Risk Assessment of Puerto Rico Medicaid ProgramINTRODUCTIONPUERTO RICO MEDICAID PROGRAMThe Medicaid program provides medical assistance to certain low-income individuals andindividuals with disabilities and is jointly funded by the Federal and State Governments. At theFederal level, the Centers for Medicare & Medicaid Services (CMS) administers the programand approves a Medicaid State Plan.In Puerto Rico, the Puerto Rico Health Insurance Administration (referred to in Spanish as theAdministracion de Seguros de Salud de Puerto Rico or ASES) administers the island-widegovernment health care delivery system, which includes Medicaid. The Puerto Rico Departmentof Health (DOH) is the single State agency responsible for developing the Medicaid State Planand for administering the Medicaid program. Program monitoring activities are performed byDOH’s Quality Control Unit (QCU), Medicaid Anti-Fraud Unit (MAFU), and Program IntegrityUnit (PIU). DOH has cooperative agreements with ASES and with the Medicaid Fraud ControlUnit (MFCU) that is part of the Puerto Rico Secretary of Justice. ASES contracts with fiveManaged Care Organizations (MCOs) to provide Medicaid services.1 Figure 1 depicts PuertoRico’s Medicaid program organizational structure.Figure 1: Puerto Rico Medicaid Program Organizational Structure1The five MCOs are First Medical Health Plan Inc., MMM Multi Health LLC, Molina Healthcare of Puerto RicoInc., Plan De Salud Menonita Inc., and Triple-S Salud Inc.Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)1

Risk Assessment of Puerto Rico Medicaid ProgramRISK ASSESSMENTWe conducted a high-level risk assessment of Puerto Rico Medicaid program controls andprocesses. We identified program integrity, beneficiary eligibility, provider enrollment,overpayment reporting, and contracting as key areas at high risk for improper Medicaid programpayments. In addition, we determined that the risk of improper Medicaid program payments inPuerto Rico could be increased because there have been no recent reviews of Puerto RicoMedicaid program payments performed by CMS, and because Puerto Rico’s MedicaidManagement Information System (MMIS) has not been fully implemented. Finally, weidentified one area (program management) at moderate risk for improper Medicaid programpayments due to limitations in staff hiring and training.PROGRAM INTEGRITYProgram integrity refers to the proper management and function of the Medicaid program toensure that quality care is provided and Medicaid funds are used appropriately and with minimalwaste. According to a 2018 report issued by the U.S. Government Accountability Office (GAO),managed care programs that lacked robust program integrity activities were at greater risk ofimproper payments.2 GAO also identified various entities that must work together on Medicaidmanaged care program integrity efforts. These entities include: (1) Medicaid managed careoffices (such as ASES), which monitor MCO compliance with contract requirements; (2) PIUs,which identify improper Medicaid payments made by MCOs to providers; (3) MFCUs, whichinvestigate and prosecute Medicaid fraud; and (4) MCOs, which monitor providers to ensurethey are complying with program requirements.In November 2018, DOH, ASES, and MFCU entered into an agreement that establishedprocedures for coordinating program integrity efforts in Puerto Rico.3 However, the PIU did notbegin full operations until February 2019. Therefore, the role of the PIU was not incorporatedinto this agreement. We assessed this area as high-risk because, as of July 2020, ASES andMFCU were not coordinating program integrity efforts with the PIU that would enable theseentities to share information and define program integrity responsibilities. In addition, ASESofficials stated that ASES had delegated responsibility for provider oversight to the MCOs.However, ASES had not established procedures for monitoring the MCOs’ program integrityefforts. A lack of coordinated program integrity activities and reliance on MCOs to conductprovider oversight increases the risk of improper Puerto Rico Medicaid program payments.We will consider any action taken by Puerto Rico to incorporate the PIU into program integrityefforts subsequent to July 2020 as we plan future work related to the Puerto Rico Medicaidprogram.2Medicaid Managed Care: Improvements Needed to Better Oversee Payment Risks (GAO-18-528, issued July2018).342 CFR § 455.21(c) and 1007.9(d)).Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)2

Risk Assessment of Puerto Rico Medicaid ProgramBENEFICIARY ELIGIBILITYMore than one-third of Puerto Rico’s 2.9 million residents are enrolled in the Medicaid program.To be eligible for the program, applicants must, among other things, demonstrate that they:(1) are U.S. citizens, nationals,4 or qualified aliens5 with satisfactory immigration status;(2) reside in Puerto Rico; (3) have a Social Security number;6 and (4) meet incomerequirements.7Figure 2 depicts Puerto Rico’s process for determining whether an applicant is eligible for theMedicaid program and for redetermining the eligibility of individuals already enrolled in theprogram.8 Redeterminations should be conducted every 12 months or when a change in aMedicaid beneficiary’s circumstances impacts their eligibility.Figure 2: Medicaid Eligibility Determination ProcessA “national of the United States” includes all United States citizens as well as persons who, though not citizens ofthe United States, owe permanent allegiance to the United States (8 U.S.C. § 1101(a)(22)).45Qualified aliens include non-citizens who are lawfully admitted for permanent residence under the Immigrationand Nationality Act (8 U.S.C. § 1641).6There are limited exceptions to the requirement for a Social Security number (42 CFR § 435.910).States use the Federal Poverty Level (FPL) to determine whether an individual’s income qualifies for Medicaidcoverage. The FPL, established in 1963, was set at three times the cost of a minimum food diet and is updatedannually based on inflation and adjusted for family size and location. Puerto Rico uses a Commonwealth PovertyLevel (CPL), that is about 40 percent of the FPL and has not been updated to reflect inflation since 1998.Consequently, many Puerto Rico residents not eligible for Medicaid would be eligible for the program if theyresided elsewhere in the United States.78States are required to develop a plan for verifying income and other eligibility factors (42 CFR § 435.945(j)).Puerto Rico submitted a draft of its plan to CMS in June 2017. As of July 2020, CMS had not approved the plan.Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)3

Risk Assessment of Puerto Rico Medicaid ProgramAs illustrated in Figure 2, Puerto Rico must verify certain information obtained from Medicaidapplicants.9 Local DOH office caseworkers verify applicant’s citizenship status by reviewingdocuments such as a birth certificate, U.S. passport, or “green card.”10 In addition, local DOHoffice caseworkers verify immigration status by checking a U.S. Department of HomelandSecurity (DHS) database11 and verify date of birth by checking DOH’s Demographic Registry.Consistent with its submitted draft eligibility verification plan, Puerto Rico accepts applicants’self-attestations12 that they meet other Medicaid eligibility requirements (e.g., proof of income,proof of residency, pregnancy status, and household composition). For example, local DOHoffice caseworkers accept a written statement from an applicant indicating how much moneythey make as proof of income.Consistent with its submitted draft eligibility verification plan, Puerto Rico relies on a posteligibility determination process performed by the QCU to validate applicant eligibilitydeterminations. Each quarter, the QCU performs a manual verification of a sample of 400eligibility determinations from MEDITI (200 positive and 200 negative).13 As of February 2020,the QCU had a staff of six analysts assigned to perform this verification. To validate theeligibility determinations, the QCU analysts go to the local DOH office and review beneficiarycase file documentation. To validate the income reported by the applicants, QCU analysts checkdata input into MEDITI from other Commonwealth agencies.14 The analysts also check aU.S. Department of Health and Human Services (HHS) report from the Puerto Rico Departmentof Family to verify that beneficiaries are not obtaining Medicaid benefits elsewhere in the UnitedStates,15 and check the DHS database to verify beneficiary immigration status for non-U.S.citizens. Finally, the analysts conduct a desk review that includes telephone calls to the 2009Verification is proof of an applicant’s statement regarding their circumstances.A “green card” holder is someone who has been granted authorization to live and work in the United States on apermanent basis.1011The database is known as the Systematic Alien Verification for Entitlement (SAVE).12A self-attestation is unverified information provided by the applicant.13The positive sample consists of applicants determined eligible for Medicaid and the negative sample consists ofapplicants determined ineligible for the program.14Other Commonwealth agencies that input data into MEDITI include the Department of Treasury (income),Department of Labor (unemployment), and Department of Natural Resources (property such as boats).15This report is known as the Public Assistance Reporting Information System (PARIS) report. PARIS is the resultof a partnership between the HHS Administration for Children and Families and states/territories to detect improperMedicaid program payments.Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)4

Risk Assessment of Puerto Rico Medicaid Programbeneficiaries determined eligible for Medicaid to verify information related to householdcomposition.16 If fraud is suspected, the case is referred to the MAFU.17We assessed this area as high-risk because we noted weaknesses related to Puerto Rico’s posteligibility determination process for validating beneficiary eligibility. Specifically, interagencyagreements that enabled DOH to access income, unemployment, and property data input intoMEDITI by other Commonwealth agencies lapsed more than 3 years ago. Although DOHcontinues to check MEDITI, it does not contain up-to-date information from these other agenciesthat DOH could use to validate eligibility. Further, QCU officials stated that some local DOHoffices lost many of their applicant case files due to damage from Hurricane Maria. Finally, theacceptance of self-attestations increases the risk of improper payments should applicants provideinaccurate information related to household size and income level.Outdated, missing, or inaccurate beneficiary eligibility information may limit the effectiveness ofthe QCU eligibility validation process and increase the risk that ineligible applicants will beenrolled in the Puerto Rico Medicaid program.As resources and staffing allow, we will consider performing a future audit of Puerto RicoMedicaid program beneficiary eligibility determinations.PROVIDER ENROLLMENTTo prevent payments to ineligible providers and protect beneficiaries, Federal regulations requireMedicaid agencies to identify providers excluded from participating in Medicaid by conductingmonthly searches of a database maintained by the HHS Office of Inspector General (OIG)known as the List of Excluded Individuals/Entities (LEIE).18 The regulations also requireMedicaid agencies to screen providers prior to enrolling them in the Medicaid program and torescreen providers at least once every 5 years thereafter.19Prior to April 2020, ASES delegated responsibility for conducting monthly searches of the LEIEand screening/rescreening providers to the MCOs. However, ASES officials stated that ASEShad not implemented procedures for monitoring MCO efforts to search for excluded providers orto screen/rescreen providers.In April 2020, DOH assumed responsibility for conducting monthly searches of the LEIE andscreening/rescreening providers. DOH began implementing a Provider Enrollment Portal (PEP)in its MMIS designed to perform monthly searches of the LEIE to ensure excluded providers are16If the beneficiary cannot be reached by telephone or if questions related to household composition remain after thecall, the analyst will visit the beneficiary’s home to obtain additional information.17MAFU officials provided documentation indicating that, since 2009, approximately 75 percent of fraud cases forwhich they are actively pursuing recoveries were the result of beneficiaries having higher incomes than what theyreported.1842 CFR § 455.436.1942 CFR §§ 455.410 and 455.414.Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)5

Risk Assessment of Puerto Rico Medicaid Programprevented from participating in the Medicaid program. The PEP will also be used toscreen/rescreen providers and validate their enrollment information. The PEP is expected to befully implemented by December 2020.DOH officials stated that beneficiaries can receive medically necessary emergency and preauthorized health care services from providers located elsewhere in the United States. Accordingto DOH officials, while providers generally must enroll in the Puerto Rico Medicaid program toreceive payment, these providers are considered “out-of-network” providers and are not subjectto screening/rescreening requirements. Moreover, DOH officials stated that provider enrollmentdata maintained by ASES did not include provider agreement end dates. Therefore, DOHassigned an end date of December 31, 2299, to all provider agreements in MMIS. As a result,providers continue to be listed as enrolled providers regardless of whether they continue toprovide health care services to Puerto Rico Medicaid beneficiaries.DOH officials told us that they believed the number of active providers enrolled in the PuertoRico Medicaid program to be approximately 30,000.20 However, according to Puerto Rico’sMMIS, by February 2020, 246,876 providers had been enrolled in Puerto Rico’s Medicaidprogram. Of the 246,876 providers, 202,646 providers (82 percent) were located outside ofPuerto Rico. DOH officials stated that the PEP, when fully implemented, will enable DOH tovalidate enrollment data by identifying out-of-network providers and providers that no longerdeliver health care services to Puerto Rico Medicaid beneficiaries.We assessed this area as high-risk because ASES did not monitor MCOs to verify that requiredsearches for excluded providers and screening/rescreening of providers were being performed.We also considered the risk that ineligible providers remain enrolled in the Puerto Rico Medicaidprogram to be high because the PEP has not yet been fully implemented. Without effectiveprovider screening, Puerto Rico may be putting Medicaid beneficiaries at risk and are at greaterrisk of making improper payments.We will consider any action taken by Puerto Rico to fully implement the PEP subsequent toJuly 2020 as we plan future work related to the Puerto Rico Medicaid program.OVERPAYMENT REPORTINGPuerto Rico’s Medicaid program uses a managed care system under which ASES pays MCOs amonthly fee, known as a capitation payment, on behalf of each beneficiary for the provision of acomprehensive range of medical services.21 The capitation payment is based on a variety offactors, including demographic factors such as the beneficiary’s age and gender, and healthrelated factors such as the diagnosis of any medical conditions.Prior to the start of each quarter, Puerto Rico estimates its total capitation payments to MCOs forthe quarter and reports this amount to CMS on Form CMS-37, Medicaid Program Budget20DOH considers providers to be active if they treat and bill for services for Puerto Rico Medicaid beneficiaries,regardless of whether the providers are located in Puerto Rico.21Capitation payments are calculated in advance and remain fixed for a set period of time regardless of how oftenthe beneficiary needs services.Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)6

Risk Assessment of Puerto Rico Medicaid ProgramReport.22 CMS uses this information to determine its quarterly grant award to Puerto Rico and toaid in its development of the Federal Medicaid budget. Throughout each quarter, Puerto Ricoincurs Medicaid expenditures and withdraws Federal funds to cover the Federal share of thoseexpenditures. Within 30 days after the end of each quarter, Puerto Rico reports its actualcapitation payments made to MCOs as expenditures on Form CMS-64, Quarterly MedicaidStatement of Expenditures for the Medical Assistance Program.23 Federal regulations require theamounts reported on the form to represent actual recorded expenditures derived from sourcedocuments—not estimates.24In accordance with sections 1903(d)(2) and (d)(5) of the Social Security Act (the Act), Statesreport the amount of overpayments on the Form CMS-64 as an offset to expenditures.25 If theFederal share of overpayments is not reported or is underreported, Federal Medicaidreimbursement for the quarter will be higher than it should be.We determined that Puerto Rico did not report any overpayments on the Forms CMS-64 filed forthe quarters ended December 2017 through March 2020. PIU and MFCU officials stated thatwhile they had identified potential overpayments made to providers, they had not collected thembecause both agencies had only recently begun program operations.26 Moreover, neither unit hadprocedures for reporting such overpayments.Finally, MCOs periodically identify and recover overpayments made to providers that, whenrefunded to the Commonwealth, should be reported on the CMS-64. According to Federalregulations and the terms of their contracts with ASES, MCOs are also required to reportoverpayments to ASES on an annual basis for use in calculating future capitation payments.27However, we noted that CMS raised a concern in its 2016 focused review of Puerto Rico’sMedicaid program that “only one of three MCOs selected for review reported any overpaymentssince being awarded the contract.” CMS concluded that “for a Medicaid program of this size,the amount of overpayments is quite low.”We assessed this area as high-risk because Puerto Rico’s lack of procedures for reportingoverpayments on the Form CMS-64 increases the risk that CMS may make funding decisionsregarding Puerto Rico’s Medicaid program based on incomplete information. In addition, ASESmay not be receiving overpayment data from MCOs needed to accurately calculate futurecapitation payments. As a result, there is a risk that the Federal Government may be providingFederal funds for excessive or erroneous Medicaid program expenditures.22States use the Form CMS-37 as a statement of their funding requirements for the upcoming quarter.23Encounter data and payments made by MCOs to providers are not reported on the CMS-64.2442 CFR § 430.30(c)(2)).25Overpayment collections are reported on lines 9.A through 9.E of Form CMS-64. These collections may includecapitation payments and MCO payments made to providers.26The PIU began full operations in February 2019 and the MFCU began full operations in July 2019.2742 CFR § 438.608(d)(3)-(4).Risk Assessment of Puerto Rico Medicaid Program (A-02-20-01011)7

Risk Assessment of Puerto Rico Medicaid ProgramAs resources and staffing allow, we will consider performing a future audit of PuertoRico Medicaid program overpayment reporting.CONTRACTINGAs described earlier, Puerto Rico’s Medicaid program is a subset of a larger public governmenthealth care delivery system administered by ASES. During the period July 1, 2019, throughJune 30, 2020, ASES was a party to 74 active contracts,28 totaling 2.8 billion, for health careand other services provided by public and private entities. During the period October 1, 2019,through September 30, 2020, DOH was a party to 77 active contracts,29 to