One law, two audit programs: Medicare unchecked, Medicaid opted out

Medicare's Recovery Audit Contractor program -- private contractors, paid a percentage of whatever they claw back, reviewing already-paid claims for overpayments and underpayments -- was already operating nationally under a 2006 law when Section 6411 of the 2010 Affordable Care Act expanded that same mechanism to more Medicare claim types and used the same provision to create a parallel Medicaid version.▸ A 2013 HHS Inspector General report⧉ found that on the Medicare side, CMS had taken corrective action on 28 of 46 identified payment vulnerabilities worth $1.86 billion -- then evaluated the effectiveness of none of them -- and left six contractor fraud referrals sitting untouched until the audit itself prompted a review. A 2023 GAO report⧉ found the Medicaid side of the same law took a different path entirely: 34 states and D.C. had simply opted out, many without CMS tracking when their exemptions expired, while one state that kept auditing managed-care claims recovered more money on its own than every participating state in the country combined.

Medicare's version of the program came first.▸ A 2005-2008 demonstration project in six states found over $1.03 billion in improper payments, prompting the Tax Relief and Health Care Act of 2006 to require a national Medicare RAC program by 2010 -- four regional contractors, all operational by October 2009. The Affordable Care Act's Section 6411 then expanded the same mechanism to Medicare Part D, Medicare Advantage, and Medicaid, with roughly 40 states eventually awarding their own Medicaid RAC contracts. Contractors are paid entirely on contingency -- 9 to 17.5 percent of whatever they recover, depending on claim type in Medicare's case -- meaning they earn nothing unless they find something.

In fiscal years 2010 and 2011, Medicare RACs reviewed 2.6 million claims from 292,265 providers and identified $1.26 billion in improper payments across half of everything they reviewed.▸ Of that, OIG could confirm $903 million was actually recovered from or returned to providers -- $768 million in overpayments, $135 million in underpayments -- a figure that itself ran about $127 million below what CMS had separately reported to Congress for the same two years, a gap OIG attributed to differing methods of matching recoveries to the payments that triggered them. Two provider types, inpatient hospitals and physicians, accounted for 93 percent of the money; providers in California and New York alone accounted for nearly a quarter of it.

CMS tracks any single issue behind more than $500,000 in improper payments as a "vulnerability."▸ In fiscal years 2010-2011, it identified 46 of them, totaling roughly $1.9 billion. By June 2012, CMS had taken corrective action -- technical direction letters, computerized claim edits, provider education -- on 28 of the 46, covering $1.86 billion of that total. But CMS's own policy holds that a corrective action isn't closed until the agency has analyzed whether it actually worked, and OIG found CMS had done that analysis for none of the 28. The remaining 18 vulnerabilities, worth $31 million, had no corrective action at all, some pending for more than 700 days. In its June 2013 response, CMS said it now considered those 18 closed and would explore a protocol to measure effectiveness -- without saying it had built one yet.

Contractors that spot improper payments are also required to flag potential fraud to CMS rather than just recovering the money.▸ In fiscal years 2010-2011, three of the four Medicare RAC regions referred six providers for potential fraud. As of November 2012, OIG found CMS had not acted on any of them. It was only in CMS's written response to a draft of the OIG report that the agency accounted for what happened next: four referrals were forwarded to fraud-detection contractors for review, one lacked enough information to investigate, and the sixth -- flagged separately by a different contractor -- led to an investigation that got the provider's Medicare billing privileges revoked in 2012. The disposition exists because OIG asked; there is no indication CMS would have reported it otherwise.

GAO's 2023 review found a very different shape to the Medicaid side of the program.▸ In fiscal year 2021, 16 states ran a Medicaid RAC program, recovering $161.1 million combined. The other 34 states and D.C. -- 35 jurisdictions in all -- held a full CMS-approved exemption. States could cite more than one reason: 25 pointed to other program-integrity efforts already in place, 22 said they couldn't find a contractor willing to take the work, and 20 cited a Medicaid population dominated by managed care, which federal rules let states exclude from RAC review entirely.

CMS's own tracking of those exemptions had gaps of its own.▸ Of the 34 states and D.C. fully exempt, GAO found 9 with no documented expiration date on their approval at all, and another 18 operating on approvals that had already expired -- one for about two years -- without CMS reassessing whether the exemption was still warranted. CMS's most recent annual report to Congress on the program, covering fiscal year 2020, was limited to a participation count and a total recovery figure; it included no analysis of effectiveness and no recommendations for improving the program, despite the Affordable Care Act requiring CMS to report on exactly that.

The managed-care exclusion looks costlier by the year.▸ Since 2011, CMS has not studied whether including managed-care payments in RAC audits would be cost-effective, even as Medicaid's managed-care population grew from 42 million enrollees (74 percent of the program) to 68 million (84 percent) over the same period. One state that chose to audit managed-care claims anyway recovered $177.5 million in overpayments from managed-care organizations and their providers in fiscal year 2021 alone -- more than the $161.1 million every participating state in the country recovered combined that year -- and another $81.9 million in fiscal year 2022.