Not All Internal Controls Implemented by the Federal, California, and Connecticut Marketplaces Were Effective in Ensuring That Individuals Were Enrolled in Qualified Health Plans According to Federal Requirements

Not all internal controls implemented by the Federal, California, and Connecticut health insurance exchanges (marketplaces) were effective in ensuring that individuals were enrolled in qualified health plans (QHPs) according to Federal requirements. The deficiencies in internal controls that we identified may have limited the marketplaces' ability to prevent the use of inaccurate or fraudulent information when determining eligibility of applicants for enrollment in QHPs.

On the basis of our review of 45 sample applicants at each marketplace, we determined that certain controls were effective, e.g., verification of applicants' incarceration status at all 3 marketplaces. However, the internal controls were not effective for validating Social Security numbers at the Federal marketplace, verifying citizenship and lawful presence at the California marketplace, and performing identity proofing of phone applicants and verifying minimum essential coverage through non-employer-sponsored insurance at the Connecticut marketplace.

On the basis of performing other audit procedures, such as interviews with marketplace officials and reviews of supporting documentation, we determined that other controls were not effective. For example, the Federal and California marketplaces did not always resolve inconsistencies in eligibility data, and the Connecticut marketplace did not always properly determine eligibility for insurance affordability programs.

These deficiencies occurred because (1) the marketplaces did not have procedures or did not follow existing procedures to ensure that applicants were enrolled in QHPs according to Federal requirements or (2) the marketplaces' eligibility or enrollment systems had defects or lacked functionality. For example, the Federal marketplace's system functionality to resolve inconsistencies in eligibility data had not been fully developed. In addition, we noted other issues that may be of interest to stakeholders.

The presence of an internal control deficiency does not necessarily mean that a marketplace improperly enrolled an applicant in a QHP or improperly determined eligibility for insurance affordability programs. Other mechanisms exist that may remedy the deficiency.

To address the specific deficiencies that we identified, we recommended that CMS (which operates the Federal marketplace), Covered California (the California marketplace), and Access Health CT (the Connecticut marketplace) take action to improve internal controls related to (1) verifying identity of applicants and entering application information, (2) determining applicants' eligibility for enrollment in QHPs and eligibility for insurance affordability programs, and (3) maintaining and updating eligibility and enrollment data. We also recommended that CMS work with Covered California and Access Health CT to implement our recommendations addressing deficiencies identified at the California and Connecticut marketplaces.

CMS concurred with all of our recommendations and provided information on actions that it had taken or planned to take to address our recommendations. However, CMS stated that it did not believe that two of our recommendations, one of which we removed, should be included in the report. Covered California agreed with one of our recommendations and provided information on actions that it had taken or planned to take to address our remaining recommendations. However, Covered California disagreed with some of our findings. Access Health CT concurred with three of our recommendations but did not concur with one recommendation. In addition, Access Health CT did not concur with one of our findings; we removed the finding and the related recommendation.