Pierre Martinon
email: pierre.martinon@polytechnique.edu

Pierre Picard
email: pierre.picard@polytechnique.edu.

Anasuya Raj
email: anasuya.raj@polytechnique.edu

On the Design of Optimal Health Insurance Contracts under Ex Post Moral Hazard

We analyze the design of optimal medical insurance under ex post moral hazard, i.e., when illness severity cannot be observed by insurers and policyholders decide for themselves on their health expenditures. The trade-o¤ between ex ante risk sharing and ex post incentive compatibility is analyzed in an optimal revelation mechanism under hidden information and risk aversion. The optimal contract provides partial insurance at the margin, with a deductible when insurers'rates are a¤ected by a positive loading, and it may also include an upper limit on coverage. The potential to audit the health state leads to an upper limit on out-of-pocket expenses.

Introduction

Ex post moral hazard in medical insurance occurs when insurers do not observe the health states of individuals, and policyholders may exaggerate the severity of their illness - Arrow (1963, 1968), Pauly (1968) and Zeckhauser (1970). Proportional coinsurance under ex post moral hazard (i.e., when insurers pay the same fraction of the health care cost whatever the individuals' expenses) has been considered by many authors, including Zeckhauser (1970), Feldstein (1973), Arrow (1976), Feldstein and Friedman (1977), and Feldman and Dowd (1991). However, while proportional coinsurance has the advantage of mathematical tractability, it is neither an optimal solution to the ex post moral hazard problem, nor an adequate representation of the health insurance policies that we may observe.

To approach this issue in more general terms, we may consider a setting where the policyholder has private information about her illness severity and she chooses her health care expenditures -or equivalently where a provider, acting as a "perfect agent" of the policyholder, prescribes the care that is in the patient's best interest. The contract between insurer and insured speci…es the insurance premium and the indemnity schedule, i.e., the indemnity as a (possibly non-linear) function of medical expenses. This is equivalent to a direct revelation mechanism that speci…es care expenses and insurance transfers as functions of a message sent by the policyholder about the severity of her illness, and where she truthfully reveals her health state to the insurer. Looking for an optimal non-linear insurance contract under ex post moral hazard is thus equivalent to characterizing the optimal solution to an information revelation problem.

The ex post moral hazard information problem was identi…ed by Zeckhauser (1970), and the corresponding literature is surveyed by Winter (2013). Blomqvist (1997) was the …rst to address this issue with the modern tools of incentive theory, but he unfortunately overlooked important technical aspects (including bunching and limit conditions), which considerably reduces the relevance of his conclusions. 1 Ma and Riordan (2002) considered a more speci…c setting, in which the existence and severity of a disease are private information of the patient, and they showed how the optimal copayment should balance the risk-sharing bene…ts of greater insurance, against the distortions due to ine¢ cient treatment choices. Drèze and Schokkaert (2013)

extended

Arrow's theorem of the deductible to the case of ex post moral hazard. However, they directly postulated that the insurance premium is computed with a positive loading factor, presumably because of transaction costs. They did not address the question of whether ex post and ex ante moral hazard di¤er in this respect, independently of the existence of transaction costs. Our objective is to progress further along these lines, with the double concern of robustness of theoretical conclusions and, as far as possible, conformity with economic reality.

Not surprisingly, as already established by Blomqvist (1997), the trade-o¤ between ex post moral hazard incentives and risk sharing leads to a partial coverage at the margin. However, we will show that, under some assumptions about the probability distribution of health states, it also involves a cap on health expenses and insurance indemnities reached by a non-negligible fraction of policyholders. In other words, the optimal contract speci…es a partial reimbursement at the margin, with bunching "at the top". 2 In the terminology of health insurance, such an upper limit on coverage corresponds to a …xed-dollar indemnity plan on a per-period basis, i.e., medical insurance pays at most a predetermined amount over the whole policy year, regardless of the total charges incurred. We will also determine that a deductible is optimal 1 Blomqvist (1997) argues that the indemnity schedule is S -shaped, with marginal coverage increasing for small expenses and decreasing for large expenses. As we will see, this conclusion is not valid when bunching and limit conditions are adequately taken into account.

2 Bunching may also occur in adverse selection principal-agent models with risk averse agents - Salanié (1990) and La¤ont and Rochet (1998) -and in the Mirrlees' optimal income tax model - Lollivier and Rochet (1983), Weymark (1986) and Ebert (1992).

only if insurers charge a positive loading because of transaction costs. 3 Hence, ex post and ex ante moral hazard lead to quite di¤erent conclusions about the optimality of deductibles: in the absence of transaction costs, a deductible is optimal under ex ante moral hazard when e¤ort a¤ects the probability of an accident (Holmström, 1979), 4 but not under ex post moral hazard. This characterization is robust to changes in the modelling, including the case where income is a¤ected by a background risk and the case where preferences are not separable between wealth and health.

Partial insurance at the margin and caps on insurance indemnities are frequent, but they are far from being a universal characterization of health insurance, be it o¤ered by social security or by private insurers. In the real world, we also observe limits to outof-pocket expenses that are usually reached for large inpatient care expenses. 5 This discrepancy between theory and practice may be the consequence of an unrealistic feature of the standard ex post moral hazard model: in practice, patients are not always allowed to choose their health expenses freely. It is a fact that basic health expenses are more or less decided unilaterally by patients, for instance whether they should visit their general practitioners or their dentists to cure benign illnesses, while insurers have control over more serious expenses, in particular surgeries or other types of hospital care.

3 It is well known that optimal insurance contracts may include a deductible because of transaction costs (Arrow, 1963), ex ante moral hazard (Holmström, 1979) or costly state veri…cation (Townsend, 1979). Drèze and Schokkaert (2013) extend Arrow's theorem of the deductible to the case of ex post moral hazard. Although ceilings on coverage are widespread, they have been justi…ed by arguments that are much more speci…c: either the insurer's risk aversion for large risks and regulatory constraints (Raviv, 1979), or bankruptcy rules (Huberman et al., 1983) or the auditor's risk aversion in costly state veri…cation models (Picard, 2000). 4 A straight deductible contract, i.e., full coverage of losses above a deductible, is optimal when e¤ort a¤ects the probability of an accident, but not the probability distribution of losses, conditionally on the occurrence of an accident.

Extending our analysis in that direction, we will immerse the ex post moral hazard problem in a costly state veri…cation setting (Townsend, 1979). There should be no audit for low health expenses, because monitoring the expenses would be cost prohibitive.

When health expenses cross a certain threshold, an audit should be triggered, and it is then optimal to provide full coverage at the margin, i.e., to include an out-of-pocket maximum in the indemnity schedule.

In brief, our objective is twofold: …rstly, to characterize the optimal health insurance indemnity schedule under ex post moral hazard in a way which is as robust as possible, and, secondly, to extend this analysis to a costly state veri…cation setting. To do so, we will mainly limit ourselves to a simple model, similar to Blomqvist's (1997),

with one period, one source of risk and one aggregate medical service, and where the health care providers agency problems are ignored. Needless to say, this is a very restrictive setting, and the literature on health insurance has gone well beyond.6 Our focus will be limited to the "fundamental trade-o¤ of risk spreading and appropriate incentives" (Cutler and Zeckhauser, 2000, p.576), inherent in the optimal insurance problem under ex post moral hazard, without exploring here these multiple extensions. Obviously, crossing these two perspectives is crucial for reaching a thorough understanding of health insurance markets.

Section 2 introduces our main notations and assumptions. Section 3 characterizes the optimal non-linear insurance contract, when the policyholder's preferences are separable between wealth and health. Theoretical results are derived through optimal control techniques, and they are also solved through a computational approach.

Section 4 immerses the ex post moral hazard problem in a costly state veri…cation setting, where health expenses may be audited. Section 5 appraises the robustness of our results by considering alternative models, with correlated background risk, non-separable utility, and insurance loading, respectively. Section 6 brie ‡y investigates the connections between our analysis and public policy issues that are ignored in our analysis, although they are of utmost importance. This includes the redistributive objective of state-driven health insurance regimes, and the ine¢ ciency loss due to the agency relationship between physician and patient. Section 7 concludes. The main proofs are in Appendix 1. Appendix 2 includes details on our computational approach and a complementary set of proofs.

The model

We consider an individual whose welfare depends both on monetary wealth R and health level H, with a bi-variate von Neumann-Morgenstern utility function U (R; H) that is concave and twice continuously di¤erentiable. In the following sections, as in Blomqvist (1997), we restrict attention to the case where U is additively separable between R and H, and we will write U (R; H) = u(R) + H, with u 0 > 0 and u 00 < 0.

Thus, the individual is income risk averse and illness a¤ects her utility, but it does not a¤ect the marginal utility of income. 7 The non-separability case will be considered in sub-section 5.2. The monetary wealth R = w T is the di¤erence between initial wealth w and net payments T made or received by the individual for her health care, including insurance transfers.

The health level may be negatively a¤ected by illness, but it increases with health expenditures. This is written as:

H = h 0 x[1 v(m)]; > 0;
where h 0 is the initial health endowment, x 0 is the severity of illness (or health state), m 0 denotes medical expenses and is a scaling parameter for the welfare gain from these expenses. We assume that v(m) is concave and twice continuously di¤erentiable, with v(0

) = 0; v 0 (0) = +1; v(m) 2 (0; 1); v 0 (m) > 0; v 00 (m) < 0 if m 2 (0; M ); v 0 (M ) = 0; v(m) = v(M ) 1 if m M > 0.
Illness severity x is randomly distributed over the interval [0; a]; a > 0, with c.d.f. F (x) and continuous density f (x) = F 0 (x) > 0 for all x 2 [0; a). 8

3 Optimal non-linear insurance

Incentive compatibility

We assume that coverage is o¤ered by risk neutral insurers operating in a competitive market without transaction costs, and that each individual can be insured through only one contract. An insurance contract is characterized by a schedule I(m) that de…nes the indemnity as a function of health expenditures and by premium P . Function I(:) : R + ! R + is supposed to be continuous, non-decreasing, piecewise continuously di¤erentiable and such that I(0) = 0. 9 We have T = m + P I(m) and R = w T = w P m + I(m). 10 A type x individual chooses her health care expenses m(x) in 8 For notational simplicity, we assume that there is no probability weight at the no-sickness state x = 0, but the model could easily be extended in that direction. 9 In addition to being realistic, assuming that I(m) is non-decreasing is not a loss of generality if policyholders can claim insurance payment for only a part of their medical expenses: in that case, only the increasing part of their indemnity schedule would be relevant. Piecewise di¤erentiability means that I(m) has only a …nite number of non-di¤erentiability points, which includes the indemnity schedule features that we may have in mind, in particular those with a deductible, a rate of coinsurance or an upper limit on coverage. I(0) = 0 corresponds to the way insurance works in practice, but it also acts as a normalization device. Indeed, replacing contract fI(m); P g by fI(m) + k; P + kg with k > 0, would not change the net transfer I(m) P from insurer to insured, hence an indeterminacy of the optimal solution. This indeterminacy vanishes if we impose I(0) = 0.

10 Our notations are presented by presuming that policyholders pay m (i.e., the total cost of medical services) and they receive the insurance indemnity I(m). However, we may also assume that the order to maximize her utility, that is

m(x) 2 arg max
The insurer's break-even condition is written as

P Z a 0 b I(x)f (x)dx: (2)
An optimal revelation mechanism fm(:); b I(:)g : [0; a] ! R 2 + maximizes the policyholder's expected utility

Z a 0 fu(R(x)) + h 0 x[1 v(m(x))]g f (x)dx; (3)
where R(x) w P + b I(x) m(x), subject to (1) and (2). Lemma 1 is an intermediary step that will allow us to write this optimization problem in a more tractable way.

insurer and policyholders respectively pay I(m) and m I(m) to medical service providers. Both interpretations correspond to di¤erent institutional arrangements, and both are valid in our analysis.

Lemma 1 (i) For any incentive compatible mechanism, m(x) and b I(x) are nondecreasing. (ii) There exists a continuous optimal direct revelation mechanism fm(:); b I(:)g.

(iii) Any continuous direct revelation mechanism is incentive compatible if and only if

b I 0 (x) = 1 xv 0 (m(x)) u 0 (R(x)) m 0 (x); (4)
m 0 (x) 0;

(5)

at any di¤erentiability point.

The monotonicity of incentive compatible mechanisms is intuitive: more severe illnesses induce higher medical expenses and higher insurance compensation. If a revelation mechanism includes discontinuities in b I(x) and m(x), then it is possible to reach the same expected utility with lower indemnities and expenses, and such a mechanism would not be optimal. The interpretation of (4) and ( 5) is as follows. Suppose a type x individual slightly exaggerates the severity of her illness by announcing e x = x + dx instead of e x = x. Then, at the …rst-order, the induced utility variation is fu 0 (R(x))[ b I 0 (x) m 0 (x)] + xv 0 (m(x))m 0 (x)gdx, which cancels out when (4) holds.

Monotonicity condition (5) is the local second-order incentive compatibility condition.

Symmetrically, it is easy to show that (4)-( 5) implies incentive compatibility.

The optimal insurance contract

Let us denote h(x) m 0 (x). The optimal revelation mechanism maximizes the policyholder's expected utility given by (3) with respect to b I(x); m(x); h(x); x 2 [0; a] and

P , subject to b I(0) = m(0) = 0, condition (2) and b I 0 (x) = 1 xv 0 (m(x)) u 0 (R(x)) h(x); (6) m 0 (x) = h(x); (7) h(x) 0 for all x; (8) b I(x) 0 for all x; (9)
This is an optimal control problem where b I(x) and m(x) are state variables and h(x) is a control variable. 11 Propositions 1, 2 and 3 and Corollaries 1 and 2 characterize the optimal solution to this problem as well as the corresponding indemnity schedule

I(m).
Proposition 1 The optimal mechanism is such that 0 < b I(x) < m(x) for all x > 0.

Proposition 2 Assume f (x) is non-increasing and ln f (x) is weakly convex. Then there exists x in (0; a] such that

0 < b I 0 (x) < m 0 (x) if 0 < x < x; b I(x) = b I(x); m(x) = m(x) if x < x a: Corollary 1 x = a if x is uniformly distributed over [0; a].
Corollary 2 Assume f (a) = f 0 (a) = 0, f 00 (a) > 0, and d ln f (x)=dx and d 2 ln f (x)=dx 2 remain …nite when x ! a. Then, we have x < a.

Proposition 1 states that the policyholder receives partial but positive compensation in all of the cases where she incurs care expenses. This is an intuitive result, since there is no reason to penalize a policyholder who would announce that her health health expenses are low (i.e., that x is close to 0). However, it sharply contrasts the ex ante moral hazard setting, since we know from Holmström (1979) that, in that case, a 11 We use Lemma 1-(ii) to restrict attention to functions b I(x) and m(x) that are continuous. Furthermore, b I(x) and m(x) are piecewise di¤erentiable because I(m) is piecewise di¤erentiable. This allows us to use Pontryagin's principle in the proof of Proposition 1. In this proof, it is shown that the optimal revelation mechanism is such that b I 0 (x) 0. Since m 0 (x) 0, the optimal mechanism will be generated by a non-decreasing indemnity schedule I(m), as we have assumed. Note that Blomqvist (1997) studies a similar optimization problem, but he wrongly ignores the second-order conditions (8) and the sign conditions (9). Nor does he fully consider the technical implications of the assumption v 0 (0) = +1, in the absence of which we would have a corner solution with m(x) = 0 for x small. straight deductible may be optimal, and more generally not indemnifying small claims may be part and parcel of an optimal insurance coverage. 12 The optimal contract trades o¤ risk-sharing and incentives to not overspend for medical services. According to Proposition 2, if f (x) is non-increasing and ln f (x) is weakly convex,13 then this trade-o¤ may tip in favor of the incentive e¤ect when x is large enough. If x is lower than x, then m(x) and b I(x) monotonically increase, with an increase in the out-of-pocket expenses m(x) b I(x), when x goes from 0 to x. When x x, there are ceilings m(x) and b I(x); respectively, for expenses and indemnity.

Corollaries 1 and 2 illustrate the two possible cases x = a (no bunching) and x < a (bunching), respectively. There is no bunching when the illness severity is uniformly distributed in the [0; a] interval. If the density function of x decreases to zero when x goes to a and is di¤erentiable at x = a, then Corollary 2 provides a su¢ cient condition for bunching to be optimal. In the …rst case, the probability of the highest severity levels remains large enough for the capping of expenditures and indemnities to be sub-optimal, while in the second case it is optimal. If we consider the di¤erentiability of density f (x) at the top as a natural assumption, then Corollary 2 provides support for upper limits in optimal insurance indemnity schedules.

In what follows, we provide detailed intuition for the possibility of bunching, and particularly for the reason why it occurs under the assumptions of Corollary 2. We may …rst observe that increasing b I(x) is a way to incentivize type x policyholders to report her health state truthfully (i.e., not to report e x > x) and also to improve her coverage. However, as highlighted in Lemma 1-iii, this can be done only by increasing m(x) in order to preserve the incentives of type x 0 policyholders for x 0 < x. This increase in m(x) will exacerbate the overexpense problem. Bunching occurs when the negative e¤ect of an increase in health care expenses outweighs the positive e¤ect of a more complete insurance coverage.

In order to understand this trade-o¤ more completely, let us consider the co-state variables 1 (x) and 2 (x), associated with b I(x) and m(x), respectively. The evolution laws of 1 (x) and 2 (x) are derived from optimal control theory, and they are used extensively in the proofs. They correspond to the …rst-order variations in the objective of the partial optimization problem limited to [x; a], following discontinuous small variations b

I(x) > 0; m(x) > 0. 14 A discontinuous increase in b I(x)
would be advantageous because it improves risk coverage and it corresponds to a relaxation of the upward incentive compatibility constraint (type x individuals have less incentive to report e x larger than x). Conversely, an upward discontinuous shift in m(x) would exacerbate the distortion between the marginal utility of wealth u 0 (R(x))

and the marginal utility of health expenses xv 0 (m(x)). It is therefore intuitive that

Lemma 1 shows that we should have

b I(x) m(x) = 1 xv 0 (m(x)) u 0 (R(x))
for such discontinuous upward variations to be approximated, as closely as we would like, by incentive compatible continuous trajectories b I(x) and m(x). Keeping in mind this link between feasible variations in b I(x) and m(x), let us denote

'(x) 1 (x) 1 xv 0 (m(x)) u 0 (R(x)) + 2 (x):
Function '(x) sums up the negative e¤ect of an increase in m(x) and the positive e¤ect of the induced increase in b I(x), weighted by 2 (x) and 1 (x), respectively, with 14 In more technical terms, we may de…ne the value function v(I 0 ; m 0 ; x) to be the greatest expected utility over [x; a], with unchanged insurance expected cost, if we start at b

I(x) = I 0 ; m(x) = m 0 . The vector of costates ( 1 (x); 2 (x))
is the gradient at x of the value function, evaluated along the optimal trajectory.

'(a) = 0. The previous intuitive reasoning suggests (and the proof con…rms) that an optimal solution should satisfy '(x) = 0 if h(x) > 0 and '(x)

0 if h(x) = 0. 15 In particular, if m 0 (x) = h(x) > 0 we have xv 0 (m(x)) < u 0 (R(x))
and thus b I 0 (x) > 0, which corresponds to the two possible regimes described in Proposition 2: m(x) and b I(x) are simultaneously increasing or stationary. Bunching occurs when the negative e¤ect of an increase in health expenses outweighs the gains from an increase in insurance coverage. More details are provided in the following remark.

Remark 1 To be more explicit about the conditions under which there is bunching,

let us assume x < a, with m(x) = m and R(x) = R when x 2 [x; a]. Then, it can be shown that 1 (x) 1 F (x) = u 0 (R) ; 2 (x) 1 F (x) = u 0 (R) + v 0 (m) Z a x t f (t) 1 F (x) dt; if x 2 [x; a],
where is the (positive) Lagrange multiplier associated with the insurer's break-even constraint (2). 16 Intuitively, when there is bunching, the trajectory

(R) tv 0 (m)] m(x) averaged over [x; a] according to the conditional density f (t)=[1 F (x)] .
Hence, for all x in [x; a], we have

'(x) = G(x)[1 F (x)];
15 '(x) is called a "switching function" in the optimal control terminology, because its sign determines the sign of the control. 16 These conditions can be deduced from the trajectories of 1 (x) and 2 (x).

where

G(x) = 1 xv 0 (m) u 0 (R) + v 0 (m) Z a x t f (t) 1 F (x) dt x :
When x is uniformly distributed, we have f (x) = 1=a; F (x) = x=a and '(x) is a second degree polynomial when x 2 [x; a]. To simplify things, assume that the control h(x) is continuous at x = x. 17 Then, the switching function '(x) is di¤erentiable at V ar[ln(x)] = 2 ; then ln f (x) is decreasing and convex when x exp(1 + 2 ) x 0 .

x = x, with '(x) = ' 0 (x) = 0, which is incompatible with '(a) = 0 when '(x)
In that case, b I(x) and m(x) are increasing in [x 0 ; x), and constant in [x; +1), with

x > x 0 . Similarly, the proof of Corollary 2 shows that bunching at the top is optimal without using the assumptions made in Proposition 2. In other words, these assumptions guarantee that there exists a threshold x such that bunching occurs if and only if

x x, but they are not required to show that there is bunching when x is large enough.

Proposition 3 Under the assumptions of Proposition 2, the optimal indemnity sched-17 The proofs do not require this assumption. 18 A similar but more complex argument is used in the proof of Proposition 2 to show that bunching cannot occur in intervals interior to [0; a].

ule I(m) is such that

I 0 (m) 2 (0; 1) if m 2 (0; m); I 0 (m) = 0 if x = a; I 0 (m) > 0 if x < a; I(m) = I(m) if m m;
where m = m(x): We have I 0 (0) 0 and lim

m!0 mv 00 (m)=v 0 (m) < 1 is a su¢ cient condition for I 0 (0) > 0.
The characterization of the indemnity schedule I(m) provided in Proposition 3 is

derived from I(m(x)) b I(x)
, which gives

I 0 (m) = b I 0 (x) m 0 (x) = 1 xv 0 (m(x)) u 0 (R(x)) < 1; if m = m(x) and 0 < x < x.
If there is no bunching, then there is no distortion at the top, i.e., the marginal bene…t drawn from health care expenses is equal to the marginal utility of wealth: this corresponds to u 0 (R) xv 0 (m) = 0, and thus I 0 (m) = 0. We have I 0 (m) > 0 in the case of bunching.

Hence, the indemnity schedule has a slope between 0 and 1 in its increasing part.

At the bottom, there is no deductible, contrary to case of ex ante moral hazard. At

(m) = u 0 (R), with R = R(a)
. This corresponds 19 In practice, the optimal policy could be approximated by a piecewise linear schedule with slope between 0 and 1 until the upper limit m and with a capped indemnity when m > m. It would be interesting to estimate the welfare loss associated with this piecewise linearization. The simulations presented in Section 3.3 suggest that this loss may be low.

to the absence of distortion at the top of the interval [0; a] when there is no bunching, a property shared by other principal-agent models with hidden information and riskaverse agent, such as Salanié (1990) and La¤ont-Rochet (1998).

Propositions 2 and 3 justify the existence of a cap on indemnity I(m), but they also show that medical expenses should not increase in illness severity after the reimbursement ceiling is reached. Intuitively, if b I(x) is constant and m(x) increases when x is large, then slightly perturbing the trajectory b I(x) so that it is monotonically increasing, with a compensating increase in premium P , would improve risk sharing while preserving incentive compatibility. In other words, the pro…les of medical expenses and insurance indemnities move simultaneously, and placing a ceiling on insurance indemnities only makes sense because medical expenses are also capped. 20

Simulations

Simulations are performed by transforming the in…nite dimensional optimal control problem into a …nite dimensional optimization problem, through a discretization of

x, applied to the state and control variables, as well as the dynamic equations. 21 We assume that x is distributed over [0; 10] (that is, a = 10), either exponentially, i.e., f (x) = e x +e a =a, with = 0:25, 22 or uniformly, i.e., f (x) = 1=a. We also assume

v(m) = p m=[1 + p m]
, with = 0:2 and utility is CARA: u(R) = e sR , with s = 10.

The numerical solver leads to optimal functions b I(x) and m(x) -and also to h(x) and Bonnans et al., 2016, and http://bocop.org). We refer the reader to Appendix 2-A and, for instance, to Betts (2001) and Nocedal and Wright (1999) for more details on direct transcription methods and non-linear programming algorithms. 22 Note that f (a) and f 0 (a) are close to 0 when a is large.

the (m; I) space for x 2 f0:3; 7; 9g when x is uniformly distributed. Parameters and k will be introduced later: they correspond to a loading factor and to the intensity of a background risk, respectively. Here, both are equal to 0, since there is no loading and no background risk. The optimal type x indi¤erence curve is tangent to the indemnity in both cases, the optimal expenses are equal to m. As in Figure 1, we have I 0 (0) > 0. for all x 2 [0; a]; and (iii) : there is audit when x > x = inffx : m(x) > m g.

For the sake of realism, we restrict attention to (piecewise di¤erentiable) continuous functions I(m) such that I 0 (m) 1 if m m , although, as we will see, an upward discontinuity of I(m) at m = m would be optimal. 25 We denote g(x) b I 0 (x) when 23 More generally, the insurer could randomly audit claims, the probability of triggering an audit depending on the size of the claim. See the references in Picard (2013) on deterministic and random auditing for insurance claims. 24 The policyholder is subject to prior authorization for increasing her medical expenses above m .

After auditing the health state, this authorization will be granted but capped by m(x) if x > x , and otherwise it will be denied. 25 Since an upward discontinuity of I(m) at m = m dominates the optimal solution when I(m) is constrained to be continuous, increasing I(m) as much as possible in a small interval (m ; m + ")

would bring the continuous function I(m) arbitrarily close to this discontinuous function. No optimal solution would exist in the set of continuous functions I(m). Thus, in addition to being realistic from an empirical point of view, the assumption I 0 (m) 1 if m m eliminates this reason for which an optimal solution may not exist. As previously shown, we have I 0 (m) < 1 in the no-audit regime where m < m .

x > x , and, as previously, h(x) = m 0 (x) for all x. The optimization problem is written as

max Z a 0 n u(w P + b I(x) m(x)) + h 0 x[1 v(m(x))] o f (x)dx
with respect to b I(x); m(x); g(x); h(x); x 2 [0; a]; and P , subject to b I(0) = 0;(7) and ( 9) for all x, (6) and ( 8) if x x , and

b I 0 (x) = g(x) if x > x ;
(10)

0 g(x) h(x) if x > x ; (11)
P = Z x 0 b I(x)f (x)dx + Z a x [ b I(x) + c]f (x)dx : (12)
Condition ( 11) follows directly from 0 I 0 (m) 1 when m m since I 0 (m(x)) = b I 0 (x)=m 0 (x) = g(x)=h(x). Now, we have an optimal control problem with two regimes, according to whether x is smaller or larger than x and where g(x) is a new control variable when x > x . 26 In the …rst stage, we will characterize the optimal trajectory b I(x); m(x) over the interval (x ; a], for a given trajectory b I(x); m(x) over [0; x ] and for given values of P and x . In the second stage, we will solve for the optimal trajectory b I(x); m(x); x 2 [0; x ] and for the optimal values of P and x , given the characterization of the optimal continuation trajectory.

Let I = b I(x ) and m = m(x ), with I m . For f b I(x); m(x); x 2 [0; x ]g; P and x given and such that

P Z x 0 b I(x)f (x)dx + (I + c)[1 F (x )]; (13)
u 0 (w P m + I ) x v 0 (m ): (14)
f b I(x); m(x); g(x); h(x), x 2 (x ; a]g maximizes Z a x n u(w P + b I(x) m(x)) + h 0 x[1 v(m(x))] o f (x)dx; (15)
subject to ( 7), ( 10)-( 12). This is a subproblem restricted to x 2 (x ; a]. Note that b I(x) = I ; m(x) = m ; g(x) = 0; h(x) = 0 for all x 2 (x ; a] is a feasible solution to this subproblem because of (13). Conversely, (13) holds for any solution such that g(x) = b I 0 (x) 0 for all x 2 (x ; a]. Furthermore, we have

u 0 (w P m(x) + I(m(x))[1 I 0 (m(x))] xv 0 (m(x)) = 0;
for all x x . Using I 0 (m) 1 for all m gives:

u 0 (w P m(x) + I(m(x)) xv 0 (m(x)) 0;
and using m = m(x ) implies ( 14). Thus, we may characterize the optimal solution to this subproblem by assuming ( 13) and ( 14) without further loss of generality.

Lemma 2 When x ; m ; P and I satisfy ( 13) and ( 14), the optimal continuation allocation is such that x 2 [x ; a]: these values correspond to the largest health expenses, and thus to the cases where the marginal utility of wealth is the largest. In the lowest part of the interval, i.e., when x < e x, not increasing health expenses may be optimal. Lemma 2 also states that the optimal insurance contract provides full coverage at the margin, that is b

b I 0 (x) = m 0 (x) = 0 if x 2 [x ; e x]; b I 0 (x) = 0; m 0 (x) = v 0 (m(x)) xv 00 (m(x)) + u 00 (R(x)) if x 2 [e x; b x]; b I 0 (x) = m 0 (x) = v 0 (m(x)) xv 00 (m(x)) if x
I 0 (x) = m 0 (x), when x > b x.
There is nothing astonishing here: in the case of an audit, there is no more asymmetry of information, and the policyholder should be fully compensated for any increase in her insurable losses. 27 Lemma 2 states that three regimes may potentially exist in the restricted problem: b I 0 (x) = m 0 (x) = 0 when x < x e x; b I 0 (x) = 0; m 0 (x) > 0 when e x < x b x; and b I 0 (x) > 0; m 0 (x) > 0 when b

x < x < a. However, if the two …rst regimes were part and parcel of the globally optimal solution, i.e., if x < e x and/or e x < b x, then a costly audit woud be performed when x 2 (x ; b x], although the same insurance indemnity I is paid when the policyholder chooses m 2 (m ; m(b x)) than when she choses m . This would be obviously suboptimal. In other words, a globally optimal allocation should be such that x = b x, because auditing is useless if the indemnity does not increase above the maximum I that can be reached in the no-audit regime.

Let V (m ; I ; x ; P; A) be the value of the integral (15) at an optimal continuation equilibrium, where

A = Z x 0 b I(x)f (x)dx: (16)
27 See Gollier (1987) and Bond and Crocker (1997) for similar results; see also Picard (2013) for a survey on deterministic auditing in insurance fraud models. Lemma 2 also characterizes the optimal health expenses pro…le m(x) when there is auditing and full insurance at the margin (that is when

x > b x): we have m 0 (x) = v 0 (m(x))=xv 00 (m(x))
, which means that the increase in health expenses which follows a unit increase in the illness severity x is equal to the inverse of the elasticity of the marginal e¢ ciency of health expenses v 0 (m(x)). Equivalently, the marginal utility of health care expenses xv 0 (m(x)) should remain constant in the auditing regime.

Our global optimization problem can be rewritten as max 9) and ( 16). The optimal solution to this problem and the corresponding indemnity schedules are characterized as follows.

Z x 0 n u(w P + b I(x) m(x)) + h 0 x[1 v(m(x))] o f (
Proposition 4 The optimal mechanism with audit is such that x > 0, with

b I 0 (x) = m 0 (x) > 0 if x 2 (x ; a];
and with an upward discontinuity of b I(x) and m(x) at x = x . Furthermore, under the same assumptions as Proposition 2, there is x 2 (0; x ] such that

0 < b I 0 (x) < m 0 (x) if 0 x < x; b I(x) = b I(x); m(x) = m(x) if x < x x :
Proposition 5 Under the same assumptions as Proposition 2, the optimal indemnity schedule with audit is such that m = m m(x) > 0, and

I 0 (m) 2 (0; 1) if m 2 (0; m); I 0 (m) = 1 if m > m:
Propositions 4 and 5 show that auditing allows the insurer to o¤er a protective shield that limits the policyholder's copayment m(x) b I(x). This copayment increases with the expenses when there is no audit, and it reaches an out-of-pocket maximum There is full insurance at the margin, that is I 0 (m) = 1 when m m , with a limit of out-of-pocket expenses equal to m I(m ). In Figure 3 The dependency between the threshold x and the audit cost c is simulated in Figure 4. As expected, the larger the audit cost, the larger the threshold above which it is optimal to audit health care expenses.

Figures 3 and4 5 Alternative models and robustness

The previous sections have shown how optimal insurance under ex post moral hazard involves partial coverage at the margin, no deductible and, possibly, an upper limit on medical care expenses and coverage, as long as an audit of the patient's health state is not required. This section exlores the robustness of these conclusions by considering alternative modeling options. For the sake of brevity, we will limit ourselves here to the most simple model of sections 2 and 3, without auditing. Dependency between threshold x* and audit cost c

Correlated background risk

Let us …rst consider the case where the health level a¤ects monetary income through an uninsurable background risk. 30 We assume that illness severity x randomly reduces the monetary wealth by an amount ". G(" j x) denotes the c.d.f. of ", conditionally on x and we assume G 0 x (" j x) < 0, where subscript x refers to the partial derivative.31 Thus, an increase in the illness severity level x shifts the distribution function of " in the sense of …rst-order dominance. Now, the individual's utility is written as u(R ") + H, where R denotes the monetary wealth excluding the background risk, and we have

V (x; e x) = u(R(e x); x) + h 0 x[1 v(m(e x))];
still with R(e x) w P + b I(e x) m(e x), where u(R; x)

Z +1 0 u(R ")dG(" j x):
Thus, the utility of wealth is now written as a state dependent function u(R; x), with u 0 R > 0; u 00 R 2 < 0; u 0 x < 0 and u 00 Rx > 0. Lemma 2 straightforwardly extends Lemma 1 to this case.

Lemma 3 Under correlated background risk, the direct revelation mechanism fm(:); b I(:)g

is incentive compatible if and only if b I 0 (x) = 1 xv 0 (m(x)) u 0 R (R(x); x) m 0 (x); m 0 (x) 0;
for all x 2 [0; a], with R(x) w P + b I(x) m(x).

Thus, the necessary and su¢ cient conditions for incentive compatibility are almost unchanged: we just have to replace u(R) with the state-dependent utility u(R; x).

Proposition 1, 2 and 3 can be adapted to the case where the individual incurs a correlated background risk, with unchanged conclusion, i.e., the fact that the optimal indemnity schedule does not include a deductible and that bunching at the top may be optimal. Corollary 2 is still valid, but not Corollary 1. In other words, bunching may now be optimal when x is uniformly distributed. Indeed, simulations show that correlated background risk reinforces the likelihood of bunching. We simulate the optimal contract under the assumption " kx=(a x) = "(x) and u(R(x); ") = u(R(x) "(x));where parameter k measures the intensity of the background risk.

Figure 5 illustrates a case where k = 0:01 with bunching for the optimal contract. 32

Non-separable utility

We now turn to the case where U (R; H) may be non-separable between R and H. 33 It is assumed that U (R; H) is increasing with respect to R and H and concave. We

thus have U 0 R > 0; U 0 H > 0; U 00 R 2 < 0; U 00 H 2 < 0 and U 00 R 2 U 00 H 2 U 002 RH > 0.
We also assume U 00 HR > 0, 34 and we denote (R; H) U 0 H =U 0 R the marginal rate of substitution between monetary wealth and health, with

0 R = U 00 HR U 0 R U 0 H U 00 R 2 U 02 R > 0; 0 H = U 00 H 2 U 0 R U 0 H U 00 HR U 02 R < 0:
32 In Figure 5-top, indi¤erence curves for x = 7 and 9 almost coincide. Figure 5-bottom shows that m decreases when k increases, with a decrease in the upper limit of the insurance indemnity I(m).

There is bunching only when k > 0 since Figure 5 corresponds to the case of uniform distribution. 33 Henceforth, we assume there is no background risk. 34 U 00 HR > 0 is assumed for the sake of simplicity. Lemma 3 is valid under more general conditions that are compatible with U 00 HR 0.

Figure 5

Uniform distribution

Case where the background risk creates bunching

Thus, the individual is more willing to pay for a marginal improvement in her health level when her income is higher and when her health level is lower. We now have

I 0 (x) = [1 xv 0 (m(x)) (R(x); H(x))] h(x): (19)
We have simulated the non-separable utility case with U (R;

H) = (b 0 R 1 1 +b 1 )H . 35
The optimal indemnity schedule remains qualitatively similar to the characterization provided in Section 2. Figure 6-top illustrates the case of an exponential distribution with bunching. 36

Figure 6

Non-separable utility -Exponential distribution

Insurance loading

In practice, insurance pricing includes a loading that re ‡ects various underwriting costs, including commissions to agents and brokers, operating expenses, loss adjustment expenses and capital cost. Let us assume that the premium is loaded at rate , which gives

P = (1 + ) Z a 0 b I(x)f (x)dx; (20)
instead of (2). As initially established by Arrow (1971), the optimal contract contains a straight deductible when there is a positive constant loading factor. Propositions 6 and 7 extend this characterization to the case of ex post moral hazard.

Proposition 6 Under constant positive loading and with the same assumptions as Proposition 2, the optimal indemnity schedule without auditing includes a deductible D > 0 and an upper limit I(m), that is

I(m) = 0 if m D; I 0 (D) 2 [0; 1); I 0 (m) 2 (0; 1) if m 2 [D; m); I(m) = I(m) if m m; I 0 (m) = 0 if x = a; I 0 (m) > 0 if x < a:
Corollary 3 Under the same assumptions as Corollary 1, we have x = a, i.e., there is no bunching.

Corollary 4 Under the same assumptions as Corollary 2, we have x < a, i.e., there is bunching. So far, we have assumed that all patients have identical wealth w. From a normative standpoint, this refers either to an unrealistic world where social inequality does not exist, or to a case where policy instruments allow the government to design health insurance and income redistribution independently. More realistically, the literature on optimal taxation highlights that income redistribution is limited by incentive compatibility and informational constraints. This leads to the persistence of wealth inequalities that may a¤ect how health insurance should be designed.

Analyzing a fully- ‡edged integrated public policy, with interaction between income redistribution and health care insurance coverage, would go far beyond the objectives of this paper. We may nevertheless draw upon our model to sketch out how income inequalities may a¤ect our conclusions. A possible approach consists in assuming that there are several groups of policyholders indexed by i = 1; :::; n, with initial wealth w i in group i and identical health risk exposures and risk preference. In other words, all groups are identical, except as regards initial wealth. Let i 0 be the fraction of type i individuals in the population, with P n i=1 i = 1. Initial wealth w i is assumed to be perfectly observable and health insurance is provided through group-speci…c insurance contracts, with indemnity schedule I i (m), premium P i and state dependent indemnity b I i (x) and health expenses m i (x) for group i. The government can cross-subsidize insurance contracts through net subsidies s i per type i policyholder, s i being a tax if s i < 0, while meeting a budget constraint

P n i=1 i s i = B;
where B denotes the amount of …nancial resources allocated by the government to health insurance, possibly with B = 0. The insurer's break-even condition for group i is written as

e P i Z a 0 b I i (x)f (x)dx:
where e P i = P i + s i , and the net income of type i policyholders with health expenses m is written as

R i = w i P i m + I i (m) = e w i e P i m + I i (m);
where e w i = w i + s i . Hence, for given net subsidies s i , everything happens as if type i policyholders purchase optimal insurance at actuarial price e P i with adjusted net wealth e w i = w i +s i . The limits to income redistribution are not analyzed here and they lead to heterogeneous adjusted net wealth levels e w i among the groups i = 1; :::; n. Thus, when income redistribution is endogenously de…ned by net subsidies s i , analyzing the e¤ects of incomplete income redistribution on health insurance boils down to considering the relationship between adjusted net wealth and optimal health coverage.

The e¤ects of wealth on optimal health insurance under ex post moral hazard go through several mechanisms that are di¢ cult to disentangle. Firstly, the degree of risk aversion may be a¤ected by wealth, and in particular under the DARA assumption, higher wealth involves a lower absolute risk aversion and thus, a larger propensity to purchase insurance. Secondly, larger wealth induces larger marginal willingness to pay for health care, which is re ‡ected in higher health expenses for any health state, and thus in higher risk exposure. This also justi…es paying a higher insurance premium, without an obvious predictable conclusion on the shape of the indemnity schedule.

Thirdly, in an ex post moral setting, decreasing the insurance coverage acts as a selfdiscipline device to moderate health expenses, which may be ultimately bene…cial to wealthy policyholders since they have a high propensity to spend money for health care. These e¤ects interact in a complex way, and we have to rely on simulations to draw some conclusions. Figures 8 and9 illustrate the optimal health expenses functions m(x) and the optimal indemnity schedule I(m) for various levels of initial wealth. 37 Figure 8 shows that increasing the initial wealth shifts the graph of m(x)

upwards: for a given health state x, the larger the initial net wealth w, the larger the expenditure for health care m(x). This is not astonishing since an increase in wealth goes along with an increase in the marginal willingness to pay for health care. As shown in Figure 9, 38 the increase in wealth has very little impact on the indemnity schedule: increasing initial wealth slightly shifts the graph of function I(m) upwards, but this impact is barely noticeable, particularly for low expense levels. 39 Figures 8 and 9

Although these simulations should not be overinterpreted, they suggest that the redistributive objective of public policy should be focused on direct transfers to individuals (through the net subsidy s i to each group i) rather than by di¤erentiating the reimbursement of medical expenses. In other words, this leads to the speculation that combining a unique reimbursement schedule with di¤erentiated direct transfers to individuals may adequately approximate the optimal strategy of a government with redistributive objective. Assessing the validity of this conjecture would require a detailed analysis, where the optimal design of health insurance and income redistribution would be simultaneously considered.

Agency relationship between physician and patient

We have reduced attention to a simple setting where the patient is perfectly well informed about her health state and where health care providers act as "perfect agents"

with the only objective of maximizing the patient's utility. In practice, the asymmetry of information between patient and insurer may be combined with a physician-patient 37 Figures 8 and 9 correspond to the assumptions made in Section 3.3 without loading or background risk, when the distribution of x is exponential. 38 The indi¤erence curves are drawn for x = 2 in Figure 9. 39 See Picard (2016) for a case with linear coinsurance where this e¤ect of wealth on the coinsurance rate vanishes completely. Let us sketch an extension of our analysis that illustrates the e¤ects of the physicianpatient agency relationship. Assume that only a part q(m) of total medical expenses m is really useful, with 0 < q(m) < m and q 0 (m) > 0. The complement m q(m) corresponds to e¢ ciency losses induced by imperfect monitoring of health care providers.

Assume q 00 (m) > 0. Hence q(m)=m is increasing, which expresses the idea that, in proportion to total medical costs, excessive expenses mainly correspond to an excessive number of minor medical acts. 40 The policyholder's utility is written by substituting v(q(m)) to v(m) in the policyholder's expected utility. All the other assumptions of The locus of function v(m ) is drawn in Figure 10. It highlights the increase in the e¢ ciency loss when > 1, by comparison with the benchmark case = 1. Figure 10 also illustrates the fact that v(m ) is no longer concave when is large enough (equal to 3 or 4). Figures 11 and12 show that the ine¢ ciency of small medical expenses leads to reduce these expenses and the corresponding insurance coverage (and even to fully cancel them when x is small and is equal to 3 or 4) 42 and to increase expenses 40 This is just an assumption made for illustrative purposes. 41 The relevant values are such m < 1, and thus q(m) = m < m. 42 This corner solution is induced by the non concavity of v(m ) when = 3 and 4. Indemnity schedule with agency costs and coverage when x is large. Figure 13 shows that changes in parameter induce relatively small shifts in the indemnity schedule I(m).

Conclusion

Using demand management to mitigate the consequences of ex post moral hazard in medical insurance goes through an adequate de…nition of the indemnity schedule.

Under reasonable assumptions, it has been shown that the optimal solution mixes partial coverage at the margin and an upper limit to coverage under the form of bunching: the most acute types of illness severity lead to the same expenses and to the same insurance indemnity. Our second main result is about the optimality of a deductible. A deductible may be optimal only if the insurer charges loaded premiums.

In other words, deductibles should not be part of the solution to the incentive-risk sharing trade-o¤ in itself. They are the consequence of transaction costs re ‡ected in an insurance loading factor, and they re ‡ect the level of these costs. This is an important di¤erence between ex post and ex ante moral hazard. Finally, we have immersed our ex post moral hazard problem in a costly state veri…cation setting where the insurer can monitor the health expenses through auditing. We have shown that there should be coinsurance at the margin, and possibly an upper limit to coverage, when the sickness severity is lower than a threshold under which there is no audit. When the sickness severity crosses this limit, then it is optimal to audit the health state, with an upward jump in care expenses. In this regime, there is full insurance at the margin, which corresponds to an out-of-pocket maximum.

Overall, this analysis reveals a contrasting picture of the way health expenses should be reimbursed by insurers. On the one hand, there are limits to coverage for low expenses under the combination of coinsurance, upper limit and deductible. On the other hand, the largest expenses should be more generously covered, with upper limits to out-of-pocket expenses. This complexity re ‡ects what we frequently observe in the real world when all these ingredients are mixed, with more complete coverage and outof-pocket maximum, for large easily monitorable categories such as surgery or other forms of inpatient care, and coinsurance or upper limits that aim to contain health spending for minor illnesses. 43 Appendix 1

Proof of Lemma 1

Step 1: There exists an optimal revelation mechanism.

Let us change variables by denoting

A(x) = u(w P + b I(x) m(x)) and B(x) = v(m(x)
). The incentive compatibility constraints and the insurer's break-even constraint are respectively rewritten as Let

A(x) + xB(x) A(e x) + xB(e x) for all x; e x; (21) w Z
a 0 [u 1 (A(x)) + v 1 (B(x)]f (x)dx; (22)
J = Z a 0 fA(x) + h 0 x[1 B(x)]gf (x)dx:
J is a linear (and thus weakly concave) function of A(:); B(:). Hence, it reaches a maximum in S, which proves the existence of an optimal incentive compatible mechanism, with P = w u 1 (A(0)).

Step 2: For any incentive compatible mechanism, m(x) and b I(x) are non-decreasing: Step 3: For any optimal revelation mechanism, m(:) and b I(:) are continuous.

Let fm 0 (:); b I 0 (:)g be an optimal incentive compatible revelation mechanism and suppose that m 0 (:) is rightward discontinuous 44 at x 2 (0; a), with m 0 (x) ! m 0 (x ) + 44 A similar proof applies to the case of leftward discontinuity.

Let e x 1 (x) be an optimal report of a type x policyholder in fm 1 (:); b I 1 (:)g, with e

x 1 (x) = x for all x 2 [0; x + ), and let fm 2 (:); b I 2 (:)g be the incentive compatible revelation mechanism de…ned by m 2 (x) m 1 (e x 1 (x)); b I 2 (x) b I 1 (e x 1 (x)). For P unchanged, the policyholder's expected utility is higher for fm 2 (:); b I 2 (:)g than for fm 0 (:); b I 0 (:)g.

Furthermore, b I 2 (x) = b I 0 (x) if x < x , b I 2 (x) = I 1 < b I 0 (x) I =4 if x x < x + and b I 2 (x) b I 0 (x) if x x + .
Hence, fm 2 (:); b I 2 (:)g is feasible with P unchanged, which contradicts the optimality of fm 0 (:); b I 0 (:)g.

Step 4: (4) and ( 5) are necessary and su¢ cient conditions for a continuous revelation mechanism to be incentive compatible.

Local …rst-order and second-order incentive compatibility conditions for type x are written respectively as @V (x; e x) @e x j e x=x = 0;

@ 2 V (x; e x) @e x 2 j e x=x 0;

(24) at any point of di¤erentiability. ( 23) and ( 24) are necessary conditions for incentive compatibility. We have @V (x; e x) @e x = u 0 (R(e x))[ b I 0 (e x) m 0 (e x)] + xv 0 (m(e x))m 0 (e x);

and thus ( 23) yields (4).

Since (4) should hold for all x 2 [0; a], a simple calculation yields @ 2 V (x; e x) @e x 2 j e x=x = v 0 (m(x))m 0 (x);

and thus (24) gives (5).

Conversely, assume (4) and ( 5) hold. (4) gives @V (x; e x) @e x = (x e x)v 0 (m(e x))m 0 (e x):

Using (5) then shows that @V (x; e x)=@e x 0 if e x > x and @V (x; e x)=@e x 0 if e x < x, which implies incentive compatibility.

Proof of Proposition 1

Let 1 (x) and 2 (x) be costate variables for b I(x) and m(x) respectively, and let and (x) be Lagrange multipliers respectively for (2) and ( 9). The Hamiltonian is written as

H = [u(R(x)) + xv(m(x))]f (x) + 1 (x)h(x) 1 xv 0 (m(x)) u 0 (R(x)) + 2 (x)h(x) b I(x)f (x) + (x) b I(x):
The optimality conditions are

'(x) 1 (x) 1 xv 0 (m(x)) u 0 (R(x)) + 2 (x) 0; = 0 if h(x) > 0; (25) 0 1 (x) = [ u 0 (R(x))]f (x) 1 (x)h(x) x v 0 (m(x))u 00 (R(x)) u 0 (R(x)) 2 (x); (26) 0 2 (x) = [u 0 (R(x)) xv 0 (m(x))]f (x) + 1 (x)h(x) x v 00 (m(x))u 0 (R(x)) + v 0 (m(x))u 00 (R(x)) u 0 (R(x)) 2 ; (27) 1 (a) = 2 (a) = 0; (28) Z a 0 u 0 (R(x))f (x) + 1 (x)h(x) x v 0 (m(x))u 00 (R(x)) u 0 (R(x)) 2 dx = 0; (29)
with (x) 0 and (x) = 0 if b I(x) > 0. A tedious but straightforward calculation using ( 26) and ( 27) leads to

' 0 (x) = [ f (x) (x)] 1 xv 0 (m(x)) u 0 (R(x)) 1 (x) v 0 (m(x)) u 0 (R(x)) : (30)
We also have R 0

(x) = b I 0 (x) m 0 (x) = xh(x)v 0 (m(x))=u 0 (R(x)) 0. Thus, R(x) is
non-increasing, and it is decreasing when h(x) > 0. The remaining part of the proof is in …ve steps.

Step 1: m(x) > 0 for all x > 0.

Since m(0) = 0 and m(x) is non-decreasing, there exists The revelation mechanism m 1 (:); b I 1 (:) de…ned by m 1 (x) m 0 (x 0 (x)) and b I 1 (x)

I 0 (x 0 (x))
is incentive compatible and it dominates the supposed optimal mechanism m(:); b I(:) -i.e., it provides a higher expected utility to the policyholder and its expected pro…t is non-negative for P unchanged -, hence a contradiction. Thus, x = 0.

Step 2:

1 (x) is continuous in [0; a] with 1 (x) = 0 if b I(x) = 0.
Let x 0 2 (0; a) be a junction point such that b I(x) = 0 if x 2 (x 0 "; x 0 ] and b I(x) > 0 if x 2 (x 0 ; x 0 + "), with 0 < " < x 0 . 45 Using the same argument as in Step 1 shows that h(x) > 0 in (x 0 "; x 0 ). Let x 2 (x 0 "; x 0 ). Using h(x) > 0; b I 0 (x) = 0 and (6) gives u 0 (R(x)) = xv 0 (m(x)). Then, '(x) = 0 gives 2 (x) = 0 and thus 0 2 (x) = 0 for all x 2 (x 0 "; x 0 ]. (30) implies 1 (x) = 0 for all x 2 (x 0 "; x 0 ), and this is true, more generally, for all x 2 [0; a] such that b I(x) = 0.

Let x 2 (x 0 ; x 0 + "). b I(x) is locally increasing over (x 0 ; x 0 + ") and thus b I 0 (x) > 0 and h(x) > 0 (at least for " small enough). Thus, we have (x) = '(x) = ' 0 (x) = 0 for all x 2 (x 0 ; x 0 + "). Since R(x) and m(x) are continuous functions and u 0 (R(x 0 )) =

x 0 v 0 (m(x 0 )), we have u 0 (R(x)) xv 0 (m(x)) ! 0 when x & x 0 . Using (30) then gives 1 (x 0 ) + = 0. Thus, 1 (x) is continuous at x 0 .

45 In optimal control problems with state variable constraints, the costate variable may be discontinuous at junctions between regimes where the constraint is binding or not binding; see for instance Section 7.6 in Beavis and Dobbs (1991). Here, 1 (x) may be discontinuous at junction points between intervals where b I(x) = 0 and intervals where b I(x) > 0. The proof is almost the same if the junction point is such that b I(x) > 0 if x 2 (x 0 "; x 0 ] and b I(x) = 0 if x 2 (x 0 ; x 0 + ").

Step 3: 1 (x) 0 for all x 2 [0; a].

Integrating 0 1 (x) given by ( 26) and using ( 28) and ( 29) give

1 (0) = Z a 0 (x)dx 0:
Suppose there exist x 0 ; x 1 2 [0; a] such that x 0 < x 1 ; 1 (x 0 ) = 1 (x 1 ) = 0 and 1 (x) < 0 if x 2 (x 0 ; x 1 ). Thus, from

Step 2, we have I(x) > 0 and (x) = 0 if x 2 (x 0 ; x 1 ). For 0 > 0 small enough, we have 0 1 (x 0 + 0 ) < 0 and (x 0 + 0 ) = 0. Hence ( 26) gives

[ u 0 (R(x))]f (x) < 1 (x)h(x) x v 0 (m(x))u 00 (R(x)) u 0 (R(x)) 2
for x = x 0 + 0 . The previous inequality holds when 0 & 0. Since 1 (x) is continuous and 1 (x 0 ) = 0, we deduce u 0 (R(x 0 )) :

By a similar argument, for 1 > 0 small enough, we have 0 1 (x 1 1 ) > 0 and (x 1 1 ) = 0. Thus ( 26) gives

[ u 0 (R(x))]f (x) > 1 (x)h(x) x v 0 (m(x))u 00 (R(x)) u 0 (R(x)) 2 > 0;
for x = x 1 1 . The previous inequality holds when 1 & 0, which implies > u 0 (R(x 1 )). Thus, we have u 0 (R(x 0 )) > u 0 (R(x 1 )). Since u 00 < 0, we deduce R(x 0 ) < R(x 1 ); which contradicts R 0 (x) 0 and x 0 < x 1 .

Step 4: b I 0 (x) 0 for all x 2 [0; a].

Suppose b I(x) > 0 and b I 0 (x) < 0 if x 2 [x 0 ; x 1 ] (0; a] with x 0 < x 1 . ( 6) and (8) yield h(x) > 0 -and thus '(x) = 0 -and xv 0 (m(x))

> u 0 (R(x)) if x 2 [x 0 ; x 1 ]. We also have (x) = 0; 1 (x) 0 if x 2 [x 0 ; x 1 ]. Hence (30) gives ' 0 (x) < 0 if x 2 [x 0 ; x 1 ], which contradicts '(x) 0 in [x 0 ; x 1 ]. Thus, b I(x) is non-decreasing over [0; a].
Step 5: b I(x) > 0 for all x 2 (0; a].

Step 4 implies that there exists x 0 in [0; a] such that b

I(x) = 0 if x 2 [0; x 0 ] and b I(x) > 0 if x 2 (x 0 ; a]. Suppose x 0 > 0. From
Step 2, we have 1 (x) = 0 for all x 2 [0; x 0 ], and We know from ( 6) and ( 7) that b I 0 (x) < m 0 (x) when m 0 (x) > 0, and thus Steps 1 and 5 prove Proposition 1.

1 (0) =
Figure 8 illustrates the simulated trajectories of 1 (x) and 2 (x) under the calibration hypothesis introduced in Section 3.3, in the case of an exponential distribution function.

Figure 14

Proof of Proposition 2

Suppose there are x 1 ; x

2 ; x 3 in [0; a] such that x 1 < x 2 < x 3 ; h(x) = 0 if x 2 [x 1 ; x 2 ]
and h(x) > 0 if x 2 (x 2 ; x 3 ]: Thus, m(x) and I(x) remain constant over [x 1 ; x 2 ], and we may write m(x) = m 0 > 0; I(x) = I 0 > 0 and R(x) = w P + I 0 m 0 = R 0 in this interval. Let '(x) be de…ned as in the proof of Proposition 1. Using ( 26), ( 30)

and (x) = h(x) = 0 if x 2 [x 1 ; x 2 ] yields ' 0 (x) = [1 xv 0 (m 0 ) u 0 (R 0 ) ]f (x) 1 (x) v 0 (m 0 ) u 0 (R 0 ) ; (32)
and

' 00 (x) = [1 xv 0 (m 0 ) u 0 (R 0 ) ]f 0 (x) v 0 (m 0 ) u 0 (R 0 ) [ f (x) + 0 1 (x)] = [1 xv 0 (m 0 ) u 0 (R 0 ) ]f 0 (x) v 0 (m 0 ) u 0 (R 0 ) [2 u 0 (R 0 )]f (x); if x 2 [x 1 ; x 2 ]: Let (x) ' 00 (x) f (x) = [1 xv 0 (m 0 ) u 0 (R 0 ) ] d ln f (x) dx v 0 (m 0 ) u 0 (R 0 ) [2 u 0 (R 0 )];
Figure 14

Trajectories of co-state variables

We have

0 (x) = v 0 (m 0 ) u 0 (R 0 ) d ln f (x) dx + [1 x v 0 (m 0 ) u 0 (R 0 ) ] d 2 ln f (x) dx 2 :
We also have '(x) 0 if x 2 [x 1 ; x 2 ] and '(x 2 ) = 0, which implies ' 0 (x 2 ) 0.

(30), (x 2 ) = 0 and 1 (x 2 ) > 047 give x 2 v 0 (m 0 ) u 0 (R 0 ). If df (x)=dx 0 and

d 2 ln f (x)=dx 2 0, then we have 0 (x) 0 if x x 2 . Suppose there is x 4 2 [0; x 2 ] such that '(x 4 ) = 0 and h(x) = 0 for all x 2 [x 4 ; x 2 ]. Since '(x) = 0 for all x 2 [x 2 ; x 3 ],
we have ' 00 (x 2 ) + = 0. Since I 0 > 0, 1 (x) is di¤erentiable at x = x 2 . Thus, using ( 30)

and (x) = 0 if x 2 [x 1 ; x 2 ] allows us to write ' 00 (x 2 ) = ' 00 (x 2 ) + + [ f (x 2 )x 2 + 1 (x 2 )] d dx v 0 (m(x)) u 0 (R(x)) jx=x 2 + < 0: (x 2 ) < 0 and 0 (x) 0 then yield ' 00 (x) < 0 for all x 2 [x 4 ; x 2 ]. Since '(x 2 ) = 0
and ' 0 (x 2 ) 0, we have '(x) < 0 for x < x 2 ; x close to x 2 . Since '(x 2 ) = '(x 4 ) = 0, there is x 5 2 (x 4 ; x 2 ) where '(x) has a local minimum, and thus such that ' 00 (x 5 ) 0, which contradicts ' 00 (x) < 0 for all x 2 [x 4 ; x 2 ]: Thus, '(x) < 0 for all x in [0; x 2 ), which contradicts '(0) = 0. Hence, if h(x) > 0 in an interval (x 2 ; x 3 ], then h(x) > 0 in [0; x 3 ], which shows that there exists x 2 [0; a] such that h(x) > 0 if x < x and h(x) = 0 if h(x) > x. We observe that x > 0, for otherwise we would have I(x) = 0 for all x in [0; a].

Finally, if x 2 (0; x) we have 1 (x) > 0; (x) = 0; ' 0 (x) = 0; and thus (30) gives xv 0 (m(x)) < u 0 (R(x)). Using (6) then yields b I 0 (x) > 0.

Proof of Corollary 1

For notational simplicity, assume a = 1 and f (x) = 1 for all x 2 [0; 1]. Suppose

x < 1. Using (30) and h

(x) = (x) = 0 if x 2 [x; 1] gives ' 00 (x) = v 0 (m) u 0 (R) [2 u 0 (R)] ' 00 if x 2 (x; 1].
The same argument as in the proof of Proposition 2 gives ' 00 = ' 00 (x) + < ' 00 (x) = 0. Since ' 0 (x) + 0, we have ' 0 (x) < 0 for all x 2 [x; 1], which contradicts

'(x) = '(1) = 0.

Proof of Corollary 2

Assume f (a) = f 0 (a) = 0 and f 00 (a) > 0. Suppose x = a and thus h(x) > 0 for all

x 2 [0; a]. 48 We also have ' 0 (x) = (x) = 0 for all x. Di¤erentiating (30) gives

h(x) = v 0 (m(x))J(x) xK(x)f (x) + v 00 (m(x)) 1 (x)
;

where

J(x) = d ln f (x) dx 1 (x) + f (x)[2 u 0 (R(x))]; K(x) = v 00 (m(x)) + xu 00 (R(x))v 0 (m(x)) 2 u 0 (R(x)) 2 < 0:
The rest of the proof is in three steps.

Step 1: J(x) > 0 if x 2 (0; a) and J(a) = J 0 (a) = J 00 (a) = h(a) = 0.

Using K(x) < 0; v 00 (m(x)) 0; 1 (x) > 0 and h(x) > 0 gives J(x) > 0 if x 2 (0; a).

Using 1 (a) = f (a) = 0 gives J(a) = 0. Furthermore, we have

J 0 (x) = d ln f (x) dx 0 1 (x) d 2 ln f (x) dx 2 1 (x) + f 0 (x)[2 u 0 (R(x))] f (x)u 00 (R(x))R 0 (x): (33)
Using 1 (a) = f (a) = 0; (x) = 0 for all x and (26) gives 0 1 (a) = 0. (33) and d ln f (x)=dx 9 1; d 2 ln f (x)=dx 2 9 1 when x ! a gives J 0 (a) = 0. Since J(x) > 0 if x 2 (0; a) and J(a) = J 0 (a) = 0; we deduce that J(x) reaches a local minimum over [0; a] at x = a, which implies J 00 (a) 0.

Using L'Hôpital's rule twice yields h(a) = v 0 (m(a))J 00 (a)= aK(a)f 00 (a) = 0.

Since h(x) 0 for all x, we deduce J 00 (a) 0, and thus J 00 The following lemma will be an intermediary step in an a contrario reasoning.

Lemma 5 Suppose I 0 (0) = 0, then: (i) h(x) ! +1 when x ! 0. (ii) There exists a sequence fx n ; n 2 Ng (0; a] such that 0 < x n+1 < x n for all n; x n ! 0 when n ! 1

and m(x n )=x n > h(x n ) for all n 2 N. Proof of Lemma 5 (i): Note that I 0 (0) = 0 implies C(x) xv 0 (m(x)) ! u 0 (w P )= when x ! 0.
If (i) does not hold, then there exists a sequence fx n ; n 2 Ng (0; a] such that 0 < x n+1 < x n for all n; x n ! 0 when n ! 1 and h(x n ) ! h < +1 when n ! +1.

Using v(0) = 0 and L'Hôpital's rule yields

lim x!0 C(x) = 1 lim x!0 h v 00 (m(x)) v 0 (m(x)) 2 h(x) i = 1 h lim x!0 [m(x)v 0 (m(x))] :
Furthermore, mv 00 (m)=v 0 (m) ! > 0 implies mv 0 (m) ! 0 when m ! 0. Hence, C(x) ! 0 when x ! 0, which contradicts C(x) ! u 0 (w P )= > 0 when x ! 0.

(ii): Let x 0 such that h(x) is continuous over (0; x 0 ] and consider the decreasing sequence fx n ; n 2 Ng de…ned by

x n = supfx 2 (0; x 0 ] jh(x 0 ) n if x 0 x g. x n is
well-de…ned and such that x n ! 0 when n ! 1 from (i) and, using the continuity of

h(x), we have h(x n ) = n and h(x) > n if x < x n . Thus, m(x n ) x n = R xn 0 h(x)dx x n > n = h(x n );
The time discretization is as follows:

t 2 [0; t f ] ! x(:); u(:) ! Objective ! Dynamics ! Admissible Controls ! Path Constraints !
Boundary Conditions ! t 0 = 0; : : : ; t N = t f X = fx 0 ; : : : ; x N ; u 0 ; : : : ; u N g min g 0 (t f ; x N )

x i+i = x i + hf (x i ; u i ) i = 0; : : : ; N u i 2 U i = 0; : : : ; N g(x i ; u i ) 0 i = 0; : : : ; N (x 0 ; x N ) = 0

We therefore obtain a nonlinear programming problem on the discretized state and control variables. In BOCOP, the discretized nonlinear optimization problem is solved by the Ipopt solver that implements a primal-dual interior point algorithm; see Wachter and Biegler (2006). The derivatives required for the optimization are computed by the automatic di¤erentiation tool Adol-C; see Walther and Griewank (2012).

2-B: Complementary proofs

subject to ( 7) and ( 10)-( 12).

Let 1 (x) and 2 (x) be co-state variables respectively for b I(x) and m(x) and let (x), and be Lagrange multipliers respectively for ( 11) and ( 12) in this sub-problem. 49 The Hamiltonian is written as x 2 [x 0 ; x 1 ] and g(x) = 0 if x 2 (x 1 ; x 2 ]. In that case 1 (x) + 2 (x) = 0 if x 2 [x 0 ; x 1 ] and 1 (x) + 2 (x) 0 if x 2 [x 1 ; x 2 ]. Since 1 (a) + 2 (a) = 0 and 1 (x) and 2 (x) are continuous, we may choose x 2 such that 1 (x 2 ) + 2 (x 2 ) = 0. The same calculation as above implies (x 1 ) = 0; 0 (x) < 0 if x 2 [x 1 ; x 2 ] and thus (x) < 0 if x 2 [x 1 ; x 2 ],

which contradicts 1 (x 2 ) + 2 (x 2 ) = 0.

Overall, we deduce that there exists b Step 1: m(x) > 0 for all x > 0.

Identical to

Step 1 in the proof of Proposition 1.

Step 2: 1 (x) is continuous in [0; x ] with 1 (x) = 0 for all x 2 [0; x ] such that b I(x) = 0.

Identical to

Step 2 in the proof of Proposition 1.

Step 3: 1 (x) 0 for all x 2 [0; x ] with 1 (x ) > 0.

We know from Lemma 4 that R(x) = w P m + I and Step 4: b I(x) > 0 for all x 2 (0; x ].

Identical to Steps 4 and 5 in the proof of Proposition 1.

Step 5: x > 0.

We have

V 0 3 = fu(R ) + h 0 x [1 v(m )] + (I + c)gf (x );
from the de…nition of V (:). Thus ( 41) and (x ) = 0 give cf (x ) 1 (x )

x v 0 (m ) u 0 (R ) 0; = 0 if x > 0;

which implies x > 0.

Step 6: There is x 2 (0; x ] such that b I 0 (x) > 0; h(x) = m 0 (x) > 0 if 0 < x < x; Identical to the proof of Proposition 2.

Finally, 1 (x ) > 0 shows that there is an upward discontinuity in m(x) and b I(x) at x = x .

Proof of Proposition 5

Using x > 0 and m 0 (x) > 0 if x 2 (0; x) gives m > 0. The remaining part of the Proposition is a straightforward adaptation of Proposition 3.

Proof of Lemma 3

Similar to Lemma 1, with straightforward adaptation.

Proof of Lemma 4

We now have Thus incentive compatibility gives (18). Conversely, assume that ( 17) and ( 18) hold.

We have @V (x; e x) @e x v 0 (m(e x))m 0 (e x)U 0 H (R(e x); H(x; e x))(x e x) < 0 if e x > x; @V (x; e x) @e x v 0 (m(e x))m 0 (e x)U 0 H (R(e x); H(x; e x))(x e x) > 0 if e x < x;

which implies incentive compatibility.

Proof of Proposition 6

The notations of costate variables and Lagrange multipliers are the same as in the proof of Proposition 1. Observe …rst that Steps 1-4 of this proof remain valid, with an unchanged de…nition of '(x), just replacing (30) by

' 0 (x) = [ (1 + )f (x) (x)] 1 xv 0 (m(x)) u 0 (R(x)) 1 (x) v 0 (m(x)) u 0 (R(x)) : (44)
and by (1 + ) in (26). 50 On can check that A 0 e x je x=x > 0 if U 0 H U 00 RH U 0 R U 00 H 2 > 0, which holds when U 00 RH > 0; U 00 H 2 < 0 as postulated, but which is also compatible with U 00 RH < 0.

  x)) the insurance indemnity received by this individual. I(0) = 0 implies m(0) = 0, and thus we have b I(0) = I(m(0)) = 0. The allocation fm(x); b I(x)g jx2[0;a] is sustained by a direct revelation mechanism in which health expenditures and the indemnity are respectively m(e x) and b I(e x) when the individual announces that her health state is e x 2 [0; a], and where truthfully announcing the health state is an optimal strategy. The characterization of the optimal indemnity schedule I(:) will go through the analysis of the corresponding optimal revelation mechanism fm(:); b I(:)g. Let V (x; e x) = u(w P + b I(e x) m(e x)) + h 0 x[1 v(m(e x))]be the utility of a type x individual who announces e x. all x 2 [0; a]:

  m(x); b I(x) is stationary, and the …rst-order e¤ect of an increase b I(x) on the policyholder's expected utility is just the di¤erence between the policyholder's marginal utility gain u 0 (R) b I(x) and the marginal loss due to the induced increase in insurance cost b I(x), multiplied by the probability 1 F (x) of being in [x; a]. Similarly, the …rst-order e¤ect of an increase m(x) can be approximated by the variation of the policyholder's surplus [u 0

  is a second degree polynomial. Hence, bunching cannot occur in that case, as established in Corollary 1.18 Under the assumptions of Corollary 2, we have '(a) = ' 0 (a) = ' 00 (a) = 0 and ' 000 (a) = f 00 (a)G(a). Hence G(a) < 0 is a su¢ cient condition for ' 00 (x) < 0 when x is close to a; x < a. In that case, the switching function '(x) has a local maximum at x = a, with '(x) < 0 when x is close to a. The proof of Corollary 2 shows that this is actually what occurs.Remark 2 Proposition 2 is based on assumptions that we may …nd overly restrictive. It can be reformulated in a weaker form, by only assuming that f (x) is nonincreasing and ln f (x) is weakly convex in a subinterval [x 0 ; x 1 ] [0; a], and in that case there exists x 2 (x 0 ;x 1 ] such that b I(x) and m(x) are increasing over [x 0 ; x) and constant over [x; x 1 ]. For instance, if x is log-normal, with a = +1; E[ln(x)] = and

  the top, in the case of bunching, the indemnity schedule has an angular point at m = m, and all the individuals with an illness severity larger than x are bunched with the same amounts of health expenses m and insurance indemnity I(m).19 In the absence of bunching, the population of policyholders is spread from m(0) = b I(0) = 0 to m(a) > b I(a) > 0 when x increases from 0 to a, with di¤erent choices for di¤erent illness severity levels. The slope of the indemnity schedule I(m) goes to zero when m increases to m = m(a) because av 0

P

  Figure 1 represents the optimal indemnity schedule I(m) and indi¤erence curves in 20 The same intuition is at work to show that b I 0 (x) > 0 when x is close to zero, and thus that the indemnity schedule should not include a deductible, with additional technical speci…cities induced by the sign constraint b I(x) 0. 21 We use the Bocop software (see Bonnans et al., 2016, and http://bocop.org). We refer the reader

  schedule for expenses m(x). As stated in Corollary 1, there is no bunching: m(x) goes from m(0) = 0 to m = m(10) ' 0:7002 and b I(x) = I(m(x)) goes from I(0) = 0 to I(0:7002) ' 0:3863, when x goes from 0 to 10. There is no deductible (i.e. I 0 (0) > 0) and the marginal coverage cancels at the top, that is I 0 (0:7002) = 0. The locus of function I(m) is completed by a ‡at part for m > m, while preserving di¤erentiability. The slope of the type x policyholder indi¤erence curve is written as dI dm jEU =const: = U 0 (w P m + I) xv 0 (m) U 0 (w P m + I) ;and it cancels at the top of the increasing part of the I(m) curve, when m = m, which corresponds to the optimal policyholder's choice when x = 10. The optimal choices of the policyholder are spread from m = 0 to m = m when x goes from 0 to 10, and the ‡at part of the I(m) curve is never reached.

Figure 2

 2 Figure 2 corresponds to the case of an exponential distribution, with indi¤erence curves also drawn for x 2 f0:3; 7; 9g. Now, there is bunching at the top, as expected from Corollary 2. We have x ' 6:7 and m ' 0:7490. I(m) has an angular point at m = m, with I(m) ' 0:4253. Figure 2 illustrates the case of types x = 7 and x = 9:

Figures

  Figures1 and 2

  allocations fm(x); b I(x)g jx2[0;a] that are induced by non-linear indemnity schemes I(m) with b I(x) I(m(x)). However, as in the costly state veri…cation

  Figure 1

  2 (b x; a]; where R(x) = w P m(x) + I and x e x b x < a, with x = b x for the optimal allocation. Lemma 2 characterizes an optimal continuation allocation, with x ; m ; P and I considered as parameters. In particular, I and m may di¤er from the optimal solutions b I(x ) and m(x ). If the hypothesized values of I and/or m are large (in particular, if they are larger than their optimal value around x in the global problem), then an optimal solution of the restricted problem may consist in keeping b I(x) and/or m(x) constant when x larger than but close to x , and to increase b I(x) and m(x) only when x is substantially larger than x . Lemma 2 says that the increase in b I(x) should be concentrated on the highest values of x, that is when x > b x with b

  x)dx+V (m ; I ; x ; P; A) with respect to f b I(x); m(x); g(x); h(x); x 2 [0; x ]g; x 0; A and P , subject to b I(0) = 0; I = b I(x ); m = m(x ); (6)-(

  m I(m) when the expenses reaches the threshold m = m m(x) above which an audit is triggered. The threshold m is reached by a positive mass subset of individuals (those with x 2 [x; x ]) in the case of bunching. The incentive compatibility constraint vanishes when the health state is audited, which explains why crossing the border between the two regimes should be accompanied by an upward jump in health expenses from m to m(x ), and insurance payment from I(m) to I(m(x )) = I(m)+m(x ) m.28 Proposition 5 is illustrated in Figure3, in the exponential distribution case with c = 0:25. We have x ' 4:95. There is coinsurance at the margin, with bunching at the top when m < m = m; and an upward discontinuity of b I(x) and m(x) at x = x .

  -bottom, the two regimes of the I(m) locus are patched together by a dotted line from m = m ' 0:41 to m(x ) ' 0:95 with constant slope equal to one, in order to de…ne I(m) for all m 0, but m is never chosen in (m; m(x )). 29

  Figure 3

Figure 5

 5 Figure 5

V

  (x; e x) = U w P + b I(e x) m(e x)); h 0 x[1 v(m(e x))] : Lemma 4 is a direct extension of Lemma 1 to the case of a non-separable utility function, with a similar interpretation. Lemma 4 Under non-separable utility, the direct revelation mechanism fm(:); b I(:)g is incentive compatible if and only ifb I 0 (x) = [1 xv 0 (m(x)) (R(x); H(x))] m 0 (x);(17)m 0 (x) 0;(18) for all x 2 [0; a], where R(x) w P + b I(x) m(x) and H(xm(:); h(:) and P , subject to b I(0) = 0; and (2),(7)-(9), and b

Figure 6 35

 6 Figure 6 35 Thus, utility is CRRA w.r.t. wealth. Parameters are = 2; = 0:5; b 0 = 0:01 and b = 1. 36 Figure 6-bottom adds a background risk and a loading factor, and it illustrates the optimality of a deductible, as shown in Section 5.3.

Figure 7 illustrates

 7 Figure 7 illustrates Corollary 4 in the case of an exponential distribution. Loading shifts the indemnity schedule rightward and creates a deductible (D ' 0:3202 = m(0:41) when = 0:1), in addition to bunching at the top.

  Figure7

  Figure 8

  section 3.3 are unchanged, and in particular we assume v(m) = p m=[1+ p m]. Figures 10, 11 and 12 illustrate the consequences of this assumption, by assuming q(m) = m , with = 1; 2; 3 and 4. 41

Figures

  Figures 10, 11, 12 and 13

  Figure 10

  = m(0) = 0 gives A(0) = u(w P ) and B(0) = 0. Let S be the subset of functions A(:); B(:) that belong to the Banach space L 1 ([0; 1]; R [0; 1]) with the sup norm topology k : k 1 and that satisfy (21),(22) and B(0) = 0. Hence, S is closed and convex, and furthermore k (A(:); B(:)) k 1 u(w) for all (A(:); B(:)) 2 S.

  the roles of x and e x; u(w P m(x) + b I(x)) u(w P m(e x) + b I(e x)) e x[v(m(e x)) v(m(x))]: We deduce (e x x)[v(m(e x)) v(m(x))] 0 for all x; e x, which implies that m(:) is non-decreasing. Since I(:) is non-decreasing, b I(:) I(m(:)) is also non-decreasing.

  m and b I 0 (x) ! b I 0 (x )+ I , when x ! x ; x > x , with m > 0 and I 0. Incentive compatibility implies that a type x individual is indi¤erent between m 0 (x ); b I 0 (x ) and m 0 (x ) + m ; b I 0 (x ) + I . If I = 0, since I(m) is non-decreasing, it remains constant when m 2 [m 0 (x ); m 0 (x )+ m ]. Using the concavity of m ! u(w P m+ b I 0 (x ))+ x v(m) then shows that the type x individual reaches a higher expected utility by choosing m 2 (m 0 (x ); m 0 (x ) + m ) than by choosing m 0 (x ), hence a contradiction. Thus, we have I > 0. Since b I 0 (x) is piecewise continuous, there exists > 0 such that b I 0 (x) b I 0 (x ) I =2 for all x 2 (x ; x + ). Consider another revelation mechanism fm 1 (:); b I 1 (:)g de…ned by: (i) If x 2 (x ; x + ), let m 1 (x) = m 1 and b I 1 (x) = I 1 close to m 0 (x ) and b I 0 (x ), respectively, with b I 0 (x) I 1 I =4, and such that u(w P m 1 + I 1 ) + xv(m 1 ) u(w P m 0 (x) + b I 0 (x)) + xv(m 0 (x)); for all x 2 (x ; x + ), and u(w P m 1 + I 1 ) + xv(m 1 ) < u(w P m 0 (x) + b I 0 (x)) + xv(m 0 (x)); if x x , (ii) If x = 2 (x ; x + ), then m 1 (x) m 0 (x) and b I 1 (x) b I 0 (x).

  x 2 [0; a] such that m(x) > 0 if and only if x > x. Suppose x > 0, which implies h(x) = 0 over [0; x]. Using b I(0) = 0 and (6) gives b I(x) = 0 for all x 2 [0; x]. > 0 for all x > 0. De…ne m 0 (x) = b m(x); I 0 (x) = 0 if x x and m 0 (x) = m(x); I 0 (x) = b I(x) if x > x, and x 0 (x) 2 arg max e x2[0;a] fu(w P m 0 (e x) + I 0 (e x)) + xv(m 0 (e x))g:

  dx = 0 implies (x) = 0 over [0; x 0 ]. 46 (26) then gives R 0 (x) = 0 and thus h(x) = 0 for all x 2 [0; x 0 ]. From the same argument as in Step 1, we have m(x) = b m(x), and thus h(x) > 0; for all x 2 [0; x 0 ], hence a contradiction.

  (a) = h(a) = 0. which implies I 0 (m) 2 (0; 1) for all m 2 (0; m); I 0 (m) = 0 if x = a; I 0 (m) > 0 if x < a, where m = m(x): All types x x choose m = m(x); and thus the optimal allocation is sustained by an indemnity schedule such that I(m) = I(m) for m m. The rest of the proof shows that mv 00 (m)=v 0 (m) ! 2 (0; 1) when m ! 0 (an assumption made in what follows) is a su¢ cient condition for I 0 (0) > 0.

Proof of Lemma 2

 2 Let b I(x); x 2 [0; x ]; P and c be given, with I = b I(x ); m = m(x ) and I m . Consider the sub-problem in which f b I(x); m(x); g(x); h(x), x 2 [x ; a]g maximizes Z a x n u(w P + b I(x) m(x)) + h 0 x[1 v(m(x))] o f (x)dx;

  x 2 [x ; a] such that b I 0 (x) = 0 if x 2 [x ; b x] and b I 0 (x) = m 0 (x) > 0 if x 2 [b x; a]. The same reasoning -replacing (x) by (x) 0 2 (x)=f (x) -shows that there exists e x 2 [x ; b x] such that m 0 (x) = 0, and thus m(x) = m , if x 2 [x ; e x] and m 0 (x) > 0 if x 2 [e x; b x]. When m 0 (x) > 0, we have (x) = xv 0 (m(x)), and thus m 0 (x) v 0 (m(x))=[ xv 00 (m(x)) + u 00 (w P m(x) + I )].When m 0 (x) = 0, we have 0 (x) < 0 if [x ; e x) and 0 (e x) = 0, and thus e x is given byu 0 (w P m + I ) = e xv 0 (m ) if u 0 (w P m + I ) > x v 0 (m ), and e x = x if u 0 (w P m + I ) = x v 0 (m ).If x < b x, then replacing m by b m m(b x) > m implements the same allocation with lower audit costs. Indeed, m(x) is an optimal choice of type x individuals if x > b x, because such individuals would prefer choosing b m rather than any m 2 [0; b m); and furthermore, for such individuals, there is full coverage at the margin in ( b m; m(x)]and they cannot choose expenses larger than m(x). In addition, the expected auditcost decreases from c[1 F (x )] to c[1 F (b x)] when b m is substituted for m . Thus, an optimal allocation is necessarily such that x = b x:Proof of Proposition 4Let 1 (x) and 2 (x) be costate variables respectively for b I(x) and m(x) and let (x) and be Lagrange multipliers respectively for (9) and (20). The Hamiltonian is written as in the proof of Proposition 1, and the optimality conditions (25), (26) and (27) still hold. We also have (x) 0 and (x) = 0 if b I(x) > 0, and 1 (x ) + 2 (x ) = 0 from the characterization of the optimal continuation allocation. The optimality conditions on m ; I ; x ; P and A are written as V 0 1 ; V 0 2 ; ::: denote the partial derivatives of V (m ; I ; x ; P; A) and R R(x ) = w P m + I . De…ne '(x) for all x 2 [0; x ] by (25) as in the proof of Proposition 1.

  0 (w P m + I )[1 F (x )]; and (40) gives 1 (x ) > 0. The remaining part of Step 3 is the same as in the proof of Proposition 1.

b

  I(x) = b I(x); m(x) = m(x); h(x) = 0 if x < x x ; b I 0 (0) = 0; b I 0 (x) = 0 if x = a and b I 0 (x) > 0 if x < x :

V

  (x; e x) = U w P + b I(e x) m(e x)); h 0 x(1 v(m(e x)) : A straightforward adaptation of the proof of Lemma 1 shows that (17) is a necessary condition for incentive compatibility. (17) gives @V (x; e x) @e x = v 0 (m(e x))m 0 (e x)U 0 H (R(e x); H(x; e x)) H 2 < 0 and U 00 RH > 0 gives A(x; e x) > 1 if e x > x and A(x; e x) < 1 if e x < x, with A 0 e x (x; e x) je x=x > 0, and thus 50 @ 2 V (x; e x) @e x 2 j e x=x = v 0 (m(x))m 0 (x)U 0 H (R(x); H(x))[1 + A 0 e x (x; e x) je x=x ]:

See, for instance, the description of the health insurance plans in the A¤ordable Care Act at https://www.healthcare.gov/health-plan-information/.

See, in particular, the references provided byEllis, Jiang and Manning (2015) on multiple health treatment goods, correlated sources of health uncertainty and trade-o¤ between treatment and prevention, and by P ‡um (2015) on physician incentives.

Regarding the empirical analysis of utility functions that depend on health status, see particularly[START_REF] Viscusi | Utility functions that depend on health status: estimates and economic implications[END_REF],Evans and[START_REF] Evans | Estimation of state dependent utility functions using survey data[END_REF][START_REF] Finkelstein | What good is wealth without health? The e¤ect of health on the marginal utility of consumption[END_REF].

Note the relationship of Proposition 1 with optimal insurance under (ex ante) moral hazard when e¤ort a¤ects the distribution of losses should an accident occur, but not the probability of the accident itself. In that case, it may be optimal to fully cover small losses without a deductible. See[START_REF] Rees | The Microeconomics of Insurance[END_REF].

This is the case, for instance, if the distribution of x is uniform or exponential.

(x) > 0;

(x) < 0, which is established and used in the proofs, as well as the transversality conditions 1 (a) = 2 (a) = 0.

If c = 0, then the …rst-best allocation would be feasible with x = 0, that is by auditing the health state in all possible cases. Thus, choosing x smaller than a is optimal when c is not too large, and this is what we assume in what follows.

Of course, this discontinuity of function m(x) at x = x is compatible with a continuous function I(m).

The bunching of types is no longer sustained by a kink in the indemnity schedule I(m) at m = m, but by the threat of an audit, since increasing expenses above m will not be possible if x x .

An example is when the individual may lose a part of her business or wage income when her health level deteriorates.

If " is continuously distributed, then G 0 " (" j x) > 0 is the density of " conditionally on x.

For the sake of illustration, see for instance[START_REF] Family | Cost Sharing for Health Care: France[END_REF] for France, Germany and Switzerland, and www.healthcare.gov for the ObamaCare Marketplace in the US.

Note that (26) and 1 (x) = 0 1 (x) = 0 for all x 2 [0; x 0 ] imply that (x) is continuous in this interval.

Step 3 in the proof of Proposition 1 shows that 1 (x) > 0 for all x 2 (0; a).

We assume w.l.o.g. that h(x) is continuous at x = a.

We can straightforwardly check that (8) is not binding in this sub-problem.

(x) = 0, and thus 02 (x) 0 if x 2 [e x; bx], which gives u 0 (w P m(x) + I ) =

Note however, that we may have I 0 (D + ) = 0 as illustrated in Figure6(bottom) and 7.

Step 2: u 0 (R(a)) = av 0 (m(a)) = 2 .

Since f (a) = f 0 (a) = 1 (a) = 0 1 (a) = 0, we deduce u 0 (R(a)) = av 0 (m(a)) from ( 26) and ' 0 (x) 0 by using the L'Hôpital's rule twice. Furthermore, (26) gives 00 1 (a) = 0 and (33) then yields J 00 (a) = f 00 (a)[2 u 0 (R(a))], which implies u 0 (R(a)) = 2 .

Step 3: Let (x) u 0 (R(x))' 0 (x), where '(x) is de…ned by (25). We have 000 (a) < 0, which contradicts '(x) = 0 for all x 2 [0; a] when x = a.

x = a implies (x) = 0 for all x 2 [0; a]. We may write

) from h(a) = 0 and u 0 (R(a)) = av 0 (m(a)). Using (26) and

Step 2 gives 000

We have

and thus, using 1 (a) = 0 and f (a) = f 0 (a) = 0, we may write

Proof of Proposition 3

The optimal non-linear indemnity schedule I(m) is such that

for all m 2 (0; m). Thus, (6), ( 7), (30) and ' 0 (x) = (x) = 0 if x 2 (0; x) give

;

which completes the proof of (ii).

We are now in the position to end up the proof of the Proposition. Let us suppose

and D(0) = 0 from I 0 (0) = 0. We thus have D 0 (x) < 0 for x close to 0. We have

) ! u 00 (w P )=u 0 (w P ) and m(x) ! 0 when x ! 0, and v 00 (m)m=v 0 (m) ! when m ! 0, we deduce that < 1 is a su¢ cient condition for D 0 (x n ) > 0 when n is large enough, which is a contradiction.

We deduce I 0 (0) > 0 when < 1.

Appendix 2 2-A: Computational approach Our simulations are performed through a discretization method. Under the notations that are standard in this …eld, an optimal control problem is usually written as follows, by denoting x the vector of state variables and u the vector of controls that are function of time t 2 R:

Objective (Mayer form)

Dynamics

Admissible Controls

Path Constraints

Boundary Conditions and the optimality conditions are

for all x, with the transversality conditions 1 (a) = 2 (a) = 0; and (x) 0 for all x and (x) = 0 if h(x) > g(x):

, and thus (x) = 0 if x 2 V. (35) gives 1 (x) = 0, and thus 0 1 (x) = 0 for all x 2 V. Then (37) gives u 0 (R(x)) = , and thus R(

. We deduce that h(x) = g(x) if x 2 V. ( 35) and ( 36)

, for all x 2 V. (37) and ( 38) then imply xv 0 (m(x)) = for all x 2 V, which gives m 0 (x) = v 0 (m(x))=xv 00 (m(x)).

)) < 0, and thus 0 (x) < 0. If m 0 (x) > 0 (and thus

Suppose there are x 0 ; x 1 ; x 2 2 [x ; a] such that x 0 < x 1 < x 2 with g(x) > 0 if Suppose that b I 0 (x) > 0 if x < ", with " > 0. Hence b I(x) > 0 (and thus (x) = 0) for all x > 0. Using (6) gives h(x) > 0;

(45)

if x < ". (45) implies '(x) = ' 0 (x) = 0 if x < ". Furthermore, using (26) (in which is replaced by (1 + )), (29) and 1 (a) = 0 yields

and thus 1 (x) < 0 for x small enough. ( 44) and ( 46) then yield ' 0 (x) > 0, hence a contradiction. Since we know from Step 4 that b I(x) is non-decreasing, we deduce that there exists d > 0 such that b

The simulated trajectories of 1 (x) and 2 (x) are illustrated in Figure 9 Zeckhauser, R., 1970, "Medical insurance: a case study of the tradeo¤ between risk spreading and appropriate incentives", Journal of Economic Theory, 2, 10-26.