PROGRAM INTEGRITY:

Report to the Subcommittee on Government Operations, Committee
on Oversight and Government Reform, House of Representatives

July 2026

United States Government Accountability Office

GAO-26-107946

A report to the Subcommittee on Government Operations, Committee on Oversight and Government Reform, House of Representatives

Contact: Rebecca Shea at SheaR@gao.gov

What GAO Found

The Office of Management and Budget annually designates a list of programs considered high-priority for improper payments. The Department of Veterans Affairs (VA) Community Care program and the Centers for Medicare & Medicaid Services’ (CMS) Medicare Advantage program are two of the 30 programs designated as high priority for fiscal year 2025. VA reported a Community Care improper payment estimate of $608 million for fiscal year 2025, or 2.4 percent of the program’s outlays. CMS reported a Medicare Advantage improper payment estimate of $23.7 billion for fiscal year 2025, or 6.1 percent of the program’s outlays. GAO found gaps in the agencies’ efforts to reduce improper payment and fraud risks.

	Community Care Program	Medicare Advantage Program
Developed and implemented a process to identify and assess the root causes of improper payments	●	●
Developed, implemented, and monitored corrective action plans that adequately address the identified root causes of improper payments	●	◐
Conducted a fraud risk assessment that identifies inherent fraud risks, assesses their likelihood and impact, determines risk tolerance, evaluates controls, and documents a fraud risk profile	○	○

Legend: ● Met; ◐ Partially met; ○ Not met.

Source: GAO.  |  GAO-26-107946

Note: Analysis based on the results of GAO work completed from November 2024 through June 2026.  

For the fiscal years included in GAO’s review, VA developed and implemented a process to identify and assess the root causes of improper payments in the Community Care program. VA also developed, implemented, and monitored corrective action plans that adequately address the identified root causes. While VA has taken steps to identify and assess fraud risks, these efforts do not meet the key elements of a fraud risk assessment and have not resulted in a comprehensive fraud risk assessment for the program, leaving it vulnerable to fraud.

For the fiscal years included in GAO’s review, CMS developed and implemented a process to identify and assess the root causes of improper payments in the Medicare Advantage program. However, its estimated improper payment rate has not decreased but remained steady. CMS’s corrective action plans are not sufficiently detailed and do not adequately monitor progress. Specifically, CMS does not have a detailed plan for expediting Risk Adjustment Data Validation (RADV) audits. These audits are CMS’s primary corrective action for identifying and recovering improper payments. CMS’s backlog of RADV audits contributes to significant delays in its recovery efforts. Furthermore, CMS has not conducted a comprehensive fraud risk assessment for the program. CMS’s efforts to reduce improper payments and fraud in the Medicare Advantage program will be inadequate without comprehensive corrective action plans and fraud risk assessments.

Why GAO Did This Study

Reducing improper payments and fraud is critical to safeguarding federal funds and could help achieve cost savings and improve the government’s fiscal position.

GAO was asked to assess agency efforts to identify and address root causes of improper payments and fraud. In this report, GAO examines to what extent (1) VA has taken steps to identify and address the root causes of improper payments and mitigate fraud risks in the Community Care program and (2) CMS has taken steps to identify and address the root causes of improper payments and mitigate fraud risks in the Medicare Advantage program.

GAO examined documentation from VA, CMS, PaymentAccuracy.gov, and prior reports from agency Offices of Inspector General (OIG). GAO also interviewed agency officials, OIG staff, and trade association representatives.

What GAO Recommends

GAO recommends that VA conduct a comprehensive fraud risk assessment of the Community Care program that aligns with leading practices in the Fraud Risk Framework. VA concurred with the recommendation.

GAO recommends that CMS establish and document a detailed plan for expediting RADV audits and conduct a comprehensive fraud risk assessment of the Medicare Advantage program that aligns with leading practices in the Fraud Risk Framework. CMS neither agreed nor disagreed with the recommendations. CMS also described past actions it has taken that it believes address GAO’s recommendations. GAO maintains new CMS actions are warranted, as discussed in the report.  

 

 

 

 

 

 

 

Abbreviations
CCN	community care network
CMRA	commercial mail receiving agency
CMS	Centers for Medicare & Medicaid Services
CPI	Center for Program Integrity
Fraud Risk Framework	A Framework for Managing Fraud Risks in Federal Programs
HHS	Department of Health and Human Services
I-MEDIC	investigations Medicare drug integrity contractor
IVC	Integrated Veteran Care
MAO	Medicare Advantage organization
OIG	Office of Inspector General
OMB	Office of Management and Budget
PIIA	Payment Integrity Information Act of 2019
RADV	risk adjustment data validation
SAO	senior accountable official
TPA	third-party administrator
VA	Department of Veterans Affairs
VACC	Department of Veterans Affairs Community Care program
VHA	Veterans Health Administration

July 21, 2026

The Honorable Pete Sessions
Chairman
The Honorable Kweisi Mfume
Ranking Member
Subcommittee on Government Operations
Committee on Oversight and Government Reform
House of Representatives

Reducing improper payments and fraud is critical to safeguarding federal funds and could help achieve cost savings and improve the government’s fiscal position. Improper payments—payments that should not have been made or were made in the incorrect amount—have been a persistent government-wide issue.[1] The Payment Integrity Information Act of 2019 (PIIA) requires the Office of Management and Budget (OMB) to annually designate a list of high‑priority programs for greater levels of review and oversight.[2] OMB has assigned the high‑priority designation to programs whose improper payment estimates indicate monetary losses equal to or greater than $100 million annually.[3]

The Department of Veterans Affairs’ (VA) Community Care program and the Department of Health and Human Services’ (HHS) Medicare Advantage program, which is administered and overseen by the Centers for Medicare & Medicaid Services (CMS), are two of the 30 programs that OMB designated as high priority for improper payments for fiscal year 2025.[4] VA reported $608 million in estimated improper payments—about 2.4 percent of outlays—for the Community Care program for fiscal year 2025. CMS reported $23.7 billion in estimated improper payments—about 6.1 percent of outlays—for the Medicare Advantage program for fiscal year 2025.[5]

Government health care programs are responsible for providing medical care for certain populations—such as veterans, people with disabilities, or people over 65 years old—and federal spending for these programs has grown significantly in the past decade. Given the more than 38 million Americans who rely on the Community Care and Medicare Advantage programs to fund their health care and the projected growth in federal spending on health care programs, it is vital that they function as intended and that the funding they receive goes toward its intended purpose.

As noted in the February 2025 update to GAO’s High Risk List, reducing improper payments and fraud is critical to better managing the cost of government.[6] Since fiscal year 2003, executive branch agencies have reported cumulative improper payment estimates of about $3 trillion, including $186 billion for fiscal year 2025. The actual amount of improper payments may be significantly higher.[7] Improper payments could suggest that a program may be vulnerable to fraud. However, improper payments estimates are not a valid indicator of the extent of fraud in a particular program. In April 2024, we estimated that the federal government lost from $233 billion to $521 billion annually from fraud, based on data from fiscal years 2018 through 2022.[8]

Beyond financial impacts, these program integrity issues erode public trust in government and hinder agencies’ efforts to execute their missions and achieve program objectives effectively and efficiently. One of the best ways to mitigate improper payments and fraud is to prevent them before they occur. To do this, agencies must have a firm understanding of the root causes of improper payments—or why those payments occurred in the first place—and assess the fraud risks in their programs. Doing so will ultimately focus agency corrective actions where they are most effective.

You asked us to examine improper payments and fraud in high-priority programs, as identified by OMB. For this report, we examined the extent to which (1) VA has taken steps to identify and address the root causes of improper payments and assess fraud risks in the Community Care program and (2) CMS has taken steps to identify and address the root causes of improper payments and assess fraud risks in the Medicare Advantage program.

To evaluate the extent to which agencies have identified and addressed root causes of improper payments, we obtained the agencies’ reported improper payment estimates from PaymentAccuracy.gov.[9] We reviewed the agencies’ financial reports and PaymentAccuracy.gov to obtain a list of reported improper payment root causes for the Community Care program and Medicare Advantage program. We then analyzed trends that occurred from fiscal year 2020 through fiscal year 2024.[10] To evaluate the extent to which agencies have developed, implemented, and monitored corrective action plans that adequately address identified root causes, we met with CMS and VA program officials and reviewed agency procedures to understand their processes for identifying root causes of improper payments and developing corrective actions. We reviewed agencies’ corrective action plans for identified root causes to determine whether elements required in PIIA and OMB guidance were present. In addition, we obtained and reviewed agencies’ internal reports, if available, for monitoring corrective action plans to determine the extent to which agencies implemented the plans and identified barriers. We analyzed data in the internal reports to identify any discrepancies regarding corrective action implementation.

To evaluate the extent to which agencies have identified and assessed fraud risks, we met with CMS and VA program officials and obtained documentation related to risk management from the agencies. We met with two health plan associations—AHIP, formerly known as America’s Health Insurance Plans, and Alliance of Community Health Plans—to obtain their perspective on improper payments and fraud in the Medicare Advantage program. We identified and selected health associations that operate nationally and represent the interest of various health plans, including Medicare Advantage organizations. We also met with HHS Office of Inspector General (OIG) and VA OIG officials to discuss fraud risks affecting the programs. We reviewed agencies’ risk assessment documentation and evaluated it against our A Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework).[11] Specifically, we evaluated them against the leading practices to identify and assess risks to document the programs’ fraud risk profile.

We conducted this performance audit from November 2024 to July 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Program Integrity

PIIA requires agencies to manage improper payments by, among other things, identifying risks, taking corrective actions, and estimating and reporting on improper payments in programs and activities they administer. Agencies’ success in addressing and preventing improper payments is largely influenced by two factors: (1) correctly identifying the root causes and (2) developing and implementing effective corrective action plans. According to OMB guidance, the root cause is the core issue that sets in motion the entire cause-and-effect reaction that ultimately leads to an improper payment.[12] According to OMB guidance, program officials will know that they have reached the root cause if eliminating the cause will prevent the error from occurring again.

Once agencies identify the root causes, they need to develop corrective action plans, which must properly address the root causes of the improper payments to be effective. According to OMB guidance, a corrective action plan should be proportional to the severity of the associated amount of improper payments due to the root cause and the frequency at which errors associated with the root cause occur.

However, actions that agencies take to address improper payments, such as improper payment reviews, are not designed to identify or measure the amount of fraud (financial or nonfinancial) that may exist, particularly schemes that cannot be easily detected. For example, improper payment reviews include checking whether certain documentation is present, but they are not designed to identify falsified documentation. As a result, improper payment root causes identified through this type of review may not fully capture the causes of fraud-related improper payments.

To help agencies manage program integrity risks from fraud, GAO issued the Fraud Risk Framework in 2015. The Fraud Risk Framework provides a comprehensive set of leading practices—organized within four components—that serve as a guide for agency managers to use when developing efforts to combat fraud in a strategic, risk-based way. The second component—assess—calls for program managers to plan regular fraud risk assessments and provides leading practices for planning and conducting regular fraud risk assessments.

See figure 1 for key elements of the second component, the fraud risk assessment process.

The assess component emphasizes conducting regular fraud risk assessments to identify and prioritize areas of vulnerability based on likelihood and impact of fraud and examining the suitability of existing controls to mitigate these risks. Understanding the root causes of fraud loss and how fraud can affect a program is essential for developing a strategy to mitigate fraud by identifying fraud risks and their likelihood and impact, then prioritizing those risks.

VA’s Community Care Program

The Community Care program allows eligible veterans to receive medical care from community providers instead of VA facilities.[13] In 2024, about 3 million veterans received medical care through the Community Care program. The program operates primarily as a fee-for-service model, administered through a community care network, with contracted third-party administrators (TPA) processing approximately 96 percent of claims in fiscal year 2024. VA’s community care network spans five regional networks across the United States. TPAs manage these networks and pay community providers on behalf of VA, and VA subsequently reimburses the TPAs.

Both TPAs and VA serve critical roles in maintaining payment integrity within the Community Care program. TPAs conduct prepayment and processing functions to ensure that they process community provider claims at correct contract rates. Meanwhile, VA performs prereimbursement validation checks to certify that reimbursements to TPAs are proper and conducts postpayment analyses to identify improper payments. According to VA officials, VA

·         conducts regular meetings with TPAs to review improper payment findings and discuss underlying root causes,

·         verifies that corrective actions are implemented, and

·         tracks financial recoupments.

Improper payments may occur when VA reimburses TPAs for claims that exceed required filing time frames, do not comply with established contract rates and appropriate payment amounts, or exceed authorized care limits.

VA’s reported improper payment estimates for the Community Care program have generally decreased from fiscal years 2020 to 2025, despite increasing program outlays (see table 1). VA reported that for fiscal year 2020, an estimated $7.5 billion, or 78.4 percent of total community care outlays, were made improperly. However, by fiscal year 2025, VA reported that this number had decreased to an estimated $608 million, or 2.4 percent of community care outlays.

Fiscal year	Program outlays (dollars in millions)	Estimated improper payment amount (dollars in millions)	Estimated improper payment rate  (percent)
2020	$9,523.48	$7,469.59	78.43%
2021	$14,167.55	$2,101.68	14.83%
2022	$17,382.00	$1,082.56	6.23%
2023	$20,152.58	$959.53	4.76%
2024	$21,981.87	$416.63	1.90%
2025	$25,444.18	$607.67	2.39%

Source: GAO analysis of Office of Management and Budget PaymentAccuracy.gov data.  |  GAO‑26‑107946

Note: Prior year improper payment estimates have not been adjusted for inflation.

In fiscal year 2021, the most recent year VA provided Community Care confirmed fraud information to OMB, the agency reported confirmed fraud of $179.9 million in the Community Care program.[14] We also previously reported on the fraud risks of ineligible providers and identified weaknesses in oversight of provider address data that could potentially allow individuals intending to commit fraud to use a nonbusiness address.[15] Additionally, various fraud schemes have targeted the Community Care program, including claims for services that were never provided and billing for unrelated and medically unnecessary services. For example, in February 2026, the owner of a home health care company pleaded guilty to one count of wire fraud and admitted to submitting fraudulent claims to the VA community care network for services totaling over $100,000 that were not provided.[16]

Federal law enforcement officials have also investigated alleged fraud in the Community Care program that resulted in providers agreeing to pay monetary settlements without admitting to fraudulent intent. For example, in 2026, a provider agreed to pay the federal government $3.7 million dollars to resolve allegations that it fraudulently billed the Community Care program and other federal and state health care programs for medically unnecessary services and knowingly endangered patient safety.[17]

Medicare Advantage Program

Medicare beneficiaries have the option to enroll in Medicare Advantage and receive their benefits through a private health plan. According to CMS enrollment data, there were 35 million Medicare beneficiaries enrolled in a Medicare Advantage plan in 2025.[18] These private plans, or Medicare Advantage organizations (MAO), are responsible for administering the private plan and collecting and maintaining the paperwork needed to determine recipient eligibility. CMS pays MAOs a monthly capitation payment that is adjusted based on the clinical risk of the beneficiary.[19] During audits, MAOs may be required to submit medical records for a select number of beneficiaries to substantiate the medical diagnosis data previously submitted to CMS. Improper payments may result when MAOs submit inaccurate or incomplete diagnosis data and CMS identifies discrepancies in medical records or insufficient documentation for those diagnoses. For example, CMS finding that a MAO’s medical record documentation does not substantiate a beneficiary’s diagnosis could result in a determination that an improper payment was made.

From fiscal years 2020 to 2025, CMS reported estimated improper payments for the Medicare Advantage program that ranged from $13.9 billion to $23.2 billion, as shown in table 2. CMS’s estimated rate of improper payments during this period ranged from 5.42 percent to 10.28 percent of program outlays.

Fiscal year	Program outlays (dollars in millions)	Estimated improper payment amount (dollars in millions)	Estimated improper payment  rate (percent)a
2020	$240,082.81	$16,271.66	6.78%
2021	$225,603.67	$23,188.06	10.28%
2022	$257,174.12	$13,940.82	5.42%
2023	$275,605.96	$16,550.76	6.01%
2024	$339,932.01	$19,066.91	5.61%
2025	$388,716.84	$23,665.12	6.09%

Source: GAO analysis of Office of Management and Budget PaymentAccuracy.gov data.  |  GAO‑26‑107946

Note: Prior year improper payment estimates have not been adjusted for inflation.

^aThe Centers for Medicare & Medicaid Services (CMS) made various changes to its methodology for calculating the improper payment rate, which, according to CMS, renders the rate incomparable across fiscal years prior to fiscal year 2023, as fiscal year 2023 established a baseline.

In 2025, HHS OIG identified combating fraud, waste, and abuse as a key element of the management and performance challenge facing HHS related to Medicare and Medicaid.[20] HHS OIG noted that fraud schemes are increasingly complex and global in scope, often migrating from one item or service to another. HHS OIG went on to note that different CMS programs have different risks because they pay for services and provide coverage differently. The OIG concluded that as HHS refines payment policies and incentives, it must anticipate and guard against exploitation of specific payment designs.

Federal law enforcement agencies have identified Medicare Advantage fraud schemes, including fraudulent overbilling, claims, and kickback schemes. According to Department of Justice press releases, these schemes have resulted in millions of dollars of losses in the Medicare Advantage program. For example, in December 2025, two health care executives were convicted of health care fraud, wire and health care fraud conspiracy, and kickback related charges for a scheme that resulted in the submission of approximately $34 million in false and fraudulent claims to Medicare Advantage plans.[21] These fraudulent claims were submitted for durable medical equipment that was not needed or not wanted by Medicare Advantage beneficiaries. One of the executives, the owner of multiple medical equipment companies, also paid kickbacks to obtain prescription orders that were then used to submit fraudulent claims.

Businesses have also agreed to pay monetary settlements without admitting to fraudulent intent to resolve allegations related to Medicare Advantage billing following federal investigations. For example, in December 2024, a nonprofit corporation that offered Medicare Advantage health plans and its affiliated corporation agreed to pay the federal government up to $98 million to resolve allegations that they knowingly submitted or caused the submission of invalid medical diagnosis codes to increase Medicare Advantage payments.[22]

VA Established Processes to Address Community Care Improper Payment Root Causes but Has Not Conducted a Comprehensive Fraud Risk Assessment

Through our review, we determined that VA has developed processes to identify root causes of improper payments and implement corrective action plans to address them.[23] While VA has taken some steps to identify and assess fraud risks in the Community Care program, it has not conducted a comprehensive fraud risk assessment of inherent fraud risks in accordance with leading practices (see table 3).

	Community Care program
Developed and implemented a process to identify and assess the root causes of improper payments	●
Developed, implemented, and monitored corrective action plans that adequately address the identified root causes of improper payments	●
Conducted a comprehensive fraud risk assessment that identifies inherent fraud risks, assesses their likelihood and impact, determines risk tolerance, evaluates controls, and documents a fraud risk profile.	○

Legend: ● = Met; ◐ = Partially met; ○ = Not met.

Source: GAO.  |  GAO‑26‑107946

Note: Table is based on results of GAO work completed from November 2024 through July 2026.

VA Has Processes to Identify the Root Causes of Improper Payments

VA Uses Tools and Collaboration to Determine the Root Causes of Improper Payments

VA has developed a set of processes and tools, supported by a multilayered and collaborative approach, to test for improper payments and identify their root causes. VA designed these processes to determine the underlying factors contributing to improper payments in the Community Care program.

According to VA officials, VA follows a seven-step review process when conducting improper payment testing in the Community Care program, including reviews of documentation, eligibility, and payment. VA created a review template to use when conducting improper payment testing in the Community Care program. According to VA officials, the review template ensures consistency by guiding reviewers through the improper payment review process and facilitating root cause determinations. Additionally, VA uses reference materials alongside its review template to help improper payment reviewers conduct complete and accurate assessments. For example, VA uses “desk procedures” that offer detailed, step-by-step guidance and scenario-based instructions for improper payment reviewers. For more information about VA’s improper payment review process and how the review template facilitates root cause determinations, see appendix I.

VA also employs a multilayered, collaborative process to further identify and refine the root causes of improper payments in the Community Care program. This includes

·         peer reviews,

·         supervisory validations,

·         concurrence reviews with stakeholders,

·         periodic assessments of improper payment review processes and tools, and

·         regular coordination and communication amongst program officials and stakeholders.

According to VA officials, this collaborative approach allows improper payment reviewers to pinpoint where errors occurred and determine their underlying causes.

Identified Root Causes of Improper Payments Changed in the Community Care Program from Fiscal Year 2021 to Fiscal Year 2024

According to VA officials, the agency’s approach to reducing improper payments in the Community Care program has evolved from broad, large‑scale actions to targeted mitigation strategies. The nature of VA’s identified payment error categories for the Community Care program shifted from broader system and policy issues—such as payment processing errors and eligibility problems related to implementation of the VA MISSION Act of 2018—toward more specific compliance issues, including untimely claim submissions and payments that did not align with contract terms.[24]

As shown in figure 2, in the Community Care program from fiscal years 2022 to 2024, VA demonstrated improvements in reducing (1) technically improper payments and (2) claims with insufficient documentation to determine whether payment is proper or improper.[25] In fiscal year 2024, VA did not report either of these issues as root causes. VA officials stated that improved Community Care procurement processes due to the VA MISSION Act of 2018 helped to reduce technically improper payments. VA officials attributed the reduction of insufficient documentation errors to two changes in the Community Care program: (1) providing improper payment reviewers direct access to VA payment and authorization systems and (2) transitioning to new claims processing systems with built-in automation that stops claims if they do not substantially comply with clean claim requirements.

VA Adequately Designed, Implemented, and Monitored Corrective Action Plans to Address Identified Root Causes of Improper Payments

VA Uses a Corrective Action Plan Template Designed to Address Root Causes

VA developed a template to implement corrective action plans.[26] This template is designed to help ensure that VA’s corrective actions address root causes and that VA can strategically measure its progress in implementing corrective actions. For each corrective action, the template directs VA officials to document (1) descriptors and underlying causes, (2) mitigation strategies, (3) planned tasks, and (4) annual benchmarks.[27] The template also directs VA officials to document benchmarks for the overall corrective action plan.

According to VA officials, VA designed the template to ensure clear ownership and accountability structures and to enable measurable, attainable, and quantifiable results. Senior accountable officials (SAO) develop and oversee each corrective action plan, and specific VA officials implement the plan by completing individual tasks assigned to them. Each corrective action and individual task has an established completion date, which SAOs use to monitor implementation progress. See appendix II for the corrective action plan template VA used in fiscal year 2024.

From fiscal year 2022 through fiscal year 2024, VA employed two primary mitigation strategies in its corrective action plans for the Community Care program. Specifically, of the 19 corrective actions taken in this time frame, 12 involved process changes and five involved automation.[28] The process changes mitigation strategy focused on operational improvements, including enhancing prepayment checks in the Community Care program’s authorization system and enforcing contract requirements for TPAs to bill at correct allowable rates through enhanced contract language. The automation mitigation strategy emphasized system-based solutions, including verifying auto-denial functions and auto processing correct claims rates in the Community Care program’s claims adjudication management system. The remaining corrective actions employed audit and training mitigation strategies.[29]

VA Uses a Multilayered Approach to Monitor Corrective Action Plans and Refine Root Causes

VA combines regular independent reviews and ongoing oversight to monitor the effectiveness of its corrective action plans and refine identified root causes in the Community Care program. VA designed this approach to ensure that corrective actions are targeted and that the root causes of improper payments in the program are adequately addressed.

Annually, the Veterans Health Administration (VHA) performs independent reviews of the effectiveness of the Community Care program’s corrective action plans. These effectiveness reviews assess mitigation strategies according to four key metrics: timeliness; reduction in number of errors; reduction in dollar amount of errors; and whether mitigation strategies are clear, are actionable, and address underlying causes.[30] Appendix I outlines the criteria VA uses to assess whether mitigation strategies meet these metrics.

Through these reviews, VA determines whether mitigation strategies were effective. Under VA’s criteria, mitigation strategies are considered effective if they either

·         pass all four metrics or

·         pass three of four metrics and reduce improper payments related to the root cause.

If mitigation strategies are new or are deemed ineffective, VA conducts additional root cause analyses to help ensure that mitigation strategies effectively address the root causes of the improper payments.

VA officials, including SAOs and VHA staff, also conduct additional oversight activities, such as reviewing monthly and quarterly corrective action plans, to monitor corrective action plans and refine root causes. VA officials stated that this collaborative approach to managing and updating corrective actions has proven to be an effective practice for VA.

VA Has Identified Additional Opportunities to Address Improper Payments in the Community Care Program

As part of its efforts to strengthen payment integrity in the Community Care program, VA plans to improve community care network (CCN) contracts through the CCN Next Generation contract initiative. As part of this initiative, VA intends to explore more proactive or preventive controls earlier in the payment life cycle and develop more efficient processes, mitigate previously identified issues, and improve the overall service quality for veterans in the Community Care program. VA publicly released a request for proposals for its CCN Next Generation contract initiative in December 2025, with the deadline for offers being May 8, 2026.

Additionally, VA officials identified technology and information systems enhancements that may improve payment integrity in the Community Care program, including

·         establishing an automated interface with Medicare to obtain veteran insurance information directly instead of relying on veterans to keep VA informed of their Medicare plans and effective dates;

·         establishing an automated interface with Medicare payment data to prevent duplicate payments, replacing VA’s current, partially manual review;

·         establishing an interface between VA’s revenue billing system and community care medical claims adjudication systems to help identify improper payments by detecting duplicate primary payer situations and ensuring accurate insurance information; and

·         consolidating to a single medical claims adjudication system for the Community Care program—according to VA, there currently are at least five different systems that adjudicate medical claims.

VA Has Not Conducted a Comprehensive Fraud Risk Assessment to Identify and Mitigate Community Care Program Fraud Risks

VA has not conducted a comprehensive fraud risk assessment of the Community Care program that aligns with leading practices in the Fraud Risk Framework. Specifically, VA has not identified all inherent fraud risks to assess their likelihood and impact or examined the suitability of existing fraud controls.

 

Department of Veterans Affairs (VA) Community Care – Settlement Examples VA’s Community Care program allows eligible veterans to receive medical care from community providers instead of VA facilities. The following are two examples of settlements regarding fraud allegations in this program: In 2024, an acupuncturist and his clinic agreed to pay $2.3 million to resolve allegations related to the submission of inflated bills for veterans in the Community Care program. Specifically, it was alleged that the provider misrepresented the time he spent treating veterans by billing for 1 hour of personal contact for each veteran he treated despite spending no more than 15 minutes with any patient. Additionally, in April 2025 a drug and alcohol rehabilitation center agreed to pay $19.75 million to resolve allegations that it submitted claims to the Community Care program for providing residential treatment and partial hospitalization care to veterans without a license or contract to provide those services and kept false records of the care provided to veterans, among other claims. Source: Department of Justice Press Releases.  |  GAO‑26‑107946

The Fraud Risk Framework identifies leading practices for conducting a fraud risk assessment to identify and assess fraud risks, which are documented in a fraud risk profile. A robust fraud risk profile should include information about all fraud risks that may affect a program. The framework states that program managers should (1) determine the type of internal and external fraud risks that programs may face and (2) have a documented risk assessment that identifies risks; assesses them; and develops a strategy to address analyzed risks, including periodically evaluating whether the risk response continues to be effective. The risk assessment process should identify all inherent fraud risks, assess the likelihood and impact of those risks, determine fraud risk tolerance, examine the suitability of existing fraud controls and prioritize residual risk, and document a fraud risk profile.

Effective managers consider financial and nonfinancial impacts during the assessment process. While the Fraud Risk Framework acknowledges that agencies may use other risk management processes that consider fraud risks, such efforts do not eliminate the separate and independent fraud risk assessment requirements.

VA officials informed us that the types of fraud risks that have been identified include community providers billing for (1) services not provided or rendered, (2) unrelated and medically unnecessary services, and (3) more severe and expensive diagnoses or procedures than diagnosed or performed (called “upcoding”). They also identified fraud risks specific to certain service types, such as substance abuse treatment, drug testing, and genetic testing.

While VA has taken various steps to identify and assess risks generally in its programs, these efforts have not resulted in a comprehensive fraud risk assessment of the Community Care program. These efforts include the following:

·         A broad assessment of risks from VA’s Office of Business Oversight.[31] According to VA officials, VA’s Office of Business Oversight generates this risk assessment annually. It is then sent to VA community care program staff for input and completion. The 2024 assessment documented two fraud, waste, and abuse risks and one health care delivery risk related to the Community Care program.[32] According to VA officials, the assessment was focused on fraud and included examples of fraud schemes. However, a comprehensive fraud risk assessment in alignment with leading practices, as described in the Fraud Risk Framework, would involve assessing all inherent program fraud risks, not just examples of fraud schemes. This broad assessment did not address all of the Fraud Risk Framework’s key elements for a comprehensive fraud risk assessment and did not include a documented fraud risk profile for the Community Care program. The identified risks were also broad or grouped fraud with waste and abuse. As a result, the assessment’s determination of likelihood and impact did not specifically consider fraud risks in accordance with leading practices.

·         A risk register that tracks risks in Integrated Veteran Care (IVC) programs, including the Community Care program. According to VA officials, as of June 2025, none of the categorized fraud risks in the register were associated with the Community Care program. Consequently, the identified community care risks discussed above are not captured in IVC’s risk register as fraud risks.

·         A fraud risk assessment specific to Community Care program provider addresses. Developed in response to our 2022 recommendation, this assessment included a fraud risk profile that analyzed the risk of veterans receiving inadequate care specifically from community care providers using commercial mail receiving agencies (CMRA) as a service address.[33] It also identified two related fraud risk factors and identified antifraud controls to verify addresses. While valuable to prevent, detect, and respond to the risk of fraudsters seeking to disguise their addresses, this assessment only covers one inherent risk in the Community Care program.

·         An Integrated External Networks risk portal.[34] According to VA officials, this risk portal documents all identified risks associated with the Integrated External Network and includes detailed records of all risks. While VA officials stated that this portal served the same function as a fraud risk profile, officials told us that none of the entries in the portal were categorized as fraud risks facing the Community Care program.

While VA has taken some steps to identify and assess risks, these efforts do not meet the key elements of a fraud risk assessment in the Fraud Risk Framework. Specifically, the agency has not performed a comprehensive fraud risk assessment that identifies inherent fraud risks affecting the program, assesses the likelihood and impact of those risks, determines fraud risk tolerance, examines the suitability of existing fraud controls and prioritizes residual risk, or documents a program-wide fraud risk profile.

VA officials acknowledged to us that they had not comprehensively assessed community care program’s fraud risks. They noted challenges such as limited bandwidth, competing priorities, and concern about duplicating efforts. For example, VA officials noted that the VA office that prepared the CMRA-related fraud profile was no longer in existence. VA officials added that, due to limited resources, they have not conducted a fraud risk assessment because they have prioritized addressing community care risks that the Office of Business Oversight and other oversight bodies have identified.[35] Additionally, IVC officials stated that they did not want to duplicate the Office of Business Oversight’s risk assessment efforts. However, because the Office of Business Oversight’s assessment did not comprehensively assess fraud risks, these efforts to avoid overlap have led to a gap in fraud risk assessment coverage for the Community Care program.

Without a comprehensive fraud risk assessment, VA cannot be assured that it is aware of and targeting resources toward preventing fraud schemes with the greatest likelihood and impact on the Community Care program. Agencies have flexibility in how they design their antifraud activities and structures and can incorporate or align fraud risk activities with other program risk management activities. However, integrating antifraud efforts into a broader risk management and internal control approach may pose trade-offs. While this structure may provide a broad view of risks, ranging from unintentional errors to sophisticated fraud schemes, without careful planning, it also could limit the resources and attention focused specifically on fraud prevention, detection, and response.

While VA’s existing risk assessment efforts could inform a fraud risk assessment, VA has not used these efforts to comprehensively assess fraud risks in the Community Care program. Given the program’s complexity—which, VA has noted, complicates compliance and oversight efforts—an assessment that considers fraud risks specific to the Community Care program can help ensure that existing controls are appropriately targeted to these unique risks. Further, with an assessment for the Community Care program, VA could better assure that its antifraud strategy appropriately prioritizes fraud risk management activities across programs.

CMS Has Not Sufficiently Addressed Improper Payments and Fraud Risks in the Medicare Advantage Program

To address improper payments and fraud in the Medicare Advantage program, CMS implemented a process to identify the root causes of improper payments, developed corrective action plans, and conducted an assessment for program integrity risks. Through our review, as shown in table 4, we determined that CMS met OMB requirements to develop and implement a process to identify the root causes of improper payments in the Medicare Advantage program. We also found that CMS developed and partially implemented corrective action plans to address those identified root causes. While CMS has taken these steps, overall, its estimated Medicare Advantage improper payment rate has not decreased but remained steady. In addition, CMS has not conducted a comprehensive fraud risk assessment of the Medicare Advantage program to fully identify and assess fraud risks consistent with the requirements of the Fraud Risk Framework.

	Medicare Advantage program
Developed and implemented a process to identify and assess the root causes of improper payments	●
Developed, implemented, and monitored corrective action plans that adequately address the identified root causes of improper payments	◐
Conducted a comprehensive fraud risk assessment that identifies inherent fraud risks, assesses their likelihood and impact, determines risk tolerance, evaluates controls, and documents a fraud risk profile	○

Legend: ● = Met; ◐ = Partially met; ○ = Not met.

Source: GAO.  |  GAO‑26‑107946

Note: Table is based on results of GAO work completed from November 2024 through July 2026.

CMS Has a Process in Place to Identify the Root Causes of Improper Payments

CMS designed and implemented a process to identify and assess the root causes of improper payments, with a focus on medical record reviews. To identify improper payments and their root causes, CMS’s Office of Financial Management selects a sample of payments using enrollee diagnosis information from CMS and, for each beneficiary in the sample, requests medical records from the MAO serving a beneficiary. Once MAOs submit the records into CMS’s system, medical record review contractors then review the medical records in two phases. For each phase, the review contractors use a standard set of questions to determine any errors and their root causes. CMS has developed its own list of root causes specific to the Medicare Advantage program. To meet OMB reporting requirements, CMS correlates those root causes to standardized OMB root cause categories for improper payments reporting.

In the first phase of review, the review contractor determines whether the MAO submitted valid medical records. If the medical records are not valid, the review contractor identifies the error, then determines and categorizes its root cause. The primary root cause of invalid medical records is “insufficient documentation,” which occurs when there is a lack of supporting documentation necessary to verify payment accuracy.

CMS considers medical records with the following issues as invalid due to insufficient documentation:

·         missing or invalid signature,

·         missing or incorrect dates,

·         invalid provider type or source, and

·         missing or invalid credentials or specialty.

Valid medical records move forward to the second phase: medical record review. For this phase, the medical record review contractor reviews the medical records to determine if the records support the diagnoses MAOs submitted and, if applicable, to determine the type of errors found within the record. The review contractor looks for discrepancies or diagnostic coding errors and maps any errors to the medical records discrepancies root cause category. The primary root cause for this phase, “medical record discrepancies,” occurs when the medical records MAOs submitted do not substantiate a diagnosis category for which the MAO received payment.[36] Medical record discrepancies that result in underpayments are reclassified as “administrative or process errors by other party.” “Administrative or process errors by other party” occur when MAOs incorrectly enter data or incorrectly classify or process applications or payments.

Examples of medical record discrepancies include instances when

·         documentation contradicts the reported diagnosis,

·         the beneficiary’s condition is no longer present,

·         the MAO does not follow coding guidelines, and

·         a diagnosis comes from the patient rather than a valid provider.[37]

If a review contractor determines that a diagnosis is not supported, a second review contractor examines the case and confirms the determination. Figure 3 depicts the two phases in CMS’s process for identifying the root causes of improper payments.

CMS considers payments improper if CMS makes them based on invalid records or valid records with discrepancies or coding errors. In these cases, the review contractor documents the identified causes of the improper payments in the system. If the review contractor is uncertain whether a payment is improper or the cause of that improper payment, the review contractor can escalate the record to the Quality Assurance Panel. The panel reviews all escalated cases and makes a final decision as to whether the payment is improper.

Ultimately, through this process, CMS has identified three main categories of improper payment root causes: medical record discrepancies, administrative or process errors by others, and insufficient documentation.[38] Figure 4 illustrates the identified root causes for improper payments from fiscal years 2021 through 2024.

CMS’s Corrective Actions for the Medicare Advantage Program Do Not Adequately Address Improper Payments

CMS Developed a Range of Corrective Actions to Address Improper Payment Root Causes

CMS’s Center for Program Integrity (CPI) is responsible for developing and coordinating corrective actions to address the three root causes of Medicare Advantage improper payments. To mitigate identified improper payments risks, CPI meets with the Vulnerability Collaboration Council to discuss improper payment issues and identified root causes specific to Medicare Advantage and to develop mitigation strategies and corrective actions.[39] CPI also considers several factors when determining corrective actions and mitigation strategies to implement, including input from CMS components involved with Medicare Advantage improper payments, prior OIG and GAO recommendations, PIIA requirements, and related OMB guidance. CMS reports its corrective actions and mitigation strategies annually within the HHS agency financial reports and quarterly on PaymentAccuracy.gov.

CMS’s corrective actions and mitigation strategies focus largely on three types of reviews, all of which occur after payment:

·         RADV audits. CMS performs risk adjustment data validation (RADV) audits to confirm that medical records support enrollees’ diagnoses. CMS does not validate the diagnosis data that MAOs submit before they are incorporated into an enrollee’s risk profile. According to CMS, there is an incentive for MAOs to potentially overreport diagnoses to increase payments. CMS conducts postpayment audits of MAO-submitted diagnosis data to ensure that diagnoses are supported by enrollees’ medical records. According to CMS officials, these audits are their primary corrective action and focus on identifying and recovering improper payments after the payment year ends and CMS finalizes payments to MAOs. According to CMS officials, RADV audits, along with other regulatory requirements, incentivize plans to report and return overpayments.[40]

·         Program integrity audits. A CMS contractor conducts program integrity audits to identify areas in which Medicare Advantage plan sponsors are noncompliant with program integrity requirements.[41] CMS also uses these audits to educate plan sponsors on fraud, waste, and abuse.

·         I-MEDIC investigations. The investigations Medicare drug integrity contractor—also referred to as I-MEDIC—conducts investigations to detect and deter fraud, waste, and abuse for high-risk prescribers and pharmacies in the Medicare Advantage program. The I-MEDIC also makes recommendations for provider revocations and refers cases to law enforcement and other regulatory bodies for further action.

According to CMS officials, certain limitations hinder CMS’s ability to implement controls before payment in the Medicare Advantage payment process:

·         Program structure. The Medicare Advantage program is set up so that CMS makes monthly payments to MAOs throughout the payment year. However, MAOs may submit and correct data that CMS uses for payment calculation before the final risk adjustment data submission deadline.[42] If an MAO corrects or submits new data, CMS retroactively adjusts monthly payments to the effective date. After the payment year ends, CMS reconciles risk adjustment data and finalizes payments. Given this payment structure, CMS has no way of determining whether payments to MAOs are improper at the time of payment and must wait until the end of the payment year, after payments are finalized, to determine propriety. According to CMS officials, payments are not considered improper before the final risk adjustment data submission deadline.

·         Resource constraints. Medical reviews can confirm enrollee diagnoses underpinning the monthly payments to MAOs. However, these reviews are costly and time intensive. According to CMS officials, conducting them on a prepayment basis as part of a preventive control structure may require significant resources due to the large number of program enrollees—35 million as of March 2025, per CMS enrollment data.[43]

These limitations to implementing prepayment controls in the Medicare Advantage program emphasize the importance of RADV audits in identifying and recovering improper payments.

In addition to postpayment reviews, CMS’s corrective actions also include training, such as program integrity training sessions; fraud, waste, and abuse webinars; and information-sharing sessions in which plan sponsors collaborate and discuss best practices. Additionally, CMS conducts outreach to plan sponsors with incomplete or invalid documentation to address potential improper payments, as well as to educate plan sponsors on documentation requirements. CMS also issues final findings reports to plan sponsors with feedback on their submissions and validation results to improve future collection of medical records and reduce improper payments.

CMS’s Corrective Actions for the Medicare Advantage Program Are Not Sufficiently Detailed and Do Not Adequately Monitor Progress

While CMS has identified various corrective actions, the Medicare Advantage program’s estimated improper payments increased from $13.9 billion in fiscal year 2022 to $23.7 billion in fiscal year 2025. Program outlays for the Medicare Advantage program have increased each fiscal year since 2021 and the improper payment rate has remained stable, around 6 percent since CMS established a baseline in fiscal year 2023. This pattern suggests program growth without effective actions for reducing improper payments.[44] CMS has not reported a significant decrease in the rate, which suggests that CMS’s corrective actions are not effective in reducing improper payments.[45]

According to OMB guidance, agencies should identify annual benchmarks to demonstrate corrective action plans’ impact on improper payment prevention, as well as the agencies’ progress in implementing their plans. Furthermore, in response to our April 2020 recommendation,[46] HHS issued its Improper Payment Corrective Action Plan User Guide.[47] The guide outlines the elements program managers should include when developing corrective action plans, such as identifying root causes, establishing planned start and completion dates, documenting corrective actions, setting targets and benchmarks, and assessing barriers. It also emphasizes the importance of evaluating the effect of corrective actions to refine program integrity activities. If targets are not met, program managers should develop new strategies, adjust resources, or revise targets.

In our February 2025 High Risk Series report, we noted that while CMS has targets for reducing Medicare improper payments and highlights corrective actions taken to address root causes of payment errors, it does not identify clear metrics to assess progress or time frames and resources needed to implement corrective actions.[48] CMS officials indicated that they assess corrective actions as part of their quarterly updates on PaymentAccuracy.gov and report on the effectiveness of corrective action plans annually in the HHS agency financial reports—and therefore can see progress across performance years. However, during our current review, we found that CMS still has not identified and reported on benchmarks or performance metrics, other than the improper payment rate, that could measure the effectiveness and progress of its corrective action plan for the Medicare Advantage program. Increased enrollment, rising estimated improper payments, and the lack of performance metrics to determine the effectiveness of its corrective action plan highlight the need for CMS to identify and recover improper payments in a timely manner.

CMS’s Plan to Improve RADV Audit Timeliness Lacks Necessary Detail

Although RADV audits are CMS’s primary corrective action to help CMS identify and recover overpayments, there have been long-standing issues with completing RADV audits in a timely manner. While CMS has developed an initiative to address these shortcomings in RADV audits, it has not (1) provided a detailed plan or (2) fully addressed concerns related to the increased administrative burden for MAOs; therefore, it runs the risk of falling short of its goals.

In April 2016, we found that RADV time frames were so long that they may hamper the agency’s efforts to conduct audits annually.[49] We recommended that CMS enhance the timeliness of its RADV process by requiring, among other things, that RADV auditors complete their medical record reviews within a specific number of days, comparable to other medical record review time frames in the Medicare program.[50]

CMS has taken steps to improve the timeliness of RADV audits. In November 2024, CMS initiated RADV audits for payment year 2018 and used an automation tool to streamline the medical record intake process.[51] According to CMS officials, the streamlined process reduced the audit time frame for the payment year 2018 audits from 18 months in prior years to approximately 12 months.

While CMS has taken steps to enhance the timeliness of the RADV audit process, it is still behind in conducting RADV audits for payment years 2019 to present. Furthermore, HHS OIG reported that recovery audits and activities performed during fiscal years 2023 and 2024 were delayed and that overpayments had yet to be recovered.[52] In May 2025, to reduce the backlog for RADV audits, CMS announced plans to expedite the completion of all RADV audits for payment years 2018 through 2024 by early 2026.[53]

In June 2025, CMS initiated the RADV audits for payment year 2019, the first set of audits that will review all eligible Medicare Advantage contracts.[54] CMS expected to initiate RADV audits for payment years 2020 through 2024 in fall 2025 but failed to do so within the specified time frame for various reasons, including a government shutdown and lack of a detailed plan for completing the audits. In December 2025, CMS adjusted its timeline, planning to initiate RADV audits of payment years 2020 through 2024 incrementally, every 3 to 4 months throughout the next year, and issue findings on a rolling basis. CMS stated that it expects to begin issuing findings in mid-calendar year 2026. However, according to the schedule on its website, CMS does not intend to initiate all audits for payment years 2024, 2023, and 2022 until August 2026, November 2026, and January 2027, respectively.

CMS’s initiative to improve the timeliness and efficiency of RADV audits is rather complex. According to CMS, it will require

·         enhancing its technology,

·         leveraging existing contract resources to expand its workforce,

·         increasing data processing and system bandwidth,

·         increasing the number of Medicare Advantage plans that CMS audits annually, and

·         collaborating with HHS’s OIG to recover uncollected overpayments identified in past audits.

Each aspect of this initiative may entail significant changes to CMS’s personnel, operational processes, and technology. As previously stated, detailed corrective action plans are necessary to track effectiveness and implementation status. However, CMS has not shared specific plans detailing (1) how it will expedite the completion of RADV audits, (2) specific time frames and milestones for completing each aspect of its initiative, or (3) estimates of costs and potential savings for implementing the initiative. Given the long-standing issues with completing RADV audits, CMS would benefit from a detailed plan to guide its efforts in expediting and completing all RADV audits from payment year 2018 and later.

A fully developed plan could also help CMS address national health plan associations’ concern that the expansion of RADV audits will increase the administrative burden on MAOs. According to representatives from one national health plan association that we interviewed, one of the biggest challenges for MAOs will be dedicating sufficient personnel and resources to collect, organize, and submit large volumes of medical records from multiple providers in response to increased RADV documentation requests. The health plan association representatives indicated that medical records needed to support diagnoses submitted to CMS from prior years may be difficult to obtain because, in many cases, providers have moved, have merged with other providers, or may no longer be in business, among other things. Representatives from another national health plan association said that the shortened timelines and overlapping audits associated with the RADV audit expansion will increase the burden for plans and providers across the industry, which could cause providers to divert resources away from care as they respond to RADV audit requests.

According to CMS officials, CMS has taken steps to address concerns about timing, operational burden, and transparency around its RADV audit initiative. Such steps include clarifying requirements for MAOs and allowing more time in the RADV audit process for MAOs to submit medical records. However, it is not clear how an extended medical record submission period will affect CMS’s efforts to accelerate RADV audits.

Without a detailed plan, CMS lacks the information necessary to implement this initiative in a timely manner, which could hinder its effort to expedite RADV audits. We have previously identified characteristics of an effective, results-oriented plan, or components of sound planning practices, such as establishing goals and a strategy for achieving them, developing activities and timelines, involving stakeholders, and assigning responsible parties.[55] By applying these practices to its initiative to expedite RADV audits, CMS can improve its efforts to reduce improper payments in the Medicare Advantage program and to collect overpayments efficiently.

CMS Has Not Conducted a Comprehensive Fraud Risk Assessment

Medicare Advantage – Settlement Examples Medicare beneficiaries have the option to enroll in Medicare Advantage to receive their benefits through a private health plan. To ensure that plans are paid for enrollees with greater health risks, the Centers for Medicare & Medicaid Services adjusts payments based on risk factors that affect expected health care expenditures. Risk factors are affected by diagnosis codes. The following are two examples of settlements regarding fraud allegations. In 2023, a Medicare Advantage insurer agreed to pay approximately $172 million to resolve allegations related to the misuse of diagnosis codes. The United States alleged that the insurer submitted inaccurate and untruthful patient diagnosis data to inflate payments, failed to withdraw these data and repay the money received, and falsely certified that the data were accurate and truthful. In 2025, another Medicare Advantage insurer agreed to pay a criminal penalty of approximately $1.4 million as part of a non-prosecution agreement linked to using artificial intelligence and automation software to illegally obtain beneficiaries’ information and fraudulently enroll them into Medicare Advantage plans. The insurer enrolled people in its Medicare Advantage plans without their knowledge or consent, illegally accessed sensitive personal information, and purposely misrepresented itself in sales calls to Medicare beneficiaries to rapidly increase its number of insurance enrollments. Source: Department of Justice Press Releases.  |  GAO‑26‑107946

CMS has not conducted a comprehensive fraud risk assessment of the Medicare Advantage program. In July 2025, CMS officials told us that the agency does not conduct its Medicare risk assessments to specifically identify fraud risks, which is a leading practice in the fraud assessment process.[56] They stated that they conduct assessments with the goal of examining all program integrity risks within a selected area of the Medicare Advantage program, including those related to fraud, waste, or abuse.

According to the Fraud Risk Framework, program managers should document the fraud risk profile as part of completing a comprehensive fraud risk assessment, which involves, among other steps, identifying risks, assessing likelihood and impact, and determining fraud risk tolerance. This profile is to then be used to develop and implement an antifraud strategy.

In response to a 2017 GAO recommendation concerning fraud risk management, CMS developed the Medicare Advantage risk assessment framework in 2021.[57] This risk assessment framework outlines CMS’s approach for conducting risk assessments, including fraud risk assessments, for specific Medicare Advantage program areas. These areas include utilization management controls, beneficiary enrollment, relationships to providers, and payments made to MAOs. The framework includes prioritization factors for risk assessments, such as risks levels, residual risks, and mitigation strategies. It also provides a standard format to document vulnerabilities. The framework describes broader risks and includes some risk areas related to fraud, such as “Insufficient or Fraudulent Documentation” and “Known Fraud Schemes.” Further in response to this recommendation, in 2022, CMS officials told us that it planned to conduct fraud risk assessments that included fraud risk tolerance but stated that the agency was still in the process of learning how to conduct fraud risk assessments for individual program areas. We noted that these planned activities, if implemented, would be consistent with leading practices in GAO’s Fraud Risk Framework and closed the recommendation.

We found that the Medicare Advantage risk assessment framework has not yet been used to assess fraud risks in the program. Using the Medicare Advantage risk assessment framework, CMS produced a July 2024 risk assessment of one Medicare Advantage program topic area related to Medicare utilization management controls.[58] At the time of our review, CMS only provided evidence that it had completed the utilization management controls risk assessment.

In our review of the utilization management risk assessment, we found that it did not contain the key elements of a fraud risk assessment as identified in the Fraud Risk Framework. Specifically, it did not identify inherent fraud risks affecting the program, assess the likelihood and impact of those risks, determine fraud risk tolerance, or examine the suitability of existing fraud controls and prioritize residual risk.[59] It also did not contain a fraud risk profile. CMS officials told us that the vulnerabilities identified in the risk assessment may or may not include fraud, but our review found that it did not discuss the fraud specific risk areas described in CMS’s risk assessment framework.

We asked CMS officials whether they planned to conduct Medicare Advantage risk assessments specific to fraud and if there were any challenges related to conducting them. In response, officials told us that they began assessments with the goal of examining all program integrity risks and did not cite specific plans to conduct assessments focusing on fraud risks. When we asked CMS officials whether they had identified and documented Medicare Advantage fraud risks, reviewed the suitability of existing fraud controls, and developed associated fraud risk profiles, they reiterated that their existing work included all program integrity risks and did not provide us with documentation of these fraud risk assessment components.

Agencies have flexibility in how they set up their antifraud activities and structures, and fraud-risk-management activities, such as planning regular fraud risk assessments, may be incorporated or aligned with other program-risk-management activities. However, integrating antifraud efforts into a broader risk management and internal control approach may pose trade-offs. Without careful planning, integrating fraud risk management into a larger risk management and internal control approach could limit the amount of resources and attention focused specifically on fraud prevention, detection, and response. Fraud’s deceptive nature makes it harder to detect, potentially requiring control activities that are specifically designed to prevent and detect criminal intent and willful misrepresentation.[60] Documenting key findings from the fraud risk assessment process is an essential piece of an overall antifraud strategy. However, risks within only one Medicare Advantage program area have been assessed and this did not include an assessment of fraud risks. Without a comprehensive fraud risk assessment, CMS is not well positioned to prevent, detect, and respond to fraud in its Medicare Advantage program and cannot determine the full extent of fraud risks to ensure a proper, effective mitigation strategy.

Conclusions

Federal spending for health care programs, including VA’s Community Cares and CMS’s Medicare Advantage, has grown significantly in the past decade, and growth is projected to continue. Developing corrective action plans that respond to identified root causes of improper payments is a crucial component in government-wide efforts to reduce improper payments. Agency processes to monitor progress and measure the effectiveness of such plans are also essential to evaluating their efforts to address improper payments. In addition, agencies should manage fraud risks by conducting a fraud risk assessment to identify and assess fraud risks and document a fraud risk profile. Until VA comprehensively assesses its Community Care fraud risks, it will have a heightened vulnerability to fraud risks. Further, until CMS develops a detailed corrective action plan that corresponds to the root causes of improper payments and comprehensively assesses Medicare Advantage fraud risks, it will have heightened vulnerability to improper payments and fraud risks.

Recommendations for Executive Action

We are making a total of three recommendations, including one to VA and two to CMS. Specifically:

·         The Department of Veterans Affairs’ Under Secretary for Health should conduct a comprehensive fraud risk assessment of the Community Care program that aligns with leading practices in the Fraud Risk Framework. (Recommendation 1)

·         The Administrator for the Centers for Medicare & Medicaid Services should establish and document a detailed plan for expediting RADV audits, including cost estimates, planned completion dates, and metrics for monitoring implementation progress and effectiveness in reducing improper payments. (Recommendation 2)

·         The Administrator for the Centers for Medicare & Medicaid Services should conduct a comprehensive fraud risk assessment of the Medicare Advantage program that aligns with leading practices in the Fraud Risk Framework. (Recommendation 3)

Agency Comments and Our Evaluation

We provided a draft of this report to VA and HHS for review and comment. We received written comments from VA and HHS that are reprinted in appendixes III and IV, respectively, and summarized below. VA agreed with our first recommendation, and HHS neither agreed nor disagreed with our recommendations. VA and HHS also provided technical comments, which we incorporated as appropriate.

With regard to recommendation 2, HHS stated that it has an expedited schedule for initiating RADV audits for payment years 2020 through 2025. HHS also noted that it has expanded its contracted resources to complete the audits timelier by using artificial intelligence and hiring additional medical coders. HHS indicated that its actions address our recommendation, but as we previously noted, HHS has not provided us with documentation of its detailed plans for expediting the completion of RADV audits, including the type of technology it will use, staffing information, internal metrics, cost estimates, or completion time frames for each aspect of its initiative. Until we receive such information, we cannot determine whether CMS has a detailed plan that, if fully implemented, would address our recommendation and improve its efforts to reduce improper payments in the Medicare Advantage program.

With regard to recommendation 3, HHS stated that it uses its Medicare Advantage risk assessment framework to evaluate program integrity risks, including fraud risks, within the Medicare Advantage program. HHS stated that its risk assessment framework is based on GAO's Fraud Risk Framework. In 2017 we recommended that CMS should conduct fraud risk assessments for Medicare, including Medicare Advantage. When we previously closed this recommendation, we did so based on CMS’s risk assessment framework approach and prioritization factors for conducting fraud risk assessments for specific program areas within Medicare. As we previously noted, the Medicare Advantage risk assessment framework has not yet been used to evaluate program fraud risks.

To date, HHS has only used its risk assessment framework to complete a risk assessment of utilization management controls within the Medicare Advantage program. This risk assessment did not contain the key elements of a fraud risk assessment described in GAO’s Fraud Risk Framework. For example, HHS did not identify and assess inherent fraud risks, determine fraud risk tolerance, examine the suitability of existing fraud controls, or develop a fraud risk profile for its July 2024 risk assessment of Medicare utilization management controls. HHS has also not provided evidence that it has assessed fraud risks for other areas of the Medicare Advantage program. While HHS indicated that its risk assessment framework directs fraud risk evaluation activities within the agency, it does not fully address our recommendation because an assessment of fraud risks affecting the program has not yet been conducted. To do so, its risk assessment activities should include a focus on fraud risks, including those in program areas beyond utilization management, and include the key elements of a fraud risk assessment as described in leading practices.

 

We are sending copies of this report to the appropriate congressional committees, the Secretary of Veterans Affairs, the Secretary of Health and Human Services, and other interested parties. In addition, the report is available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at SheaR@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix V.

Rebecca Shea

Director, Forensic Audits and Investigative Service

Overview of the Seven-Step Improper Payment Review Process

The Department of Veterans Affairs (VA) follows a seven-step review process when conducting improper payment testing in the Community Care program:

1.    Documentation review. VA improper payment reviewers determine whether VA received all required documentation to properly review the sampled payment.

2.    Contract review. Improper payment reviewers determine whether VA based the sampled payment on a proper contract or purchase order.

3.    Authority review. Improper payment reviewers determine whether VA properly authorized the sampled payment according to VA’s requirements, such as a comparison of records to verify their accuracy and resolve discrepancies.

4.    Eligibility review. Improper payment reviewers determine whether VA paid the correct vendor, veteran, or beneficiary according to the underlying claim, referral, and payment documentation.

5.    Authorization review. Improper payment reviewers determine whether the goods or services rendered were eligible for payment, authorized by VA when required, and provided to an eligible beneficiary. Improper payment reviewers also determine whether Community Care program filers submitted claims in a timely manner.

6.    Receipt review. Improper payment reviewers determine whether the beneficiary received the goods or services by reviewing the underlying medical claim.

7.    Payment review. Improper payment reviewers determine whether VA made the sampled payment for the correct amount by reconciling the payment to underlying documentation and VA’s clean claim requirements. Improper payment reviewers also determine whether the sampled payment is a duplicate payment.

For the seven-step process, VA’s review template provides reviewers with predefined payment error categories (e.g., “claim not paid according to contract”) to apply to potential improper payments. VA uses these categories for internal reporting purposes and for developing corrective action plans. The review template also traces these internal categories to error and cause categories (e.g., “failure to access data/information”) aligned with Office of Management and Budget (OMB) requirements for improper payment reporting, which VA uses when reporting externally on PaymentAccuracy.gov and in its agency financial report. Figure 5 demonstrates how internal payment error categories are assigned OMB-aligned error and cause categories for the payment review step.

Note: The Department of Veterans Affairs (VA) has a list of internal payment error cause categories that are more specific than the OMB root cause categories used for external reporting. VA uses the detailed internal cause categories for internal reporting and for developing corrective action plans. This figure is an example specific to the payment review step of the improper payment review process for the Community Care program. Each of the other six review steps follows a similar mapping approach tailored to its specific requirements.

Criteria Used During Corrective Action Effectiveness Reviews

As part of VA’s corrective action plan effectiveness reviews, VA officials perform analyses, such as comparing the estimated completion date to actual completion dates and comparing the number of times the internally reported root causes occurred from prior year to current year, according to improper payment testing results. Figure 6 outlines the four metrics and the criteria used during the corrective action plan effectiveness reviews.

Figure 7 provides the corrective action plan template that the Community Care program used in fiscal year 2024.

Note: GAO modified the corrective action plan template for presentation in this report. The template also includes guidance on how to complete and use the template.

The corrective action plan template requires Department of Veterans Affairs programs, including the Community Care program, to document descriptors of each improper payment and its underlying cause(s), mitigation strategies, planned tasks, and annual benchmarks for each corrective action and for the overall corrective action plan. Senior accountable officials develop and oversee each corrective action plan, and each individual task is assigned an owner and has an established completion date.

The corrective action plan template contains elements corresponding to both internal and external reporting requirements. Internal reporting elements are marked with an asterisk (*); external reporting elements are identified by the label Office of Management and Budget (OMB).

GAO Contact

Rebecca Shea, SheaR@gao.gov

Staff Acknowledgments

In addition to the contact named above, M. Hannah Padilla (Director), Heather Dunahoo (Assistant Director), Dan Flavin (Assistant Director), Sophie Geyer (Auditor in Charge), Melissa Bentley, Giovanna Cruz, Latasha Freeman, Megan Jones, Jason Kelly, Patricia Powell, Daniel Silva, Michael Wagner, and Michelle Yu made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us