Testimony Before the United States House of Representatives 
Committee on Energy and Commerce: 
Subcommittee on Oversight and Investigations 
 
 
 
 
Medicare and Medicaid Program Integrity: 
Combatting Improper Payments and Ineligible Providers  
 
Testimony of: 
 
Ann Maxwell 
Assistant Inspector General  
Office of Evaluation and Inspections 
Office of Inspector General  
Department of Health and Human Services 
 
 
 
 
May 24, 2016 
10:15 a.m. 
Location:  Rayburn House Office Building, Room 2322 
    Testimony of: 
Ann Maxwell 
Assistant Inspector General for Evaluation and Inspections 
   Office of Inspector General, U.S. Department of Health and Human Services 
 
 
Good morning, Chairman Murphy, Ranking Member DeGette, and other distinguished Members 
of the Subcommittee.  Thank you for the opportunity to appear before you to discuss improper 
payments in Medicare and Medicaid and the role that improved provider enrollment safeguards 
can play in protecting these programs.   
 
OIGs mission is to protect the integrity of Department of Health and Human Services (HHS) 
programs and operations as well as the health and welfare of the people HHS serves.  The 2014 
combined expenditures for Medicare and Medicaid amounted to over one trillion dollars, and the 
programs served 120 million beneficiaries.  OIG protects the integrity of these programs and 
others through robust audits, evaluations, investigations, enforcement actions, and compliance 
efforts. 
 
To ensure that these essential programs can continue to serve our nations most vulnerable 
populations well into the future, we must foster their sound financial stewardship.  Reducing 
improper payments to providers is a critical element in protecting the financial integrity of the 
Medicare and Medicaid programs.  Although not all improper payments are fraud, nor even 
overpayments, all improper payments pose a risk to the financial security of these programs.  
The estimated levels of improper payments in these programs indicate that HHS must remain 
vigilant in its efforts to pay the right provider the right amount for the right service.  In its Fiscal 
Year (FY) 2015 Agency Financial Report (AFR), HHS reported the estimated improper 
payments for Medicare and Medicaid to be approximately $88.8 billion. 
 
One way to protect Medicare and Medicaid from improper payments is to have strong enrollment 
safeguards to prevent ineligible providers from ever entering the program and to identify those 
with whom HHS does business.  The Centers for Medicare & Medicaid Services (CMS) and 
States can prevent inappropriate payments, protect beneficiaries, and reduce time-consuming and 
expensive pay and chase activities by ensuring that providers engaging in fraudulent or 
abusive activities are not allowed to enroll in Medicare and Medicaid.  Of course, this vigilance 
must be balanced with the need to maintain a relatively burden-free system for eligible providers.   
My testimony today focuses on how HHSs improper payment rates did not meet targets as well 
as insights into the implementation of the new provider enrollment safeguards authorized by the 
Patient Protection and Affordable Care Act (ACA) to better screen providers in an effort to 
protect Medicare and Medicaid from paying fraudulent and abusive providers.   
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  1 
  IMPROPER PAYMENT RATES INDICATE NEED TO BETTER 
PROTECT MEDICARE AND MEDICAID 
 
Medicare and Medicaid accounted for $88.8 billion, or almost 99 percent, of the $89.8 billion in 
improper payments that HHS reported in its FY 2015 AFR.  Traditional Medicare fee-for-service 
alone accounted for $43.3 billion, or almost one-half, of the improper payments that HHS 
reported.  Medicaid improper payments totaled an additional $29.1 billion.  OIG has identified 
reducing improper payments as an organizational priority necessary to ensuring the long-term 
health of HHS programs, especially Medicare and Medicaid.   
 
To improve accountability for the administration of funds, Federal agencies are required to 
annually report information on the agencies improper payments to the President and Congress.  
For FY 2015, HHS did not fully comply with these reporting requirements.  OIG has looked into 
HHSs noncompliance with these requirements for the Medicare and Medicaid programs and has 
issued annual reports on the topic since 2012.  Two findings from the most recent report are 
described below.   
 
HHSs Error Rate Percentage for Medicare Fee-for-Service 
Exceeded 10 Percent 
 
To comply with the Improper Payments Elimination and Recovery Act of 2010, an agency must 
report an improper payment rate of less than 10 percent (a statutorily required target level) for 
each program determined susceptible to significant improper payments.  HHS did not meet this 
requirement as it reported an estimated improper payment rate for the Medicare Fee-for-Service 
program of 12.1 percent in FY 2015.  Although Medicare Fee-for-Service improper payments 
exceeded the 10 percent threshold, the error rate decreased 0.6 percentage points from its 
estimated FY 2014 level of 12.7 percent.   
 
HHS Did Not Meet All Goals for Reducing Improper Payments  
 
In FY 2015, HHS did not meet its established improper payment targets for four programs  
Medicare Advantage; Medicaid; Childrens Health Insurance Program (CHIP); and Child Care 
Development Fund.  In FY 2014, HHS set FY 2015 targets of 8.5 percent for the Medicare 
Advantage program and 6.7 percent for Medicaid.  However, the actual improper payment rates 
for FY 2015 were 9.5 percent for Medicare Advantage (1 percentage point over the goal) and 9.8 
percent for Medicaid (3 percentage points over the goal).  
  
 
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  2 
  Primary Causes of Improper Payments and Plans for Reducing 
Them 
 
In its FY 2015 AFR, HHS attributed about 69 percent of Medicare Fee-for-Service improper 
payments to errors associated with insufficient documentation and the remaining improper 
payments to medical necessity errors (about 17 percent) and administrative or process errors 
(about 14 percent).  HHS said that the primary reason for Medicaid improper payments relates to 
States difficulties bringing their systems into compliance with new requirements, including 
requiring screening of providers under a risk-based process prior to enrollment.   
 
HHS described a variety of corrective actions it is taking to address improper payments in both 
the Medicare and Medicaid programs.  For example, in the Medicaid program, HHS has engaged 
with States to proactively address issues identified in their Corrective Action Plans, facilitated 
national best practice calls to share ideas across States, offered ongoing technical assistance, and 
provided additional guidance, as needed. 
 
For our part, OIG has long been at the forefront of measuring, monitoring, and recommending 
actions to prevent improper payments, including developing the first Medicare payment error 
rate in 1996, a time when there were few error rate models in Government.  In addition to 
reviewing and reporting on HHSs annual improper payment information, OIG audits, 
evaluations, and investigations identify improper payments for specific services and items, assess 
internal control and payment vulnerabilities, and make recommendations to prevent future 
improper payments.  For example, we found that hospices inappropriately billed Medicare over 
$250 million for general inpatient care and made recommendations to CMS, such as conducting 
prepayment reviews, that may help prevent improper payments.  In the FY 2015 AFR, HHS 
reported that the improper payment rate for home health care claims increased to 59 percent, up 
by 7.57 percentage points since the last reporting period.  Considering this statistic, and the 
results of prior OIG work, home health care is an area ripe for corrective action and reducing 
improper payments.  In fact, we have audits underway to determine whether home health 
agencies across the country complied with Medicare requirements. 
 
One key component of a strategy for minimizing improper payments is to take steps to ensure 
that only eligible providers are allowed to enroll in the Medicare and Medicaid programs.  
Provider enrollment safeguards are important tools in helping prevent improper payments.  My 
comments on provider enrollment safeguards will highlight four OIG reports, three of which are 
being released to this Subcommittee today.  As mentioned, the ACA strengthened provider 
enrollment by expanding who gets screened and how they get screened.  These reports will 
inform todays conversation and enhance our combined efforts to ensure that the Medicare and 
Medicaid programs maximize the valuable tools the ACA provided.    
 
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  3 
  PROVIDER ENROLLMENT IS A CRITICAL SAFEGUARD  
 
Preventing ineligible providers from entering the Medicare and Medicaid programs not only 
reduces improper payments, but also prevents patient harm.  Unfortunately, there are numerous 
examples of Medicare and Medicaid providers causing significant harm to patients.  One such 
example includes an oncologist with multiple facilities who administered aggressive cancer 
treatments and other therapies to patients who did not need them to increase the providers 
billings to Medicare.  The unnecessary therapy and excessive medications led to significant 
health problems for a number of patients.  Another example includes a number of dentists in a 
pediatric dentistry company.  These pediatric dentists performed medically unnecessary dental 
services, including baby root canals, on young children covered by Medicaid.  These dental 
facilities did not let parents accompany their children, placed children in unreasonable 
confinement, and caused significant physical pain to this vulnerable population of children.       
 
Strong provider safeguards at the beginning of the enrollment process and ongoing verification 
to ensure that enrolled providers continue to meet Medicare and Medicaid requirements allow 
CMS to better protect beneficiaries from harm and reduce improper payments.  Through the 
ACA, Congress provided CMS and States the authority for enhancements to the enrollment 
screening process.   
 
ACA authorized additional screening tools designed to strengthen 
provider enrollment 
  
The ACA strengthened provider enrollment processes for Medicaid and Medicare by expanding 
who gets screened and how they get screened.  The ACA screening requirements, as 
implemented in regulation, apply not only to the provider, but also to all those who have an 
ownership or controlling interest in the provider.  Additionally, the ACA authorized enhanced 
screening tools, including verifying provider information, placing providers in risk categories, 
increasing site visits, and requiring fingerprinting.  In 2011, CMS began assigning providers to 
one of three risk categories:  limited, moderate, or high risk.  The extensiveness of provider 
screenings depends on provider risk categories.  Providers assigned to the high-risk category are 
subject to a more extensive review than those in the lower-risk categories.  Chart 1 provides a 
description of what screening is required for each risk category.  
   
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  4 
  Chart 1:  ACA screening requirements for each risk category  
 
 
Type Of Screening Required  Limited  Moderate  High 
 
Verify any provider/supplier-specific requirements 
  X  X  X 
established by Medicare and Medicaid  
 
Conduct license verifications  X  X  X 
 
Check databases  (to verify Social Security  
 
Number; the National Provider Identifier;  the 
  National Practitioner Data Bank licensure; an OIG 
  exclusion; taxpayer identification number; death  X  X  X 
  of individual practitioner, owner, authorized 
  official, delegated official, or supervising 
  physician)  
  Conduct unscheduled or unannounced site visits     X  X 
  Check fingerprint-based criminal history records         X 
 
 
Implementation by States and CMS of this stronger, risk-based approach needs improvement to 
truly strengthen provider enrollment in Medicaid and Medicare.  OIG has identified a number of 
opportunities for States Medicaid programs and CMS to prevent ineligible providers from 
enrolling in Medicaid and Medicare, as described below.  CMS concurred with all of our 
recommendations related to working with State Medicaid Agencies to strengthen provider 
enrollment, as well as our provider enrollment recommendations for Medicare. 
 
State Medicaid Agencies should fully implement ACA screening 
tools 
 
Implementing the ACA required screening activities is critical to safeguarding the Medicaid 
program as it is expanded to serve more beneficiaries.  The ACA requires States to more 
uniformly screen providers according to the risk for fraud, waste, and abuse that they pose to 
Medicaid.  In addition, to help ensure that CMS and State Medicaid agencies identify 
potentially fraudulent providers prior to their initial enrollment in Medicaid, providers must 
disclose the identity of any person or entity who has ownership or controlling interest.        
 
However, when reviewing moderate- and high-risk providers, OIG found that State 
implementation of ACA screening procedures is incomplete.  States with incomplete screening 
activities enrolled thousands of providers categorized as posing a high or moderate risk to 
Medicaid without conducting fingerprint-based criminal background checks.  This leaves the 
Medicaid program vulnerable to providers who may be ineligible or who may defraud the 
program and harm patients in the process. 
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  5 
   
Some States recently reported incomplete implementation of fingerprint-based criminal 
background checks and site visits.  Specifically, 37 States reported not having fingerprint-based 
criminal background checks while waiting for CMS to require them.  CMS did not require 
fingerprint-based criminal background checks until June 2015, more than 4 years after the other 
Medicaid enhanced provider screening activities went into effect.  In addition, 11 States 
reported that they had not implemented site visits, which were required during the period 
reviewed. 
 
OIG also uncovered problems with provider ownership disclosure.  For States to identify 
potentially fraudulent providers, as well as those that may be associated with excluded 
individuals or entities, State Medicaid agencies must be aware of those with whom they are 
doing business.  Yet, OIG found that few State Medicaid agencies requested that providers 
disclose all Federally required ownership information.  In addition, 14 State Medicaid agencies 
reported not verifying the completeness or accuracy of required provider ownership 
information.  Additionally, OIG found that 14 State Medicaid agencies reported not confirming 
that individuals or entities that providers disclosed as owners were not excluded from other 
State Medicaid agencies. 
 
OIG Recommends  
 
  CMS assist States in fully implementing the tools provided to them through the ACA.  
Specifically, States should implement fingerprint-based criminal background checks for 
high-risk providers and conduct site visits.   
  CMS work with State Medicaid agencies to improve the collection and verification of 
provider ownership information to ensure completeness and accuracy.   
 
 
CMS should do more to strengthen ACA enhanced enrollment 
safeguards in Medicare  
 
To fully benefit from the new authorities that the ACA provided, CMS needs to strengthen 
implementation of enhanced enrollment screening in Medicare.  For instance, OIG found gaps in 
CMS contractors verification of key information on enrollment applications that could leave 
Medicare vulnerable to ineligible providers.  OIG also found that CMS contractors were 
inconsistent in applying site visit procedures and using site visit results for enrollment decisions.  
The purpose of site visits is to determine whether a provider is operational and meets all 
applicable Medicare standards.  However, OIG found that contractors approved hundreds of 
applications where site visit inspectors found providers to be nonoperational.  We followed up 
with one contractor to determine under what circumstances it would approve enrollment with an 
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  6 
  unfavorable site visit result.  The contractor reported that it had not reviewed the site visit results 
in some cases, should have conducted more research on the provider location in others, or may 
have provided an incorrect location for the site visit.  OIG also found that, site visit inspectors 
were sometimes inconsistent in their determination of whether a site was operational and 
sometimes provided contradictory information on site visit forms. 
 
Despite these gaps, CMS achieved some positive outcomes as a result of the new screening tools.  
For example, when CMS revalidated current providers enrollment using the new screening 
tools, OIG found that the number of revocations and deactivations substantially increased.   
 
While there are some positive results from the new screening tools, OIG has identified several 
potential vulnerabilities in the enhanced enrollment process.  To address these vulnerabilities and 
prevent ineligible providers from enrolling in Medicare, OIG recommends that CMS take 
practical steps to ensure effective oversight of enrollment data to ensure that contractors are 
performing their activities appropriately and that enhancements are producing intended results. 
 
OIG Recommends  
 
  CMS monitor contractors to ensure they are verifying information on enrollment 
applications.   
  CMS improve the execution and use of site visits by:   
o  revising site visit forms so that they can be more easily used by inspectors,  
o  improving quality assurance oversight and training of site visit inspectors, and  
o  ensuring that contractors are appropriately considering site visit results when 
making enrollment decisions. 
 
 
CMS must improve Medicare and Medicaid provider data systems 
 
OIG has a history of work pointing to problems in CMSs Medicare enrollment data system, the 
Provider Enrollment, Chain and Ownership System (PECOS).  The information in PECOS 
should aid CMS in tracking enrollment and revalidation trends as well as to help determine 
whether CMS contractors are abiding by program requirements.  However, OIG has found 
PECOS to be incomplete and inaccurate.  Additionally, OIG has found inaccuracies in a separate 
database that CMS established for storing information about providers terminated from the 
Medicare and Medicaid programs.  The database is meant to assist State Medicaid agencies in 
denying enrollment to providers who have been terminated from Medicare or by another State 
Medicaid agency. 
   
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  7 
  OIG has historically found PECOS data to be incomplete, inconsistent and inadequate.  In 2013, 
OIG found that provider data were inconsistent between the National Plan and Provider 
Enumeration System and PECOS for 97 percent of records.  Addresses, which are essential for 
contacting providers and identifying trends in fraud, waste, and abuse, were the source of most 
inaccuracies and inconsistencies.  Also, OIG recently found that PECOS did not contain all the 
information needed for CMS to effectively oversee whether its contractors are performing their 
activities appropriately and that enhancements are producing intended results.  OIG found that 
shortcomings in PECOS rendered CMS unable to leverage data to determine whether 
enhancements were strengthening provider enrollment.     
 
More recently, OIG has also found vulnerabilities in the accuracy of provider ownership 
information within PECOS.  Specifically, we compared provider ownership names in PECOS 
with names that State Medicaid agencies had on file for the same providers.  We found that for 
nearly all providers in our review, owner names in PECOS did not match those on record with 
the State Medicaid agencies.  This means that Medicare and Medicaid information for the same 
providers does not match.  Further, when we compared PECOS data with provider ownership 
names that we collected directly from providers, we found that over three-quarters of them did 
not match.   
 
An example helps illustrate the issues we found with provider enrollment information.  When we 
asked for ownership names from a provider enrolled in both Medicare and Medicaid, the 
provider reported having 12 owners.  In the State Medicaid agencys database, this same 
provider was listed as having 63 owners.  And finally, Medicares PECOS database listed the 
provider with 14 owners.  Most of the 12 owners reported to OIG did not even match those listed 
with Medicaid or Medicare.   
 
The prevalence of nonmatching owner names raises concern about the completeness and 
accuracy of information about Medicare providers ownership in PECOS, and in State databases.  
If PECOS does not accurately and completely capture provider ownership information for 
Medicare providers, CMS does not know exactly with whom it is doing business, and its ability 
to provide adequate oversight of the Medicare program is compromised.  High-quality PECOS 
data are equally important to State Medicaid agencies.  To streamline the enrollment process and 
save resources, States are allowed to use Medicare screening results  assuming the provider is 
also enrolled in Medicare  rather than screening a provider again for Medicaid.  However, many 
States reported that they did not take advantage of this option because of concerns about the 
completeness and accuracy of the PECOS data.   
 
OIG also found weaknesses in the CMS process for collecting and sharing data on providers 
terminated from Medicaid for reasons of quality, integrity, or fraud.  Specifically, there is not a 
comprehensive CMS data source for identifying all provider terminations for cause.  The ACA 
required CMS to establish a process to make available to State agencies information about 
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  8 
  providers terminated from the Medicare, Medicaid, and CHIP programs so that States do not 
enroll providers who have been terminated in other States and can identify those enrolled 
providers who are required to be terminated.  To implement this requirement, CMS established 
a central database that allows State Medicaid agencies to voluntarily report providers whom 
the State agencies terminated for cause from their programs and to retrieve information about 
providers who were terminated for cause by Medicaid programs in other States.  We found that 
not all State Medicaid agencies were reporting to the database and that not all of the submitted 
records met the CMS definition of a for-cause termination. 
   
The lack of this comprehensive database allows providers terminated in one State to continue 
participating in other States Medicaid programs.  OIG found that 12 percent of providers who 
were terminated for cause by State Medicaid agencies in 2011 continued to participate in other 
State Medicaid programs as of January 2012, notwithstanding the requirement that such 
providers be terminated in all States.  About half of these providers remained listed as 
participating in Medicaid in other States until as late as January 2014, and about one-third of 
these participating providers received payments for services rendered to Medicaid beneficiaries 
after the providers terminations for cause. 
 
OIG Recommends 
 
  CMS ensure that PECOS includes data that relate to the enhancements implemented for 
the provider enrollment process and that contractors enter all required data. 
  CMS enable States to substitute Medicare screening data by ensuring the accessibility 
and quality of PECOS data.   
  CMS require each State Medicaid agency to report all terminated providers.   
 
 
To promote further efficiencies, we recommend that CMS develop a central system for States to 
submit and access results from other States.  CMS could eventually consider creating a 
consolidated enrollment system that covers both Medicare and Medicaid.  A joint enrollment 
system would reduce duplication and inconsistency across government programs and would also 
reduce the burden on providers.  Providers would no longer have to separately provide 
enrollment information, including ownership information, to CMS and to their respective States 
Medicaid programs.   
   
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  9 
  CONCLUSION 
 
We appreciate the Subcommittees interest in these important issues.  Increased attention to CMS 
improper payments and provider enrollment safeguards will help keep our Medicare and 
Medicaid programs safe and secure, while protecting beneficiaries from patient harm and 
ensuring that taxpayer money is appropriately spent.  To that end, we continue to urge CMS to 
fully address OIGs recommendations related to improving provider enrollment 
safeguards.  While we are encouraged by CMSs commitment to strong provider enrollment 
safeguards, our work has demonstrated that more could be done to strengthen the implementation 
of enhanced provider screening in Medicare and to fully implement enhanced provider screening 
in all State Medicaid agencies.  Until such time, these programs are not as protected as they 
could be from ineligible providers who intend to defraud the program and potentially harm 
beneficiaries in the process.   
OIG is encouraged that CMS concurred with all of our recommendations referenced in this 
testimony and stated that it is strongly committed to program integrity efforts in Medicare and 
Medicaid.  We look forward to continuing to work with CMS to implement all of the 
recommendations expeditiously so that CMS can take maximum advantage of the array of tools 
afforded to it by the ACA to protect Medicare and Medicaid resources and the beneficiaries these 
programs serve.  
OIG believes it is critical that we continue to conduct effective oversight to ensure that funds are 
spent appropriately and that steps are taken to improve the quality of care for Medicare and 
Medicaid beneficiaries.  We have a substantial body of Medicare- and Medicaid-related work, 
both underway and planned, to ensure that beneficiaries are protected from harm and taxpayer 
dollars are spent for their intended purposes.   
Thank you again for inviting OIG to speak with the Subcommittee today on improper payments 
in Medicare and Medicaid and the role that improved provider enrollment safeguards can play in 
reducing them.  We hope that our work and this testimony will assist you in your oversight 
efforts to protect these programs.  
House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
Hearing  May 24, 2016  10