The Commonwealth Health Insurance Connector Authority did not Ensure that its Database was Accurate

Audit found that the Commonwealth Health Insurance Connector Authority did not ensure it had the accurate home address information entered in its database system for all program participants.

Overview

The Commonwealth Health Insurance Connector Authority (CCA) did not ensure that it had accurate home address information in its database for all program participants. Using data-matching software, our data analytics team identified 5,026 members whose addresses appeared to be invalid. From these members, we chose a random sample of 307 addresses to test to determine whether they were in fact erroneous. We determined that 103 of the 307 addresses in our sample were invalid. In some instances, the home addresses were commercial properties, not residences, including a church and a warehouse in Hyannis, a strip mall in Middleborough, and a check-casher/tax-preparer business in Salem. In other instances, although CCA’s database indicated that the person’s address had been verified, this was not possible, since complete address information was not available in the database we tested. For example, the only address information for one program participant in the database was 47 West Roxbury (with no street name provided). By not performing periodic verifications of program participants’ addresses and then using the addresses to update its database, CCA may be providing participants with benefits or a level of benefits to which they are not entitled.

Authoritative Guidance

Title 130 of the Code of Massachusetts Regulations (CMR) sets forth requirements that apply to both MassHealth and CCA as MassHealth agencies.

According to 130 CMR 502.003, “The MassHealth agency requires verification of eligibility factors including income, residency, citizenship, immigration status, and identity.”

And 130 CMR 503.002 states,

As a condition of eligibility, an applicant or member must be a resident of the Commonwealth of Massachusetts. . . .

(E)(1)    The individual’s residency is considered verified if the individual has attested to Massachusetts residency and the residency has been confirmed by electronic data matching with federal or state agencies or information services.

In order to effectively ensure that program participants continue to meet the residency requirement, CCA should have a process in place that requires its staff to periodically verify the residency of all program participants, investigate any discrepancies, and update the information in its database promptly. It should also have internal controls in place, including monitoring controls, to ensure that this process is followed

Reasons for Issue

CCA officials asserted that the agency attempts to validate participants’ address information using LexisNexis, an online research tool, and that when a discrepancy is noted, CCA issues a request for information² (RFI) to the participant/s to clarify it. During our audit, they could not provide an explanation of why, if address validation was being done, CCA was not updating the information in its database to make sure it was accurate.

Recommendations

1. CCA should review its verification process and ensure that adequate controls (policies and procedures) exist that require information in its database to be reviewed for completeness and accuracy and updated appropriately on a regular basis to keep its database accurate and to better ensure that only eligible participants receive benefits.
2. CCA should immediately take the measures necessary to update the information in its database.

Auditee’s Response

CCA employs a procedure to verify information provided by applicants for health coverage, including residential address and other personal information within the hCentive database (“HIX”). This process is governed by federal regulation governing health insurance exchanges like CCA. . . . Residential addresses provided by applicants are validated against external data bases to determine if the addresses are valid residential addresses. In instances where this validation process identifies discrepancies, applicants are sent a request for information (RFI) to provide documentary verification of the address within 90 days. Information that is verified by this manual process is then updated in the database. . . .

Between January 1, 2015 through June 30, 2016, the HIX database contained approximately 810,554 individuals with addresses. The number of addresses that showed discrepancies represents a small percentage of that number. The CCA database reviewed for this audit represents an extract from the HIX database, which is the database used for eligibility determinations. The identified address discrepancies could be the result of the translation of the data received from the HIX database that occurred during that extraction process, or timing, from when the data extract was received and when it was provided to the auditors. In response to this audit finding, CCA will validate residential address data to reflect the ongoing verification process in databases that are used for eligibility related determinations and transactions.

Auditor’s Reply

As noted above, we found that CCA did not adequately ensure that it had accurate home address information in its database for all program participants. Moreover, in some instances the home addresses were clearly not residences, and in other instances, although CCA’s database indicated that the person’s address had been verified, this was not possible because complete address information was not available in the database we tested. Although there may be a number of possible reasons for these discrepancies, we believe that CCA needs to do a better job of ensuring that the information in its database is current and accurate. Based on its response, CCA is taking measures to address our concerns in this area.

2. An RFI is issued to customers to corroborate and verify information from the application. The applicant has 90 days from receipt of the RFI to respond.

Date published:	January 16, 2018