Medicaid Audit Impact and Post-Audit Efforts

During this time period auditees implemented recommendations from the Office of State Auditor that will save taxpayer dollars and make the MassHealth program work better.

Overview

The objectives of the performance audits conducted by the Office of the State Auditor (OSA) at MassHealth and its providers are not only to identify improper payments for Medicaid services, but also to identify any systemic problems such as deficiencies in internal controls that may exist within the MassHealth system. Measures such as referring cases to law enforcement for prosecution, recommending restitution, and taking other remedial actions against individual Medicaid vendors are typical results of OSA audits and serve as a deterrent against future waste, fraud, and abuse. However, systemic changes that MassHealth makes as a result of OSA audits, in many instances, have a more significant effect on the overall efficiency and integrity of the operation of Medicaid-funded programs.

To assess the impact of our audits and the post-audit efforts made by auditees to address issues raised in our reports, OSA has implemented a post-audit review (PAR) survey process that is conducted six months after the release of an audit. This process documents the status of the recommendations made by OSA, including any corrective measures taken by the auditee, as well as any estimates of future cost savings resulting from changes made based on our recommendations.

During the reporting period, OSA issued, and agencies completed, four PAR surveys for Medicaid audits. This number reflects audits with findings issued at least six months ago for which follow-up surveys have been completed. The self-reported surveys are issued six months after an audit is issued to allow management time to plan and implement its corrective action(s).

According to the survey results received, MassHealth and its providers reported that they have acted, or will act, on implementing the 9 recommendations. Summaries of the PAR surveys follow.

Audit of the Office of Medicaid (MassHealth)—Review of Capitation Payments

This audit was conducted in conjunction with the US Department of Health and Human Services Office of Inspector General and had the following findings:

1. MassHealth made an estimated $84,832,094 in capitation payments on behalf of members who were residing outside of Massachusetts.

In its response to the PAR survey, MassHealth indicated that the following three of OSA’s four recommendations were fully implemented:

   1.    MassHealth should revise its policies and procedures regarding its data matches for member eligibility. Specifically, MassHealth should require that all members flagged by data matches submit      documentation to substantiate that they reside in Massachusetts. If the member does not provide this  documentation, MassHealth should either pause this member’s coverage or move the member to its      fee-for-service model until it can determine whether the member’s coverage should be terminated.

2. MassHealth should investigate and resolve all instances where its data matches indicate that a member is enrolled in another state’s Medicaid program.
3. MassHealth should provide members with written instructions during the annual enrollment process on how to unenroll from MassHealth if they move outside of Massachusetts.

In addition, MassHealth had the following responses to the recommendation still in progress:

   1.    MassHealth should consult with CMS to see if it can gain access to T-MSIS, which MassHealth can use in its eligibility detection and residency verification process.

In its PAR survey, MassHealth stated the following:

MassHealth has reached out to CMS to set up a meeting to inquire about gaining access to the Transformed Medicaid Statistical Information System.

Audit of the Office of Medicaid (MassHealth)—Review of Telehealth

The finding from the audit of a review of telehealth behavior health services found that MassHealth made payments totaling $91,852,881 to its providers for telehealth behavioral health services that were not properly documented.

In the PAR survey, MassHealth stated that it had fully implemented both recommendations.

Audit of the Office of Medicaid (MassHealth)—Review of Continuity of Operations Plan

The findings from the audit of a review of MassHealth’s continuity of operations plan (COOP) found the following:

• MassHealth did not annually update its COOP or conduct staff training or exercises related to the plan
• MassHealth did not annually update or test its disaster recovery plan (DRP)

In response to the above findings, OSA provided four recommendations within the previously issued audit report. Responses provided by MassHealth as part of the PAR survey are as follows:

OSA Recommendations Fully Implemented by MassHealth

1. MassHealth should establish monitoring controls to ensure that it properly adheres to the policies and procedures it has established for updating and testing its COOP.
2. MassHealth should work with EOHHS to annually update its COOP and conduct staff training and exercises

OSA Recommendation Partially Implemented by MassHealth

3. MassHealth should establish written policies and procedures for assigning, managing, and monitoring its DRP.

Specifically, in its PAR survey, MassHealth stated the following:

MassHealth established the written policies and procedures for its Disaster Recovery Plan as a component of its Information System Contingency Plan (ISCP). MassHealth is in the process of finalizing its [calendar year 2023] review of the ISCP. In addition, MassHealth will be planning the ISCP Testing exercise later in [calendar year 2023].

OSA Recommendation Not Yet Implemented by MassHealth

4. MassHealth should identify an offsite disaster recovery location to use for the Medicaid Management Information System (MMIS). Once the site has been selected, MassHealth should test the updated DRP and incorporate the results into it.

Specifically, in its PAR survey, MassHealth stated the following:

MassHealth is preparing to migrate MMIS disaster recovery to Amazon Web Services (AWS) cloud space. Due to the complexity of the technology implementation, the significant cyber security reviews, and the involvement of multiple agencies, this migration will take some time. MassHealth expects to complete the migration by Summer 2024. MassHealth will perform the migration in close coordination with the Executive Office of Technology Services and Security (EOTSS), which is in the process of closing its Chelsea and Springfield data centers and migrating to the AWS cloud as part of its Cloud First strategy. When the migration is complete, MMIS will take advantage of DRP services available within the AWS cloud. The MMIS DRP will then be updated, tested, and integrated into the regular DRP monitoring schedule.

Date published:	March 1, 2024