OIG reviews MassHealth and its Medicaid data and information system safeguards

MassHealth failed to adequately safeguard data and information systems through its Medicaid Management Information System (MMIS) according to an audit by the HHS’ Office of Inspector General (OIG) undertaken to determine whether Massachusetts safeguarded MMIS data as required under federal requirements.

What is MMIS?

The MMIS is “an integrated group of procedures and computer processing operations (subsystems) developed at the general design level to meet principal objectives” which are: Title XIX program control and administrative costs; service to recipients, providers and inquiries; operations of claims control and computer capabilities; and management reporting for planning and control. States receive 90 percent federal financial participation (FFP) for design, development, or installation of MMIS and 75 percent FFP for operation of state mechanized claims processing and information retrieval systems.

MassHealth MMIS

The Massachusetts Executive Office of Health and Human Services is responsible for administering the state Medicaid program, commonly known as MassHealth, and information technology architecture, maintenance, and support is provided by the Massachusetts Office of Information Technology. Application support is provided through a contract with Hewlett-Packard.

The audit

Audits of information security controls are performed routinely on states’ computer systems used to administer HHS-funded programs and states are required to implement computer system security requirements and review them biennially. The OIG’s audit of MassHealth’s MMIS included MassHealth’s websites, databases, and other supporting information systems. The review was limited to security control areas and controls in place at the time of the visit. Specifically, the OIG looked at MassHealth’s implementation of federal requirements and National Institute of Standards and Technology guidelines regarding: system security plan, risk assessment, data encryption, web applications, vulnerability management, and database applications. Preliminary findings were communicated directly to MassHealth prior to the report’s issuance.

OIG’s findings

The OIG found MassHealth did not safeguard MMIS data and supporting systems as required by federal requirements. Vulnerabilities were discovered related to security management, configuration management, system software controls, and website and database vulnerability scans. Should exploitation of the vulnerabilities have occurred (and there was no evidence that it had), sensitive information could have been accessed and disclosed and operations of MassHealth could have been disrupted. Sufficient controls must be implemented over MassHealth Medicaid data and information systems.

Specific vulnerabilities uncovered were not detailed in the report because of the sensitive nature of the information. However, specific details were provided to MassHealth so it may address the issues. In response to the report, MassHealth described corrective actions it had taken or planned to take in response to the vulnerabilities.

Highlight on Minnesota: Health plans’ red ink worst in a decade

Nonprofit insurers in Minnesota reported an operating loss of $687 million on nearly $25.9 billion in revenue for 2016, according to a trade group for insurers, the Minnesota Council of Health Plans. The financial results were the worst in a decade, with losses in both the state public health insurance programs and the marketplace where individuals purchase coverage for themselves.

Overall, revenue from premiums increased 4 percent over the prior year, while expenses increased 6 percent to $26.6 billion. State public programs accounted for more than half of the overall losses, followed by continued losses in the individual market. According to the report, on average, health insurers paid $763 per second for care. To pay those bills, insurers withdrew nearly $560 million from state-mandated medical reserves. The bulk of the financial losses reported did not result from the employer group and Medicare markets, which remained steady, and where most Minnesotans get health insurance.

In the individual market, Blue Cross and Blue Shield of Minnesota said it lost $142 million for 2016, compared to a $265 million deficit the previous year. The decline mirrored the drop in enrollment, the insurer noted, rather than an improvement in the business. Over the last 10 years, health insurers returned a profit in seven. The numbers reported by the trade group focused solely on revenue and income from the health insurance business, as investment returns made by insurers were not counted in the numbers. Some saw hope in the overall numbers, however, noting that the market was not in a “death spiral,” as some health law critics have argued, because many insurers in 2016 saw slight improvements from the previous year.

Highlight on Mississippi: OIG finds a big ‘Miss’ in state’s Medicaid reimbursement

The Mississippi state Medicaid agency claimed over $21 million in unallowable school-based administrative costs over a three-year period, according to an OIG review of the state’s school-based and community-based administrative costs. The improper reimbursement request arose from inadequate documentation and sampling.

Administrative Costs

For Fiscal Years 2010 through 2012, Mississippi claimed school-based administrative costs, which are considered public assistance costs, totaling nearly $42.4 million. The OIG conducted a review of the state’s administrative costs because of the significant amount claimed and the fact that the state had not submitted a cost allocation plan (CAP). School-based Medicaid administrative costs are reimbursable when the costs are for activities that directly support identifying and enrolling potentially eligible children in Medicaid.

Not Reimbursable

The OIG determined that the state Medicaid agency claimed costs in violation of federal requirements. Specifically, the state agency used statistically invalid random moment sampling (RMS) to allocate its Medicaid costs and did not maintain adequate support to validate its sample results and related extrapolations. When evaluating the legitimacy of the RMS, the OIG found duplications on participant lists, improperly documented employee schedules, and sampling that included improper days like holidays. Additionally, sample data was not properly stored and could not be duplicated to ensure accuracy.

Additionally, under 45 C.F.R. Sec. 95.507(a), states must submit to the division of cost allocation (DCA) a CAP that follows federal requirements. The state submitted $42,399,301 ($21,199,651 in FFP) in school-based Medicaid administrative costs without promptly submitting all of the necessary information to DCA.

Recommendations

The OIG recommended the state agency:

  • refund $21,199,651 to the Federal Government;
  • revise its implementation plan and amend its CAP to both address the statistical validity issues identified and incorporate CMS’s sampling documentation requirements;
  • implement policies and procedures to ensure that its RMS complies with Federal requirements for statistical validity;
  • maintain adequate support, including all information necessary to reproduce and verify its sample results, for school-based administrative costs allocated to Medicaid;
  • promptly submit to DCA for review and approval its future CAP amendments describing its procedures for identifying, measuring, and allocating costs to Medicaid; and
  • review school-based Medicaid administrative costs claimed after the audit period and refund unallowable amounts.

Response

The State agency disagreed with the OIG’s comments but did not address the recommendations. The state agency disagreed that its RMS was statistically invalid and asserted that it was, instead, properly documented.

Highlight on Wisconsin: As opioid overdose and deaths rise, state seeks $15.7 million in SAMHSA support

The rate of opioid overdose deaths in Wisconsin has risen approximately 81 percent from 2006 through 2015, according to a new Wisconsin Department of Health Services (DHS) report, titled “Select Opioid-Related Morbidity and Mortality Data for Wisconsin.” In response, the Wisconsin DHS has submitted an application for up to $15.7 million in federal funding to boost the state’s response to the growing misuse and abuse of opioids from the Substance Abuse and Mental Health Services Administration (SAMHSA). The amount of the grant is based on the unmet need for opioid-related treatment and the number of opioid-related deaths in the state. Wisconsin is eligible to receive up to $7,636,938 each year for the next two years under the 21st Century Cures Act.

The DHS report provides statewide and county-level data on opioid-related deaths and hospital visits, neonatal abstinence syndrome (NAS) (in which an infant is born with withdrawal symptoms from substances taken by the mother), and data on ambulance runs in which naloxone (a medication used to reverse opioid overdose) was administered. The report includes these data highlights:

  • The rate of opioid overdose deaths increased from 5.9 deaths/100,000 residents in 2006 to 10.7 deaths/100,000 in 2015.
  • Rates of drug overdose deaths involving opioids were higher among counties in the southeastern region of the state (Milwaukee area), and higher among men compared with women.
  • Drug overdose deaths involving opioids were highest among young men aged 25-34, and among women aged 35-54.
  • Hospital visits involving opioid acute poisoning (including overdose) increased from 25.3 to 52.0 per 100,000 between 2006 and 2014.
  • The rate of ambulance runs in which naloxone was administered rose from 51.2 to 67 per 100,000 from 2011 to 2015.
  • The rate of NAS increased from 2.0 to 8.7 per 1,000 live births from 2006 to 2014, a rate increase of 335 percent.

In 2016, DHS issued a Public Health Advisory due to the opioid epidemic. In 2017, Governor Scott Walker called for a special session of the legislature to consider recommendations presented by the Governor’s Task Force on Opioid Abuse. New legislative proposals will build on efforts already underway under the HOPE (Heroin, Opioid Prevention and Education) agenda, which includes 17 bills aimed at prevention and treatment of opioid addiction and overdose.

Pending approval from SAMHSA, the funds will be used to:

  • Support community coalitions focused on reducing the nonmedical use of opioids among people age 12 to 25.
  • Establish a hotline to provide information on treatment services and recovery supports.
  • Expand access to treatment for uninsured and underinsured individuals.
  • Establish new opioid-specific treatment programs to reduce the distance people have to travel for these services.
  • Establish a network of individuals in long-term recovery from the misuse and abuse of opioids trained to coach people through the treatment and recovery process.
  • Develop training for professionals on proven intervention and treatment strategies for opioid misuse and abuse.