Georgia’s faulty oversight of private Medicaid management contractors has left the state’s Medicaid program vulnerable to overpaying for health care and to fraud, a state auditor’s report has found.

Over seven years from 2013 to 2019, a total of $41 million in claims the contractors paid out for Medicaid “were not subject to adequate oversight and claims review,” the report says, and some questionable claims were forwarded to the state for review but left to languish for years.

Scattered oversight systems that lack coordination are at fault, the report says.

The audit cites business after business—whether a doctor, clinic or hospital—that engaged in sketchy behavior with one part of the system, was caught, but not reported and able to continue the same behavior in other parts of the system. The Department of Community Health, which oversees Medicaid, did not even have protocols written into contracts for how exactly to report fraud with an end to tamping it down system-wide, the audit found.

The contractors are called CMO’s, or Care Management Organizations. In one example, auditors cited a questionable health care provider business, which it didn’t name, with “pervasive” improper claims practices flagged by a CMO.

“DCH waited five years to analyze a provider’s Medicaid claims after being informed by a CMO of improper claims practices,” the audit found. “After CMO A investigated and terminated the provider’s contract in 2014, (Georgia Medicaid and two other Georgia CMO’s) continued to pay the provider approximately $2.6 million in Medicaid payments.”

The Department of Community Health, which oversees Medicaid, said it agreed with most of the recommendations and was working to consolidate and strengthen its oversight.

The need to reduce silos and improve coordination “is a common concern” across many Georgia agencies, said Laura Harker, senior health policy analyst at the Georgia Budget and Policy Institute. “The managed care organizations take a lot of credit for reducing state Medicaid costs,” she said. “But just because they help produce savings doesn’t mean they don’t need oversight on ensuring they are making the correct payments.”

Georgia insures 2.1 million individual patients through Medicaid and the Medicaid program PeachCare for Kids. The patients are mostly children, but also some elderly nursing home residents and people with disabilities. In the fiscal year ending June 2019, that cost $10.6 billion. The federal government pays about two-thirds and the state pays the rest.

Traditionally, Medicaid would simply pay a doctor or hospital the fee for a particular service. But that built in an incentive to do more services than might be necessary. CMO’s came in to purportedly save the state money and hopefully improve care by changing that fee-for-service model.

Rather than pay a doctor or hospital a direct fee for each service to a Georgia Medicaid patient, Georgia Medicaid pays the contractor a set fee for managing the Medicaid of a number of enrollees. The CMO’s say they save the state money by incentivizing better care, not lots of fees, and that they offer more support to enrollees.

But that also means what goes on between the CMO and the billing and paying is now somewhat removed from state overseers.

And if the CMO’s are overpaying for services, that eventually comes back to the state budget. The CMO’s report their own overall spending to actuaries, who calculate the cost of providing care: And that is a basis of Georgia Medicaid deciding how much to contract for in the coming year.

DCH said it had already established new data analytics and protocols with CMO’s and its own units that would identify potential fraud better than it currently does. It said it had established better processes and communication between its disparate integrity units, and it planned to designate one as the lead.

One of the audit’s recommendations was to the General Assembly, to allow the CMO’s to have more time to investigate providers and recover overpayments. Questionable claims to CMO’s are currently allowed to be recovered only up to 18 or 24 months following the service, while the state’s own unit has three years.

The group that represents the state’s doctors, the Medical Association of Georgia, said it would oppose expanding the time limit to recover overpayments, “especially considering the financial hardship the Covid-19 pandemic has placed on physician practices.”