In the Medicaid program, comprehensive managed care is the predominant mode for delivering services. Approximately, seventy-two percent of beneficiaries receive services through managed care, covering 57 million people, in forty-one states. The contracts between managed care organizations (MCOs) and state Medicaid agencies spell out the services and benefits MCOs must provide Medicaid beneficiaries. Contracts also include penalties that states may impose if the MCOs fail to meet contractual requirements, or fall short in other ways, such as if the services provided are of poor quality and do not meet performance standards and benchmarks. These penalties often take the form of sanctions.
We conducted an in-depth analysis examining managed care contracts to identify different categories of sanctions and the reasons the states may impose them. This analysis began with a review of the managed care contracts of Arizona, California, Florida, Hawaii. Montana, New Hampshire, Ohio, Oregon, and Tennessee. We then searched for publicly available information on the number and kinds of sanctions these states imposed on their MCOs. When we were unable to locate the information online, we requested the sanctions information directly from the states, but to date some states have not responded.
Ultimately, we obtained information about sanctions imposed on MCOs from five states in our sample: Arizona, California, Florida, New Hampshire, and Ohio. The availability of this information as well as the depth of content varies widely from state to state.
Examples of Sanctions
Arizona reported sanctions for a variety of reasons. These include: failing to operate a Dual-Special Needs program in a specific geographic area, requiring prior authorization for crisis behavioral health services, and failing to maintain compliance with customer service performance standards. The most common action the state took against the MCOs was imposing sanctions for data reporting errors on over 119,000 member encounters. They did not report imposing any sanctions dealing with financial infractions committed by the plans.
California reported a wider array of types of sanctions than the other states selected for review. These sanctions dealt with a variety of issues directly impacting enrollees – denials of services, failing to pay for necessary medical treatment, failing to acknowledge and respond to member grievances – carried fines in the hundreds of thousands or millions of dollar range and were typically imposed on the MCOs by California’s Department of Managed Health Care (DMHC). For example, Blue Cross of California Partnership Plan was fined $1.2 million for failing to timely authorize coverage for medically necessary services after an Independent Medical Review determination. The state’s Department of Health Care Services (DHCS) recently announced sanctions on twenty-two MCOs for poor performance on quality measures related to children’s and women’s preventive services.
Florida imposed sanctions in 2022 on Sunshine Health Plan for $9.1 million in response to over 100,000 instances in which the MCO delayed payments or failed to pay providers. This was the largest penalty in a year in which the state took action against MCOs over 200 times for contract violations totaling $23.1 million.
In the New Hampshire managed care contract, the section on sanctions has a detailed breakdown of monetary penalties referred to as Liquidated Damages. There are fifty-four different actions or inactions by MCOs that could draw a penalty from the state. The 109 sanctions that New Hampshire reported and imposed on their three MCOs each drew a $1,000 penalty. Those 109 sanctions were for three broad reasons:
- 5% Failure to timely process a clean and complete provider credentialing application
- 43% Failure to meet performance standards in the contract
- 51% Submission of a late, incorrect, or incomplete report or deliverable
The contract specifies that two or more performance standards violations in a contract year should draw a $50,000 penalty for each occurrence. Forty-seven of the sanctions New Hampshire reported on the three MCOs are for failing to meet performance standards, meaning there should be numerous $50,000 penalties in the data. As it stands, there do not appear to be any. (See Appendix A in the full report for a breakdown of the reasons sanctions were imposed by the health care service category across the three plans.)
Ohio’s data indicates that the vast majority of reported financial sanctions were imposed for failure to meet provider panel requirements for network adequacy and failure to meet performance measure benchmarks. But, due to the nature of how the data we requested was returned to us, it is impossible to discern which of the MCOs operating in the state were subjected to those penalties or how much each plan was fined for these violations.
Reporting Requirements
One potential reason for the lack of reporting of sanctions against MCOs lies in the fact that the Medicaid statute does not require timely public reporting. The current regulation only requires that the “State must give CMS written notice whenever it imposes or lifts a sanction for one of the violations listed in § 438.700.” The state must notify CMS no later than 30 days after they impose or lift a sanction and in that notification the state must detail “the name of the MCO, the kind of sanction, and the reason for the State’s decision to impose or lift a sanction.”
At the very end of the Clinton Administration, in January 2001, the federal agency published a final rule that would have required the states to publicly report any time a sanction was imposed or lifted on a MCO. The notification would “(1) describe the intermediate sanction imposed, (2) explain the reasons for the sanction, and (3) specify the amount of any civil penalty.” Section 438.724 of the proposed regulation would have given the state up to thirty days after the sanction was imposed to report the action and – in a clear indication that this proposal is over twenty-years old – the notice was supposed to be reported in “the newspaper of widest circulation in each city within the MCO’s service area that has a population of 50,000 or more, or, if there is no city with a population of 50,000 or more, the newspaper of widest circulation in the MCO’s service area.” But, when the Bush Administration took office, the federal agency delayed implementation of the rule, then issued a rule in 2002 that eliminated the publication requirement.
Currently, the regulations require reporting on sanctions at the end of the contract year in the annual report on each MCO, stipulated in § 438.66. The annual report must cover “the results of any sanctions, corrective action plans, or other performance improvement actions.” At the moment, however, these reports are only available for a handful of states. This is because the requirement for mandated reporting has not yet been fully implemented. Most of the states will release their first annual report detailing their sanctions information and other oversight activities to the Medical Care Advisory Committee and their state’s Long Term Services and Supports (LTSS) stakeholder group at some point during 2023.
While gathering the information needed to write our report, we found that Arizona and California have the most comprehensive and easily accessible information online. These two states appear to be taking a tack similar to the 2013 proposal and release sanctions information as they impose them upon MCOs. Although locating this information on the state’s Medicaid website takes some effort, Florida has an online dashboard that details a wealth of information about the number of times MCOs have had liquidated damages and other compliance actions imposed on them and the amounts of those fines. The dashboard also details the categories of MCO performance that were most often cited for damages.
Next Steps
The intention of imposing sanctions on MCOs is to inflict a financial burden with the goal of inducing future compliance and better service delivery. Additionally, sanctions reveal to stakeholders that MCOs have violated the rules and make that public knowledge. It appears, however, that most imposed monetary penalties are not likely to produce real change in how MCOs do business, given how small the fines are relative to the yearly revenues and profits earned by the MCOs.
We believe more must be done to get MCOs to take notice of the quality of services they provide. A first step is some form of clearly stated, standardized reporting similar to what was proposed in 2001 – updated to direct people to online resources where health care news and information is typically found. The upcoming state annual reports could go a long way in helping advocates, policymakers, and beneficiaries understand the actions their state has taken against MCOs in the name of accountability, transparency, and oversight. Whether or not the annual reports will do enough to bring attention to these accountability issues, we will see as more of them are released throughout 2023.
