Equal Employment Opportunity: Progress Made on GAO Recommendations to Improve Nondiscrimination Oversight, but Challenges Remain

Several federal laws, executive orders, and regulations seek to promote equal employment opportunity by prohibiting employers from discriminating in employment on the basis of race and gender, among other things, and generally require companies contracting with the federal government to comply with affirmative action and other equal employment opportunity provisions. The EEOC and OFCCP are the primary federal agencies that enforce these requirements. Although federal law also generally prohibits employment discrimination based on religion, faith-based organizations may hire based on religion. Some federal grant programs contain statutory restrictions prohibiting this practice; however, since a 2007 DOJ legal opinion, federal agencies have allowed faith-based grantees to use RFRA as a basis for seeking an exemption to allow religious-based hiring.

GAO has issued three reports since September 2016 that address equal employment opportunity ( GAO-16-750 , GAO-18-69 , and GAO-18-164 ). This testimony is based on these three reports and discusses 1) OFCCP and EEOC's progress in addressing prior GAO recommendations and 2) equal employment opportunity exemptions for faith-based organizations.

To update the status of prior recommendations, GAO reviewed agency guidance and documentation and interviewed agency officials.

The Department of Labor's Office of Federal Contract Compliance Programs (OFCCP) and the Equal Employment Opportunity Commission (EEOC) face challenges in overseeing compliance by employers and federal contractors with applicable federal equal employment opportunity requirements. In its 2016 report, GAO made six recommendations to OFCCP and in its 2017 report made five additional recommendations to OFCCP and one to EEOC to strengthen program oversight. OFCCP has implemented four recommendations, but seven require additional agency action to be fully implemented, as does the one to EEOC. For example:

In 2016, GAO found that OFCCP's oversight was limited by reliance on contractors' voluntary compliance with affirmative action plan requirements. OFCCP has taken steps to develop a new web portal for collecting those plans annually, but has not yet obtained Office of Management and Budget approval for the collection or launched the portal. GAO also found OFCCP's oversight was limited by a lack of timely staff training. OFCCP has taken steps to implement a new training curriculum, but has not yet implemented its new learning management system that will help ensure timely and regular training.

In 2017, GAO found that EEOC had not consistently captured information on industry codes, which limits EEOC's ability to identify trends by industry sector and conduct sector-related analyses. EEOC has not yet completed development of its Employer Master List that will include industry codes. GAO also found that OFCCP's methodology for identifying equal employment disparities by industry might not accurately identify industries at greatest risk of noncompliance with affirmative action and nondiscrimination requirements. OFCCP has taken steps to develop a new methodology, but needs to further refine it to ensure that it will identify industries at greatest risk.

From fiscal years 2007 through 2015, few faith-based grantees sought an exemption from nondiscrimination laws related to religious-based hiring under the Religious Freedom Restoration Act of 1993. In October 2017, GAO found that the Departments of Justice (DOJ), Health and Human Services (HHS), and Labor (DOL) had awarded funding to at least 2,586 grantees through at least 53 grant programs that restricted grantees from making employment decisions based on religion. The number of relevant grant programs could be higher because GAO could not identify all such programs due to data limitations. Across the three agencies, GAO identified 117 grantees that were potentially faith-based organizations (FBO). Of the 117 potential FBOs, nine DOJ grantees were FBOs certified as being exempt from statutory restrictions on religious-based hiring. All three agencies required grantees seeking an exemption to self-certify that they were eligible for the exemption, but the agencies' processes for reviewing and approving exemption requests varied. In August 2019, OFCCP issued a proposed rule to clarify the scope and application of the religious exemption to help organizations with federal contracts and subcontracts and federally assisted construction contracts and subcontracts better understand their obligations.

I am pleased to be here today to discuss the challenges facing the federal  government in conducting oversight to ensure that employers meet  federal equal employment opportunity requirements. Various federal laws,  executive orders, and regulations promote equal employment opportunity  by prohibiting employers from discriminating in employment on the basis  of race and gender, among other things, and generally require companies  contracting with the federal government to comply with affirmative action  and other equal employment opportunity provisions. The U.S. Equal  Employment Opportunity Commission (EEOC) and the Office of Federal  Contract Compliance Programs (OFCCP) within the U.S. Department of  Labor (DOL) the primary federal agencies that enforce these  requirements.

My statement today will focus on three GAO reports examining equal  employment opportunity. In particular, I will be discussing our findings and  agencies’ progress in addressing our recommendations from a  September 2016 report in which we examined OFCCP’s oversight of  federal contractor compliance with nondiscrimination requirements, and  a November 2017 report in which we examined OFCCP and EEOC’s  efforts to increase equal employment opportunity and affirmative action in  the technology sector. I will also be discussing findings from an October  2017 report in which we examined the number of faith-based grantees  who sought exemptions from nondiscrimination laws related to religious- based hiring and recent action by OFCCP to clarify the exemption—we  made no recommendations in that report.

To conduct the work for these three reports, we analyzed program data  and reviewed relevant federal laws, executive orders, regulations and  guidance. We also interviewed agency officials, academics, and  representatives from employers, as well as civil rights and advocacy organizations. To update the status of recommendations from our  September 2016 and November 2017 reports, we reviewed agency  reports on their related actions, publicly available information on related  new or revised agency policies and procedures and interviewed agency  officials. More detailed information on our objectives, scope, and  methodology for the three reports discussed in this statement can be  found in the issued reports.

We performed the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.

Federal Requirements Related to Equal Employment Opportunity and Affirmative Action

Private companies are generally prohibited by federal law from  discriminating in employment on the basis of race, color, religion, sex,  national origin, age, and disability status. Additionally, federal contractors  and subcontractors are generally required to take affirmative action to  ensure that all applicants and employees are treated without regard to  race, sex, color, religion, national origin, sexual orientation, and gender  identity, and to employ or advance in employment qualified individuals  with disabilities and qualified covered veterans. EEOC enforces federal  antidiscrimination laws, and OFCCP enforces affirmative action and  nondiscrimination requirements for federal contractors. EEOC and  OFCCP share some enforcement activities and have established a  memorandum of understanding (MOU) to minimize any duplication of  effort.

The EEOC enforces Title VII of the Civil Rights Act of 1964, as amended,  which prohibits employment discrimination on the basis of race, color,  religion, sex, or national origin. EEOC also is responsible for enforcing  other federal laws that prohibit discrimination in employment based on  age and disability, among other characteristics. EEOC investigates  charges of employment discrimination from the public, litigates major  cases, and conducts outreach to prevent discrimination by educating  employers and workers. EEOC also pursues a limited number of cases  each year designed to combat systemic discrimination, defined by the  agency as patterns or practices where the alleged discrimination  presented by a complainant has a broad impact on an industry,  profession, company, or geographic location. EEOC can also initiate a  systemic investigation under Title VII with the approval of an EEOC  commissioner provided the commissioner finds there is a reasonable  basis for the investigation. In fiscal year 2018, EEOC resolved about  90,558 charges of discrimination, secured more than $505 million for  victims of discrimination, and filed 199 lawsuits.

The OFCCP within DOL is responsible for ensuring that about 200,000  federal contractor establishments comply with federal nondiscrimination  and affirmative action requirements. Under Executive Order 11246 and  other federal laws and regulations, covered federal contractors and  subcontractors are prohibited from discriminating in employment on the  basis of race, color, religion, sex, sexual orientation, gender identity, or  national origin and are required to take affirmative action to help ensure  that all applicants and employees are treated without regard to these  factors. OFCCP also enforces Section 503, and the affirmative action  provisions of VEVRAA, which require covered contractors to take  affirmative action to employ and advance in employment qualified  individuals with disabilities and covered veterans, respectively.

OFCCP uses two approaches to ensure compliance with federal equal  employment and affirmative action requirements—enforcement and  compliance assistance. OFCCP’s enforcement program primarily involves  conducting evaluations of contractors’ compliance with federal  requirements and these evaluations represent the preponderance of  agency activity. In 2015, OFCCP compliance officers conducted 2,345  compliance evaluations, which represented about 2 percent of federal  contractor establishments in its jurisdiction. OFCCP has since  significantly decreased the number of compliance evaluations it conducts.  In fiscal year 2018, OFCCP completed 812 compliance evaluations,  which is 65 percent fewer than in fiscal year 2015. Since fiscal year  2016, OFCCP has adopted a strategy of conducting fewer compliance  evaluations and prioritizing larger systemic cases. Since OFCCP can only  evaluate a small fraction of federal contractors each year, the agency also  carries out compliance assistance efforts, including issuing guidance,  conducting outreach concerning nondiscrimination requirements, and  providing compliance assistance to contractors.

OFCCP’s regulations generally require that covered contractors prepare  and maintain an affirmative action program (AAP). Contractors must  also comply with certain recordkeeping requirements; for example, under  Executive Order 11246, covered contractors are required to maintain  records pertaining to hiring, promotion, layoff or termination, rates of pay,  and applications, among other records. Under OFCCP’s Executive  Order 11246 regulations, an AAP is a management tool that is designed  to ensure equal employment opportunity, with an underlying premise that  the gender, racial, and ethnic makeup of a contractor’s workforce should  be representative of the labor pools from which the contractor recruits and  selects. An AAP must also include practical steps to address  underrepresentation of women and minorities, such as goals for  expanding employment opportunities to these groups in instances in  which they are underrepresented. Companies must create an AAP for  each business establishment—generally, a physical facility or unit that  produces goods or services, such as a factory, office, or store for the  federal contractor.

Each year the federal government provides billions of dollars to  organizations that provide social services to needy families and  individuals. Some of these funds are provided through competitive grants  to faith-based organizations (FBO), which may include religious groups,  like churches, mosques, synagogues, and temples, or charitable  organizations affiliated with religious groups.

In some instances, FBOs believe it is necessary to hire only individuals  who share their religious beliefs in order to carry out their mission. Title  VII of the Civil Rights Act of 1964 generally prohibits employment  discrimination based on religion. However, section 702(a) of the Act  exempts FBOs with respect to basing employment decisions on religion,  thereby permitting FBOs to intentionally, and exclusively, hire individuals  who share their religious beliefs. In light of this exemption, FBOs that  receive federal grant funding or that contract with the federal government  have also generally been permitted to make employment decisions based  on religion. OFCCP is responsible for ensuring that federal contractors  comply with federal nondiscrimination requirements and provides  compliance assistance to the entities it oversees, including guidance  related to this exemption.

There are, however, certain federal grant programs that are subject to  statutory restrictions that prohibit recipients from using grant funding, in  whole or in part, to discriminate or deny employment on the basis of  religion, among other factors. In June 2007, the Department of Justice’s  Office of Legal Counsel issued an opinion in a particular case stating that  the Religious Freedom Restoration Act of 1993 (RFRA) could be  reasonably construed to require an agency to exempt FBOs from  statutory requirements that restrict federal grantees from hiring on the  basis of religion. Pursuant to that opinion, and the RFRA, certain federal  agencies have permitted FBOs that receive funding under a program that  is subject to a statutory restriction on religious-based hiring to certify that  they are exempt from such restrictions, allowing these FBOs to engage in  religious-based hiring, provided that they do not discriminate on other  bases.

OFCCP and EEOC Could Improve the Effectiveness of their Processes to Ensure Employers Meet Equal Employment Opportunity Requirements

OFCCP and EEOC face challenges in conducting oversight efforts to  ensure that employers meet applicable federal equal employment  opportunity requirements. For example, in our September 2016 report, we  found several shortcomings that limited OFCCP’s oversight efforts,  including weaknesses in OFCCP’s compliance evaluation selection  process, its reliance on voluntary compliance, and the lack of staff  training. Also, in our November 2017 report, we found that OFCCP’s  planned methodology for identifying equal employment disparities by  industry, such as the technology sector, might not accurately identify  industries at greatest risk of potential noncompliance with affirmative  action and nondiscrimination requirements. Additionally, we reported that  while EEOC had identified barriers to recruitment and hiring in the  technology sector as a strategic priority, it had not consistently captured  information identifying specific industries when conducting investigations.  EEOC’s inability to capture this information using standard industry codes  impeded its ability to conduct related analysis that could be used to more  effectively focus its limited enforcement resources and outreach activities.

Weaknesses in the Compliance Evaluation Process Limited OFCCP’s Ability to Ensure Federal Contractors’ Nondiscrimination Compliance

In September 2016, we reported that about 22 percent of OFCCP’s  compliance evaluations of supply and service contractors found violations  of some type and about 2 percent had discrimination findings, since 2010  (see figure 1). When OFCCP found violations during compliance  evaluations, it often resolved those violations with conciliation agreements  that outlined remedial action that contractors agreed to take.

As a result of our work, we made six recommendations (see table 1). The  agency has taken action to fully implement three of our  recommendations: (1) to address the risk geographic imbalances in  compliance evaluation assignments; (2) to review outreach and  compliance assistance efforts and identify options for improving  information provided to federal contractors; and (3) assess existing  contractor guidance for clarity. However, the agency has not taken  action to fully implement our other three recommendations that focus on  improving enforcement and compliance.

With regard to the recommendations that have not been fully  implemented, OFCCP has taken action to date as described below.

Focus compliance evaluations on greatest violation risk. We found  the process OFCCP used to select contractors for compliance  evaluations could not ensure that contractors with the highest risk of  noncompliance were being selected. OFCCP’s selection process was  nonrandom and did not produce a generalizable sample of contractors for  evaluation. As a result, OFCCP was unable to draw conclusions about  noncompliance risk in the overall federal contractor population. While the  selection process included consideration of a number of neutrally applied  factors, such as alphabetical order, employee count at the establishment,  contract value, or contract expiration date, OFCCP was not able to  identify which of these factors, or any factors, are associated with risk of  noncompliance. Thus, OFCCP was unable to quantify the extent to which  federal contractors in its jurisdiction are noncompliant, and did not have  reasonable assurance that it was focusing its efforts on those contractors  at greatest risk of not following equal employment opportunity or  affirmative action requirements. Because OFCCP only conducts  evaluations about 2 percent of federal contractor establishments in its  jurisdiction, without an effective risk-based contractor selection process,  OFCCP may be missing opportunities to evaluate whether there is a  significant segment of contractors who may be more likely to violate  nondiscrimination and affirmative action requirements, leaving workers  potentially vulnerable.

OFCCP has taken steps to improve its contractor selection process, but  has not fully implemented either this 2016 recommendation or a related  recommendation we made in 2017 that it assess the quality of its  proposed methods to incorporate consideration of disparities by industry  before selecting contractors for compliance evaluation. Beginning in fiscal  year 2020, contractors will be able to apply to the Voluntary Enterprise- wide Review Program (VERP), which aims to remove top-performing  contractor participants from the pool of contractors scheduled for  compliance evaluations. OFCCP also recently implemented a new  scheduling list (the list of contractor establishments selected for  evaluation) methodology based on research on closed cases from the  previous five years (2014-2018). Thirty-three percent of the new  scheduling list was comprised entirely of contractor establishments from  the three industries with the highest rates of violation based on this  sample of closed cases. However, the scheduling lists of the previous 5  years included nonrandom selections of contractor establishments that  included a number of neutrally applied factors. If OFCCP’s goal is to  prioritize contractors at highest risk of noncompliance, this new  scheduling methodology may not achieve this, because contractors  selected will be weighted towards prior neutrally applied selection factors,  such as employee count, in addition to violation risk. Further, while VERP  may remove some compliant contractors from the scheduling list pool,  without overwhelming volunteer participation, it will do little to help identify  those most likely to violate. Consequently, it remains unclear whether  contractors with the highest risk of not following equal employment  opportunity and affirmative action requirements will be selected for  compliance reviews.

Monitor affirmative action programs. In 2016 OFCCP relied  significantly on voluntary compliance by federal contractors, and this  approach could not ensure that contractors were complying with basic  requirements like developing and maintaining an AAP. By signing a  qualifying federal contract, covered contractors are required to develop an  AAP within 120 days of contract commencement and update it annually.  However, OFCCP had no process for ensuring that the tens of thousands  of establishments that had signed a qualifying federal contract do so.

OFCCP has taken steps towards implementing a mechanism to monitor  AAPs but has not fully implemented this recommendation. In 2018  OFCCP contracted with an information technology vendor to develop a  web-based portal to allow contractors to upload their AAPs electronically  for convenience, increased compliance, and for OFCCP review and  resource prioritization. Officials anticipate delivery of the portal by the  close of fiscal year 2019. Simultaneously, according to officials, OFCCP  has developed the necessary information collection request to obtain  approval from OMB to collect all contractors’ AAPs annually. The agency  anticipates that OMB approval will be timely to align with completion of  the AAP portal.

Facilitate timely compliance officer training. In 2016, we found that  OFCCP may not be providing timely training for new compliance officers.  According to OFCCP officials, budget constraints had made it difficult to  hold timely centralized training for new compliance officers. In half of the  regions we visited, compliance officers or management officials we spoke  with noted that this training was not provided in a timely manner after new  officers are hired. For example, one compliance officer told us they  worked for 8 months before receiving formal training. In one district office,  compliance officers we spoke with explained that the lack of uniform,  timely training made compliance officers feel unprepared when they  began their job. Further, without providing timely training to new  compliance officers, OFCCP cannot ensure consistency in its  enforcement efforts across its offices.

OFCCP has taken steps to improve its training program, but has not fully  implemented this recommendation. In 2018, OFCCP retained an expert  consultant to assess its national training program and standardize its  training development and evaluation process. The assessment was  completed in 2019 and a plan of action was created to address any  program gaps, according to agency officials. Officials reported that the  plan of action was fully implemented in fiscal year 2019 and OFCCP  obtained a 5 year International Association for Continuing Education and  Training (IACET) accreditation for its program. OFCCP officials told us  they are developing a learning management system that will allow new  compliance officers easy access to training soon after the hiring. OFCCP  plans for the system to include the development of course requirements  by level of competence— basic, intermediate, and advanced. OFCCP  officials told us they plan to roll out the new system in January 2020.

Weaknesses in Oversight Efforts Impact EEOC’s and OFCCP’s Effectiveness in Ensuring Nondiscrimination and Equal Employment Opportunity in the Technology Sector

In November 2017, we reported that the estimated percentage of minority  technology workers had increased from 2005 to 2015, however, while we  found statistically significant increases in the numbers of Asian and  Hispanic workers, no growth had occurred for either female or Black  workers (see figure 2). Further, female, Black, and Hispanic workers  remain a smaller proportion of the technology workforce—mathematics,  computing, and engineering occupations—compared to their  representation in the general workforce. These groups have also been  less represented among technology workers inside the technology  sector—those companies that have the highest concentration of  technology workers in such industries as computer systems design and  software publishing—than outside the technology sector such as retail or  finance companies. In contrast, Asian workers were more represented in  these occupations than in the general workforce.

As a result of our work, we made one recommendation to EEOC and five  recommendations to OFCCP (see table 2). EEOC has taken action, but  not fully implemented our recommendation on identifying missing  standard industry classification data from its handling of charges. By  providing guidance to contractors regarding the option to include more  specific goals in their AAPs, OFCCP has taken actions to implement one  of our six recommendations—to take steps toward requiring contractors  to disaggregate demographic data for the purpose of setting placement  goals in the AAP. The agency has not taken action to fully implement our  other four recommendations that focus on improving oversight, as shown  in table 2 and discussed below.

With regard to the recommendations that have not been fully  implemented, EEOC and OFCCP have taken action to date as described  below.

Capture standard industry classifications on charges. In our  November 2017 report, we found that EEOC could not analyze charge  data by industry to help identify investigation and outreach priorities. This  was inconsistent with EEOC strategic planning documents and EEOC  Inspector General reports which, had emphasized the importance of  analyzing charge data by industry. EEOC’s inability to analyze charge  data by industry limits EEOC’s ability to identify trends by industry sector  and conduct sector-related analyses that could be used to more  effectively to focus its limited enforcement resources and outreach  activities. EEOC has taken some action towards addressing missing  industry code data, but has not taken actions sufficient to fully implement  this recommendation. As part of an effort to overhaul its data system,  EEOC has begun developing an Employer Master List that will provide a  source of employer information, including industry codes, but EEOC told  us that it has not yet completed this effort. It anticipates this system will  be more fully developed by spring 2020.

Use data on closed evaluations to address delays. In our November  2017 report, we found that OFCCP did not analyze data on closed  evaluations to understand the root causes of delays in its compliance  review process that may be straining its resources and inhibiting  OFCCP’s efforts to identify potential discrimination. This evaluation could  help OFCCP determine whether changes are needed in its own internal  policies and processes, as well as guide OFCCP’s selection of improved  methods for obtaining complete, accurate, and timely documentation from  federal contractors. OFCCP has taken actions but it does not fully  address this recommendation. In June 2019, OFCCP officials reported  that OFCCP’s procedures outlined in the Active Case Enforcement  Directive (DIR 2011-01) caused delays in case closures, but it does not  indicate that this conclusion resulted from the recommended analysis of  internal process data from closed evaluations. OFCCP officials reported  that the agency’s aged case rate—defined as a case which is open for  more than 730 days and has not been referred for further enforcement— has dropped from 27.7 percent in fiscal year 2017 to 20.9 percent in fiscal  year 2019, though they did not report any corresponding change in case  outcomes. In September 2019, OFCCP officials told us they continue to  study causes and how to address delays with effective policies that make  the agency more efficient.

Assess the methods used to consider industry disparities in  compliance. In our November 2017 report, we found that OFCCP’s  current methodology for identifying disparities by industry—using data  from the American Community Survey—may not have accurately  identified industries at greatest risk of potential noncompliance with  nondiscrimination and affirmative action requirements. In its agency  response to our November 2017 report, OFCCP officials reported that the  agency was exploring the use of U.S. Census Bureau and administrative  data to refine its selection process to focus on industries with a greater  likelihood of noncompliance. OFCCP has taken some action, but has not  fully implemented this recommendation. In January 2019, DOL officials  reported that DOL had revised its scheduling methodology to include  industries with the highest rates of violations. OFCCP published the  scheduling list in March 2019 and its field offices started scheduling cases  in May 2019. OFCCP stated it will continue to monitor results from this  revised scheduling methodology to determine its effectiveness. It will be  important for OFCCP to refine these methods based on its experiences  with them. This new process is a step toward focusing efforts on  industries at greater risk of potential noncompliance with  nondiscrimination or affirmative action requirements.

Evaluate establishment-based approach to compliance evaluations.  In our November 2017 report, we found that OFCCP had made no  changes to its establishment-based approach since OFCCP was founded  in 1965. However, OFCCP officials acknowledged the changing nature of  a company’s work can involve multiple locations and corresponding  changes in the scope of hiring and recruitment. OFCCP has taken some  action, but has not fully addressed this recommendation. In fiscal year  2019, OFCCP evaluated its current approach for identifying  subcontractors for review. OFCCP stated that the current approach does  not reliably include subcontractors in the pool from which contractors are  scheduled because there is no government or public database that  captures the complete universe of subcontractors and other important  data. In June 2019, OFCCP submitted revisions to its process to the  Office of Management and Budget (OMB) for approval.

Evaluate the Functional Affirmative Action Program. In November  2017, we found that OFCCP had not evaluated its Functional Affirmative  Action Program (FAAP)—an alternative affirmative action program for a  business function or unit that may exist at multiple establishments or  multi-establishment contractors. OFCCP offered the FAAP so that  companies could move away from establishment-based reviews, which  may be more appropriate for some multi-establishment contractors.

However, few contractors participate in this program and the agency has  not conducted an evaluation of it. OFCCP has taken some action, but has  not fully implemented this recommendation. OFCCP has taken steps to  encourage contractors to use the FAAP program without fully evaluating it  as an alternative to the establishment-based program. Evaluating the  FAAP could help OFCCP improve its ability to achieve its objectives and  may provide broader insight for OFCCP’s overall enforcement approach.

Few Faith-based Grantees Certified They Were Exempt from Statutory Restrictions on Religious-based Hiring

In our October 2017 report, we found that from fiscal years 2007 through  2015, 9 of the 117 potential FBOs we identified across HHS, DOJ, and  DOL, certified that they were exempt based on RFRA from  nondiscrimination laws related to religious-based hiring (see fig. 3). As a  result, the nine FBOs were allowed to consider a prospective employees’  religious faith when making employment decisions. All nine of the FBOs  were awarded funding by DOJ primarily through the agency’s Justice  Programs, and collectively received approximately $3.2 million, which is  less than 1 percent of the $804 million in grants that DOJ awarded that  were subject to statutory restrictions from fiscal years 2007 to 2015. HHS,  DOJ, and DOL awarded funding to at least 2,586 grantees through 53  grant programs that were subject to statutory restrictions on religious- based hiring. The number of relevant grant programs could be higher  because GAO could not identify all such programs due to data limitations.

We interviewed six of the nine faith-based grantees that certified that they  were exempt from religious-based hiring restrictions. Each of the six  grantees emphasized the importance of hiring someone of the same  religious faith to assist with grant activities. For example, the grantees  said that hiring someone with the same religious faith was critical to their  mission and organizational success, and if the RFRA exemption were not  available, they may not have sought the grant. We also interviewed  grantees from five of 35 potential FBOs that did not certify that they were  exempt from statutory restrictions based on religious-based hiring to see  if they were aware of the potential for an exemption. The five grantees  said that they did not recall seeing information about the exemption option  in the grant application or grant award documentation. They said that they  also may not have been looking for the information because they were  not considering religion in their hiring decisions.

HHS, DOJ, and DOL used various methods for informing grant applicants  and recipients of the statutory restrictions on religious-based hiring and  their processes for obtaining an exemption from such restrictions.  Specifically:

DOJ had made this information available on agency web pages as  well as in the documentation that is provided to grant recipients.

DOL had a web page dedicated specifically to explaining statutory  restrictions on religious-based hiring to faith-based grant applicants  and recipients, which also covers the process for seeking exemptions  from the restrictions.

In addition to providing information in grant announcements, HHS  provided all Substance Abuse and Mental Health Services grant  applicants seeking funds for substance abuse prevention and  treatment services with a form that cites laws and regulations  governing religious organizations that receive grant funding, including  the regulation that outlines the exemption process.

As we reported in 2016, DOJ, DOL, and HHS all required grantees that  seek to make employment decisions based on religion to self-certify that  they met requirements to be eligible for an exemption from statutory  restrictions on religious-based hiring, but varied in how they reviewed and  approved requests for approval. All three agencies required that faith- based grantees complete a form or some written request to demonstrate  their eligibility for the exemption, but DOL is the only agency that  reviewed and approved the requests. For example, DOL required that  faith-based grantees submit their requests for the exemption for review  and approval by the Assistant Secretary responsible for issuing or  administering the grant. Conversely, while DOJ and HHS required that  faith-based grantees submit a form or written request, respectively,  neither reviewed nor approved the requests.

On August 15, 2019, OFCCP proposed regulations intended to clarify the  scope and application of the religious exemption to help religious  employers with federal contracts and subcontracts and federally  assisted construction contracts and subcontracts better understand their  obligations. OFCCP proposes to add definitions of the following terms:  exercise of religion; particular religion; religion; religious corporation,  association, educational institution, or society; and sincere. In addition,  the proposed rule states that the religious exemption should be construed  to provide the broadest protection of religious exercise permitted under  the Constitution and related laws, consistent with the administration policy  to protect religious freedom. The stated intent of the proposed rule is to  make clear that religious employers who contract with the federal  government can condition employment on acceptance of or adherence to  religious tenets, provided that they do not discriminate on other bases.

Chairwoman Bonamici, Senior Republican Comer, and Members of the  Subcommittee, this completes my prepared statement. I would be  pleased to respond to any questions you may have at this time.

If you or your staff have any questions about this testimony, please  contact Cindy Brown Barnes, Director, Education, Workforce and Income  Security Team at (202) 512-7215 or brownbarnesc@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this statement. GAO staff who made key  contributions to this testimony are Blake Ainsworth, Amber Yancey- Carroll, Melinda Bowman, Sheranda Campbell, Sarah Cornetto, Mary  Crenshaw, Helen Desaulniers, Holly Dye, Michael Erb, Monika Gomez,  LaToya King, Joel Marus, Diana Maurer, Heidi Neilson, James Rebbe,  Katrina Taylor, Rosemary Torres Lerma, Kathleen van Gelder, and Betty  Ward Zukerman.

This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Federal law prohibits employers from employment discrimination based on race and gender (among other things). The U.S. Equal Opportunity Employment Commission and the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) are the primary agencies that enforce these laws.

We testified about challenges these agencies face in ensuring that employers meet equal employment opportunity requirements. For instance, OFCCP’s method for selecting contractors to conduct compliance evaluations might not accurately identify those at the greatest risk of equal employment disparities.


Medicaid Providers: CMS Oversight Should Ensure State Implementation of Screening and Enrollment Requirements

A crucial component of protecting the integrity of the Medicaid program is ensuring that only eligible providers participate in Medicaid. States' non-compliance with provider screening and enrollment requirements contributed to over a third of the $36.3 billion estimated improper payments in Medicaid in 2018. To improve the integrity of the Medicaid program, PPACA and the 21st Century Cures Act established new requirements for screening and enrolling providers and expanded enrollment to include additional provider types.

In this report, GAO (1) describes challenges states faced implementing provider screening and enrollment requirements; and (2) examines CMS support for and oversight of states' implementation of these requirements. GAO reviewed federal laws and CMS guidance. GAO also reviewed CMS documents, including reports resulting from CMS oversight activities published from 2014 through 2018 for seven states. These states were selected based on their use of CMS's contractor site visits, among other things. GAO also interviewed officials from CMS and the seven selected states.

Officials from seven selected states that GAO interviewed described challenges they faced implementing new Medicaid provider screening and enrollment requirements, established by the Patient Protection and Affordable Care Act (PPACA) in 2010 and the 21st Century Cures Act in 2016. These challenges included establishing procedures for risk-based screenings, using federal databases and collecting required information, and screening an increased volume of providers. Due in part to these challenges, officials from five of the seven selected states told GAO they had not implemented certain requirements. For example, one state plans to launch its new information technology system, which automates screenings, before it will enroll providers under contract with managed care organizations, as required under these laws.

The Centers for Medicare & Medicaid Services (CMS)—the federal agency that oversees Medicaid—supports states' implementation of new requirements with tailored optional consultations, such as CMS contractor site visits that examine the extent of states' implementation. Yet, because these are optional, states that need support might not participate, and CMS would not have information on those states. CMS uses other methods to oversee states' compliance, such as, the Payment Error Rate Measurement (PERM) process for estimating improper payments, and focused program integrity reviews.

PERM. This process assesses states' compliance with provider screening and enrollment requirements, but does not assess compliance for all providers and all requirements, and occurs once every 3 years.

Focused program integrity reviews. These reviews examine specific areas in Medicaid, like state compliance with provider screening and enrollment requirements, but have not been done in all states. CMS conducted reviews in 39 states in fiscal years 2014 through 2018.

Collectively, CMS's oversight methods do not provide it with comprehensive and timely reviews of states' implementation of the provider screening and enrollment requirements or the remediation of deficiences. As a result, CMS lacks assurance that only eligible providers are participating in the Medicaid program.

GAO recommends that CMS (1) expand its review of states' implementation of provider screening and enrollment requirements to include states that have not participated in optional consultations; and (2) for states not fully compliant with the requirements, annually monitor the progress of those states' implementation. The Department of Health and Human Services, the department that houses CMS, concurred with both recommendations.

A crucial component of protecting the integrity of the Medicaid program is  ensuring that only eligible providers participate in Medicaid—a federal- state health care program for low-income and medically needy  individuals. However, errors related to states’ non-compliance with  provider screening and enrollment requirements comprised over one-third  of Medicaid improper payments in 2018. That year, estimated improper  payments in Medicaid were $36.2 billion, or nearly 10 percent of federal Medicaid expenditures. At the federal level, the Centers for Medicare &  Medicaid Services (CMS), within the Department of Health and Human  Services, is responsible for overseeing states’ administration of Medicaid,  including their efforts to screen and enroll providers. Our work has  identified Medicaid as a high-risk program since 2003 due to concerns  about improper payments, the appropriate use of Medicaid dollars, and  the need for more accurate and complete data to effectively manage and  oversee this multibillion dollar program.

To strengthen program integrity, federal laws have changed how and  whom states must screen and enroll into their Medicaid programs. In  2010, the Patient Protection and Affordable Care Act (PPACA) included  provisions requiring CMS to establish procedures for screening and  enrolling providers according to their risk for fraud, waste, and abuse, as  well as activities that must or may be included in these procedures—such  as verifying provider licensure, conducting checks in federal databases to  identify providers who have been excluded from participating in federal  programs, and conducting on-site visits to provider practices. PPACA  also included provisions expanding provider enrollment; for example, by  requiring states to enroll providers who only order and refer services for  beneficiaries. The year following enactment of these changes, CMS  issued regulations establishing the screening and enrollment  requirements that states must perform to enroll providers. In 2016, the  21st Century Cures Act included provisions that further expanded  provider enrollment requirements. Under these requirements, states  must screen and enroll all Medicaid managed care providers into their  programs by January 1, 2018. While states and CMS have taken steps  to implement requirements in PPACA and the 21st Century Cures Act,  questions have been raised regarding the timeliness of these steps.

You asked us to examine states’ and CMS’s efforts to implement provider  screening and enrollment requirements. This report  1.  describes challenges selected states face implementing provider  screening and enrollment requirements, and their steps to address  these challenges; and  2.  examines CMS support for and oversight of states’ implementation of  provider screening and enrollment requirements.

To describe challenges selected states faced implementing provider  screening and enrollment requirements, and steps taken to address these  challenges, we reviewed applicable laws and CMS’s guidance on  provider screening and enrollment, including the Medicaid Provider  Enrollment Compendium. We also interviewed officials from the District  of Columbia, Kentucky, Maine, Minnesota, Nebraska, New Jersey, and  Oregon. We selected these seven states to obtain a mix of experiences  with CMS’s optional consultations that help states implement provider  screening and enrollment requirements; and other factors including their  total managed care spending and their improper payment rates in fiscal  year 2017, and geographic location. CMS’s optional consultations  include the following:

A multi-day CMS contractor site visit that assesses states’ progress  toward implementing the provider screening and enrollment  requirements.

A data compare service, in which states submit a list of all their active  providers, and CMS provides a full report of the state’s providers who  were previously screened by Medicare. The service also identifies  providers states may need to take action on because they were  revoked, terminated, reported as deceased, or had their National  Provider Identifier deactivated.

We interviewed officials from each of the selected states to learn about  their screening and enrollment procedures as of February 2019, and  included any vendors the state contracted with to screen and enroll  Medicaid providers. We also reviewed documents from the selected  states, including provider enrollment manuals, policies, provider  applications, and contracts with Medicaid managed care organizations  (MCO)—some of which also performed provider screening activities—and  vendors that screen and enroll providers. Further, we collected available  data from each of our selected states on the number of providers  enrolled, number of providers screened, and costs associated with  provider screening and enrollment activities for fiscal years 2015 through  2018. We interviewed state officials and reviewed the documentation they  provided to assess the reliability of these data. We determined that these  data were sufficiently reliable for the purposes of this reporting objective.  Our findings on the challenges states face are specific to our selected  states and cannot be generalized.

To examine CMS support for and oversight of states’ implementation of  provider screening and enrollment requirements, we reviewed relevant  laws and CMS’s guidance on provider screening and enrollment. To  examine CMS’s support for states, we reviewed CMS documents,  including reports resulting from CMS contractor site visits conducted in  calendar years 2016 through 2018; CMS’s data compare templates for  provider data; and documents related to other optional consultations,  such as monthly Provider Enrollment Technical Assistance Group calls,  during which CMS and state officials discuss issues and share best  practices. To examine CMS oversight of states’ compliance with provider  screening and enrollment requirements, we reviewed the most recently  available CMS documents on the Payment Error Rate Measurement  (PERM)—CMS’s methodology for estimating improper payments in the  Medicaid programs. We also examined information CMS obtains through  program integrity reviews on relevant topics—such as provider screening  and enrollment, and managed care—from fiscal years 2014 through 2018  and were completed as of June 2019.

For our selected states, we also examined information CMS obtains  through other oversight activities, such as states’ PERM corrective action  plans from fiscal years 2016 through 2018, and CMS desk reviews  published from fiscal years 2014 and 2015, which examined the status of  states’ progress toward implementing corrective actions related to  provider screening and enrollment. We also interviewed officials from  CMS, its site visit contractor, and our selected states. We also collected  information from CMS and state officials on any limitations in CMS’s  support for states and evaluated CMS’s oversight of states’  implementation of provider screening and enrollment requirements within  the context of federal requirements and internal controls.

We conducted this performance audit from July 2018 to October 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

The size and complexity of states’ Medicaid programs have implications  for program administration and oversight, including provider screening  and enrollment. States have flexibility, within broad federal guidelines, in  how they design, administer, and oversee their Medicaid programs. For  example, states have the option to pay for care through fee-for-service  (FFS) payments to participating providers, contract with managed care  organizations (MCO) to deliver services based on a fixed amount per  beneficiary, or a combination of both. In fiscal year 2018, total Medicaid  spending was $629 billion, about half of which was estimated to be spent  for services delivered under managed care.

CMS and states each have a role to play in protecting the integrity of the  Medicaid program and preventing fraud, waste, and abuse. States  administer their Medicaid programs, including implementing federal  requirements for screening and enrolling Medicaid providers. CMS has a  role overseeing states’ compliance with federal requirements. CMS’s  oversight activities include measuring improper payments in the Medicaid  program, and conducting focused program integrity and desk reviews.  Other federal and state entities also have a role in oversight of the  Medicaid program. For example, state auditors—state agencies that  typically conduct the annual single state audit of federal programs—may  also conduct program integrity reviews and identify Medicaid improper  payments. We have previously testified that state auditors are uniquely  qualified to partner with CMS in its oversight of Medicaid. In our  testimony, we noted that CMS could help improve program integrity by  providing state auditors with a substantive and ongoing role in auditing  state Medicaid programs.

Provider Screening and Enrollment Requirements

To limit payments to ineligible providers—such as those convicted of  program-related fraud and abuse, or with a suspended or revoked  medical license for reasons of bearing on professional competence or  performance—federal regulations require states to screen and enroll all  providers, whether the provider furnished, ordered, or referred services to  an eligible beneficiary or whether the service was paid for under FFS or  Medicaid managed care contracts. Providers subject to these  requirements include individual practitioners—such as physicians, nurse  practitioners, and physical therapists—as well as any physicians and  other professionals who may only order or refer beneficiaries to services,  but do not render services; for example, providers who only prescribe  medications or order imaging services, such as an x-ray. Providers also  include provider organizations—such as hospitals, group practices, and  skilled nursing facilities—and providers and suppliers of medical  equipment or goods.

All providers must be screened when they (1) initially apply for and submit  an application, and (2) upon reenrollment in a state’s Medicaid program.  Further, states must screen all providers at least once every 5 years to  revalidate their enrollment. States may rely on the results of providers’  screenings performed by the Medicare program or another state’s  Medicaid program. States may also choose to delegate screening  activities to vendors that screen providers on the states’ behalf or MCOs.  If a state chooses to delegate screening activities, it must ensure that the  screenings are conducted in accordance with the Medicaid program  requirements.

States must also collect certain information from providers to enroll them  into their Medicaid programs, such as their Social Security numbers,  dates of birth, and National Provider Identifiers, if applicable. States  must also collect disclosure information for owners, managing employees,  and others with controlling interests in provider organizations meeting  certain criteria. For example, states must collect disclosure information for  those with direct or indirect ownership totaling 5 percent or more, or who  are agents or managing employees of a provider organization. These  owners and others with controlling interests who are subject to disclosure  requirements must undergo certain required screening activities, such as  federal database checks, and states must perform these screening  activities to enroll the provider organization.

Federal regulations require states to perform several screening activities  prior to enrolling providers. The provider’s categorical risk level for fraud,  waste, and abuse determine the required screening activities. The  screening activities may include conducting checks in federal databases;  verifying licensure; and performing site visits and fingerprint-based  background checks. In addition to required activities, states may also  choose to conduct other screening activities in order to identify providers  ineligible for participating in Medicaid. See figure 1 for an overview of  Medicaid provider screening activities and appendix II for a full list of  provider screening requirements.

Risk-based screening. States must screen providers according to the  provider’s categorical risk level for fraud, waste, and abuse. The  regulations establish screening requirements for three risk levels—limited,  moderate, and high risk—and each risk level includes a range of provider  types. (See table 1.) In addition, providers’ risk levels can change. For  example, limited- or moderate-risk providers may be categorized as high  risk if the state Medicaid agency imposes a payment suspension based  on a credible allegation of fraud, waste, or abuse.

Federal database checks. States must confirm the identity of  prospective providers, providers seeking revalidation, and individuals  subject to disclosure requirements to determine if they have been  excluded from participating in Medicaid by checking four federal  databases:  1.  the Social Security Administrations’ Death Master File (DMF);  2.  the National Plan and Provider Enumeration System (NPPES);  3.  the List of Excluded Individuals/Entities (LEIE); and  4.  the General Services Administration’s System for Award Management  (SAM).

In addition, states must conduct at least monthly checks in the LEIE and  SAM. States may also check other federal and state databases. For  example, states may check CMS’s database containing Medicare  provider enrollment data—the Provider Enrollment, Chain and Ownership  System (PECOS)—prior to conducting their own database checks to  determine if a provider is enrolled in Medicare and was previously  screened. For providers enrolled in Medicare, states may choose to rely  on the results of the screening conducted for the Medicare program and  enroll the provider without conducting any further screening activities. For  providers not enrolled in Medicare, states must screen the provider prior  to enrolling them. (See table 2.)

Licensure verification. States must verify that providers have a current,  valid medical license in the states in which they are licensed. Further,  states must confirm that the providers’ license does not have any  limitations, such as a suspension or probation.

Site visits and fingerprint-based criminal background checks. States  must conduct on-site visits for moderate- and high-risk providers to verify  that the information submitted is accurate and to determine providers’  compliance with federal and state enrollment requirements. Further,  states must collect fingerprints from high-risk providers, and these  providers must consent to a criminal background check.

CMS Oversight of States’ Provider Enrollment

CMS developed the PERM to estimate the national Medicaid improper  payment rate, including improper payments due to states’ non- compliance with provider screening and enrollment requirements. CMS  computes the national improper payment rate as the weighted average of  states’ improper payment rate estimates from the PERM using three key  components of the Medicaid program: FFS, managed care, and  beneficiary eligibility determinations. Each component of the PERM is  estimated differently, and only the FFS component is used to oversee  states’ compliance with provider screening and enrollment requirements.

When calculating the FFS component, CMS measures improper  payments in a sample of FFS claims, which record services provided.  Specifically, CMS reviews the sample of FFS claims and examines  related state documents to identify any errors resulting from a failure  to meet federal and state policies, including provider screening and  enrollment requirements. For example, CMS verifies the provider was  eligible to render and bill for the services by reviewing provider  information, including the provider’s name and license, and whether  the provider was screened in accordance with risk-based screening  requirements. Any FFS claims paid for services furnished, ordered,  referred, or prescribed by a provider who was not screened in  compliance with requirements or not enrolled with the state is  considered an improper payment.

The managed care component of the PERM measures any improper  payments in the capitated payments that state Medicaid agencies  make to MCOs on behalf of enrollees. It does not examine whether  providers in managed care were appropriately screened and enrolled  within a state.

The eligibility component focuses solely on measuring improper  payments related to state determinations of whether Medicaid  enrollees meet categorical and financial criteria for Medicaid  benefits.

CMS conducts the PERM across all states on a 17-state, 3-year rotation  cycle and computes an annual rolling average of improper payment rates  from the 3 years of data. At the conclusion of each PERM cycle, CMS  develops reports for each state, which include any findings related to  provider screening and enrollment. Following each PERM cycle, states  must prepare a corrective action plan to address errors found.

CMS also conducts other oversight activities to protect the integrity of the  Medicaid program and assess states’ compliance with Medicaid provider  screening and enrollment requirements. These activities include the  following:

Focused program integrity reviews. CMS conducts these reviews  to examine specific areas of Medicaid, including provider screening  and enrollment and managed care. These reviews may include a full  or partial review of states’ compliance with provider screening and  enrollment requirements.

Desk reviews. CMS conducts these off-site reviews on specific  aspects of states’ program integrity activities, such as a state’s  progress toward implementing corrective action plans in response to  PERM findings and payments made to providers terminated from  Medicaid.

Selected States Faced Challenges Implementing Provider Screening and Enrollment Requirements; Some States Have Not Implemented Certain Requirements

Officials from all seven selected states told us they faced challenges  building the capacity and establishing the administrative processes  needed to implement the new and expanded provider screening and  enrollment requirements under PPACA and the 21st Century Cures Act.  These challenges included establishing procedures for risk-based  screenings, using federal databases and collecting information from  providers, and screening and enrolling an increased volume of providers.  Due, in part, to these challenges, officials from five selected states told us  they have not yet implemented some of the requirements.

Challenges Establishing Procedures for Risk- Based Screenings

Officials from all seven selected states described challenges building their  capacity to conduct risk-based provider screenings prior to enrollment into  their Medicaid programs. To incorporate database checks, site visits,  fingerprint-based background checks, and other risk-based screening  activities into state screening procedures; state Medicaid officials said  they needed financial resources, leadership support, and time.  Specifically, officials from the selected states told us they used one of the  following three approaches to build capacity to implement the screening  and enrollment requirements.  1.  Developing new information technology systems. Officials from  two of the seven selected states told us they developed new state  information technology systems that automated screening and  enrollment activities. For example, officials from one state told us they  spent $5.9 million from 2015 through 2018 to develop a new provider  screening and enrollment system that included an online provider  application portal and automated screening activities, such as  conducting database checks and flagging high-risk providers for site  visits and fingerprint-based background checks. According to state  officials, this new system helped the state implement provider  screening and enrollment requirements, yielding efficiencies by  allowing staff to focus on analyzing provider screening results rather  than clarifying data entry errors and manually checking each  database. (See fig. 2.)  2.  Contracting with vendors. Officials from four other selected states  told us they initiated or modified existing contracts with vendors to  screen new provider applications and conduct revalidations on their  behalf. For example, officials from one state told us their contract with  a vendor resulted in screening and enrolling about 10,000 providers in  2018, more than five times the number the state had processed in the  previous year. Another state used a vendor to revalidate more than  9,000 providers in 2016; about 12 percent of the state’s enrolled  provider population.  3.  Modifying existing procedures. Officials from our seventh selected  state told us that they modified their existing state information  technology system and procedures to manually screen and enroll  providers. However, according to state officials, this approach has put  pressure on their resources. Officials said that they were working to  automate some database checks as much as possible without  requiring services from a contractor.

Challenges Using Federal Databases and Collecting Required Information for Screening and Enrollment

Officials from six of the seven selected states told us they experienced  challenges using federal databases, and all seven of the states described  challenges collecting required information for screening and enrollment.  To mitigate challenges using federal databases, the state Medicaid  agencies took actions including accessing data from alternate sources,  manually verifying information, and collecting information from providers.  (See table 3.)

Recent CMS actions could also improve states’ ability to search  databases. In April 2019, CMS officials told us they have partnered with  the Treasury Department, which is conducting a pilot that will offer states  access to its Do Not Pay Business Center services. Do Not Pay is a  resource developed by the Treasury Department to detect and prevent  improper payments. This resource allows federal agencies to automate  screenings by searching for excluded parties using common identification  numbers, such as Social Security numbers. Do Not Pay also allows users  to search DMF, LEIE, and SAM from a single portal. CMS referred seven  states, including two of our selected states, to take part in Treasury’s  pilot.

Officials from all seven selected states told us that they faced challenges  collecting required information from providers for screening and  enrollment, such as Social Security numbers or fingerprints. These states  took steps—such as educating providers and developing or updating  forms, procedures, and statutory provisions—to address some of the  challenges associated with collecting the information necessary to screen  and enroll providers. For example, one state told us that some providers  have been hesitant to disclose Social Security numbers and their date of  birth on applications, as well as other information that states are required  to collect for enrollment. In response, the state has offered provider  education on the requirements to facilitate collecting this information.  State Medicaid officials also noted that their agencies worked with CMS,  state legislatures, and state law enforcement agencies to implement  fingerprint-based background check requirements to, for example, collect  fingerprints and check them against Federal Bureau of Investigation  records. Officials from two selected states told us their agencies did not  have the authority under state law to collect fingerprints from providers or  submit them to the Federal Bureau of Investigation prior to PPACA, and  officials from one of these states told us changes to state statute were  needed before they could implement this requirement.

Challenges Screening and Enrolling an Increased Volume of Providers

Officials from five of the seven selected states described challenges  having sufficient capacity to screen an increased volume of providers and  enroll certain provider types. Officials from one state told us that the new  requirement to screen managed care providers more than doubled the  number of providers the state needed to screen and enroll. Further,  officials from three states told us about challenges obtaining information  needed to conduct screenings from prescribers and other professionals  who only order and refer services. Previously, such providers were not  required to enroll in Medicaid and some were not responsive to the state  Medicaid agency’s requests for information. Officials from the five  selected states that faced these challenges told us they had taken steps  to address these challenges. Yet, four of the five selected states that  faced these challenges continued to make payments to these types of  providers even though they were not enrolled in their Medicaid programs,  because they wanted to maintain beneficiary access to the services.

Managed care providers. Officials from three of the selected states  told us they faced challenges enrolling managed care providers. For  example, officials from one state told us that they could not process  the large number of applications they needed to screen before  enrolling these providers, and attempted to delegate some required  database checks for managed care providers to its MCOs. However,  officials told us these MCOs do not have state-level access to all  required databases; therefore, the managed care providers have not  been screened as required and are not all enrolled with the state. The  officials told us the state has about 80,000 managed care providers to  screen and enroll as part of implementing the 21st Century Cures Act  requirements. However, officials said they have chosen to wait until  the state launches a new information technology system that  automates screenings before screening and enrolling these providers.

Prescribers and other professionals who may only order and  refer services to beneficiaries. Officials from three selected states  told us they had not enrolled all prescribers and other professionals  who may only order and refer services, but do not render them. These  states have taken steps to address this challenge. Officials from one  state told us they took steps to screen and enroll medical residents— hospital providers who are not providing services to Medicaid  beneficiaries, but may prescribe medication during a beneficiary’s  hospital stay. These officials told us they did not screen and enroll  medical residents prior to PPACA, because of differences in licensure.  Officials from all three states said they continue to pay for  prescriptions written by these providers who are not enrolled in their  Medicaid programs.

CMS’s Optional Consultations Are Tailored to Support States; Oversight Does Not Provide Comprehensive, Timely Information on States’ Compliance

CMS offers optional consultations that are tailored to support states’  implementation of the Medicaid provider screening and enrollment  requirements. However, these consultations are optional, regardless of  whether states have implemented the federal requirements. CMS also  conducts several oversight activities—the PERM, focused program  integrity reviews, and other activities—to oversee states’ compliance with  provider screening and enrollment requirements. Collectively, these  activities do not ensure CMS has comprehensive and timely information  on the extent of states’ compliance with the requirements.

CMS’s Optional Consultations Are Tailored to Support States’ Implementation of Medicaid Screening and Enrollment Requirements

In 2016, CMS began offering optional consultations tailored to support  states’ implementation of Medicaid screening and enrollment  requirements. Optional consultations include CMS contractor site visits to  states that examine the extent to which states have implemented the  requirements, and the data compare service to assist states with  screening providers. While most states (38) have used one or more of  these consultations, 13 states have not used any. Because some states  do not avail themselves of the optional consultations, these consultations  do not provide CMS with information on all states’ progress in  implementing the requirements. Officials from some of the seven selected  states reported limitations affecting their use of the consultations.

CMS contractor site visits. One-third of states (17), including three of  the seven selected states, participated in at least one multi-day CMS  contractor site visit, as of June 2019. Officials from CMS and its  contractor told us that during the site visit, the state completes a self- assessment, followed by the contractor’s assessment on the  implementation status of all provider screening and enrollment  requirements to identify requirements that have not been implemented  and opportunities for improving the states’ screening and enrollment  procedures. (See fig. 3 for a map of states that participated in the CMS  contractor site visit.)

After the visit, the contractor provided a report that summarizes the  state’s status toward implementing each requirement, such as full, partial,  nearly complete, and not started. (See fig. 4.) CMS officials consider any  requirements that are not fully implemented as “opportunities for  improvement.” CMS contractor site visits are not required and are not  considered audits; the agency does not track states’ progress on  implementing requirements and opportunities for improvement unless the  state engages CMS in follow-up. At the time of their contractor site visit,  16 of the 17 states that opted for this service had not fully implemented all  provider screening and enrollment requirements.

Officials from the three selected states that received a CMS contractor  site visit told us that the visit helped (1) accurately identify requirements  that their state had not fully implemented, or (2) establish priorities for  making changes. Two of these states found it helpful to learn from the  contractor about other states’ best practices and requested a return visit.  Officials from another state told us they were able to make positive  changes to their screening and enrollment procedures immediately after  the visit, such as improving documentation of database checks through  the use of screenshots to record search results.

Data compare service. About half of all states (25), including four of the  seven selected states, used the data compare service as of June 2019— a process by which states submit a list of all their active providers, and  CMS provides a full report of the state’s providers who were previously  screened by Medicare, as well as identify providers the state may need to  take action on, because, among other reasons, they were terminated  from Medicaid. For the states that have used the data compare service,  CMS officials reported being able to screen between 40 to 80 percent of  their providers. Officials from the four selected states said it was also  useful for testing their provider screening and enrollment procedures to  see whether the service would identify any providers they should have  excluded in their screening, and three of these states said it was useful  for streamlining their provider revalidations. Additionally, officials from one  state that had not yet used the service told us they would consider using it  in the future for both of these purposes. For example, officials from one  state reported that CMS’s data compare service screened half of the  approximately 80,000 providers they needed to revalidate. (See fig. 5 for  a map of states that opted for the data compare service.)

However, officials from all seven selected states identified limitations of  the data compare service that led some states to use the service less  frequently and three states to not use the service at all. CMS officials  acknowledged the three limitations reported by state officials:  1.  Time for receiving results. The results from the data compare  service were not timely enough to help states with screening newly  enrolling providers. Officials from one state explained that some  provider information may become outdated by the time the results are  received 6 to 8 weeks later, which makes the service less useful than  it could be.  2.  Different Medicare and Medicaid address entries. The data  compare service’s addresses reflected Medicare practice or billing  locations that may be different from providers’ Medicaid addresses.  Because these addresses do not match, they could not be relied upon  for updating the state’s provider records or to help states conduct site  visits required for screening and enrolling moderate- and high-risk  providers.  3.  Additional burden for manual enrollment systems. Officials from  two selected states told us that manually extracting provider data from  their system—including names, addresses, Social Security numbers,  and National Provider Identifiers—and manually re-entering the  results from CMS for each provider into their system was burdensome  and resource-intensive, leading one of these states to stop using the  service.

CMS offers guidance and other supports to states on a regular and  periodic basis, including monthly calls with states, and assigning states to  a CMS contact (see sidebar). These services also assist states with  implementing the Medicaid provider screening and enrollment  requirements. Officials from all of our selected states told us the guidance  and other supports were helpful. According to CMS officials, the extent to  which states participate in these other supports varies, because the level  of participation is optional. CMS officials also told us that they use these  other supports, including monthly calls and ad hoc emails, to discuss  progress and keep a record of information provided; however, the agency  does not revisit or require corrective actions unless the state initiates it.

The PERM and other methods CMS uses to oversee states’ efforts to  screen and enroll Medicaid providers do not provide CMS with  comprehensive and timely information on states’ compliance with the  requirements. Some methods do not fully track whether states have  enrolled all types of providers and are in compliance with all the  requirements; other program integrity oversight methods have not been  conducted on all states. Further, these methods do not ensure timely  follow-up to address identified concerns.

The PERM’s components—FFS, managed care, and beneficiary eligibility  determinations—measure improper payments across all states; as  previously noted, the FFS component is the only component CMS uses to  assess states’ compliance with provider screening and enrollment  requirements. However, using the PERM to oversee states’ compliance  with the requirements has limitations, including the following:

The PERM does not examine whether providers under contract with  MCOs are appropriately screened and enrolled. The PERM assesses  states’ compliance with the provider screening and enrollment  requirements by reviewing provider information for claims paid under  FFS; it does not review such information for services financed under  managed care.

Currently, the PERM does not examine ownership disclosure and  certain other provider screening and enrollment requirements. CMS  officials told us the agency plans to assess the feasibility of including  ownership disclosure requirements in the PERM over the next 3  years.

The PERM does not ensure that CMS identifies areas of non- compliance in a timely manner. CMS conducts the PERM in each  state every 3 years, and states develop corrective action plans in  response to findings from the PERM; thus, it may be years before  CMS identifies—and states resolve—areas of non-compliance with  the provider screening and enrollment requirements. (See fig. 6.)

Although CMS follows up annually with states regarding their corrective  action plans, it does not fully assess states’ progress toward  implementing their plans until the next PERM cycle, which is 3 years later.  Further, while four of our selected states had implemented all their  corrective action plans regarding provider screening and enrollment  requirements within 1 year of PERM findings, the other three states had  not fully implemented their plans about 2 years after PERM findings. CMS  officials emphasized that developing and tracking corrective action plans  was a collaborative process and that states may change corrective action  plans in response to competing priorities.

CMS uses other methods to oversee states’ compliance with the provider  screening and enrollment requirements—focused program integrity  reviews and desk reviews—that are not optional and have resulted in  findings. However, these methods do not provide the agency with  comprehensive and timely information on states’ compliance with the  requirements. Specifically, these methods have not been conducted in all  states, performed in a timely manner, or included a systematic review of  states’ compliance with all the provider screening and enrollment  requirements. For example:

Focused program integrity reviews. CMS has not conducted  focused program integrity reviews examining specific areas in  Medicaid for all states. Most of the reviews performed did not include  a comprehensive or timely examination of states’ compliance with  provider screening and enrollment requirements. Overall, CMS has  conducted 42 focused program integrity reviews in fiscal years 2014  through 2018 in 39 states. Among these reviews, nine of the 42  focused program integrity reviews examined states’ compliance with  provider screening and enrollment requirements, the last of which was  completed in fiscal year 2015. CMS also conducted focused program  integrity reviews on managed care for 34 of the 41 states with  managed care expenditures in fiscal year 2017. However, nearly all of  these reviews (33) were conducted prior to January 2018 when states  were required to screen and enroll all managed care providers, as  required by the 21st Century Cures Act. CMS also conducted seven  focused reviews examining personal care services in seven states— which include examining screening and enrollment requirements for  providers of these services.

Desk reviews. Off-site desk reviews that examine specific aspects of  states’ program integrity activities do not include a comprehensive or  timely examination of states’ compliance with the provider screening  and enrollment requirements. CMS has conducted desk reviews  examining activities related to provider screening and enrollment,  such as corrective actions states have taken in response to PERM  findings. However, desk reviews on corrective action plans are limited  to examining findings on provider screening and enrollment identified  during the PERM and are not conducted until 3 years after the PERM  has occurred. For example, CMS told us that in 2018 the agency  conducted desk reviews on the 17 states that underwent the PERM in  fiscal year 2015. CMS also conducted 35 desk reviews on potential  payments to terminated providers since fiscal year 2014.

The PERM and CMS’s other oversight methods do not provide CMS with  sufficient or timely information about states’ screening and enrollment  procedures for all Medicaid provider types, and most states with managed  care expenditures have not undergone a managed care-focused program  integrity review since the 21st Century Cures Act screening and  enrollment provisions went into effect. The lack of complete information  on whether states are screening and enrolling all providers according to  requirements is inconsistent with federal internal controls on assessing  risk, which note that management should consider the potential for fraud  when identifying, analyzing, and responding to risks. Without complete  information, CMS cannot ensure that only eligible providers are  participating in the Medicaid program, leaving the program vulnerable to  improper payments.

Further, CMS does not obtain timely information on all states’ actions to  address areas of non-compliance or track progress toward addressing  these areas. The length of the PERM cycle—3 years—and time for  performing corrective actions to address PERM findings, limits CMS’s  awareness of states’ progress, or lack thereof, toward implementing  requirements. As a result, CMS lacks assurance that states are  addressing areas of non-compliance or if such actions are being taken in  a timely manner. This is inconsistent with federal internal controls on  monitoring, which note that management should remediate deficiencies in  the internal control system on a timely basis.

CMS has a range of activities that provide the agency with some  knowledge of states’ implementation of required provider screening and  enrollment under PPACA and the 21st Century Cures Act; however, the  agency’s oversight activities are not designed to systematically examine  compliance with all the requirements for all providers in a timely manner.  Notably, the PERM does not examine managed care providers, and  CMS’s assessment of compliance and monitoring of corrective actions  are not timely, because they are based on the 3-year PERM cycle. Also,  focused program integrity reviews—which may examine states’ oversight  of MCOs and their compliance with provider screening and enrollment  requirements for providers participating in managed care—have not been  conducted on all states.

The one activity that can provide CMS and states with a complete and  timely assessment of states’ implementation with provider screening and  enrollment requirements is optional. While CMS does some tracking of  state-reported information on the status of states’ implementation of the  requirements, this oversight does not include states that have not availed  themselves of the support CMS provides. Since states are not required to  participate in these optional consultations, the states that may face the  greatest challenges with implementing the provider screening and  enrollment requirements might not volunteer to participate in the  consultations. Without a thorough review of states’ implementation of the  provider screening and enrollment requirements, as well as processes to  monitor states to ensure timely remediation of deficiencies, the agency  lacks assurance that only eligible providers are participating in the  Medicaid program, leaving the program at risk for improper payments.

We are making the following two recommendations to CMS:  The Administrator of CMS should expand its review of states’  implementation of the provider screening and enrollment requirements to  include states that have not made use of CMS’s optional consultations.  Similar to CMS’s contractor site visits, such reviews should include any  necessary steps to address areas of noncompliance for all types of  enrolled providers, including those under contract with MCOs.  (Recommendation 1)

The Administrator of CMS should annually monitor progress toward  addressing any areas of noncompliance related to the provider screening  and enrollment requirements for any state with one or more corrective  action plans. (Recommendation 2)

We provided a draft of this report to HHS for review and comment. In its  written comments, HHS concurred with our recommendations; the full text  of which are reproduced in appendix I.

Regarding our first recommendation, HHS stated that it will reach  out to states that have not yet participated in optional  consultations to discuss their progress and outline steps that the  states should take to come into full compliance with the provider  screening and enrollment requirements.

Regarding our second recommendation, HHS stated that it is in  the process of instituting more frequent reviews of corrective  action plans resulting from one of CMS’s oversight activities—the  PERM—stating that such reviews will now be performed quarterly.  However, HHS’s comments did not discuss monitoring areas of  noncompliance that are identified through other oversight  activities, such as focused program integrity reviews, which  include reviews of states’ screening and enrollment of providers  who are under contract with MCOs. We recommend that CMS  annually monitor progress toward addressing any areas of  noncompliance related to the provider screening and enrollment  requirements, which would include areas of noncompliance  identified through the PERM, optional consultations, and other  oversight activities.

HHS also provided technical comments, which we incorporated as  appropriate.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or at yocomc@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this report. GAO staff that made key contributions to  this report are listed in appendix III.

Appendix I: Comments from the Department of Health and Human Services

Appendix II: Summary of Medicaid Provider Screening and Enrollment Requirements

Appendix II: Summary of Medicaid Provider  Screening and Enrollment Requirements Description  The state Medicaid agency must require all enrolled providers to be screened in accordance  with applicable requirements.

The state Medicaid agency must have a method for verifying that a provider is licensed  without restrictions in accordance with the laws of that state.

The state Medicaid agency must complete revalidation of enrollment for all providers,  regardless of provider type, at least every 5 years.

The state Medicaid agency must deny enrollment to any provider and disclosing entity that  does not successfully pass or comply with the screening process, and the agency must  terminate providers who no longer meet the requirements for enrollment.

The state Medicaid agency must rescreen a provider who has been deactivated for any  reason prior to the provider’s reactivation.

The state Medicaid agency must share with providers who are terminated or denied  enrollment the process for appealing the decision.

The state Medicaid agency must conduct site visits for providers who are designated as  moderate or high-risk levels.

Fingerprint criminal background checks  The state Medicaid agency must complete fingerprint-based criminal background checks for  providers and disclosing entities in the high-risk category.

The state Medicaid agency must confirm the identity and determine the exclusion status of  providers, any person with an ownership or control interest, and any agent or managing  employee of the provider.

The state Medicaid agency must require all claims for payment for items and services that  were ordered or referred to contain the National Provider Identifier of the physician or other  professional who ordered or referred such items or services.

Screening levels for Medicaid providers  The state Medicaid agency must screen all initial applications based on a categorical risk  level of “limited,” “moderate,” or “high.”

The state Medicaid agency must collect an application fee from institutional providers during  a new enrollment or revalidation, unless Medicare or another Medicaid agency has already  collected an application fee.

Allows CMS and states to implement temporary moratoria pausing the enrollment of new  provider types in a given location.

Appendix III: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Leslie V. Gordon (Assistant  Director), Kristin Ekelund (Analyst-in-Charge), Manuel Buentello, Drew  Long, Giao N. Nguyen, and Chris Zakroff made key contributions to this  report. Also contributing were Marissa Coloske, Vikki Porter, and Jennifer  Whitworth.

States must screen and enroll health care providers in Medicaid according to federal and state rules. These rules are designed to exclude providers who don’t meet minimum standards, which can help prevent fraud, waste, and abuse. Congress established new federal rules in 2010 and 2016, yet officials we spoke with in 5 of 7 states said they haven’t implemented all of them.

The Centers for Medicare & Medicaid Services oversees states’ administration of Medicaid, but it doesn’t have a complete picture of state compliance with the new rules. We recommended that it expand its oversight.

The Medicaid program is on our High Risk List.