period.
        \3\ GAO, Patient Protection and Affordable Care Act: Preliminary
    Results of Undercover Testing of Enrollment Controls for Health-Care
    Coverage and Consumer Subsidies Provided Under the Act, GAO-14-705T
    (Washington, D.C.: July 23, 2014).
        \4\ According to Department of Health and Human Services' (HHS)
    Centers for Medicare & Medicaid Services (CMS) data, about 11.7 million
    people selected or were automatically reenrolled into a 2015 health
    insurance plan under the act. A high fraction of those enrollees--87
    percent, in states using the HealthCare.gov system--qualified for the
    premium tax-credit subsidy provided by the act, which is described
    later in this statement.

        PPACA, signed into law on March 23, 2010, expands the availability
    of subsidized health-care coverage, and provides for the establishment
    of health-insurance exchanges, or marketplaces, to assist consumers in
    comparing and selecting among insurance plans offered by participating
    private issuers of health-care coverage.\5\ Under PPACA, states may
    elect to operate their own health-care exchanges, or may rely on the
    federally facilitated exchange, known to the public as HealthCare.gov.
    These marketplaces were intended to provide a single point of access
    for individuals to enroll in private health plans, apply for income-
    based subsidies to offset the cost of these plans--which are paid
    directly to health-insurance issuers--and, as applicable, obtain an
    eligibility determination for other health coverage programs, such as
    Medicaid or the Children's Health Insurance Program. The Department of
    Health and Human Services' (HHS) Centers for Medicare and Medicaid
    Services (CMS) is responsible for overseeing the establishment of these
    online marketplaces, and the agency maintains the federally facilitated
    exchange. At the time we began the work described in this statement,
    CMS was operating HealthCare.gov, also known as the Health Insurance
    Marketplace (Marketplace) in about two-thirds of the states.\6\
    ---------------------------------------------------------------------------
        \5\ Specifically, the act required, by January 1, 2014, the
    establishment of health-insurance exchanges in all states. In states
    not electing to operate their own exchanges, the federal government was
    required to operate an exchange.
        \6\ Specifically, in 34 states, the federal government operated
    individual exchanges. Two states operated their own exchanges, but
    applicants applied through HealthCare.gov. As of March 2015, the number
    of states had grown to 37, according to HHS's Office of the Assistant
    Secretary for Planning and Evaluation, with the Marketplace accounting
    for 76 percent (8.8 million) of consumers' plan selections.

        To be eligible to enroll in a qualified health plan offered through
    a marketplace, an individual must be a U.S. citizen or national, or
    otherwise lawfully present in the United States; reside in the
    marketplace service area; and not be incarcerated (unless incarcerated
    while awaiting disposition of charges). Marketplaces, in turn, are
    required by law to verify application information to determine
    eligibility for enrollment and, if applicable, determine eligibility
    for the income-based subsidies.\7\ These verification steps include
    validating an applicant's Social Security number, if one is provided;
    \8\ verifying citizenship, status as a national, or lawful presence
    with the Social Security Administration (SSA) or the Department of
    Homeland Security (DHS); and verifying household income and family size
    against tax-return data from the Internal Revenue Service (IRS), as
    well as data on Social Security benefits from the SSA.
    ---------------------------------------------------------------------------
        \7\ 42 U.S.C. Sec. 18081(c); 45 C.F.R. Sec. Sec. 155.310, 155.315,
    155.320.
        \8\ An exchange must require an applicant who has a Social Security
    number to provide the number. 42 U.S.C. Sec. 18081(b)(2) and 45 CFR
    Sec. 155.310(a)(3)(i).

        My statement today presents results and analysis from work
    originally requested by a number of congressional requesters.\9\
    Specifically, today's statement (1) describes the final results of our
    undercover testing of the federal Marketplace's application,
    enrollment, and eligibility verification controls, including
    opportunities for potential enrollment fraud, for the act's first open-
    enrollment period ending March 31, 2014; and (2) describes additional
    undercover testing in which we sought in-
    person consumer assistance for federal Marketplace applications. Our
    control testing began in January 2014 and concluded in April 2015.
    ---------------------------------------------------------------------------
        \9\ Our original requesters were: in the U.S. Senate, the then-
    ranking member of the Committee on Homeland Security and Government
    Affairs and the then-ranking member of the Committee on Finance; and in
    the U.S. House of Representatives, the then-chairman of the Committee
    on Ways and Means and the then-chairman of the Committee on Ways and
    Means, Subcommittee on Oversight.

        Our July 2014 testimony, which described the results of our work up
    to that time, focused on application for, and approval of, coverage for
    fictitious applicants.\10\ My statement today extends that work to the
    post-application process, including our maintenance of the fictitious
    applicant identities throughout 2014 and into 2015, payment of
    subsidized premiums on policies we obtained, and the Marketplace's
    verification process for applicant documentation. Thus, taken together,
    our two statements now cover the entire process of first obtaining, and
    then continuing, coverage for our fictitious applicants, from early
    2014 into 2015.
    ---------------------------------------------------------------------------
        \10\ GAO-14-705T.

        To perform our undercover testing of the Marketplace application,
    enrollment, and eligibility-verification process, we created 18
    fictitious identities for the purpose of making applications for
    individual health-care coverage by telephone, online, and in-
    person.\11\ Because the federal government, at the time of our review,
    operated a marketplace on behalf of the state in about two-thirds of
    the states, we focused our work on those states. We selected three of
    these states for our undercover applications, and further selected
    target areas within each state.\12\ To maintain independence in our
    testing, we created our applicant scenarios without knowledge of
    specific control procedures, if any, that CMS or other federal agencies
    may use in accepting or processing applications. We thus did not create
    the scenarios with intent to focus on a particular control or
    procedure.\13\ The results obtained using our limited number of
    fictional applicants are illustrative and represent our experience with
    applications in the three states we selected. They cannot, however, be
    generalized to the overall population of all applicants or enrollees.
    In particular, our tests were intended to identify potential control
    issues and inform possible further work. We shared details of our work
    with CMS during the course of our testing, to seek agency responses to
    the issues we raised. We also provided details prior to this hearing,
    and made technical changes as appropriate.
    ---------------------------------------------------------------------------
        \11\ For all our applicant scenarios, we sought to act as an
    ordinary consumer would in attempting to make a successful application.
    For example, if, during online applications, we were directed to make
    phone calls to complete the process, we acted as instructed.
        \12\ We based the state selections on factors including range of
    population size, mixture of population living in rural versus urban
    areas, and number of people qualifying for income-based subsidies under
    the act. We selected target areas within each state based on factors
    including community size. To preserve confidentiality of our
    applications, we do not disclose here the number or locations of our
    target areas. We generally selected our states and target areas to
    reflect a range of characteristics.
        \13\ We were aware of general eligibility requirements, however,
    from public sources such as websites.

        For 12 of the 18 applicant scenarios, we chose to test controls for
    verifications related to the identity or citizenship/immigration status
    of the applicant.\14\ This approach allowed us to test similar
    scenarios across different states. We made half of these applications
    online and half by phone. In these tests, we also stated income at a
    level eligible to obtain both types of income-based subsidies available
    under PPACA--a premium tax credit and cost-sharing reduction.\15\ Our
    tests included fictitious applicants who provided invalid Social
    Security identities, noncitizens claiming to be lawfully present in the
    United States, and applicants who did not provide Social Security
    numbers. As appropriate, in our applications for coverage and
    subsidies, we used publicly available information to construct our
    scenarios. We also used publicly available hardware, software, and
    materials to produce counterfeit or fictitious documents, which we
    submitted, as appropriate for our testing, when instructed to do so. We
    then observed the outcomes of the document submissions, such as any
    approvals received or requests to provide additional supporting
    documentation. We began this control testing in January 2014 and
    concluded it in April 2015. We also obtained data from CMS on applicant
    submission of required verification documentation. These data listed
    document submission status as of April 2015 for the act's first open-
    enrollment period, including for our undercover applications.
    ---------------------------------------------------------------------------
        \14\ As noted earlier, to be eligible to enroll in a qualified
    health plan offered through a marketplace, an individual must be a U.S.
    citizen or national, or otherwise lawfully present in the United
    States; reside in the marketplace service area; and not be incarcerated
    (unless incarcerated while awaiting disposition of charges).
    Marketplaces, in turn, are required by law to verify application
    information to determine eligibility for enrollment and, if applicable,
    determine eligibility for the income-based subsidies.
        \15\ To qualify for these income-based subsidies, an individual
    must be eligible to enroll in marketplace coverage; meet income
    requirements; and not be eligible for coverage under a qualifying plan
    or program, such as affordable employer-sponsored coverage, Medicaid,
    or the Children's Health Insurance Program. Cost-sharing reduction
    (CSR) is a discount that lowers the amount consumers pay for out-of-
    pocket charges for deductibles, coinsurance, and copayments. Because
    the benefit realized through the CSR subsidy can vary according to
    medical services used, the value to consumers of such subsidies can
    likewise vary.

        For the remaining 6 of our 18 applicant scenarios to examine
    enrollment through the Marketplace, we sought to test only income-
    verification controls. We randomly selected three ``Navigator'' and
    three non-Navigator in-person assisters in our target areas.\16\ For
    half of these 6 applications, our applicant planned to state income
    slightly above the maximum amount allowable for income-based subsidies,
    while for the others, our applicant planned to state income slightly
    below the range eligible for these subsidies. We sought to determine
    the extent to which, if any, in-person assisters might encourage our
    undercover applicants to misstate income in order to qualify for either
    of the income-based PPACA subsidies. We chose to limit our review of
    those providing in-person assistance to the extent we encountered these
    assisters as part of our enrollment control testing. A full examination
    of in-person assistance, including issues other than eligibility and
    enrollment, was beyond the scope of our work. Overall, our review
    covered the act's first open-enrollment period, from October 1, 2013 to
    March 31, 2014, as well as follow-on work through 2014 and into 2015
    after close of the open-enrollment period.
    ---------------------------------------------------------------------------
        \16\ For the 2014 coverage year, CMS awarded $67 million in grants
    for ``Navigators,'' which are individuals or organizations that are to
    provide, without charge, impartial health-insurance information to
    consumers, and to help them complete eligibility and enrollment forms.
    In addition, such aid is also to be available from other in-person
    assisters (``non-Navigators'') who generally perform the same functions
    as Navigators, but are funded through separate grants or contracts.
    Navigators and non-Navigator assisters must complete comprehensive
    training, according to CMS. Through the HealthCare.gov website, CMS
    published a state-by-state list of where in-person assistance can be
    obtained.

        We plan to issue a final report, with recommendations, on our
    undercover eligibility- and enrollment-controls testing. We are
    conducting our audit work in accordance with generally accepted
    government auditing standards. Those standards require that we plan and
    perform the audit to obtain sufficient, appropriate evidence to provide
    a reasonable basis for our findings and conclusions based on our audit
    objectives. We believe that the evidence we obtained provides a
    reasonable basis for our findings and conclusions based on our audit
    objectives. We conducted our related investigative work in accordance
    with investigative standards prescribed by the Council of the
    Inspectors General on Integrity and Efficiency.
       the federal marketplace approved subsidized coverage for 11 of 12
       fictitious applicants in 2014, with coverage continuing into 2015
    We Obtained Coverage for 11 of 12 Fictitious Applicants by Using the
            Telephone
            Application Process and Bypassing Online Identity Verification
        As we described in our July 2014 testimony, the federal Marketplace
    approved subsidized coverage for 11 of 12 fictitious applicants who
    initially applied online or by telephone. For the 11 approved
    applications, we paid the required premiums to put health-insurance
    policies into force. We obtained the advance premium tax credit (APTC)
    in all cases, totaling about $2,500 monthly or about $30,000 annually
    for all 11 applicants. After receiving these premium subsidies, our 11
    fictitious applicants paid premiums at a total annual rate of about
    $12,000. We also obtained eligibility for cost-sharing reduction (CSR)
    subsidies.\17\ The APTC and CSR subsidies are not paid directly to
    enrolled consumers; instead, the federal government pays them to
    issuers of health-care policies on consumers' behalf. However, they
    represent a benefit to consumers--and a cost to the government--by
    reducing out-of-pocket costs for medical coverage.\18\ To receive
    advance payment of the premium tax credit, applicants agree they will
    file a tax return for the coverage year, and must indicate they
    understand that the premium tax credits paid in advance are subject to
    reconciliation on their federal tax return.
    ---------------------------------------------------------------------------
        \17\ Because the benefit realized through the CSR subsidy can vary
    according to medical services used, the value to consumers of such
    subsidies can likewise vary.
        \18\ Even if not obtaining subsidies, applicants can also benefit
    if they obtain coverage for which they would otherwise not qualify,
    such as by not being a U.S. citizen or national, or lawfully present in
    the United States.

        As we also reported in July 2014, for each of our 6 online
    applications (among the group of 12 applications made online and by
    phone), we failed to clear a required identity-checking step, and thus
    could not complete the process online. For online applications, the
    Marketplace employs a process known as ``identity proofing'' to verify
    an applicant's identity.\19\ It does so by using personal and financial
    history on file with a credit reporting agency contracted by the
    Marketplace. The Marketplace generates questions, based on information
    on file with the contractor, that only the applicant is believed likely
    to know.\20\ If an applicant's identity cannot be verified online,
    applicants are directed to call the credit reporting agency for
    assistance.\21\ If the credit reporting agency then cannot verify
    identity, applicants are typically told to contact the federal
    Marketplace or their state-based exchange, credit-reporting agency
    officials told us.
    ---------------------------------------------------------------------------
        \19\ According to CMS, the purpose of identity proofing is to
    prevent someone from creating an account and applying for health
    coverage based on someone else's identity and without their knowledge.
    Although intended to counter such identity theft involving others,
    identity proofing thus also serves as an enrollment control for those
    applying online.
        \20\ According to executives of the contractor that performs the
    identity proofing, about 78 percent of applicants overall that have
    attempted identity proofing online for the 2014 and 2015 application
    cycles were successful, across the federal Marketplace and state
    exchanges combined. The contractor officials said that the 78 percent
    success rate is marginally lower than the general success rate for
    identity-proofing services the contractor provides. This lower rate,
    the contractor told us, is likely due to the health-care exchange
    population being less likely to have an ``electronic footprint'' upon
    which identity proofing is based. The contractor executives said that
    the remaining 22 percent did not necessarily fail the identity
    proofing. In many cases, the contractor was not able to locate the
    applicant in its records, or the applicant did not respond to the
    questions for identity verification.
        \21\ According to the contractor, about 560,000 telephone inquiries
    were made to the contractor from October 2013 to April 1, 2015, after
    applicants did not pass the online identity proofing. In about 35
    percent of those cases, identity could be verified.

        We subsequently were able to obtain coverage for all six of these
    applications that we began online by completing them by phone. By
    following instructions to make telephone contact with the Marketplace,
    we circumvented the initial identity-
    proofing control that had stopped our online applications. When we
    later asked CMS officials about this difference between online and
    telephone applications, they told us that unlike with online
    applications, the Marketplace allows phone applications to be made on
    the basis of verbal attestations by applicants, given under penalty of
    ---------------------------------------------------------------------------
    perjury, who are directed to provide supporting documentation.

        For our 6 phone applications, we successfully completed the
    application process, with the exception of one applicant who declined
    to provide a Social Security number and was not allowed to proceed.\22\
    After being approved for coverage, we received enrollment material from
    insurers for each of our 11 successful fictitious applicants. Appendix
    I summarizes outcomes for all 12 of our phone and online
    applications.\23\
    ---------------------------------------------------------------------------
        \22\ As shown in app. I, three of our applicants did not provide
    Social Security numbers. While one of them was not allowed to proceed,
    the other two were allowed to complete applications. Our purported
    rationale for not providing the numbers was concern about personal
    privacy.
        \23\ We shared with CMS details on our successfully obtaining
    coverage, during the course of our review, in March 2015.

        The Marketplace is required to seek post-approval documentation in
    the case of certain application ``inconsistencies.'' Inconsistencies
    occur in instances in which information an applicant has provided does
    not match information contained in data sources that the Marketplace
    uses for eligibility verification at time of application, or such
    information is not available. For example, an applicant might state
    income at a particular amount, but his or her federal tax return lists
    a different amount, or the applicant has no tax return on file.
    Likewise, the applicant may provide a Social Security number, but it
    does not match information on file with the SSA. If there is such an
    application inconsistency, the Marketplace is to determine eligibility
    using attestations of the applicant, and ensure that subsidies are
    provided on behalf of the applicant, if he or she is eligible to
    receive them, while the inconsistency is being resolved using ``back-
    end'' controls. Thus, the Marketplace was required to approve
    eligibility to enroll in health-care coverage and to receive subsidies
    for each of our 11 fictitious applicants while the inconsistencies were
    being addressed.\24\ At the time of our July 2014 testimony, we had
    begun to receive notifications from the Marketplace on the outcomes of
    our fictitious document submissions. As discussed later in this
    statement, we continued to receive additional notices about our
    applicants through 2014 and into 2015.
    ---------------------------------------------------------------------------
        \24\ According to CMS officials, the federal Marketplace makes
    eligibility determinations. Private insurers, also called ``issuers,''
    provide coverage.
    ---------------------------------------------------------------------------
    Federal Marketplace Communications With Our 11 Successful Fictitious
            Enrollees About Their Applications Were Unclear or Incomplete
        In all 11 cases in which we obtained coverage, the Marketplace
    directed us, either orally or in writing, to send supporting
    documentation. However, the Marketplace did not always provide clear
    and complete communications. As a result, during our testing, we did
    not always know the current status of our applications or specific
    documents required in support of them. Examples include the following:

        Unclear correspondence. Rather than stating a message directly,
            correspondence instead was conditional or nonspecific, stating
            the applicant may be affected by something, and then leaving it
            to the applicant to parse through details to see if they were
            indeed affected.

        Inaccurate guidance. The Marketplace directed 8 of our 11
            successful applicants to submit additional documentation to
            prove citizenship and identity--but an accompanying list of
            suitable documents that could be sent in response consisted of
            items for proving income.

        Lack of Marketplace notice on document submissions. In five cases,
            we did not receive any indication on whether information sent
            in response to Marketplace directives was acceptable. As a
            result, we had to call the Marketplace to obtain status
            information. According to CMS, after documents are processed,
            consumers will receive a written notice.

        Lack of written notice. In one case, the Marketplace did not
            provide us with any written correspondence directing we submit
            additional documentation. The Marketplace only requested
            documentation for the initial enrollment during our phone
            application for coverage. According to the Marketplace,
            applicants are to receive written notice of documentation
            required.\25\
    ---------------------------------------------------------------------------
        \25\ We shared with CMS details on communication issues we
    encountered, during the course of our review, in March 2015.

        CMS officials told us they are working to improve communication
    with consumers, and will make improvements in consumer notices.
    According to the officials, they are soliciting feedback from consumer
    advocates, call-center representatives, and application assisters to
    improve such communications. According to the officials, CMS has
    already made significant improvements that include adding a complete
    list of acceptable documents to resolve citizenship and immigration
    status inconsistencies, and consolidating warning notices to include
    all inconsistency issues. CMS is currently working on further
    improvements in notices, including those for eligibility and instances
    of insufficient documentation, according to the officials.
    Our 11 Fictitious Enrollees Maintained Subsidized Coverage Throughout
            2014, Even Though We Sent Fictitious Documents, or No
            Documents, to Resolve Application Inconsistencies
        As part of our testing, and in response to Marketplace directives,
    we provided follow-up documentation, albeit fictitious.\26\ Overall, as
    shown in appendix II, we varied what we submitted by application--
    providing all, none, or only some of the material we were told to
    send--in order to test controls and note any differences in outcomes.
    Among the 11 applications for which we were directed to send
    documentation, we submitted
    ---------------------------------------------------------------------------
        \26\ Any documentation we supplied was, like our initial
    applications, fictitious, having been fabricated by us using
    commercially available hardware, software, and materials.

        all requested documentation for four applications,
        partial documentation for four applications, and
        no documentation for the remaining three applications.

        Although our documentation was fictitious, and in some cases we
    submitted none, or only some, of the documentation we were directed to
    send, we retained our coverage for all 11 applicants through the end of
    the 2014 coverage year. As described earlier, APTC subsidies our
    applicants received totaled about $30,000 annually, and further
    financial benefit would have been available through CSR subsidies if we
    had obtained qualifying medical services. Following our document
    submissions, the Marketplace told us, either in writing or in response
    to phone calls, that the required documentation for all our approved
    applicants had been received and was satisfactory. In one case, when we
    called the Marketplace to inquire about the status of our documentation
    submission--but where we had not actually submitted any documents--a
    representative told our applicant that documents had been reviewed and
    processed, and, ``There is nothing else to do at this time.'' Figure 1
    shows a portion of a call in which a Marketplace representative said
    our documentation was complete, even though we did not submit any
    documents.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        For one applicant, the Marketplace did subsequently state in a
    November 2014 letter that we would lose our subsidies, beginning in
    December 2014. However, there was no follow-up communication regarding
    the loss of our subsidies, and the subsidies were not terminated in
    December 2014.

        On the basis of applicant data we obtained from CMS, the
    Marketplace cleared inconsistencies for some of our 11 fictitious
    applications in instances where we submitted bogus documents.\27\
    Appendix III contains a summary of our document requests and
    submissions. We also noted instances where the Marketplace either did
    not accurately capture all inconsistencies, or resolved inconsistencies
    based on suspect documentation, including the following:
    ---------------------------------------------------------------------------
        \27\ The inconsistency data we obtained listed status as of April
    2015 for all inconsistencies generated during the first open-enrollment
    period, including those for our undercover applications. For this
    statement, we examined only inconsistency information for our
    applications, but we plan to make a broader analysis as part of ongoing
    work.

        Did not capture all inconsistencies. For 3 of the 11 applicants,
            while the Marketplace at the outset directed our applicants to
            provide documentation of citizenship/immigration status, the
            CMS applicant data we later received for these applicants do
    ---------------------------------------------------------------------------
            not reflect inconsistencies for the items initially identified.

        Disqualifying income. For 2 of the 11 applicants, we reported
            income substantially higher than the amount we initially stated
            on our applications, and at levels that should have
            disqualified our applications from receiving subsidies.
            However, according to the CMS data, the Marketplace resolved
            our income inconsistencies and, as noted, our APTC and CSR
            subsidies for both applicants continued.

        In addition to having fictitious documentation approved, two of our
    applicants also received notices in early 2015 acknowledging receipt of
    documents recently submitted, when we had not sent any such documents.
    We do not know why we received these notices.
    The CMS Document-Verification Process Is Not Designed to Identify
            Fraudulent Applications
        We found that the CMS document-processing contractor is not
    required to seek to detect fraud.\28\ It is only required to inspect
    for documents that have obviously been altered. According to contractor
    executives we spoke with, the contractor personnel involved in the
    document-verification process are not trained as fraud experts and do
    not perform antifraud duties. In particular, the executives told us,
    the contractor does not certify the authenticity of submitted
    documents, does not engage in fraud detection, and does not undertake
    investigative activities. In the contractor's standard operating
    procedures for its work for CMS, document-review workers are directed
    to ``determine if the document image is legible and appears unaltered
    by visually inspecting it.'' Further, according to the contractor, it
    is not equipped to attempt to identify fraud, and does not have the
    means to judge whether documents submitted might be fraudulent.
    ---------------------------------------------------------------------------
        \28\ Fraud involves obtaining something of value through willful
    misrepresentation. Whether conduct is in fact fraudulent is a
    determination to be made through the judicial or other adjudicative
    system. For information generally on fraud controls, see GAO,
    Individual Disaster Assistance Programs: Framework for Fraud
    Prevention, Detection, and Prosecution, GAO-06-954T (Washington, D.C.:
    July 12, 2006).

        CMS officials told us there have been no cases of fraudulent
    applications or documentation referred to the U.S. Department of
    Justice or the HHS Office of Inspector General, because its document-
    processing contractor has not identified any fraud cases to CMS.
    However, as noted earlier, the contractor is not required to detect
    fraud, nor is it equipped to do so. According to the CMS officials,
    ---------------------------------------------------------------------------
    there has been ``no indication of a meaningful level of fraud.''

        According to CMS officials, it would not be practical to have
    applicants show original documents at time of application. With the
    HealthCare.gov website, the agency decided to move away from in-person
    authentication, in order to avoid burden on consumers, the officials
    told us. They also said in-person presentation of documentation is not
    possible in the current structure, as there are insufficient resources
    to establish a system to do so.

        Overall, according to CMS officials, the agency has limited ability
    to respond to attempts at fraud. They told us CMS must balance
    consumers' ability to ``effectively and efficiently'' select
    Marketplace coverage with ``program-integrity concerns.'' CMS places a
    strong emphasis on program integrity and builds program integrity
    features into all aspects of implementation of the law, according to
    CMS officials. In any case, the CMS officials said the design of the
    program does not allow for direct consumer profit from fraud, because
    APTC and CSR subsidies are paid to policy issuers, not consumers. We
    note, however, that even so, the subsidies nevertheless can produce
    direct financial benefits to consumers. For example, if consumers elect
    to receive the premium tax credit in advance, that lowers the cost of
    monthly coverage. A consumer could also receive the advance premium tax
    credit and not file a federal tax return, as required to ensure proper
    treatment of the credit. Likewise, CSR subsidies mean smaller out-of-
    pocket expenses when obtaining medical services. Accordingly, although
    subsidies may be paid directly to issuers, they still result in a cost
    to the government and a benefit to enrollees.

        CMS officials told us the agency plans to conduct an assessment of
    the Marketplace's eligibility determination process, including the
    application process and the inconsistency resolution process. They did
    not provide a firm date for completion, saying the review would depend
    on obtaining IRS information for use as a reference.
    Four of Our 11 Applicants Continued to Receive Subsidized Coverage for
            2014,
            Likely Because CMS Waived Documentation Requirements
        According to the applicant data we obtained from CMS, most of our
    applications had unresolved inconsistencies--indicating either that the
    Marketplace did not receive requested documentation or the
    documentation was not satisfactory. Specifically, as shown in appendix
    III, the CMS data indicate that, as of April 2015, 7 of our 11
    applications had at least one inconsistency that remained unresolved.

        Because we did not disclose the specific identities of our
    fictitious applicants, CMS officials said they could not explain our
    findings on handling of inconsistencies for our applications.\29\
    However, in general, they said our subsidized policies may have
    remained in effect during 2014 because CMS waived certain document
    filing requirements. Specifically, CMS directed its document contractor
    not to terminate policies or subsidies if an applicant submitted any
    documentation to the Marketplace. That is, if an applicant submitted at
    least one document, whether it resolved an inconsistency or not, that
    would be deemed sufficient so that the Marketplace would not terminate
    either the policy or subsidies of the applicant, even if other
    documentation had initially been required.\30\ For example, for one of
    our applicants, the Marketplace requested citizenship, income, and
    identity documents, but our applicant submitted only identity
    information. Under the CMS directive, the applicant's policy and
    subsidies continued through 2014 because our applicant submitted at
    least one document to the Marketplace, but not all documents required.
    Thus, in the case of our four applicants that submitted partial
    documentation to the Marketplace, we likely were relieved of the
    obligation for submitting all documents for the 2014 plan year.
    ---------------------------------------------------------------------------
        \29\ GAO's standard practice is to not disclose identifiers
    associated with undercover identities and operatives, in order to
    protect use of this sensitive investigative technique, which can yield
    results not obtainable through other means.
        \30\ For example, in the case of an income inconsistency,
    contractor procedures stated there will not be action taken ``if the
    consumer or anyone in the household has sent any supporting document .
    . . regardless of the relevance of the document to the Annual Income
    inconsistency.'' For instance, there will be no action on the income
    issue ``if the consumer or household member has sent a document
    relating to immigration, even though that document cannot be used to
    resolve the Annual Income inconsistency.'' relieved of the obligation
    for submitting all documents for the 2014 plan year.

        For the 2014 plan year, PPACA authorized CMS to extend the period
    for applicants to resolve inconsistencies unrelated to citizenship or
    lawful presence.\31\ Additionally, regulations state that CMS may
    extend the period for an applicant to resolve any type of inconsistency
    when the applicant demonstrates a ``good faith effort'' to submit
    documentation.\32\ CMS officials told us they relied upon these
    authorities to make a policy decision to broadly extend the period for
    resolving all types of inconsistencies in 2014. Under the policy, the
    officials told us, the submission of a single document served as
    evidence of a good faith effort by the applicant to resolve all
    inconsistencies, and therefore extended the resolution period through
    the end of 2014.\33\ As such, CMS did not terminate any applicant who
    ``demonstrated a good faith effort'' in 2014. The officials told us
    that CMS is enforcing the full submission requirement for 2015, and
    that any good-faith extensions granted in 2015 would be decided on a
    case-by-case basis and be limited in length. All consumers, regardless
    of whether they benefitted from the good-faith effort extension in
    2014, will still be subject to deadlines for filing sufficient
    documentation, they said. In particular, according to the officials,
    those who made a good-faith effort by submitting documentation, but
    failed to clear their inconsistencies in 2014, were among the first
    terminations in 2015, which they said took place in February and early
    March. We are continuing to seek further information from CMS officials
    on their good-faith effort policy, as well as any 2015 terminations, as
    part of ongoing work.
    ---------------------------------------------------------------------------
        \31\ 42 U.S.C. Sec. 18081(e)(4)(A).
        \32\ 45 CFR Sec. 155.315(f)(3).
        \33\ We did not find any public announcement of CMS's decision to
    apply the good-faith provision.

        Although the good-faith effort policy could explain the handling of
    some of our applications, CMS officials could not provide a general
    explanation for the three applications for which we submitted no
    documentation but our subsidized coverage remained. However, based on
    our examination of applicant files at the CMS document contractor, this
    could be due to an error in the CMS enrollment system. Specifically, we
    found instances in which records we reviewed showed that applicants had
    not enrolled in a plan, when they actually had done so. Contractor
    officials told us that in such cases, they did not terminate the plans
    or subsidies because the applicants were shown as not enrolled. We plan
    to address this issue of tracking of inconsistencies in our ongoing
    ---------------------------------------------------------------------------
    work.

        Also included among the unresolved inconsistencies for our
    applicants were four for Social Security numbers. According to CMS
    officials, inconsistencies for Social Security numbers occur when an
    applicant's name, date of birth, and Social Security number cannot be
    validated in an automated check with SSA. The officials told us that
    systems capability has not allowed CMS's document contractor to make
    terminations for such inconsistencies. They also said the agency has
    done no analysis of the fiscal effect of not making such terminations.
    We plan to address this issue in ongoing work.\34\ In addition, CMS
    officials told us that although it checks applicants or enrollees
    against SSA's Death Master File, it currently does not have the systems
    capability to change coverage if a death is indicated. Instead, the
    officials told us, the Marketplace has established a self-reporting
    procedure for individuals to report a consumer's death in order to
    remove the consumer from coverage. The number of reported deaths from
    SSA is ``very minimal,'' according to CMS officials.
    ---------------------------------------------------------------------------
        \34\ CMS officials also told us the agency did not pursue
    terminations for inconsistencies involving American Indian status and
    presence of employer-sponsored or minimum essential coverage. For
    incarceration status (incarcerated individuals are generally not
    eligible for coverage), CMS officials said the agency accepted
    applicant attestations after determining that the SSA prisoner database
    was unreliable.
    ---------------------------------------------------------------------------
    The Marketplace Automatically Reenrolled Coverage for All 11 Fictitious
            Applicants for 2015
        The coverage we obtained for our 11 fictitious applicants contained
    an automatic reenrollment feature--both insurers and the Marketplace
    notified us that if we took no action, we would automatically be
    enrolled in the new coverage year (2015).\35\ In all 11 of our cases,
    we took no action and our coverage was automatically reenrolled in
    January 2015. We continued to make premium payments, in order to
    demonstrate continuation of subsidized coverage, which meant continuing
    costs for the federal government. Appendix IV summarizes our automatic
    reenrollments.
    ---------------------------------------------------------------------------
        \35\ Under a CMS policy adopted in September 2014 for the 2015
    coverage year, generally, if consumers do nothing, they will be
    automatically enrolled in the same plan with the same premium tax
    credit and other financial assistance. Consumers whose 2013 tax return
    indicates they had very high income, or who did not give the
    Marketplace permission to check updated tax information for annual
    eligibility redetermination purposes, were to be automatically enrolled
    but without financial assistance if they do not return to
    HealthCare.gov. CMS said this process provides continuity of coverage
    and safeguards public funds. See
        http://cms.gov/Newsroom/MediaReleaseDatabase/Fact-sheets/2014-Fact-
    sheets-items/2014-09-02.html?DLPage=1&DLSort=0&DLSortDir=descending,
    accessed July 8, 2015.

        Although we obtained automatic reenrollments, we found
    communications from the Marketplace leading up to the end of 2014 to be
    ---------------------------------------------------------------------------
    contradictory or erroneous. Examples include the following:

        As noted earlier, our applicants were notified they would
            automatically be reenrolled for the new coverage year. But most
            of the applicants also received, to varying degrees, notices to
            reapply or to take some type of action. For example, we
            received notices stating: ``Official Notice: Your 2015
            application is ready,'' ``Action Needed: Your 2015 health
            coverage,'' and ``Follow these steps to re-
            enroll by December 15.'' The message and frequency of these
            notices could create uncertainty among applicants who believed
            they need not take any action to remain enrolled.

        In correspondence to our applicants, the Marketplace referred to
            things that could not have happened. In four cases in the
            latter part of 2014, Marketplace correspondence referred to the
            filing of federal tax returns of our applicants, even though
            our applicants never filed a tax return.

        In four cases, our enrollees received notices directing them to
            send additional information in order to continue coverage,
            saying they could lose coverage if they did not--but the
            deadline for submission was a date that had passed months
            earlier. For example, one enrollee received such a notice in
            December 2014, advising that coverage might be lost six months
            earlier, in June 2014.

        As mentioned previously, CMS officials told us they are working to
    improve communication with consumers, and will make improvements in
    consumer notices.
    CMS Provided Inaccurate Tax Information for 3 of 11 Fictitious
            Applicants
        Under PPACA, an applicant's filing of a federal income-tax return
    is a key element of back-end controls. When applicants apply for
    coverage, they report family size and the amount of projected income.
    Based, in part, on that information, the Marketplace will calculate the
    maximum allowable amount of advance premium tax credit. An applicant
    can then decide if he or she wants all, some, or none of the estimated
    credit paid in advance, in the form of payment to the applicant's
    insurer that reduces the applicant's monthly premium payment.

        If an applicant chooses to have all or some of his or her credit
    paid in advance, the applicant is required to ``reconcile'' on his or
    her federal tax return the amount of advance payments the government
    sent to the applicant's insurer on the applicant's behalf with the tax
    credit for which the applicant qualifies based on actual reported
    income and family size.\36\
    ---------------------------------------------------------------------------
        \36\ To receive advance payment of the tax credit at time of
    application, applicants must pledge to file a tax return. The actual
    premium tax credit for the year will differ from the advance tax credit
    amount calculated by the Marketplace if family size and income as
    estimated at the time of application are different from family size and
    household income reported on the tax return. If the actual allowable
    credit is less than the advance payments, the difference, subject to
    certain caps, will be subtracted from the applicant's refund or added
    to the applicant's balance due. On the other hand, if the allowable
    credit is more than the advance payments, the difference is added to
    the refund or subtracted from the balance due.

        To facilitate this reconciliation process, the Marketplace sends
    enrollees Form 1095-A, which reports, among other things, the amount of
    advance premium tax credit paid on behalf of the enrollee. This
    information is necessary for enrollees to complete their tax returns.
    The accuracy of information reported on this form, then, is important
    for determining an applicant's tax liability, and ultimately,
    ---------------------------------------------------------------------------
    government revenues.

        We found errors with the information reported on 1095-A forms for 3
    of our 11 fictitious applicants.\37\ In two cases, we received multiple
    forms containing different information for the same applicant. In all
    three cases, the forms did not accurately reflect the number of months
    of coverage, thus misstating the advance premium tax credits received.
    In one of the cases, for instance, the form did not include a couple of
    months of advance premium tax credit that was received and, as a
    result, understated the advance premium tax credit received by more
    than $600. Appendix V shows complete results for tax forms we received.
    Because we did not provide CMS with detailed information about the
    specific cases, CMS officials said they could not conduct research and
    explain why these errors occurred. In general, CMS officials told us
    the agency made quality checks on tax information before mailings to
    consumers.\38\
    ---------------------------------------------------------------------------
        \37\ The errors we encountered were of a different type than those
    announced by CMS in February 2015, when the agency said about 800,000
    tax filers had received Forms 1095-A that listed incorrect benchmark
    plan premium amounts. For details, see
        http://blog.cms.gov/2015/02/20/what-consumers-need-to-know-about-
    corrected-form-1095-as/ accessed on June 30, 2015.
        \38\ We shared with CMS details on errors in our applicants' 1095-A
    forms, during the course of our review, in March 2015.

        During our testing work, we also identified that unlike advance
    premium tax credits, CSR subsidies are not subject to a recapture
    process such as reconciliation on the taxpayer's federal income-tax
    return. In discussions with CMS and IRS officials, we found that the
    federal government has not established a process to identify and
    recover the value of CSR subsidies that have been provided to our
    fictitious enrollees improperly. These subsidies increase government
    costs; and, according to IRS, excess CSR payments, if not recovered by
    CMS, would be taxable income to the individual for whom the payment was
    made. We are continuing to seek information from CMS on any efforts to
    recover costs associated with subsidy reductions or eliminations due to
    unresolved inconsistencies.
    The Marketplace Later Terminated Subsidized Coverage for 6 of Our 11
            Applicants in Early 2015, but We Restored Coverage for 5 of
            These Applicants--With Larger Subsidies
        In December 2014, the Marketplace sent notifications to 5 of our 11
    applicants, indicating that we had filed new applications for
    subsidized coverage. In four of these notices, the Marketplace stated
    our subsidies or coverage, or both, would be terminated if we failed to
    provide supporting documentation. However, we had not filed any such
    applications, nor, as described earlier, had we sought any
    redetermination of subsidies. Because each of our fictitious applicants
    earlier received either written or verbal assurances from the
    Marketplace that documentation had been received and no further action
    was necessary, we did not respond to these requests to submit
    supporting documentation.

        A few months later, the Marketplace terminated coverage or
    subsidies for six applicants, including four applicants who had
    received notice of new applications in December 2014, and two
    applicants who had not received notice of a new application. The
    termination notices cited failure to respond to requests to submit
    documentation in support of what were claimed to be the new
    applications we submitted. Our remaining five applicants continued
    receiving subsidized coverage without interruption.\39\ Following the
    termination notices, we elected to pursue continued coverage for the
    six cases as part of our testing, even though we had not filed the
    claimed new applications. Each of our six fictitious applicants that
    lost coverage or subsidies made phone inquiries to the Marketplace for
    an explanation of the terminations. In three of these inquiries, the
    Marketplace representatives told our applicants that they were required
    to file a new application or supporting documentation each year.
    However, as described earlier, notifications we received earlier from
    the Marketplace and insurers told us that no actions were needed to
    automatically reenroll in our plans other than to continue to pay
    premiums. In addition, as noted, other applicants did not receive
    notices of new applications being filed.\40\ We are continuing to seek
    from CMS information on this treatment of our applicants.\41\
    ---------------------------------------------------------------------------
        \39\ We shared with CMS details of our purported new applications,
    during the course of our review, in May 2015.
        \40\ Although our other applicants did not receive notices of new
    applications being filed, CMS officials told us that each year, a new
    application for the upcoming coverage year is created for those who
    have coverage through the Marketplace. To lessen consumer burden, the
    Marketplace pre-populates a new application using existing information,
    they said. According to the officials, CMS encourages applicants who
    wish to continue Marketplace coverage to update their application
    information during open-enrollment and decide what coverage they will
    need for the next year. If applicants do not contact the Marketplace to
    choose coverage by December 15th, the Marketplace will automatically
    re-enroll them in their current plan or a similar one, the CMS
    officials told us.
        \41\ For the general situation for reenrollment, see Centers for
    Medicare and Medicaid Services, Bulletin #14: Guidance for Issuers on
    2015 Reenrollment in the Federally-facilitated Marketplace (FFM),
    available at https://www.cms.gov/CCIIO/Resources/Regulations-and-
    Guidance/Downloads/Bulletin14_Reenrollment_120114.pdf, accessed July 2,
    2015.

        Next, for each of these six fictitious applicants, we requested in
    Marketplace phone conversations reinstatement of coverage or subsidies.
    For five of the six applicants, the Marketplace approved reinstatement
    of subsidized coverage, while in the process also increasing total
    premium tax credit subsidies for all these applicants combined by a
    total of more than $1,000 annually.\42\ For the sixth applicant, a
    Marketplace representative said a caseworker must evaluate our
    situation. We were told we could not speak with the caseworker, and it
    could take the caseworker up to 30 days to resolve the issue. This
    applicant's case was still pending at the time we concluded our
    undercover activity in April 2015. Appendix VI summarizes outcomes for
    the unknown applications and terminations that followed for six of our
    applicants.
    ---------------------------------------------------------------------------
        \42\ In seeking restoration of coverage, we did not request any
    change in subsidies. The Marketplace provided us with new subsidy
    amounts in approving our restored coverage. According to CMS officials,
    factors that could affect subsidy amounts include use of updated
    federal poverty level income information; a change in plans available
    in the market, which affects calculation of subsidies; and a consumer
    aging. We did not make premium payments for these five applicants
    following reinstatement because the reinstatements occurred at the end
    of our undercover testing period.

        For three of the five applicants for whom we obtained reinstatement
    of subsidized coverage, we had open inconsistencies related to
    citizenship/immigration status remaining from our initial applications
    for 2014, according to CMS data. For each of these three applications,
    we had never submitted any citizenship or immigration documentation to
    the Marketplace for resolution. Nonetheless, we had subsidized coverage
    restored. We are continuing to seek from CMS any information on whether
    procedures allow repeated applications as a way to avoid document-
    filing requirements.
    We Were Unable To Obtain In-Person Assistance in Five of Six Undercover
            Attempts To Test Income-Verification Controls, and Application
            Assisters Subsequently Acknowledged Errors
        As described earlier, CMS has awarded grants for ``Navigators,''
    which are to provide free, impartial health-insurance information to
    consumers. In addition, such aid is also to be available from other in-
    person assisters (``non-Navigators'') who generally perform the same
    functions as Navigators, but are funded through separate grants or
    contracts.

        As described in our July 2014 statement, in addition to the 12
    online and telephone applications, we also attempted an additional 6
    in-person applications, seeking to test income-verification controls
    only.\43\ During our testing, we visited one in-person assister and
    obtained information on whether our stated income would qualify for
    subsidy. In that case, as shown in Figure 2, a Navigator correctly told
    us that our income would not qualify for subsidy. However, for the
    remaining five in-person applications, we were unable to obtain such
    assistance. We encountered a variety of situations that prevented us
    from testing our planned scenarios.\44\ We later returned to the
    locations, seeking explanations on why we could not obtain the
    advertised assistance, which are also shown in figure 2.\45\
    Representatives of these organizations generally acknowledged the
    issues we raised in handling of our application inquiries.
    ---------------------------------------------------------------------------
        \43\ In these in-person applications, our planned approach was to
    discuss concerns about policy costs and to inquire whether there were
    ways to reduce the expenses, such as through income-based PPACA
    subsidies.
        \44\ For these six in-person applications, we randomly chose three
    Navigators and three non-Navigators in the target areas of our selected
    states. For the in-person applications, because our sole interest was
    any potential advice on reducing policy costs, we did not seek or
    obtain policies, as we did with our phone and online applications.
        \45\ These subsequent visits were not undercover, and we identified
    ourselves as being with GAO.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        We shared these results with CMS officials, who said they could not
    comment on the specifics of our cases without knowing details of our
    undercover applications. CMS officials said Navigators are required to
    accept all applicants, even if an organization's mission is to work
    with specific populations. If Navigators cannot provide timely help
    themselves, they must refer applicants to someone who can give
    assistance. CMS officials also said that they can terminate grant
    agreements, among other enforcement actions, if Navigators do not
    comply with terms of their awards. They cited as an example a
    corrective action taken in March 2015 against a Navigator grantee
    operating in several states for not providing the full range of
    activities it promised. CMS officials stressed to us Navigator training
    and experience from the first open-enrollment period helped improve
    training for the second enrollment period ending in February 2015. As
    noted earlier, our review of in-person assistance was limited to the
    extent we encountered Navigators and non-Navigators as part of our
    enrollment control testing. A full examination of in-person assistance
    ---------------------------------------------------------------------------
    was beyond the scope of our work.

        CMS officials told us there is no formal policy or specific
    guidance for situations such as the one we encountered in a case
    described in figure 2, in which an applicant is asked if he or she
    wishes to perform a service, such as volunteering for union activities,
    at the time the applicant seeks assistance. Still, CMS officials said
    Navigators would be discouraged from such activities while applicants
    seek help.

        CMS officials told us it is reasonable for consumers to think that
    if an assister is listed on the federal website as providing help--as
    were the assisters we selected--that assistance should be available as
    indicated. CMS officials told us the agency recognizes challenges with
    its online tool to find local assistance, and has been working to make
    changes. We are continuing to seek written documentation on these
    planned improvements.

        Chairman Hatch, Ranking Member Wyden, and Members of the Committee,
    this concludes my statement. I would be pleased to respond to any
    questions that you may have.
                     gao contact and staff acknowledgments
    GAO Contacts
        For questions about this statement, please contact Seto J. Bagdoyan
    at (202) 512-6722 or BagdoyanS@gao.gov. Contact points for our Offices
    of Congressional Relations and Public Affairs may be found on the last
    page of this statement.
    Staff Acknowledgements
        Individuals making key contributions to this statement, or our 2014
    statement reporting preliminary results, include: Matthew Valenta and
    Gary Bianchi, Assistant Directors; Maurice Belding; Mariana Calderon;
    Marcus Corbin; Carrie Davidson; Paul Desaulniers; Colin Fallon; Suellen
    Foth; Sandra George; Robert Graves; Barbara Lewis; Maria McMullen;
    James Murphy; George Ogilvie; Shelley Rao; Ramon Rodriguez; Christopher
    H. Schmitt; Julie Spetz; Helina Wong; and Elizabeth Wood.
                   appendix i: undercover application results
        Figure 3 summarizes outcomes for all 12 of the undercover phone and
    online applications we made for coverage to the Health Insurance
    Marketplace (Marketplace) under the Patient Protection and Affordable
    Care Act, as part of our testing of eligibility and enrollment
    controls.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

           appendix ii: fictitious applicant documentation submitted
        Figure 4 shows, by application, the documentation we submitted in
    support of the 11 undercover applications that were successful. As part
    of our eligibility- and
    enrollment-controls testing, we varied what we submitted by
    application--providing all, none, or only some of the material we were
    told to send.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

       appendix iii: marketplace consideration of documentation submitted
        Figure 5 shows, by application, a summary of our document requests
    and submissions, with Marketplace communications on adequacy of the
    submissions, for the 11 undercover applications that were successful.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

        a CMS officials said that any ID documents requested and
    submitted are reported under the citizenship status inconsistency. They
    said this is because ID information is not a distinct inconsistency,
    and that any such information is used as part of evaluating citizenship
    inconsistencies. As a result, CMS-reported status of inconsistencies,
    as shown in the table, does not include a separate item for ID status.
    We note, however, that Marketplace representatives specifically cited
    ID documents to our applicants, and that CMS online information, as
    well as letters sent to applicants, likewise refer to ID or documents
    that can be submitted to resolve an ID issue.
        b Although GAO applicants were not specifically
    requested at time of application to provide confirmation of Social
    Security number, data obtained from CMS listed separately a Social
    Security number inconsistency.
        c CMS data did not show an inconsistency for this
    category.
        d Indicates case where GAO submitted income at a level
    substantially higher than the amount initially stated on fictitious
    applications, and at levels making the applicant ineligible for income-
    based subsidies.
        e Notwithstanding the status as reported by CMS, the
    applicant continued to receive coverage and subsidies.
                      appendix iv: automatic reenrollments
        Figure 6 summarizes automatic reenrollment activity at the end of
    the 2014 coverage year for the 11 undercover applications that were
    successful.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                   appendix v: accuracy of tax forms received
        Figure 7 summarizes receipt of Forms 1095-A, for reconciliation of
    advance premium tax credits received, for the 11 undercover
    applications that were successful.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                appendix vi: restoration of subsidized coverage
        Figure 8 summarizes outcomes for the six applicants for whom the
    Marketplace terminated subsidies or coverage in early 2015. Prior to
    termination, four of these applicants had received notices of new
    applications filed, although we did not file any such applications.
    Following notice of the terminations, we restored subsidized coverage
    in five of six cases, with one case pending at the time we concluded
    our undercover activity.

    [GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]

                                     ______

                  Prepared Statement of Hon. Chuck Grassley,
                            a U.S. Senator From Iowa
        GAO conducted an undercover operation to sign up fictitious
    individuals in Obamacare's marketplaces to try to determine if
    fictitious individuals could actually acquire Federal subsidies. A July
    2014 GAO report concluded that the answer is ``yes.''

        GAO created 12 fake applicants, and, for 11 of 12 applications
    which were made by phone and online using fictitious identities, GAO
    obtained subsidized coverage. For three of the 12 applications, GAO did
    not submit any documents requested of them by CMS and yet still
    received subsidized coverage.

        CMS has been aware of this issue since July 2014. Even so, the 11
    fake applicants were automatically re-enrolled. In 2015, coverage
    continued for all applicants until six were terminated for unclear
    reasons. However, GAO was able to reinstate five of the six with
    greater subsidy amounts.

        In addition, the administration has spent $120 million on
    ``navigators'' to help people to sign up. Five out of six applicants
    did not receive any help from the navigators.

        The undercover GAO operation illustrates, yet again, that the
    Federal Government--and Obamacare in particular--is not working in the
    people's best interest.

        It is apparent that the Federal Government is not meeting the
    requirements of Federal law. For example, GAO provided false
    documentation, partial documentation, and sometimes no documentation to
    enroll in marketplaces. In response, CMS told GAO that the documents
    were satisfactory, and 10 out of 11 fictitious applicants continue to
    receive taxpayer subsidies.

        The GAO report noted that document processing contractors are not
    required to authenticate documentation. Marketplaces are required by
    law to verify applications to determine eligibility, not only for
    enrollment but also for subsidies. And CMS is allowing promises to take
    the place of paperwork.

        This GAO report documented systemic failures that leave the
    taxpayer on the hook for an even bigger bill.

                                     ______

                  Prepared Statement of Hon. Orrin G. Hatch,
                            a U.S. Senator From Utah
    WASHINGTON--Senate Finance Committee Chairman Orrin Hatch (R-Utah)
    today delivered the following opening statement at a Committee hearing
    examining problems with HealthCare.gov enrollment controls:

        Good morning.

        Today's hearing will address controls at the HealthCare.gov
    website.

        Specifically, the committee will hear from the Director of Audit
    Services at the Government Accountability Office, Seto Bagdoyan.
    Director Bagdoyan's team has led an undercover ``secret shopper''
    investigation to test the internal controls of HealthCare.gov and to
    review the Centers for Medicare & Medicaid Services' handling of this
    program.

        This investigation was designed to determine the degree to which
    the administration's federal health insurance exchange can protect
    against fraudulent applications, what happens when applicants provide
    false information and documentation, and whether the controls are
    successful in dealing with irregularities once they are found.

        Perhaps I should say ``spoiler alert'' before this next part.
    Today, Director Bagdoyan will explain how the federal exchange failed
    spectacularly on virtually all relevant accounts tested by GAO.

        For this investigation, GAO created fictitious identities to apply
    for premium tax subsidies through the federal health insurance
    exchange. We learned last year that 11 out of 12 fake applications were
    approved. CMS accepted fabricated documentation with these applications
    without attempting to verify its authenticity and enrolled fake
    applicants while handing out thousands of dollars in premium tax
    subsidies.

        Now, a year later, GAO has reported that nothing has changed and
    that, if anything, there are more problems.

        Worst of all, the administration has known about these problems for
    over a year now and has apparently not taken the necessary steps to
    rectify them. While CMS says that it is balancing consumer access to
    the system with program integrity concerns, I think it's pretty clear
    just what's going on here.

        Since the federal exchange was first implemented, success has been
    measured by the number of applicants who have signed up for insurance.
    Indeed, last year, when the administration reached its initial
    enrollment goal, critics of the law were told that we had been wrong
    all along and that the law was, despite all the evidence to the
    contrary, working just fine.

        However, with these findings from GAO, it seems obvious, at least
    to me, that the administration has been preoccupied with signing up as
    many applicants as possible, ignoring potential fraud and integrity
    issues along the way.

        Now, supporters of Obamacare often insist that it is ``the law of
    the land,'' and that Congress should work to improve, rather than
    repeal it.

        On the first point, these proponents are, unfortunately, correct.
    For the foreseeable future, the so-called Affordable Care Act is the
    law of the land.

        On the second point, Republicans in Congress continue to work
    toward repeal of the misguided law and its expensive mandates,
    regulations, penalties, and taxes, and replacement of it with patient-
    centered reforms that put patients, rather than Washington bureaucrats,
    in charge of their health care decisions.

        However, needless to say, that day will not come until there is a
    President who shares our goal.

        So until then, Obamacare will remain in place. In the meantime,
    Congress has an obligation to exercise rigorous oversight of the
    implementation of the law and to work to protect both beneficiaries and
    taxpayers from its negative consequences.

        That's what today's hearing is about.

        We're here today to get an account of how things are working on the
    federal health insurance exchange. And, once again, what we've heard
    thus far is not reassuring and does not speak well for CMS's management
    of HealthCare.gov, the protection of taxpayer dollars, or the
    experience of enrollees.

        The GAO's investigation exposes not only huge gaps in federal
    exchange program integrity, but also flaws in how the exchange and CMS
    contractors treat Americans who are trying to file or correct
    legitimate applications.

        Time after time, the GAO team sent information to the exchange for
    verification only to have it ignored, or have the exchange respond as
    if something entirely different had been sent in. The fact that GAO
    encountered mind-boggling levels of incompetence and inefficiency at
    nearly every turn does not bode well for the experience of your
    average, honest enrollee.

        I look forward to today's hearing and what I hope will be a good
    discussion on program integrity of HealthCare.gov.

        Before I conclude, I want to note that, even though this GAO
    investigation was requested by this committee, CMS was less than
    cooperative. Indeed, throughout the entire endeavor, officials at CMS
    appeared to be dragging their feet, blowing past deadlines and good-
    faith attempts to carry out this important work.

        Put simply, when Congress asks GAO to conduct an inquiry, no
    federal agency should stand in the way of that work. By delaying the
    GAO and hampering their efforts, CMS has also delayed this committee's
    work and hampered our efforts.

        This is unacceptable. And, unfortunately, despite promises of
    increased transparency and cooperation from agencies throughout this
    administration, this type of stonewalling of legitimate oversight
    efforts is far, far too common.

        Acting CMS Administrator Andy Slavitt, who is now the President's
    nominee to run the agency, was personally involved in this process. As
    the committee considers his nomination, I look forward to asking Mr.
    Slavitt about this investigation and why CMS has been interfering with
    our oversight efforts.

        Of course, that will all have to wait for another day and another
    time. Today, we have our hands full as we hear testimony about this
    important GAO investigation.

                                     ______

                     Prepared Statement of Hon. Ron Wyden,
                           a U.S. Senator From Oregon
        Let me begin my remarks by saying that on this side of the aisle,
    we don't take a back seat to anybody in fighting fraud and protecting
    taxpayer dollars. One dollar ripped off is one dollar too many. But
    let's be perfectly clear about one thing: the report up for discussion
    today is not about any real-world fraud.

        This study looks at a dozen fictitious cases--and not one of them
    was a real person who filed taxes or got medical services. No fast-buck
    fraudster got a government check sent to their bank account. Moreover,
    the government auditors acknowledge today that their work, quote,
    ``cannot be generalized to the full population of applicants or
    enrollees.''

        None of the fictitious characters in this study stepped foot in a
    hospital or a doctor's office. And the fact is, when you actually show
    up for medical services, it's a lot harder to fake your way into
    receiving taxpayer-subsidized care. Often before any services are
    delivered, providers ask for a photo I.D. with an insurance card. And
    if you've stolen an identity, there's probably a medical history
    belonging to somebody else that should set off alarm bells.

        If you're a real person signing up in the insurance marketplace,
    you have to attest under penalty of perjury that the information you
    provide is correct. And if you falsify the application, you face the
    prospect of a fine of up to $250,000.

        Another big anti-fraud check went untested in this study. That is,
    squaring up tax returns with the information from your insurance
    application. The GAO's testimony today calls it a, quote, ``key element
    of back-end controls.'' If your tax return and personal info don't
    match, the gambit's up. But the study before us today ignores that
    anti-fraud check. It looks at only part of the picture when it comes to
    stopping fraud.

        As I said at the beginning, there are always methods of
    strengthening any program and rooting out fraudsters and rip-off
    artists. Part of any smart, ferocious strategy against fraud, on one
    hand, is drawing a distinction between aggressively going after
    scammers and, on the other, not harming a law-abiding American who has
    made an honest, often technical mistake.

        A retiree nearing Medicare age shouldn't get kicked to the curb
    because she accidentally submitted an incorrect document. A transgender
    American shouldn't lose health coverage after a name change because
    some forms don't match. I can't imagine the Congress wants a system
    that nixes the health insurance coverage of Americans because of simple
    issues like those.

        A recent Gallup report stated that the rate of Americans without
    health insurance is the lowest they've ever measured. This is the first
    Finance Committee hearing on health care since the Supreme Court's
    landmark decision upholding the law that made that possible. The fact
    is, the Affordable Care Act has extended health care coverage to more
    than 16 million real people who use their insurance to see real
    doctors. At some point down the road, GAO is expected to complete their
    report. At that time, let's work responsibly to draw conclusions on a
    bipartisan basis about how the committee can work to improve American
    health care.

                                       [all]