GAO Report Reveals Vulnerabilities in Affordable Care Act Exchanges

This morning, the Government Accountability Office (GAO) published a report highlighting significant vulnerabilities within the Affordable Care Act (ACA) exchanges, indicating a considerable risk of fraud. The document was requested by several committee chairs, including Brett Guthrie from Energy and Commerce, Jim Jordan from Judiciary, and Jason Smith from Ways and Means.

The findings suggest that, due to expanded subsidies and increased federal oversight, ACA exchanges approved subsidized health insurance for 23 out of 24 fake applications submitted by GAO. Furthermore, many billions of dollars in upfront subsidies to health insurers were not adequately adjusted. This lack of oversight raises concerns that ACA exchanges are susceptible to fraud, which potentially wastes taxpayer money.

Interestingly, GAO’s results back up research from Paragon about inappropriate fictitious enrollments. For instance, they estimate about 6.4 million inappropriate enrollees in fully subsidized plans by 2025. The issue seems to have arisen partly due to many individuals being unaware of their own insurance coverage or other options available; the percentage of exchange enrollees without medical claims has doubled from 2021 to 2024.

GAO Testing Reveals Easy Enrollment for Fictitious Applicants

In its tests spanning the plan years 2024 and 2025, GAO established 20 fictitious identities and submitted 24 applications. Out of these, 23 were approved.

2024 Application: Full Approval

For the 2024 plan, GAO lodged four hypothetical applications, using methods that included HealthCare.gov and intermediaries. They all contained invalid information, like fake Social Security numbers and unverifiable income claims.

Shockingly, the exchanges frequently bypassed documentation requirements, even when such documentation was technically necessary for subsidized enrollment. The exchanges approved applications without reliable documentation. In one instance, GAO noted that the marketplace failed to verify an applicant’s citizenship or income, even though that information could have triggered necessary checks.

GAO remarked, “In one instance, we were notified by the Federal Marketplace that we verified the applicant’s estimated income based on the documentation we submitted. However, we didn’t actually provide any such documentation.” Such lapses in addressing data discrepancies can lead to ineligible applicants receiving subsidized insurance.

2025 Applications: Dominantly Approved

For the 2025 plan, GAO tested 20 fictitious applicants. Alarmingly, 19 out of these 20 received grant compensation, and 18 remain active as of September 2025. This indicates ongoing subsidies in cases of fake registrations, mirroring outcomes from tests conducted between 2014 and 2016, during which all fictitious applicants were approved. GAO affirmed that the results for 2024 and 2025 are “generally consistent” with previous findings.

Issues with Subsidy Reconciliation through IRS

The ACA mandates individuals receiving the Prepaid Premium Tax Credit (APTC) to file federal tax returns to reconcile estimated income with actual income. This is essential for ensuring subsidies are accurate.

GAO’s analysis revealed large-scale failures in this reconciliation process. Reports suggest that the Centers for Medicare and Medicaid Services (CMS) have halted enforcement actions regarding IRS settlement data from 2021 to 2024.

GAO noted, “As of April 2025, our preliminary analysis identified no evidence in IRS tax data for over $21 billion in APTC settlements linked to enrollees who submitted SSNs via the federal marketplace during the 2023 plan year.” Essentially, around one-third of APTC payments to individuals with Social Security numbers were not reconciled with tax returns in states using the federal exchange. Thus, CMS cannot confirm whether the billions in payments were valid.

GAO outlined, “Preliminary analysis of the federal marketplace registration data pointed to potential misuse of SSNs, including their multiple usage and matching with death records.”

This oversight issue is magnified by CMS’s choice to suspend enforcement regarding settlements for years. GAO stated that CMS “did not act on IRS data for consumers who did not file tax returns and did not adjust prior APTCs for the years 2021-2024.” Consequently, those who received subsidies without filing taxes for four consecutive years could continue to receive benefits without facing repercussions. The statutory protections intended to avert improper payments were essentially bypassed during the Biden administration.

Further Integrity Risks within Exchange Programs

GAO discovered additional concerns:

• Social Security Number Irregularities: Over 66,000 SSNs showed coverage periods exceeding 366 days in 2024. GAO noted that this could arise from identity theft, synthetic identity fraud, or data entry mistakes. Ongoing research will probe these instances further.
• One particular SSN was used to obtain subsidized coverage for more than 26,000 days—or an equivalent of 71 years—across over 125 policies.
• Grants for Deceased Individuals: More than 58,000 SSNs receiving subsidies matched with Social Security death records from 2023, involving over $94 million in APTCs linked to deceased members.
• GAO also pinpointed more than 7,000 SSNs whose death dates preceded their Marketplace enrollment in 2023, indicating potential composite identity fraud.

Conclusion

GAO’s findings indicate that exchanges are still approving fraudulent registrations, allowing unethical agents to inflate their commissions and letting insurance companies enroll impostors. Moreover, there’s a lack of measures to prevent or rectify improper payments. In essence, despite more than a decade since the ACA’s rollout and the expenditure of billions on verification systems, exchanges remain highly susceptible to fraud and abuse. These issues have intensified, particularly due to the increased subsidies during the pandemic, and may worsen if such extensions are continued.