Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
 
 
 
S  B R
URETY  ONDS  EMAIN AN 
 
U T T
  NDERUTILIZED  OOL  O 
P M F
ROTECT  EDICARE  ROM 
S O  
UPPLIER  VERPAYMENTS 
 
 
Daniel R. Levinson   
Inspector General  
 
March 2013  
OEI-03-11-00350   
   
EXECUTIVE SUMMARY:  SURETY BONDS REMAIN AN UNDERUTILIZED  
TOOL TO PROTECT MEDICARE FROM SUPPLIER OVERPAYMENTS  
OEI-03-11-00350 
 
WHY WE DID THIS STUDY 
 
In 2009, the Centers for Medicare & Medicaid Services (CMS) began to require suppliers 
of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) to obtain a 
minimum of $50,000 in surety bond coverage per location.  A surety bond is issued by an 
entity (the surety) guaranteeing that the surety will pay CMS the amount of any monetary 
obligations incurred during the term of the bond, and for which the supplier is 
responsible, up to the suretys maximum  obligation.  Surety bonds can discourage 
enrollment of fraudulent suppliers and aid the recovery of debts owed to Medicare.  We 
set out to determine the extent to which CMS maintains complete and accurate surety 
bond data and to determine the amount of supplier debt that could have been recovered 
through surety bonds. 
 
HOW WE DID THIS STUDY  
 
We requested from CMS information on all outstanding overpayments that were 
identified for collection between October 2, 2009, and April 1, 2011.  We also requested 
information regarding suppliers surety bond coverage and requested CMSs written 
procedures for recovering DMEPOS overpayments through surety bonds. 
 
WHAT WE FOUND 
 
Two years after the surety bond requirement was implemented, CMS did not have 
accurate surety bond information for all suppliers.  Information for thousands of bonded 
suppliers was missing, and surety bond amounts were not consistently maintained by 
supplier location. Bonded suppliers have tens of millions in uncollected overpayments.  
As of July 2012, CMS reported it collected $263,000 from the millions in overpayments 
eligible for surety bond recovery.  Most of these overpayments will likely remain 
uncollected because a number of suppliers had overpayments of more than $50,000, and 
CMS can recover only up to the amount of the surety bond.    
 
WHAT WE RECOMMEND 
 
We recommend that CMS: (1) improve oversight of supplier data to ensure accurate and 
consistent information, (2) immediately begin utilizing the surety bond requirement to 
recover outstanding overpayments from suppliers surety bonds, (3) consider using the 
legislative authority given by the Patient Protection and Affordable Care Act of 2010 to 
require increased surety bond amounts for suppliers that receive high overall Medicare 
payments, and (4) revise collection guidelines to state that collection of debts through 
surety bonds is based on dates of service. CMS concurred with all four recommendations.   
 
   
   
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................7 

Findings......................................................................................................11 
 
Two years after the surety bond requirement was implemented, 

CMS did not have complete or accurate surety bond information 

for all suppliers ..............................................................................11 
 
CMS has yet to recover millions of dollars in supplier debt..........12 

Conclusion and Recommendations ............................................................15 

Agency Comments and Office of Inspector General Response .....18 

Appendix A:  Agency Comments ..............................................................20 

Acknowledgments......................................................................................23 

 
 
   
   
OBJECTIVES 
To determine: 
1. 	  the extent to which the Centers for Medicare & Medicaid Services 
(CMS) maintains complete and accurate surety bond information for 
suppliers of durable medical equipment, prosthetics, orthotics, and 
supplies (DMEPOS), and 
2. 	  the number of DMEPOS suppliers with overpayment debt, the extent 
to which these suppliers had surety bond coverage, and the amount of 
overpayment debt that could have been recovered through surety 
bonds from October 2009 to April 2011.   
BACKGROUND 
Historically, Medicare Part B DMEPOS have been highly vulnerable to 
fraud and abuse. As early as 1997, the Office of Inspector General (OIG) 
reported that 1 of every 14 DMEPOS suppliers (suppliers) and 1 of every 
9 new applicants did not have a required physical address.1  Additionally,  
41 percent of suppliers failed to meet at least one supplier standard, such as 
those related to warranties, information for customers, and inventories.  A  
2005 Government Accountability Office (GAO) report concluded that 
Medicares standards for screening suppliers for enrollment were insufficient 
to prevent illegitimate businesses from enrolling in Medicare.2  In 2007 and 
2008, OIG conducted unannounced site visits in South Florida and 
Los Angeles and found that some suppliers visited were not in compliance 
with basic supplier standards, providing further evidence of the insufficiency 
of supplier enrollment standards.3  
CMS has taken steps to improve the supplier enrollment process.  For 
example, CMS has implemented new accreditation and supplier enrollment 
standards and now requires certain types of suppliers to obtain surety bonds.4   
A surety bond is a bond issued by an entity (the surety) guaranteeing that a 
supplier will fulfill an obligation or series of obligations to Medicare.  If the 
obligation is not met, the surety covers losses up to the bond amount.  
 
1 OIG,  Medical Equipment Suppliers:  Assuring  Legitimacy, OEI-04-96-00240,  
December 1997. 

2 GAO,  More Effective Screening and Stronger Enrollment Standards Needed for 

Medical Equipment Suppliers, GAO-05-656, September 2005. 
 
3 OIG,  South Florida  Suppliers Compliance with Medicare Standards:  Results from 

Unannounced Visits, OEI-03-07-00150, March  2007; OIG,  Los Angeles County 

Suppliers Compliance With Medicare  Standards: Results From Unannounced Site Visits, 

OEI-09-07-00550, February  2008. 

4  42  CFR  424.57(c)(22), 424.57(c)(24), and 424.57(c)(26).   
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  1   
   
Specifically, the surety bond guarantees that the surety will pay CMS the 
amount (including accrued interest) of any overpayments, civil monetary 
penalties, or assessments incurred during the term of the bond and for which 
the supplier is responsible, up to the suretys maximum obligation.5  
Surety Bonds for DMEPOS Suppliers 
Section 4312(a) of the Balanced Budget Act of 1997, P.L. 105-33, amended 
section 1834(a) of the Social Security Act to require as a condition of 
enrollment that DMEPOS suppliers maintain a surety bond of at least 
$50,000.  CMS promulgated a final rule on January 2, 2009, requiring 
certain DMEPOS suppliers to furnish CMS with a surety bond.6   The final 
rule became effective on March 3, 2009. New suppliers were required to 
obtain a surety bond by May 4, 2009, while enrolled suppliers had until 
October 2, 2009, to obtain a surety bond.7     
According to the final rule, the purpose of the surety bond requirement is to 
(1) limit Medicares risk from fraudulent suppliers; (2) enhance the 
enrollment process to ensure that only legitimate suppliers are enrolled or 
remain enrolled; (3) ensure recovery of erroneous payments resulting from  
fraudulent billing practices; and (4) ensure that beneficiaries receive 
products and services that are reasonable and necessary from legitimate 
suppliers.8  
The final rule provides exemptions from the surety bond requirement for the 
following types of suppliers: 
	   government-operated suppliers (if the supplier has provided CMS with a 
comparable surety bond under State law); 
	   State-licensed orthotic and prosthetic personnel in private practice 
making custom-made orthotics and prosthetics (if the business is  
solely owned and operated by the orthotic and prosthetic personnel, and 
if the business is billing only for orthotics, prosthetics, and supplies); 
	   physicians and nonphysician practitioners (if the items are furnished only 
to the physician or nonphysician practitioners own patients as part of the 
service); and   
	   physical and occupational therapists in private practice (if the business is 
solely owned and operated by the physical or occupational therapist, 
items are furnished only to the therapists own patients as part of the 
 
5 42 CFR   424.57(d)(5). 

6 74 Fed. Reg. 166167  (Jan. 2, 2009). 

7 42 CFR   424.57(d)(1). 

8 74 Fed. Reg. 166167  (Jan. 2, 2009). 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  2   
   
service, and the business is billing only for orthotics, prosthetics, and 
supplies).9    
All nonexempt suppliers are required to obtain a surety bond from an 
authorized surety.10  CMS requires nonexempt suppliers to provide surety 
bond information and documentation upon enrollment.  The supplier must 
submit a copy of the original surety bond with the enrollment application.11    
The surety bond must be in the amount of at least $50,000 for each assigned 
National Provider Identifier (NPI) for which the supplier is seeking to 
acquire Medicare billing privileges.12  A supplier with multiple practice 
locations must secure a surety bond for each location.13  A supplier has the 
option of obtaining a single surety bond that encompasses all of its practice 
locations.14    
Suppliers against which final adverse actions have been taken are considered 
to pose a higher than average risk to the program and must obtain an 
elevated surety bond, at a rate of an additional $50,000 for each final adverse 
action imposed against them.15  For example, if a suppliers billing privileges 
had been revoked or suspended in the preceding 10 years, the supplier would 
need to secure an elevated surety bond in the amount of $100,000 (i.e., the 
base amount of $50,000 plus an additional $50,000 because of the final 
adverse action). 
Provisions in the Patient Protection and Affordable Care Act of 2010 also 
give the Secretary of Health and Human Services the authority to increase 
 
9 42 CFR   424.57(d)(15)(i). 

10  42 CFR   424.57(d)(2).   As  defined at 42 CFR 424.57(a), the term authorized surety 

means a surety that has been issued a Certificate of Authority by the U.S.  Department of 

the Treasury as an acceptable surety on Federal bonds and the certificate has neither 
 
expired nor been  revoked.  

11 42 CFR   424.57(d)(2) and (d)(4); CMS, Medicare Program Integrity Manual, 

Pub.  No. 100-08, ch. 10,  21.7(A)(2). 

12 42 CFR   424.57(d)(2). 

13CMS, Medicare Program Integrity Manual, Pub.   No. 100-08, ch. 10,  21.7(A)(3). 
 
Suppliers generally pay a fee of approximately $1,500 (or 3 percent  of the  value of a 

$50,000 bond)  to obtain a bond. 

14 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 10,   21.7(A)(3). 

15 42 CFR    424.57(a) and (d)(3); CMS, Medicare Program Integrity Manual, 

Pub.  No. 100-08, ch. 10,  21.7(A)(3).  An adverse legal action includes a 

Medicare-imposed revocation  of any Medicare billing number; revocation or suspension  

of a license to  provide health care by any State licensing authority; revocation for failure 

to meet quality standards; a conviction of a Federal or State felony  offense within the last 

10 years preceding enrollment, revalidation,  or re-enrollment; or an exclusion or
  
debarment from participation in a Federal  or State health care program.
    
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  3   
   
surety bond requirements for suppliers on the basis of the companys billing 
volume.16   
CMS Contractors 
Two types of contractors have responsibilities with regard to suppliers:  
durable medical equipment Medicare administrative contractors (DME 
MAC) process DMEPOS claims, and the National Supplier Clearinghouse 
(NSC) oversees supplier enrollment.   
DME MACs.  DME MACs are responsible for processing DMEPOS claims  
and determining whether those claims are complete and should be paid.  In 
certain instances, improper payments are made to providers, suppliers, or 
beneficiaries, resulting in underpayments or overpayments.  If a DME MAC 
makes a final determination of an overpayment, it must follow specific 
procedures when recovering, reporting, and referring overpayments.17 On a 
monthly basis, DME MACs must submit to CMS a detailed report of all 
outstanding overpayments and all actions occurring for any overpayment in 
the preceding month.18  
NSC. NSC is responsible for overseeing Medicare supplier enrollment.  
NSC processes all new supplier applications for billing numbers and ensures 
that enrolled suppliers meet established standards.19  Before granting billing 
privileges, NSC may conduct an unannounced site visit to determine 
whether a supplier meets all Medicare supplier standards.  NSC is required 
to perform unannounced site visits for moderate- and high-risk suppliers, but 
may also conduct unannounced site visits to any supplier.  If NSC finds after 
a site visit that a supplier no longer meets the supplier standards, NSC has 
the authority to revoke the suppliers billing privileges.20  Suppliers billing 
privileges also may become inactive.   This can happen for a number of 
reasons, such as voluntary inactivation or failure to submit claims for four 
consecutive quarters. 
Additionally, NSC issues letters to suppliers that require elevated surety 
bond amounts and revocation letters to suppliers that lack required surety 
bonds. NSC also provides CMS with data on the status of suppliers surety 
bonds and of their accreditation. 
 
16 The Patient Protection and Affordable Care Act, P.L. 111-148   6402(g)  (amending  
Social Security Act,  1834(a)(16)(B)). 
17 CMS, Durable Medical Equipment Medicare Administrative Contractor:  Attachment 
 
J-01Statement of  Work Procurement  of  DME MAC Jurisdictions A & B,   5.4 and 5.5. 
 
18 Ibid,  5.3, p.  55. 

19 CMS, National Supplier Clearinghouse Medicare Administrative Contractor Statement
  
of Work,  I.A.,  I.B., and II.1.14. 
 
20 42 CFR   424.57(c)(8), 424.517, and 424.518; 76 Fed. Reg.  5862, 5866 (Feb. 2, 

2011). 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  4   
   
Prior to October 2010, NSC used the Provider Information Management 
System (PIMS) to store and maintain supplier information.  However, in 
October 2010, NSC transferred supplier information from PIMS to the 
Provider Enrollment, Chain, and Ownership System (PECOS), so supplier 
information is now stored in PECOS.  PECOS is the repository for all 
collected and verified health care provider enrollment information, including 
surety bond information, and provides a single national enrollment record 
for each provider or supplier.  
Overpayment Recovery Through Surety Bonds 
In January 2012, CMS finalized its procedures for recovering, through surety 
bonds, overpayments made to suppliers.  These procedures became effective 
on February 21, 2012. According to these procedures, DME MACs can 
make a claim against a surety for the recovery of overpayments related to 
payments made on or after March 3, 2009.21    
Debt Collection Procedures. The procedures for collection on surety bonds 
incorporate the existing collection procedures for all providers in the 
Medicare Financial Management Manual.2 2  Under these procedures, once 
the DME MAC makes a final determination on an overpayment, a first 
demand letter is sent to the supplier (for overpayments of $10 or more).  The 
first demand letter requests that the supplier refund the overpaid amount, 
informs the supplier how the DME MAC will recover the overpayment if  
repayment is not made, explains when interest will begin to accrue, and 
informs the supplier of the right to request a review or hearing.  If the 
overpayment is not paid in full by the 30th day after the first demand letter is 
sent to the supplier, interest begins to accrue on the 31st day. 23    
Once 101 days have passed since the initial demand letter was sent and no 
payment or partial payment has been received, the DME MAC must attempt 
to recover the overpayment through the surety bond.24   The DME MAC 
notifies the surety by letter that the amount of the overpayment (plus any 
accrued interest) must be paid to CMS within 30 days.  The DME MAC can 
seek repayment only up to the total sum of the surety bond (i.e., $50,000 for 
most suppliers).25    
If the surety does not pay the amount of the overpayment within 30 days, the 
overpayment becomes eligible for debt referral to the Department of the 
 
21 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15,   15.21.7.1. 
22 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, 

 15.21.7.1(A)(2). 
 
23 CMS, Medicare Financial Management Manual, Pub.  No. 100-06,  ch. 4,  90.2. 
 
24 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, 

 15.21.7.1(A)(2). 
 
25 Ibid. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  5   
   
Treasury.26  Once the overpayment debt has been referred and accepted, 
DME MACs terminate active collection efforts.27   
Related OIG Studies 
As stated previously, in 1997 OIG reported that 1 of every 14 suppliers and 1 
of every 9 new applicants did not have a required physical address.28   
Additionally, 41 percent of suppliers failed to meet at least one supplier 
standard, such as those related to warranties, information for customers, and 
inventories. The report noted that the ease and low expense of acquiring a 
supplier number facilitated the entry of abusers into Medicare. 
In 2006, OIG conducted unannounced site visits of 1,581 suppliers in three 
South Florida counties and found that 31 percent did not maintain physical 
facilities or were not open and staffed, contrary to Medicare requirements.29   
In a subsequent report, OIG found that nearly half of 491 South Florida 
suppliers whose billing privileges had been revoked appealed and received 
hearings and that hearing officers reinstated the billing privileges of 
91 percent of these suppliers.30  However, two-thirds of the suppliers whose 
billing privileges were reinstated had subsequently had these privileges 
revoked or inactivated, and some individuals connected to suppliers with 
reinstated billing privileges had been indicted.   
In 2007, OIG conducted unannounced site visits of suppliers in Los Angeles 
County and found that 13 percent of the 905 suppliers visited did not 
maintain a physical facility or were not open and that an additional 9 percent 
did not meet additional standards.31    
In a May 2010 report, OIG determined the collection status, as of  
June 2008, of overpaymentsidentified by program safeguard contractors 
that had been made to South Florida suppliers and referred to claims  
processors for collection in 2007. OIG found that the collection rate of those 
overpayments was only 1 percent, compared to a national DMEPOS 
collection rate of 3 percent.32   Additionally, the report found that Medicare 
 
26 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, 
 15.21.7.1(A)(2).  Debts ineligible for referral include those in  bankruptcy status, in an  
appeal status, under a fraud and abuse investigation, or for which the debtor is deceased. 
27 CMS, Medicare Financial Management Manual, Pub.  No. 100-06,  ch. 4,  80.2.  
28 OIG,  Medical Equipment Suppliers:  Assuring  Legitimacy, OEI-04-96-00240, 
 
December 1997. 

29 OIG,  South Florida  Suppliers Compliance with Medicare Standards:  Results From  

Unannounced Visits, OEI-03-07-00150, March  2007. 
30 OIG,  South Florida Durable Medical Equipment  Suppliers:  Results  of Appeals, 

OEI-03-07-00540, October  2008. 

31 OIG,  Los Angeles County Suppliers Compliance with Medicare Standards:  Results 

From Unannounced Site Visits, OEI-09-07-00550, February 2008.  

32 OIG,  Collection Rate for Overpayments Made to  Medicare Suppliers in South Florida, 

OEI-03-09-00570, May 2010. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  6   
   
could have recovered an additional $15 million, or 6 percent, of 
South Florida DMEPOS overpayment dollars if the surety bond requirement 
had been in place at the time of the study.   
In September 2011, OIG issued an early alert memorandum report detailing 
the early findings of the current study.33 OIG found that CMS had not 
finalized procedures for recovering DMEPOS overpayments through surety 
bonds.34  In addition, as of July 2011, no overpayments had been recovered 
through surety bonds since October 2, 2009, the date the surety bond 
requirement became effective for all suppliers.    
METHODOLOGY 
Scope 
Our study focused on nonexempt suppliers with overpayments identified 
between October 2, 2009the date that all nonexempt suppliers were 
required to have a surety bondand April 1, 2011.  These overpayments 
were still outstanding as of August 31, 2011.     
Data Collection 
In August 2011, we requested from CMS  information on overpayments 
made to all bonded suppliers.  Specifically, we requested information on 
currently outstanding overpayments made to bonded suppliers that were 
identified for collection between October 2, 2009, and April 1, 2011 (i.e., an 
initial demand letter had been sent to the supplier during that timeframe).   
We defined an outstanding overpayment as the total supplier-owed principal 
amount of all overpayments not under appeal, minus any adjustments, 
reductions, or partial payments, for which the supplier was not in active 
repayment status.  We requested the total outstanding overpayment amount, 
plus accrued interest, for each bonded  supplier and supplier location.  We  
requested each suppliers billing status as of August 31, 2011.   
In addition to the total overpayment amounts for each bonded supplier, we 
requested the amount of surety bond coverage for each separate supplier 
location. 
In response to our data request, CMS stated that it would be difficult to 
provide the surety bond information for the specific suppliers with 
outstanding overpayments because overpayment data and surety bond data 
are maintained in different database systems.  Instead, CMS provided 
overpayment data from its DME MACs for all suppliers (both exempt and 
 
33 OIG,  Use of Surety Bonds to Recover Overpayments  Made to  Suppliers of Durable 
Medical Equipment, Prosthetics, Orthotics, and Supplies:  Early Findings, 
OEI-03-11-00351, September  2011. 
34 CMS subsequently finalized  these procedures in January 2012. 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  7   
   
nonexempt) with outstanding overpayments identified between October 2, 
2009, and April 1, 2011.  CMS provided us with this information at the end 
of September 2011.     
Separately, CMS provided surety bond information for all suppliers who 
were bonded between October 2, 2009, and April 1, 2011.  However, OIG 
identified problems with these data, which caused CMS to have multiple 
delays in providing updated data to OIG.  The final data related to suppliers  
surety bonds was not received until July 2012.   
Data Analysis  
Overpayment Data. DME MACs provided to OIG information for a total of 
3,111 suppliers with outstanding overpayments.  Because suppliers can bill 
multiple DME MACs (depending on the beneficiary address), some  
suppliers appeared in more than one DME MACs overpayment information.  
We combined all overpayments for these suppliers to determine the 
overpayment amount for each unique supplier NPI.  To do this, we verified  
that each suppliers NPI, name, address, and billing status were consistent 
across contractors. We determined that a total of 2,927 unique suppliers had 
outstanding overpayments identified between October 2, 2009, and April 1, 
2011. 
From the overpayment data set, we excluded suppliers that had an 
overpayment amount of less than $10.35   We also excluded suppliers with 
billing privileges that were inactive or revoked before October 2, 2009, 
because they would not be subject to the surety bond requirement.  
Additionally, we excluded suppliers that CMS reported as exempt or that we 
determined were likely to be exempt from the surety bond requirement.  To  
determine which suppliers were likely to be exempt, we used the primary 
specialty code provided by CMS for each nonbonded supplier.36  The total 
number of suppliers with outstanding overpayments meeting our inclusion 
criteria was 1,429. 
 
35 DME MACs  do  not  send a demand letter unless the overpayment is $10 or more 
(CMS, Medicare Financial Management Manual, Pub.  No. 100-06,  ch. 4,  90.2);  
however, there were a number of identified overpayments in the data  set provided  by  
CMS that were under  $10. 
36  We considered suppliers with any of the following  primary specialty codes to  be  
exempt from the surety  bond  requirement:  physician,  physical therapist, medical supply 
company with  orthotic  personnel, medical supply company with  prosthetic personnel, 
prosthetic  personnel,  orthotic personnel, and optician.  Suppliers we considered  
nonexempt included those with the following primary specialty codes:  medical supply  
company, medical supply company with respiratory therapist, home health agency, 
nursing  facility, and  pharmacy.  We excluded two additional suppliers that did  not have  
specialty codes and had inactive billing privileges but did not have status dates (i.e., we 
could not determine when they became inactive).   
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  8   
   
Surety Bond Data. In October 2011, CMS provided information for  
54,695 suppliers that had surety bonds between October 2, 2009, and  
April 1, 2011.  Because we found discrepancies and inconsistencies within 
this information, we asked CMS to verify it.  In December 2011, CMS 
resubmitted to OIG surety bond information for 82,458 suppliers that had 
surety bonds between October 2, 2009, and April 1, 2011.  From this data 
set, we combined suppliers with matching NPIs, resulting in a total of  
77,898 suppliers. 
Merged Overpayment and Surety Bond Data.  To determine how many of the 
1,429 suppliers with outstanding overpayments also had surety bonds, we 
matched these suppliers NPIs with those of the 77,898 suppliers with surety 
bonds.37   We determined that 1,117 suppliers had surety bonds.     
For each of the 1,117 suppliers, we calculated the total amount of 
outstanding debt (overpayment principal plus accrued interest) and the 
amount that could have been recovered from surety bonds.  From our 
review of the surety bond data for all 77,898 bonded suppliers, we 
determined that the surety bond information was not always reported by 
practice location. Because we could not determine whether records 
showing surety bond amounts greater than $50,000 reflected elevated 
bonds (for high-risk suppliers) or were data errors, we calculated possible 
recovery amounts for each supplier based on a bond amount of $50,000, 
resulting in a conservative estimate.  For the suppliers that owed less than  
$50,000, we used the amount owed as the amount that CMS could have 
recovered. For suppliers that owed $50,000 or more, we used $50,000 as 
the amount CMS could have recovered.     
We also calculated the total amount of debts for the remaining  
312 suppliers that lacked surety bonds.  
Limitations 
The DME MACs provided suppliers  aggregated overpayment amounts 
identified between October 2, 2009, and April 1, 2011.  We did not 
validate any of the overpayment data provided by the DME MACs. 
Because we do not have information on the dates of individual 
overpayments, it is possible that some individual overpayments may have 
been from dates of service prior to surety bond coverage, which would 
make them ineligible for collection through surety bonds.   
 
 
 
37 For suppliers  missing an NPI in the overpayment data set, we used the supplier name  
and address to  determine whether a match existed in the surety bond data set.         
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  9   
   
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency. 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  10   
   
FINDINGS 
Two years after the surety  bond requirement was 
implemented, CMS did not have complete or accurate 
surety bond information for all suppliers 
Although surety bond coverage has been one of the requirements of supplier 
enrollment since March 2009, CMS lacked complete or accurate surety 
bond information for all suppliers as of October 2011.  Information for 
thousands of bonded suppliers was missing, and surety bond amounts were  
not consistently maintained in PECOS by supplier location.          
Surety bond data for over 27,000 suppliers were missing from 
CMSs provider data system  
In October 2011, CMS provided OIG with surety bond information for  
54,695 suppliers, which was extracted from PECOS, the current provider 
data system.  However, a comparison of these suppliers to the  
CMS-provided list of suppliers with overpayments resulted in very few 
matches.  In November 2011, at our request, CMS reviewed the data and 
discovered that information for a large number of suppliers was missing 
from PECOS.  CMS determined that errors had occurred during the  
October 2010 transition of supplier data from the previous data system 
PIMSto the current data system, PECOS.  As a result, data for 
27,763 suppliers had not been transferred from PIMS to PECOS and were  
thus missing from the initial data received.  After discovering this error 
2 years after suppliers were required to have bondsCMS provided OIG 
with an updated surety bond data set in December 2011 containing 
82,458 suppliers.   
CMS did not consistently maintain surety bond amounts by 
supplier practice location in PECOS, making it difficult to 
determine whether suppliers complied with the surety bond 
requirement  
Suppliers are allowed to obtain one bond to cover multiple practice 
locations, but each location must have at least $50,000 in coverage.  
Therefore, a supplier with 10 locations can obtain a single bond in the 
amount of $500,000 (i.e., $50,000 in coverage for each location).   
According to the surety bond data that CMS provided, 35 percent of the 
77,898  supplier locations had surety bond coverage greatly exceeding 
$50,000 (i.e., bonds over $500,000 per location).  Some of these appeared to 
be cases in which multiple supplier locations were covered under one large 
bond, but only the overall bond amountnot the location coverage 
amountwas reported for each location.  For example, one supplier had six 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  11   
   
locations, with a surety bond amount reported as $300,000 for each location.  
Because $300,000 divided by the six locations equals $50,000 in coverage 
per location, it is likely that this supplier had one $300,000 bond that 
covered all six locations for $50,000 each. 
In other cases, the surety bond coverage for specific locations could not be 
determined.  For example, CMS reported that one supplier had 12 locations, 
each with surety bond coverage reported as $20 million.  Even if this were 
the overall coverage amount, the coverage amount per location would have 
been approximately $1.7 million.   
Although suppliers are required to have a higher bond amount if they meet 
the criteria for having any adverse legal actions imposed against them, CMS 
staff stated that few suppliers meet this criteria.  Therefore, it is likely that  
bond amounts that greatly exceed $50,000 per supplier location were not 
accurately listed in CMSs database.   
CMS can recover debts only up to the amount of the surety bond coverage 
for a particular supplier location. Given the inconsistencies mentioned, it 
would be difficult for CMS to determine from the PECOS data whether a 
supplier with multiple locations covered under one bond was required to 
have elevated bonds for any of its locations.  According to CMS, if a 
supplier with multiple locations is required to obtain elevated bond coverage 
for one location but not the others, a manual search of enrollment records 
would have to be performed to determine which location has the elevated 
bond coverage. 
CMS has yet to recover millions of dollars in supplier 
debt  
We calculated the total debts owed by suppliers using the date that 
overpayments were identified.  From the data provided by CMS, we found 
1,429 suppliers with outstanding overpayments identified between  
October 2, 2009, and April 1, 2011.  As shown in Table 1, these   
1,429 suppliers owed $70 million to Medicare as of August 31, 2011.  We  
calculated that $50 million of this debt is owed by 1,117 suppliers that had 
surety bonds. In addition, we calculated that another $20 million is owed by 
312 suppliers without bonds. 
CMS did not finalize its guidelines to contractors for the collection of debts  
through surety bonds until January 2012, more than 2 years after the surety 
bond requirement was implemented.   CMS staff stated that significant 
personnel changes delayed the finalization of these guidelines.  These  
guidelines specify that recovery through surety bonds applies only to 
overpayments with payment dates made on or after March 3, 2009.     
 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  12   
   
Table 1:  Medicare Debts Owed by  Suppliers as of  August 31, 2011  
Percentage of  
Number of  
Surety Bond Coverage   Suppliers   Total Medicare Debt  
Suppliers  
With Debts 
Bonded Suppliers   1,117  78.2%   $50,090,879  
Suppliers Without Surety Bonds   312  21.8%  $20,395,517 
   
  Suppliers With Billing 
  Privileges Revoked or 
  Inactivated Between 10/3/09  289 
  and 12/31/09 
  Suppliers  With Billing  22 
  Privileges Revoked or 
  Inactivated After 12/31/09 
  1  
  Nonexempt Suppliers 
  Without Surety Bonds 
 
     Total   1,429   100%   $70,486,396  
 
Source: OIG analysis of overpayment and surety bond data 
 
In its comments on the draft report, CMS recalculated the debt owed by 
bonded suppliers using data that included only overpayments with dates of 
service on or after March 3, 2009.  Using dates of service to determine 
eligible overpayments, CMS found that 1,190 bonded suppliers had a total 
Medicare debt of $32 milliona difference of $18 million from our 
calculation. The use of dates of service to calculate the debt is not 
consistent with CMSs January 2012 guidelines that apply only to 
overpayments with payment dates of March 3, 2009 or after. Because a 
payment can be made months after the date of service, calculations based on 
dates of service versus dates of payment may differ.  Although CMSs  
calculations show that $18 million of the total debt calculated by OIG may 
not be eligible for recovery through surety bonds, this amount would remain  
an outstanding debt to Medicare. 
Millions of dollars continue to be owed by suppliers.  In its comments on 
the draft report, CMS reported that as of July 2012, it has recovered 
$263,000 of the millions in overpayments that it determined were eligible 
for recovery from surety companies.        
With a surety bond amount of $50,000, CMS cannot recover all of the  
overpayments owed by bonded suppliers.  Based on our analysis, each of 
the 1,117 bonded suppliers had at least $50,000 in coverage.  Because CMS 
is able to recover only up to the amount of the surety bond, most 
($42 million) of the $50 million owed by bonded suppliers will likely 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  13   
   
remain uncollected.  Ninety-eight suppliers in our analysis had 
overpayments of more than $50,000; 80 percent of these suppliers owed 
more than $100,000, and 27 percent owed more than $500,000.  One 
supplier had a total debt of $5 million.  For these suppliers, a surety bond of  
$50,000 would recover only a very small percentage of their debt.38  
Over $20 million in debt is owed by suppliers without surety bonds; the 
majority of these suppliers had their billing privileges revoked or inactivated 
within 3 months after the surety bond requirement date.  Of the 
1,429 suppliers with debts, 312 suppliers did not have surety bonds.  As 
shown in Table 1, these nonbonded suppliers owed  $20 million.  Most of 
these suppliers (289) had their billing privileges revoked or inactivated 
between October 3, 2009, and December 31, 2009.  CMS reported that it 
did not immediately revoke the billing privileges of suppliers that did not 
have a surety bond by the October 2, 2009, deadline because it needed  
several weeks to confirm whether suppliers had bonds.  Because these 
312 suppliers did not obtain surety bonds and are no longer actively billing, 
it is unlikely that their debts will be recovered.        
 
 
38 As discussed in the methodology, the overpayments owed  by suppliers were identified  
between October 2, 2009,  and  April 1, 2011.   It  is possible that  some  overpayments 
identified may  not  have been for dates of service covered during the term of the bond  
and, therefore, would not be eligible for collection through  the bond.   
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  14   
   
CONCLUSION AND RECOMMENDATIONS 
Fraud and abuse among DMEPOS suppliers is not a recent challenge for 
Medicare; the problem of suppliers enrolling in Medicare and billing 
millions of dollars in fraudulent claims has been well documented for 
years. Although CMS has made changes to strengthen the enrollment 
process, including implementing the surety bond requirement, millions of 
dollars continue to be at risk. 
Section 4312(a) of the Balanced Budget Act of 1997 requires certain 
suppliers to obtain a surety bond as a condition of Medicare enrollment.  
The surety bond requirement is a program integrity tool that is intended to 
safeguard the enrollment process by discouraging fraudulent providers 
from enrolling and by providing an additional method to recover debts.  
However, multiple inaccuracies and inconsistencies within CMSs surety 
bond data raise concerns regarding CMSs ability to promptly and 
effectively recover debts from surety bonds.  Specifically, surety bond 
amounts for some supplier locations could not be determined because 
overall bond amounts were reported instead of per-location amounts.  
Because CMS can recover debts only up to the bond amount, CMS would 
have difficulty determining the maximum amount that could be recovered 
from bonds without knowing the coverage amounts for specific supplier 
locations. 
The findings in this report also raise concerns about the accuracy of surety 
bond information in CMSs PECOS database.  A significant number of 
suppliers were originally missing from PECOS, an error CMS discovered 
during data collection for this report 2 years after the surety bond 
requirement was implemented.   
Between October 2, 2009, and April 1, 2011, CMSs contractors identified 
millions in overpayments paid to bonded suppliers. However, as of 
August 2011, CMS had yet to utilize the surety bond requirement to 
recover these overpayments.  Furthermore, a number of suppliers had 
overpayments much greater than the $50,000 minimum amount for a 
surety bond; therefore, only a small percentage of these suppliers  
overpayments could be recovered under current surety bond requirements.   
As of July 2012, CMS reported that they had collected from supplier 
surety bonds only $263,000 of the millions identified for surety bond 
recovery.  While the OIG and CMS total debt calculations differ, it is clear 
that tens of millions of dollars in debt remain uncollected from suppliers.    
By utilizing surety bonds as a program integrity tool, CMS has the 
potential to recover millions of dollars in overpayments from suppliers.  
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  15   
   
To ensure that it is maximizing the effectiveness of this program integrity 
tool, we recommend that CMS: 
Improve Oversight of Supplier Data to Ensure Accurate and 
Consistent Information  
To efficiently recover debts through surety bonds, CMS needs to ensure 
(on an ongoing basis) that supplier information maintained in PECOS is 
accurate, consistent, and accessible.  CMS should add new data fields and 
expand the data functions within PECOS specifically for supplier 
information.  Edits (i.e., data system  processes to ensure proper payment 
of claims) should be established for certain fields to prevent clerical errors.  
For example, surety bonds in the amounts of $5,000 or $500,000,000 for a 
single location should be flagged as potential typographical errors for the 
typical surety bond amount of $50,000. CMS should also create data 
fields so that both per-location and overall surety bond amounts are 
available. This will increase efficiency by allowing CMS to quickly 
obtain the surety bond amount per location, eliminating the need for 
manual searches, and providing an additional accuracy check.   
Additionally, because of the systemic issues and data errors revealed 
throughout our study, CMS should review all surety bond data in PECOS 
to identify other discrepancies or errors resulting from the transition from  
PIMS to PECOS. 
Immediately Begin Utilizing Surety Bonds to Recover Debts 
From Bonded Suppliers 
More than 2 years have passed since the surety bond requirement was 
implemented, yet CMS has not comprehensively used this valuable 
program integrity tool to recover the millions of dollars owed by suppliers.  
CMS should immediately begin making claims against sureties for all 
bonded suppliers with outstanding debts.     
Consider Using the Legislative Authority Given by the Patient 
Protection and Affordable Care  Act of 2010 To Require 
Increased Surety Bonds Based on Suppliers Billing Volume  
With a surety bond amount of $50,000, $42 million of the $50 million in 
total debt owed by bonded suppliers may remain uncollected because a 
number of suppliers had outstanding overpayments much greater than 
$50,000. Provisions in the Patient Protection and Affordable Care Act 
give the Secretary of Health and Human Services the authority to increase 
surety bond amounts for suppliers based on the billing volume of the 
company.   To provide CMS with the ability to recoup a higher percentage 
of overpayments made to suppliers, CMS should consider increasing 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  16   
   
surety bond amounts above $50,000 for suppliers with high overall 
Medicare payments.  
Revise Collection Guidelines to State That Collection of Debts 
Through Surety Bonds is Based on Dates of Service  
The collection guidelines, which were finalized in January 2012, state that 
a surety is liable for overpayments related to payments made on or after 
March 3, 2009. However, in calculating the total debt owed by bonded 
suppliers in response to the OIG draft report, CMS used overpayments 
related to claims with dates of servicenot payment datesafter 
March 2009. Therefore, we recommend that CMS revise the collection 
guidelines to state that a surety is liable for overpayments related to 
payments made for claims with dates of service on or after March 3, 2009. 
 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  17   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
CMS concurred with all four of the report recommendations but disagreed 
with OIGs conclusions.   
Regarding the first recommendation, CMS agreed that there are 
opportunities for improvement in how surety bond information is captured 
within PECOS. CMS stated that it will be implementing enhancements to 
PECOS in 2013 to increase accuracy and tracking of surety bond 
information. 
CMS concurred with our second recommendation and has begun 
collecting overpayments from bonded suppliers.  As of July 2012, CMS 
collected approximately $263,000 from supplier surety bonds.  CMS 
stated that the DME MACs are continuing to make requests for payments 
from sureties; therefore, it expects more overpayments to be collected as a 
result. 
CMS concurred with our third recommendation.  CMS is considering 
issues and options related to a requirement that the DMEPOS surety bond 
be commensurate with the volume of a suppliers billing.  CMS also is 
considering the possibility of requiring home health agencies and certain 
other provider and supplier types to obtain and maintain surety bonds as a 
condition of enrollment.   
CMS concurred with our fourth recommendation and will revise the 
guidelines so they state that surety bond collection is based on the date the 
service was provided. 
In its comments to this report, CMS disagreed with OIGs conclusion that 
bonded suppliers had overpayments of $50 million.  CMS stated that it re-
analyzed the data and calculated an overpayment amount of $32 million, 
not the $50 million calculated by OIGa difference of $18 million.  CMS 
calculated overpayments using the same criteria as OIG, with the 
exception of excluding overpayments based on claims with dates of 
service prior to March 2009. 
Because the data provided by CMS did not include payment or service 
dates for individual overpayments, OIG agrees that it is possible that some 
of the overpayments identified by OIG may relate to claims with dates of  
service prior to March 2009, making them ineligible for collection through 
surety bonds. OIG stated this methodological limitation in the draft report 
to CMS. Additionally, when OIG began data collection, CMS had yet to 
finalize its guidelines for surety bond collection.  While OIG recognizes 
that $18 million may not be recovered through surety bonds based on 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  18   
   
CMSs guidelines for surety bond collection that were finalized in January 
2012, the $18 million would remain an outstanding debt to Medicare.    
As a result of this study, OIG identified significant problems with surety 
bond data of which CMS had been unaware. CMS also was not prepared 
to collect overpayments using surety bonds until 3 years after the surety 
bond requirement was implemented and has collected a limited amount of 
overpayments from surety bonds to date.  Finally, most of the 
overpayments for bonded suppliers will likely remain uncollected because  
a number of the suppliers have overpayments of more than $50,000, and 
CMS can recover only up to the amount of the bond.  CMS stated that it 
understands the importance of surety bonds as a program integrity tool and 
is exploring multiple avenues to strengthen this important tool.   
The full text of CMSs comments is provided in Appendix A. 
 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  19  APPENDIX A 
Agency Comments 
l4 
~(1;\' l('~
DEPAKIMENT OF HEAL1H & HUMAN SERVICES 
Centers for Medicare & Medicaid SeNices 
Administrator 
Washington , DC 20201 
DATE:  MAR  0 4 2013 
TO: 	 Daniel R. Levinson 

Inspector General 

FROM: 	 M'ttiilyl'l Tavenner 

Actiilg Admipistrator 

SUBJECT: 	 Office oMuspector General (OIG) Draft Report: "Surety Bonds Remain an 
Underutilized Tool to Protect Medicare from Supplier Overpayments" 
(OEI-03-11-00350) 
The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 
comment on the OIG draft report entitled, "Surety Bonds Remain an Underutilized Tool to 
Protect Medicare from Supplier Overpayments." The objectives ofthe draft report were to 
determine:  1) the extent to which CMS maintains complete and accurate surety bond 
information for suppliers of durable medical equipment, prosthetics, orthotics, and supplies 
(DMEPOS), and 2) identify the number of DMEPOS suppliers with overpayment debt, the 
extent to which these suppliers had surety bond coverage, and the amount of overpayment debt 
that could have been recovered through surety bonds since October 2009. 
Since January 2012, when CMS finalized its contractor guidelines for collection of outstanding 
obligations from DMEPOS suppliers with surety bonds, CMS has been working to recover 
overpayment debts from DMEPOS suppliers by asserting claims against the surety companies. 
As of July 2012, CMS has successfully collected $263,000 from surety companies for DMEPOS 
supplier debts. In addition, there have been cases where DMEPOS suppliers have repaid 
overpayments on their own initiative once they become aware CMS referred their debt to the 
surety company for collection. CMS believes its efforts to collect outstanding obligations from 
surety companies will continue to spur DMEPOS suppliers to satisfy their Medicare debts. 
As noted in our technical comments to OIG, we disagreed with OIG's conclusions drawn from 
the data set utilized in its initial analysis. This is because in its initial request for overpayment 
data for this report, OIG asked for "information for all DMEPOS supplier overpayments 
identified between OctoQ.er 2. 2009. and A pril I . 2011, that currently are outstanding." 
Overpayments identified between October 2, 2009, and April l, 2011, which resulted from 
payments made prior to March 3, 2009, would not have been subject to collection from the 
surety . 
When CMS received the preliminary draft report, we obtained data from all four DME Medicare 
Administrative Contractors (MACs) and attempted to replicate the original OIG report excluding 
all overpayments based upon claims with a date of service prior to March 3, 2009. Our analysis 
indicated I, 190 bonded suppliers had a total Medicare debt (overpayment) of $31,829,604. The 
OIG has appropriately incorporated those comments into the report. 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11 -00350)  20   
   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  21   
   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  22   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Robert A. Vito, Regional 
Inspector General for Evaluation and Inspections in the Philadelphia 
regional office, and Linda M. Ragone, Deputy Regional Inspector General.   
Maria Schepise Johnson served as the team leader for this study, and 
Courtney Hilts assisted in conducting the study.  Central office staff who 
provided support include Scott Manley and Christine Moritz.  
 
 
DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350)  23   
   
Office  of Inspector General 
 
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452,  as amended, is  
to protect  the  integrity of  the Department of Health and  Human  Services (HHS)  programs, as  well as the  
health and welfare  of  beneficiaries served by those programs.   This statutory mission is carried out through  
a nationwide network  of audits, investigations, and inspections conducted  by the  following operating 
components:  
Office of  Audit  Services  
The Office  of  Audit Services  (OAS)  provides auditing services for  HHS, either by conducting audits  with  
its  own audit resources or by overseeing  audit work done by others.  Audits  examine  the  performance of  
HHS  programs and/or its grantees and contractors in carrying  out their  respective  responsibilities and are  
intended to provide independent assessments of  HHS  programs and operations.   These assessments  help 
reduce  waste, abuse, and mismanagement and  promote economy  and efficiency throughout  HHS.  
Office of  Evaluation  and  Inspections  
The  Office  of Evaluation and Inspections  (OEI) conducts  national evaluations to provide HHS, Congress,  
and the  public  with timely,  useful, and reliable information on significant issues.  These  evaluations focus  
on preventing fraud,  waste, or abuse and promoting economy, efficiency, and effectiveness  of  
departmental programs.   To promote impact, OEI reports  also present practical  recommendations  for  
improving program operations.   
Office of  Investigations  
The  Office  of Investigations (OI) conducts criminal, civil,  and administrative investigations  of  fraud  and  
misconduct related to HHS programs, operations,  and beneficiaries.  With  investigators working in all  
50  States  and  the District of Columbia, OI utilizes  its  resources by  actively  coordinating with the  
Department of Justice and  other Federal, State, and local law enforcement authorities.   The investigative  
efforts  of  OI  often lead to criminal convictions, administrative sanctions, and/or civil monetary  penalties.  
Office  of  Counsel  to  the Inspector  General  
The Office of  Counsel  to the Inspector General  (OCIG) provides general  legal  services to OIG, rendering 
advice  and opinions on HHS programs  and operations  and providing all  legal  support for OIGs  internal  
operations.  OCIG represents  OIG in all civil and administrative fraud and abuse cases involving  HHS  
programs, including False Claims  Act,  program exclusion, and civil  monetary  penalty cases.  In  
connection with these cases,  OCIG also negotiates and monitors corporate integrity agreements.   OCIG  
renders advisory opinions, issues compliance  program  guidance,  publishes fraud alerts, and provides  other  
guidance to the  health care industry concerning the anti-kickback statute and other  OIG enforcement  
authorities.