Department of Health and Human Services 
OFFICE OF 
   
IN  SPECTOR GENERAL 
 
 
 
 
 
 
 
 
A V
DDRESSING  ULNERABILITIES 
 
R   M
EPORTED BY  EDICARE 
 
B I
 ENEFIT  NTEGRITY 
 
C  
ONTRACTORS
 
 
 
 
 
 
Daniel R. Levinson  
Inspector General 
 
December 2011 
OEI-03-10-00500   E X E C U T I V E   S U M M A R Y  
OBJECTIVES
 
1.  To determine the extent to which the Centers for Medicare & 
Medicaid Services (CMS) has resolved vulnerabilities reported by 
Medicare benefit integrity contractors. 
2.  To determine the monetary impact of the reported vulnerabilities on 
the Medicare program. 
3.  To review CMSs procedures for tracking, reviewing, and resolving 
reported vulnerabilities. 
BACKGROUND 
One way that Medicare benefit integrity contractors help prevent fraud, 
waste, and abuse is by identifying program vulnerabilities.  This report 
provides information on the vulnerabilities reported by Medicare benefit 
integrity contractors in 2009.  Within Medicare Parts A and B, Program 
Safeguard Contractors (PSC) and Zone Program Integrity Contractors 
(ZPIC) are responsible for benefit integrity; within Parts C and D, 
Medicare Drug Integrity Contractors (MEDIC) perform that function.  
PSCs, ZPICs, and MEDICs are required to submit periodic vulnerability 
reports to CMS.  These reports describe vulnerabilities and may include 
recommendations for resolving them.  These reports also may contain 
the monetary impact of the vulnerabilities on Medicare.  For this study, 
we determined the number and monetary impact of vulnerabilities 
reported by PSCs, ZPICs, and MEDICs in 2009.  We reviewed the 
actions that CMS took to address or resolve these reported 
vulnerabilities.  We also reviewed CMSs policies and procedures for 
tracking, reviewing, and resolving the reported vulnerabilities. 
FINDINGS 
As of January 2011, CMS had not resolved or taken significant action 
to resolve 77 percent of vulnerabilities reported by contractors in 
2009.  Of the 62 vulnerabilities reported by contractors in 2009,  
48 (77 percent) had not been resolved as of January 2011, nor had CMS 
taken significant action to resolve them.  CMS indicated that of these  
48 reported vulnerabilities, 20 were currently under review and  
3 required additional analysis to determine whether they were actual 
vulnerabilities.  For the remaining 25, we determined from CMSs 
description that no action was taken or that the action taken was not 
significant.  CMS took significant action to resolve 14 of the 62 reported 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS   i  E X E C U T I V E   S U M M A R Y  
vulnerabilities, but only 2 of these 14 had been fully resolved by  
January 2011. 
Over half of the vulnerabilities submitted by contractors included detailed 
recommendations for CMS to resolve the vulnerabilities; however, most of 
the actions that CMS reported taking to resolve them were not the result 
of these contractor recommendations. 
Coding and/or billing vulnerabilities were the most common type of 
vulnerability reported by PSCs and ZPICs.  Vulnerabilities related to 
provider identifiers were the most common type of vulnerability reported 
by MEDICS.  
Contractors reported monetary impact for only one-third of 
vulnerabilities, but their estimated impact was $1.2 billion.  Only 21 
of the 62 vulnerabilities had an associated monetary impact reported by 
the contractor.  According to CMS staff, PSCs and ZPICs are required to 
report monetary impact, but less than half of their reports included this 
information.  MEDICs are not required to report monetary impact.   
The estimated impact of these 21 vulnerabilities was $1.2 billion, with 
the estimated impacts of individual vulnerabilities ranging from $77,692 
to $803,025,113.  None of these vulnerabilities had been resolved as of 
January 2011, although CMS had taken significant action to resolve four 
of them, including the two with the largest monetary impact  
($803 million and $99 million).  For these two vulnerabilities, 
implementation of corrective actions will not be complete until 2012.   
The monetary impact for the 17 vulnerabilities that were not resolved or 
for which significant action had not been taken was estimated to be  
$202 million.   
Because monetary impact was reported inconsistently or not at all, the 
actual monetary impact of the vulnerabilities reported in 2009 could be 
significantly greater than $1.2 billion.     
Although CMS has recently begun developing procedures to 
consistently track and review vulnerabilities, it lacks procedures to 
ensure that they are resolved.  The CMS divisions responsible for 
tracking and reviewing vulnerabilities have procedures that outline the 
general steps that they take to perform these tasks.  Although contractors 
have been submitting vulnerability reports for several years, CMS did not 
begin developing these procedures until June 2010.  Furthermore, only one 
of these CMS divisions has developed procedures to follow up on the 
implementation of corrective actions to resolve vulnerabilities.   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS   ii  E X E C U T I V E   S U M M A R Y  
RECOMMENDATIONS 
One of the ways that Medicare benefit integrity contractors help 
prevent fraud, waste, and abuse is by identifying program 
vulnerabilities.  To minimize the financial impact on Medicare, CMS 
needs to take prompt action to resolve vulnerabilities.  Only two of the 
vulnerabilities reported in 2009 had been resolved as of January 2011.   
Most of the vulnerability reports from 2009 did not contain information 
on monetary impact, and in those that did, monetary impact was not 
reported consistently.  Furthermore, none of the vulnerabilities with 
reported monetary impact had been resolved.  Significant action had 
been taken to resolve two of the vulnerabilities with the greatest 
monetary impact ($803 million and $99 million).  However, 
implementation of these actions will not be complete until 2012, 3 years 
after the vulnerabilities were reported.             
For CMS to gain sufficient oversight of program vulnerabilities, it must 
have policies and procedures for ensuring the prompt resolution of 
vulnerabilities.  In 2011, CMS was still reviewing vulnerabilities 
reported in 2008 and 2009 to determine whether they had been resolved 
or whether action still needed to be taken to resolve them. 
Therefore, we recommend that CMS: 
Determine the status of all vulnerabilities that have not been resolved and 
take action to address them 
Require all benefit integrity contractors to report monetary impact, when 
calculable, in a consistent format 
Ensure that vulnerabilities are resolved by establishing formal written 
procedures that include timeframes for followup and that outline CMS and 
contractor responsibilities regarding vulnerability resolution 
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with our first recommendation and is determining the 
status of all open vulnerabilities and taking action, when possible, to 
address them.  CMS stated that it has determined the status of all 
MEDIC-identified vulnerabilities.   
CMS did not concur with our second recommendation.  CMS stated that 
it would be challenging to require all benefit integrity contractors to 
report the monetary impact for each vulnerability and to use it in a 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS   iii  E X E C U T I V E   S U M M A R Y  
consistent methodology.  CMS noted that it could be labor intensive for 
the contractors to determine the dollars at risk for vulnerabilities and 
that not all vulnerabilities have a monetary impact that results in a loss 
to the Medicare Trust Fund.  Furthermore, CMS stated that different 
types of vulnerabilities would require different methods of calculating or 
estimating the monetary impact or would even make such a 
determination impossible or very difficult because of the time and 
resources required.  We understand that calculating the monetary 
impact for some vulnerabilities may not be possible and that different 
types of vulnerabilities would require different methods of calculating 
monetary impact.  However, for cases in which calculating the monetary 
impact is too burdensome or time consuming, the contractor should 
report the vulnerabilities and explain why the monetary impact could 
not be calculated.  Based on CMSs comments, we clarified the wording 
of this recommendation.      
CMS concurred in part with our third recommendation.  CMS stated 
that it has standard operating procedures in place and continues to 
actively manage reported vulnerabilities on a monthly basis.  CMS 
stated that it can establish timeframes for resolution on a case-by-case 
basis, but said that it will be difficult to establish standard timeframes 
because actions and resolutions to address vulnerabilities will vary.  
Although we agree that actions and resolutions will vary depending on 
the type of vulnerability, it is possible to have standard timeframes for 
following up to determine the status of the vulnerabilities.   
     
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS   iv   
 T A B L E   O F   C O N T E N T S  
EX ECUT I VE  SUM M ARY  .....................................i 
 
 
I NT RO DU CT I O N  ............................................ 1 
 
 
F I NDI NG S  .................................................  10 
As of January 2011, CMS had not resolved or taken significant  
action to resolve 77 percent of vulnerabilities reported by 
contractors in 2009......................................  10 
   
  Contractors reported monetary impact for only one-third of 
vulnerabilities, but their estimated impact was $1.2 billion .....  12 
   
Although CMS has recently begun developing procedures to  
consistently track and review vulnerabilities, it lacks           
procedures to ensure that they are resolved ..................  14 
 
 
RECO M M END AT I O N S  .....................................  16 
  Agency Comments and Office of Inspector General Response ....  17 
 
APP EN DI X  
  Agency Comments ......................................  19 
 
ACKNO WL E DG M E N T S .....................................  23   I N T R O D U C T I O N  
OBJECTIVES 
1.  To determine the extent to which the Centers for Medicare & 
Medicaid Services (CMS) has resolved vulnerabilities reported by 
Medicare benefit integrity contractors. 
2.  To determine the monetary impact of the reported vulnerabilities on 
the Medicare program. 
3.  To review CMSs procedures for tracking, reviewing, and resolving 
reported vulnerabilities. 
BACKGROUND 
One way that Medicare benefit integrity contractors help prevent fraud, 
waste, and abuse is by identifying program vulnerabilities.  This report 
provides information on the vulnerabilities reported by Medicare benefit 
integrity contractors in 2009.  Within Medicare Parts A and B, Program 
Safeguard Contractors (PSC) and Zone Program Integrity Contractors 
(ZPIC) are responsible for benefit integrity; within Parts C and D, 
Medicare Drug Integrity Contractors (MEDIC) perform that function.  
PSCs, ZPICs, and MEDICs are required to submit periodic vulnerability 
reports to CMS.  These reports describe vulnerabilities and may include 
recommendations for resolving them.  These reports also may contain 
the vulnerabilities monetary impact on Medicareinformation that 
allows CMS to understand the scope of the vulnerabilities and to 
prioritize those needing corrective actions.  For this study, we 
determined the number and monetary impact of vulnerabilities reported 
by PSCs, ZPICs, and MEDICs in 2009.  We reviewed the actions that 
CMS took to address or resolve these reported vulnerabilities.  We also 
reviewed CMSs policies and procedures for tracking, reviewing, and 
resolving the reported vulnerabilities.   
Medicare Integrity Program Contractors 
The Health Insurance Portability and Accountability Act of 1996 
established the Medicare Integrity Program and required CMS to use 
contractors to perform specific program integrity activities.1  These 
activities include, but are not limited to, cost-report auditing, medical 
review, provider education, and benefit integrity.  CMS awards task 
orders to these contractors to perform specific duties related to program 
 
1 P.L. 104-191  202, Social Security Act,  1893(a), 42 U.S.C.  1395ddd.   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  1  I N T R O D U C T I O N  
integrity.  These task orders require contractors to review Medicare 
data to identify cases of potential fraud, investigate these cases, and 
refer them to law enforcement.   
Program Safeguard Contractors and Zone Program Integrity Contractors.  
Beginning in 1999, CMS awarded benefit integrity task orders to PSCs to 
detect and deter fraud and abuse in Medicare Part A and/or Part B.  In  
2009the period of review for this study7 PSCs performed work under 
18 benefit integrity task orders, with each task order covering a specific 
geographic jurisdiction.   
CMS is transitioning the work of PSCs to ZPICs.  The transition is part 
of CMSs effort to consolidate fraud-fighting work in Parts A, B, C, and 
D under one type of contractor, the ZPIC.  Seven ZPICs will operate in 
the following geographic zones: 
  Zone 1:  American Samoa, California, Guam, Hawaii, the 
Mariana Islands, and Nevada. 
  Zone 2:  Alaska, Arizona, Idaho, Iowa, Kansas, Missouri, 
Montana, Nebraska, North Dakota, Oregon, South Dakota, 
Utah, Washington, and Wyoming. 
  Zone 3:  Illinois, Indiana, Kentucky, Michigan, Minnesota, 
Ohio, and Wisconsin. 
  Zone 4:  Colorado, New Mexico, Oklahoma, and Texas.  
  Zone 5:  Alabama, Arkansas, Georgia, Louisiana, Mississippi, 
North Carolina, South Carolina, Tennessee, Virginia, and 
West Virginia. 
  Zone 6:  Connecticut; Delaware; Maine; Maryland; 
Massachusetts; New Hampshire; New Jersey; New York; 
Pennsylvania; Rhode Island; Vermont; and Washington, D.C. 
  Zone 7:  Florida, Puerto Rico, and the U.S. Virgin Islands.  
Contracts for six of the seven ZPIC zones were awarded between 
September 2008 and April 2011.  ZPICs became operational in five 
zones1, 2, 4, 5, and 7between February 2009 and February 2011; 
ZPIC operations in Zone 3 have been delayed because of a postaward 
protest.  The contract for Zone 6 was awarded in September 2011. 
ZPICs currently perform work under a benefit integrity task order that 
includes work for Parts A and B, durable medical equipment, and home 
health and hospice.   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  2  I N T R O D U C T I O N  
The activities that PSCs and ZPICs perform are established through 
each type of contractors Statement of Work (SOW).  According to the 
SOWs for both contractor types, PSCs and ZPICs shall review and 
analyze a variety of data to focus program integrity efforts by  
(1) identifying program vulnerabilities; (2) identifying providers for 
review and investigation within their respective jurisdictions;  
(3) referring potential fraud, waste, and abuse cases to law enforcement; 
and (4) pursuing administrative actions.2   
Medicare Drug Integrity Contractors.  The Balanced Budget Act of 1997 
established Medicare Part C to allow eligible individuals to enroll in 
health plans offered by private companies approved by Medicare.3  The 
Medicare Prescription Drug, Improvement, and Modernization Act of 2003 
established Medicare Part D to provide prescription drug benefits under 
Medicare beginning January 1, 2006.4  In September 2006, CMS awarded 
contracts to three regional MEDICsWest, North, and Southeastto 
address potential fraud, waste, and abuse related to Part D benefits.  In 
2008, CMS added Part C to MEDICs oversight.   
MEDIC Wests contract was not renewed when it ended in  
September 2008.  In the 2 months following, CMS transitioned MEDIC 
Wests jurisdiction to the two remaining MEDICs.  In fall 2009, CMS 
again restructured the MEDICs, moving from a regionally based 
program to two national MEDICs with specific areas of focus.  MEDIC 
Southeast became the national Benefit Integrity (BI) MEDIC, and 
MEDIC North became the national Compliance and Enforcement 
MEDIC.  The BI MEDIC has responsibility for detecting and deterring 
fraud, waste, and abuse in Parts C and D nationwide. 
Reporting of Vulnerabilities 
CMS defines vulnerabilities to the Medicare program as instances of 
potential fraud, waste, or abuse identified through analyzing and  
   
 
2 CMS, Zone Program Integrity Contractor Statement of Work,  1.3, p. 49; CMS, 
Program Safeguard Contractor Statement of Work, ch. 7,  1, p. 58. 
3 The Balanced Budget Act of 1997, P.L. 105-33, Title IV,  4001; Social Security Act,     
 1851-1859. 
4 The Medicare Prescription Drug, Improvement, and Modernization Act of 2003,  
P.L. 108-173, Title I,  101(a)(2); Social Security Act,  1860D-1(a)(2), 42 U.S.C.  
 1395w-101.  
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  3  I N T R O D U C T I O N  
managing data on Medicare providers, suppliers, and beneficiaries.5  
Vulnerabilities may be specific (e.g., providers are receiving multiple 
payments as a result of incorrect coding) or general and programwide 
(e.g., vulnerabilities exist in the Part D online application process).  The 
types of vulnerabilities and the ways in which they are addressed may 
differ depending on the Medicare program involved.  The vulnerabilities 
involving fee-for-service payments in Parts A and B may require an 
approach different from that used for vulnerabilities involving health 
plans offered by private companies under Medicare Parts C and D.  
Some methods through which program vulnerabilities may be resolved 
are claims processing edits, provider education, or issuance of new 
regulations.   
PSCs and ZPICs are required to submit to CMS monthly narratives of 
all vulnerabilities identified in the previous month.  PSCs and ZPICs 
use the CMS Analysis, Reporting, and Tracking System (CMS ARTS) to 
submit these narratives.   
Since 2008, PSCs and ZPICs also have been required to submit reports 
on all vulnerabilities to an electronic vulnerability mailbox, no less than 
quarterly.6  According to CMS staff, the vulnerability reports submitted 
to this mailbox are more descriptive than the narratives submitted to 
CMS ARTS.  Within each vulnerability report, PSCs and ZPICs should 
include a description of how the vulnerability was discovered, a 
summary of the issues, a description of the methodology, 
recommendations for resolving the vulnerability, and any action they 
took to resolve the vulnerability.7  CMS staff stated that PSCs and 
ZPICs are also required to include monetary impact in these reports.   
MEDICs are required to submit quarterly vulnerability reports to CMS, 
listing vulnerabilities they identified during that quarter.8  The reports 
should address, to the extent possible, the scope of the vulnerabilities 
and the extent to which they jeopardize Parts C and D.  The MEDICs 
may also propose to CMS the most effective and efficient ways to 
address the vulnerabilities.  CMS staff stated that MEDICs are not 
required to include monetary impact in these reports.   
 
5 CMS Manual System, Pub. 100-08, Medicare Program Integrity, Transmittal 211, 
Change Request 5581, June 22, 2007.  
6 CMS, Medicare Program Integrity Manual, Pub. 100-04, ch. 4  4.31. 
7 Ibid. 
8 CMS, Medicare Prescription Drug Integrity Contractor (MEDIC) Statement of Work,  
 8.2.12. 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  4  II NN TT RR OO DD UU CC TT II OO NN   
CMS Divisions Responsible for Tracking and Reviewing Vulnerabilities 
Two CMS divisions review PSC- and ZPIC-reported vulnerabilities:  the 
Division of Medicare Integrity Contractor Operations (DMICO) within 
the Center for Program Integrity (CPI) and the Division of Data 
Analysis (DDA) within the Office of Financial Management.   
DMICO takes the lead role in tracking and reviewing PSC- and  
ZPIC-reported vulnerabilities.  It also decides how to address them and 
how to coordinate with other CMS components in doing so.   
DDA identifies and addresses improper payments at a programwide 
level.  To minimize the risk for improper payments, DDA reviews PSC- 
and ZPIC-reported vulnerabilities to compare them with vulnerabilities 
reported by Medicare administrative contractors (MAC)9 and recovery 
audit contractors (RAC).10       
The Division of Plan Oversight and Accountability within CPI is 
responsible for tracking, reviewing, and coordinating efforts to resolve 
MEDIC-reported vulnerabilities.         
Related Studies by the Government Accountability Office 
In March 2010, the Government Accountability Office (GAO) issued a 
report that found that CMS did not establish an adequate process to 
address vulnerabilities identified by Medicare RACs, which are 
responsible for postpayment claims review in Medicare Parts A  
and B.11  Specifically, GAO stated that CMS did not develop a plan to 
take corrective action or implement sufficient monitoring, oversight, 
and control activities to ensure these significant vulnerabilities were 
addressed.  
In March 2011 testimony before the Senate Subcommittee on Federal 
Financial Management, Government Information, Federal Services, and 
International Security, GAO officials recommended that CMS 
implement prior report recommendations, including developing a robust  
   
 
9 MACs process and pay claims for Parts A and B. 
10 RACs conduct postpayment claims reviews to detect and correct past improper 
payments in Medicare Parts A and B.  Unlike PSCs and ZPICs, RACs are not responsible 
for detecting fraud, waste, and abuse.   
11 GAO, Medicare Recovery Audit Contracting:  Weaknesses Remain in Addressing 
Vulnerabilities to Improper Payments, Although Improvements Made to Contractor 
Oversight  (GAO-10-143), March 2010. 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  5  I N T R O D U C T I O N  
process for addressing identified vulnerabilities.12 
METHODOLOGY 
Scope 
Our study focused on the vulnerabilities reported by the PSCs, ZPICs, 
and MEDICs that had benefit integrity task orders in 2009.  We chose 
2009 because it was the first year in which all three types of contractors 
were operational.  This timeframe also gave CMS time to take action, as 
we began collecting data in December 2010.    
The Zone 4 and Zone 7 ZPICs were not fully operational until February 
1, 2009; therefore, the earliest vulnerability reports collected for these 
2 ZPICs were from March 1, 2009.  The Zone 4 and Zone 7 ZPICs were 
the only ZPICs that had completed their first contract year in 2009.13  
Additionally, because MEDIC Wests contract was not renewed when it 
ended in September 2008, we did not review vulnerabilities reported by 
this MEDIC. 
Data Collection  
In December 2010, we requested from CMS all vulnerability reports 
submitted by PSCs and ZPICs in 2009.  Specifically, we requested the 
vulnerability narratives submitted by PSCs for 2009 and by ZPICs from 
February 1, 2009, through December 31, 2009.  We also requested the 
quarterly reports submitted by the MEDICs for 2009.   
In January 2011, we received from CMS all vulnerability reports 
submitted by contractors.  These included either the narratives from 
CMS ARTS or the more detailed vulnerability reports that were 
submitted to the electronic vulnerability mailbox.   
We also asked CMS to provide the following additional information for 
each vulnerability reported: 
  the specific contractor that reported the vulnerability; 
 
12 Medicare and Medicaid Fraud, Waste, and Abuse:  Effective Implementation of Recent 
Laws and Agency Actions Could Help Reduce Improper Payments, Subcommittee on 
Federal Financial Management, Government Information, Federal Services, and 
International Security, Committee on Homeland Security and Governmental Affairs,  
U.S. Senate, 112 Cong. (March 9, 2011) (Statement of Kathleen M. King, Director of Health 
Care, and Kay L. Daly, Director of Financial Management and Assurance, GAO). 
13 The first contract year for the Zone 4 and Zone 7 ZPICs was September 30, 2008, 
through October 31, 2009.   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  6  I N T R O D U C T I O N  
  the date of the report in which the vulnerability was 
identified; 
  a description of the vulnerability; 
  a detailed description of any action taken by CMS that 
resolved or addressed the vulnerability;14 
  whether the action taken to resolve or address the 
vulnerability was a result of a contractor-suggested 
recommendation; 
  the date that the action taken to resolve or address the 
vulnerability was implemented; and 
  if no action was taken to resolve or address the vulnerability, 
the reason why. 
In addition, we conducted structured interviews with relevant CMS 
staff regarding the policies and procedures for handling 
vulnerabilities reported by PSCs, ZPICs, and MEDICs.  Our questions 
focused on the roles of different staff in tracking, reviewing, and 
resolving contractor-reported vulnerabilities; procedures for tracking 
and reviewing vulnerability reports; and procedures for resolving 
reported vulnerabilities.  We also reviewed all available written 
policies and procedures outlining how CMS tracks, reviews, and 
resolves contractor-reported vulnerabilities.    
Data Analysis 
From the vulnerability reports and information collected from CMS, we 
determined the number of vulnerabilities reported by each contractor.  
PSCs, ZPICs, and MEDICs reported a total of 70 vulnerabilities in  
2009, with PSCs reporting 34 vulnerabilities, ZPICs reporting 11, and 
MEDICs reporting 25.  For 1 of the 34 PSC-reported vulnerabilities, 
CMS could not find a corresponding report and, therefore, could not 
determine whether an actual vulnerability was reported.15  Of the  
25 MEDIC-reported vulnerabilities, CMS determined that 5 were not 
actual vulnerabilities and 2 were outside the scope of CMSs 
 
14 This included actions taken by contractors as a result of discussions and collaboration 
with CMS.  
15 In CMS ARTS, a vulnerability report was noted as submitted, but it is unknown 
whether this report identified any vulnerabilities because no corresponding vulnerability 
report was attached to CMS ARTS or sent to the vulnerability mailbox.  
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  7  I N T R O D U C T I O N  
responsibilities for Parts C and D.  As a result, the total number of 
vulnerabilities used for analysis was 62. 
We categorized the vulnerabilities by type and determined the number 
of each type of vulnerability by contractor.     
We used the information collected from CMS to identify any significant 
actions that CMS took to resolve each reported vulnerability.  We 
determined actions to be significant if CMS described specific steps that 
it took to resolve the vulnerability.  We also determined CMSs actions 
to be significant if, as a result, a contractor took action to resolve a 
vulnerability (e.g., if CMS discussed the vulnerability with the 
contractor and approved the contractors plan to resolve it).   
The actions that we determined not to be significant were mainly steps 
that CMS took to review, rather than resolve, the vulnerabilities.  For 
example, CMS provided dates and details of correspondence with 
contractors or other CMS components, but did not report what, if any, 
corrective actions were taken as a result. 
Based on our analysis of CMSs description of actions taken, we 
determined the number of vulnerabilities that were resolved, the 
number for which significant actions were taken to resolve the 
vulnerabilities, and the number of vulnerabilities that were not 
resolved.   
We reviewed the vulnerability narratives and reports to determine what 
types of recommendations contractors made to CMS to resolve the 
vulnerabilities.  We also asked CMS to tell us whether any actions it 
took were the result of contractor recommendations. 
Finally, we calculated the estimated monetary impact on Medicare of 
the contractor-reported vulnerabilities.  For each vulnerability, we 
calculated monetary impact by using the contractor-reported actual or 
estimated dollars allowed, paid, overpaid, at risk, or lost as a result of 
the vulnerability.  Because monetary impact was reported 
inconsistently (e.g., some contractors reported monetary impact for a 
certain year, whereas others reported it for a range of years; some 
reported it for an individual provider, whereas others reported it for a 
group of providers), we aggregated monetary impact regardless of how it 
was reported.   
 
 
 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  8  II NN TT RR OO DD UU CC TT II OO NN   
Limitations 
We did not ask CMS for documentation of actions taken to resolve the 
vulnerabilities.  Therefore, we did not verify that the reported actions 
were taken.   
Standards 
This study was conducted in accordance with the Quality Standards 
for Inspection and Evaluation issued by the Council of the Inspectors 
General on Integrity and Efficiency.   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  9   F I N D I N G S  
As of January 2011, CMS had not resolved or  PSCs, ZPICs, and MEDICs 
taken significant action to resolve 77 percent of  reported 62 vulnerabilities in  
2009.  Seventy-seven percent (48) 
vulnerabilities reported by contractors in 2009 
of these had not been resolved as 
of January 2011, nor had CMS taken significant action to resolve them.  
CMS indicated that of these 48 vulnerabilities, 20 were currently under 
review and 3 required additional analysis to determine whether they 
were actual vulnerabilities.  For the remaining 25, we determined from 
CMSs description that no action was taken or that the action taken was 
not significant.   
CMS resolved or took significant actions to resolve 14 vulnerabilities 
Only two vulnerabilities were resolved.  According to the report for one of these 
vulnerabilities, no uniform guidelines were in place for contractors to 
calculate the monetary loss to government for cases of fraud and abuse.  
The loss to the U.S. Government is often requested by Federal law 
enforcement agencies and is one of the key factors considered in 
determining sentences for defendants found guilty of health care fraud.  To 
resolve this vulnerability, CMS developed a methodology for contractors to 
use to calculate loss to government.   
The other vulnerability involved payment for unnecessary home health 
visits to diabetic patients.  CMS adopted a 10-percent cap on outlier 
payments for home health agencies to reduce payments for unnecessary 
services.16    
CMS took significant action to resolve 12 vulnerabilities.  Actions that CMS 
took to resolve these vulnerabilities include changing policy, conducting 
medical review or additional analysis of certain providers, issuing a 
national fraud alert, establishing edits17, educating contractors, 
providing contractors with access to data, and working to implement the 
National Provider Identifier (NPI) number as a single identifier for 
prescription drug prescribers for Medicare Part D.   
Table 1 shows the status of the vulnerabilities reported by PSCs, ZPICs, 
and MEDICs in 2009.   
 
16 Medicare pays home health agencies a predetermined base payment for each 60-day 
episode of care per beneficiary.  An outlier payment is an addition or adjustment to that 
base payment amount to reflect unusual variation in the type or amount of medically 
necessary home health care. 
17 Editssystem processes that use automated logiccan be used to prevent improper 
claims from being paid or to flag claims for further review.  Edits are a means of verifying 
and validating claims data and are necessary to detect errors or potential errors. 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  10  F I N D I N G S  
Table 1:  Status of Vulnerabilities Reported by Contractors in 
2009 
Contractor Type  Status of Vulnerability 
Significant 
Not  Actions 
  Resolved  Total 
Resolved  Taken To 
Resolve 
PSC  33   0  0  33 
ZPIC  5   5  1  11 
MEDIC  10   7  1  18 
     Total  48  12  2  62 
Source:  OIG analysis of the status of vulnerabilities reported to CMS in 2009.  
 
Over half of contractors reports regarding vulnerabilities included 
detailed recommendations for CMS to resolve the vulnerabilities.  
However, many of the significant actions that CMS took to resolve 
vulnerabilities were not the result of these contractor recommendations.  
One of the recommendations was that CMS mandate periodic reviews of 
home health agency cost reports to determine the true cost of providing 
home health services.  For 9 of the 14 vulnerabilities for which CMS 
took action, the actions it took were not those recommended by 
contractors.   
Coding and/or billing vulnerabilities were the most commonly reported type 
of vulnerabilities 
Over half of the vulnerabilities reported by PSCs and ZPICs related to 
coding and/or billing.  Some examples include:  a claims processing system 
allowed certain claims to be paid based on incorrect codes, nonphysician 
practitioners inappropriately billed for services, and providers billed more 
than the allowed number of services.   
The vulnerabilities most commonly reported by MEDICs were those 
related to provider identifiers.  Examples include use of provider 
identifiers of deceased providers and use of invalid provider identifiers to 
bill Medicare.   
 
Table 2 shows the number of each type of vulnerability reported by each 
contractor.   
 
 
 
 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  11  F I N D I N G S  
 
Table 2:  Types of Vulnerabilities Reported by Contractor 
Vulnerability Type  Contractor Type 
 
PSC  ZPIC  MEDIC  Total 
 
Coding/Billing  20  6  1  27 
Lack of Medicare 
4  2  3  9 
Guidelines 
Provider Enrollment  5  2  0  7 
Provider Identifiers  1  0  5  6 
Beneficiary-Related  2  0  3  5 
Data Systems/Claims 
1  1  2  4 
Processing 
Procedure/Process  0  0  2  2 
Marketing Violations  0  0  2  2 
     Total  33  11  18  62 
         Source:  OIG analysis of vulnerabilities reported by CMSs benefit integrity contractors in 2009. 
 
Only 21 of the 62 vulnerabilities 
Contractors reported monetary impact for only 
reviewed had an associated 
one-third of vulnerabilities, but their estimated 
monetary impact reported by the 
impact was $1.2 billion 
contractor.  According to CMS 
  staff, PSCs and ZPICs are 
required to report monetary impact in their vulnerability reports.  
However, less than half of the vulnerabilities submitted by PSCs and 
ZPICs in 2009 had an associated monetary impact reported by the 
contractor.  MEDICs are not required to report monetary impact, and 
few of the vulnerabilities reported by MEDICs had reports containing 
this information.   
For these 21 vulnerabilities, the estimated monetary impact reported 
was $1.2 billion, with the monetary impact of individual vulnerabilities 
ranging from $77,692 to $803,025,113.18  None of these vulnerabilities 
had been fully resolved as of January 2011. 
 
18 To determine monetary impact, we aggregated estimates of overpayments, dollars at 
risk, and dollars lost as reported by contractors.  The estimated amount is not necessarily 
the impact during a 1-year period.  Because monetary impact was not reported for the same 
years or timeframes by contractorssome contractors reported monetary impact for a 
single year, whereas others reported monetary impact for a range of yearswe aggregated 
all monetary impact regardless of time. 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  12  F I N D I N G S  
For 4 of the 21 vulnerabilities with reported monetary impact, CMS has 
taken significant actions to resolve the vulnerabilities, but has yet to 
fully resolve them.  Two of these vulnerabilities had the highest 
amounts of reported monetary impact ($803 million and $99 million), 
and both involve Part D provider identifiers.  The vulnerability with the 
reported monetary impact of $803 million involved invalid prescriber 
identifiers.  According to the vulnerability report, between  
January 1, 2006, and June 24, 2009, Medicare paid a total of 
$803,025,113 for claims submitted using the top five prescriber 
identifiers, although none were bona fide identifiers.  To address 
vulnerabilities with Part D provider identifiers, CMS is working to 
implement use of a single identifier, the NPI, in the prescriber ID field 
of the prescription drug event (PDE) data.19  CMS also stated that it 
will implement edits in the Drug Data Processing System (DDPS) to 
resolve these vulnerabilities, but that these edits will be not be 
implemented until 2012.20  
Although CMS has taken significant action to resolve the 2 vulnerabilities 
with the largest monetary impacts, the estimated monetary impact for the 
17 vulnerabilities that (as of January 2011) had not been resolved or for 
which significant action had not been taken is $202 million.        
Monetary impact was not reported consistently   
Some contractors estimated the monetary impact by analyzing the data 
of an individual provider, whereas others analyzed data from a select 
sample of providers.  Some reported monetary impact for a certain year, 
whereas others reported monetary impact for a range of years.  Because 
we aggregated monetary impact regardless of time period or provider 
sample, the actual monetary impact of these vulnerabilities could be 
significantly greater than the estimated  
$1.2 billion. 
 
 
 
 
19 Prescription drug plans submit PDE data to CMS for prescriptions filled under 
Medicare Part D.  The PDE record contains prescription drug cost and payment data.  
Among the data fields included in this record is the prescriber identifier number.  
Currently, prescribers can enter into this field any of the following: NPI, Unique Physician 
Identification Number, State license number, or Drug Enforcement Administration number.       
20 PDE data are processed in DDPS.  Edits in DDPS evaluate incoming PDE data and 
confirm that the PDE data are valid.  
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  13  F I N D I N G S  
Although CMS has recently begun developing  All three CMS divisions 
procedures to consistently track and review  responsible for tracking and 
reviewing vulnerabilities have 
vulnerabilities, it lacks procedures to ensure 
procedures that outline the steps 
that they are resolved  
they take to track and review 
 
vulnerabilities.  Although contractors have been submitting 
vulnerability reports since at least 2007, CMS did not begin developing 
these procedures until June 2010.  Furthermore, only one of these 
divisions has developed procedures to follow up on the implementation 
of corrective actions to resolve vulnerabilities.   
CMS has begun developing new procedures to track and review 
vulnerabilities   
Currently, each CMS division responsible for tracking and reviewing 
PSC-, ZPIC-, and MEDIC-reported vulnerabilities has its own tracking 
system and procedures for reviewing vulnerabilities.  Two divisions 
review PSC- and ZPIC-reported vulnerabilities:  one division reviews 
vulnerabilities involving improper payments, and the other tracks all 
vulnerabilities but takes the lead on tracking vulnerabilities involving 
fraud, waste, and abuse.  PSCs and ZPICs have been submitting 
vulnerability reports since at least 2008; however, it was not until 2010 
that these two CMS divisions developed their own procedures for 
handling PSC- and ZPIC-reported vulnerabilities.    
A third CMS division is responsible for tracking and reviewing 
MEDIC-reported vulnerabilities.  Although MEDICs have been 
reporting vulnerabilities quarterly since at least 2007, this CMS 
division only recently began drafting standard operating procedures to 
address the reported vulnerabilities and to delineate the roles and 
responsibilities of division staff in this process.  It also did not have a 
system to track MEDIC-reported vulnerabilities until February 2011.   
CMS is developing a centralized vulnerability tracking  
system, the Program Vulnerability Tracking System (PVTS).  Once it 
becomes operational, PVTS will enable all three CMS divisions to track 
vulnerabilities.  Contractors also will be able to directly submit their 
vulnerability reports into PVTS.   
Not all CMS divisions have procedures to ensure that vulnerabilities are 
resolved 
In most cases, the CMS divisions responsible for tracking and reviewing 
vulnerabilities are not responsible for taking direct action to resolve 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  14  F I N D I N G S  
them.  Instead, division staff refer vulnerabilities to other CMS 
components that have authority to take corrective action.   
For the MEDIC-reported vulnerabilities, CMS division staff stated that 
because they are not directly involved with resolving vulnerabilities, 
they do not routinely keep track of corrective actions implemented to 
resolve them.  For some of these MEDIC-reported vulnerabilities, 
division staff must coordinate with other components within CMS that 
take action for resolution.  Division staff stated that in these cases, 
corrective actions are recorded once the resolution has been 
implemented (e.g., regulatory language has been changed or a system 
change has been made).  However, division staff do not have procedures 
for routinely following up to determine whether vulnerabilities have 
been resolved.   
Similarly, the CMS division responsible for tracking and reviewing 
PSC- and ZPIC-reported vulnerabilities does not have procedures for 
following up to ensure that vulnerabilities have been resolved.  Once a 
vulnerability is referred to the appropriate CMS component, the 
division considers the status of the vulnerability to be closed.  
The division responsible for reviewing PSC- and ZPIC-reported 
vulnerabilities involving improper payments across the Medicare 
program has developed a standard operating protocol for tracking the 
implementation of corrective actions.  However, these procedures do not 
establish timeframes for following up with the CMS components to 
ensure prompt resolution of vulnerabilities.   
   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  15   R E C O M M E N D A T I O N S  
 
 
One of the ways that Medicare benefit integrity contractors help 
prevent fraud, waste, and abuse is by identifying program 
vulnerabilities.  To minimize the financial impact on Medicare, CMS 
needs to take prompt action to resolve vulnerabilities.  Only two of the 
vulnerabilities reported in 2009 had been resolved as of January 2011.  
Given that the estimated monetary impact of vulnerabilities reported in 
2009 was over a billion dollars, millions of dollars may continue to be at 
risk each year if vulnerabilities are not being promptly and effectively 
resolved. 
It is also important that vulnerabilities monetary impact be 
consistently reported and tracked.  For most of the vulnerabilities in 
2009, contractors did not report monetary impact.  When contractors did 
report monetary impact, it was not reported consistently.  Because 
monetary impact is often used to prioritize vulnerabilities needing 
corrective action, the consistent reporting of monetary impact will 
ensure that CMS has all the necessary information to make informed 
decisions about resolving vulnerabilities.  None of the vulnerabilities 
with reported monetary impact have been resolved, although CMS has 
taken significant action to resolve the two with the greatest monetary 
impact ($803 million and $99 million).  However, implementation of 
these actions will not be complete until 2012, 3 years after the 
vulnerabilities were reported.             
To gain sufficient oversight of program vulnerabilities, CMS needs to 
have policies and procedures for ensuring the prompt resolution of 
vulnerabilities.  Contractors have been reporting vulnerabilities for 
several years; however, CMS has not been conducting routine followup 
to determine whether corrective actions have been taken to resolve the 
reported vulnerabilities.  In 2011, CMS was still reviewing 
vulnerabilities reported in 2008 and 2009 to determine whether they 
had been resolved or whether action still needed to be taken to resolve 
them. 
Therefore, we recommend that CMS: 
Determine the status of all vulnerabilities that have not been resolved and 
take action to address them 
CMS needs to promptly follow up on the vulnerabilities reported in 2009 
that have not been resolved.  CMS needs to determine what actions, if 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  16  R E C O M M E N D A T I O N S  
any, have been taken to resolve them in the 2 years since they were 
reported.               
Require all benefit integrity contractors to report monetary impact, when 
calculable, in a consistent format 
PSCs and ZPICs have been required to report vulnerabilities for several 
years.  According to CMS staff, PSCs and ZPICs were required to 
submit vulnerability reports using a revised report template beginning 
in December 2010.  This revised template includes the amount of 
estimated or actual dollars at risk, if known.  MEDICs are not required 
to report monetary impact.  CMS should ensure that PSCs, ZPICs, and 
MEDICs report actual or estimated monetary impact whenever 
possible.  However, when it would be too burdensome or  
time consuming to estimate monetary impact, contractors should still 
report the vulnerability and explain why the calculation of monetary 
impact was not possible.  Additionally, to accurately assess 
vulnerabilities monetary impact on Medicare and to more effectively 
prioritize the actions needed, CMS should develop a consistent way for 
benefit integrity contractors to report this impact.  For example, CMS 
should request that when possible contractors report monetary impact 
for a standard timeframe, such as 1 year.      
Ensure that vulnerabilities are resolved by establishing formal written 
procedures that include timeframes for followup and that outline CMS and 
contractor responsibilities regarding vulnerability resolution 
Because contractors and different CMS components are involved in 
resolving vulnerabilities, coordination is essential for prompt resolution.  
CMS needs to establish formal written procedures that include 
timeframes for following up with contractors and other involved CMS 
components to ensure that vulnerabilities are resolved promptly.  
Procedures should also include specific roles and responsibilities of CMS 
and contractors in ensuring that vulnerabilities are resolved.   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS acknowledged the importance of identifying vulnerabilities in 
preventing fraud, waste, and abuse.  CMS also acknowledged the 
importance of minimizing the financial impact on Medicare by taking 
prompt action to resolve vulnerabilities.  CMS concurred with our first 
recommendation and is determining the status of all open 
vulnerabilities and taking action, when possible, to address them.  CMS 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  17  R E C O M M E N D A T I O N S  
stated that it has determined the status of all vulnerabilities identified 
by the MEDICs.   
CMS did not concur with our second recommendation.  CMS stated that 
it would be challenging to require all benefit integrity contractors to 
report the monetary impact for each vulnerability and to use it in a 
consistent methodology.  CMS noted that it could be labor intensive for 
the contractors to determine the dollars at risk for vulnerabilities and 
that not all vulnerabilities have a monetary impact that results in a loss 
to the Medicare Trust Fund.  Furthermore, CMS states that different 
types of vulnerabilities would require different methods of calculating or 
estimating the monetary impact or would even make such a 
determination impossible or very difficult because of the time and 
resources required.  We understand that calculating the monetary 
impact for some vulnerabilities may not be possible.  We also 
understand that different types of vulnerabilities would require 
different methods of calculating monetary impact.  However, for cases in 
which calculating the monetary impact is too burdensome or time 
consuming, the contractor should report the vulnerabilities and explain 
why the monetary impact could not be calculated.  Based on CMS 
comments, we clarified the wording of this recommendation.     
CMS concurred in part with our third recommendation.  CMS stated 
that it has standard operating procedures in place and continues to 
actively manage reported vulnerabilities on a monthly basis.  CMS 
stated that it can establish timeframes for resolution on a case-by-case 
basis, but said that it will be difficult to establish standard timeframes 
because actions and resolutions to address vulnerabilities will vary.  
Although we agree that actions and resolutions vary depending on the 
type of vulnerability, it is possible to have standard timeframes for 
following up to determine the status of the vulnerabilities.  Standard 
intervals, such as every 6 months, for following up with the various 
CMS components and staff responsible for addressing vulnerabilities 
would ensure that vulnerabilities are being appropriately and promptly 
addressed, regardless of the specific actions and resolutions that are 
implemented. 
The full text of CMSs comments is provided in the Appendix. 
    
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  18  x 
A  P  PEN  D 
Agency Comments 
( 'f-
/"'..1..... 
:S'r  DEPARTMENT OF HEALm & HUMAN SERVICES  Centers for Medicare & Medicaid Services
Administrator 
Washlnglon, DC 2020t 
,OCT 26 20111 
DATE: 	
TO: 	 Daniel R. Levinson 

Inspector General 

FROM: 	 Donald M. Berwick, M.D. 

Administrator 

SUBJECT: 	 Office ofInspector General (OIG) Draft Report: "Addressing Vulnerabilities 
Reported by Medicare Benefit Integrity Contractors" (OEI-03-! 0-00500) 
The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 
comment on the Office of Inspector General (OIG) draft report entitled, "Addressing 
Vulnerabilities Reported by Medicare Benefit Integrity Contractors." This report had mUltiple 
objectives.  First, it seeks to determine whether CMS resolved vulnerabilities reported by 
Medicare benefit integrity contractors.  Secondly, it determined the monetary impact of the 
reported vulnerabilities on the Medicare program, and lastly, the report reviews CMS' procedures 
for tracking, reviewing, and resolving reported vulnerabilities. 
One ofthe ways that Medicare program integrity contractors help prevent fraud, waste, and 
abuse is by identifying program vulnerabilities. To minimize the financial impact of these 
vulnerabilities on the Medicare program, CMS needs to take prompt action to resolve them. 
CMS currently has vulnerability standard operating procedures in place and continues to actively 
manage reported vulnerabilities on a monthly basis. CMS is collaborating and coordinating 
throughout the Agency to address program vulnerabilities, as appropriate. We note that CMS 
cannot always resolve the vulnerabilities or resolve them as promptly as CMS would like due to 
various constraints. For example, the magnitude and complexity of the resolution, such as 
changing a regulation or requesting a system change, may require significant time to resolve the 
vulnerability. Additionally, some vulnerabilities require legislative changes to resolve, 
We appreciate the OIG's efforts in working with CMS to help ensure that vulnerabilities are 
addressed.  Our response to each ofthe OIG recommendations and other comments follow. 
OIG Recommendation 
Determine the status of all vulnerabilities that have not been resolved and take action to address 
them. 
OEI031000500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  19  A P P E N D I X  
 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  20   
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  21   
 
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  22   A C K N O W L E D G M E N T S  
 
This report was prepared under the direction of Robert A. Vito, Regional 
Inspector General for Evaluation and Inspections in the Philadelphia 
regional office, and Linda M. Ragone, Deputy Regional Inspector 
General.   
Maria Schepise Johnson served as the team leader for this study.  Other 
principal Office of Evaluation and Inspections staff from the 
Philadelphia regional office who contributed to the report include 
Courtney Hilts.  Central office staff who contributed include  
Scott Manley.  
  
  OEI-03-10-00500  ADDRESSING VULNERABILITIES REPORTED BY BENEFIT INTEGRITY CONTRACTORS  23   
Office of Inspector General 
http://oig.hhs.gov 
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department of Health and Human Services 
(HHS) programs, as well as the health and welfare of beneficiaries served by those 
programs.  This statutory mission is carried out through a nationwide network of audits, 
investigations, and inspections conducted by the following operating components: 
Office of Audit Services 
The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 
audits with its own audit resources or by overseeing audit work done by others.  Audits 
examine the performance of HHS programs and/or its grantees and contractors in carrying 
out their respective responsibilities and are intended to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and 
mismanagement and promote economy and efficiency throughout HHS. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud, waste, or abuse and promoting 
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 
of fraud and misconduct related to HHS programs, operations, and beneficiaries.  With 
investigators working in all 50 States and the District of Columbia, OI utilizes its resources 
by actively coordinating with the Department of Justice and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to criminal 
convictions, administrative sanctions, and/or civil monetary penalties. 
Office of Counsel to the Inspector General 
The Office of Counsel to the Inspector General (OCIG) provides general legal services to 
OIG, rendering advice and opinions on HHS programs and operations and providing all 
legal support for OIGs internal operations.  OCIG represents OIG in all civil and 
administrative fraud and abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program guidance, publishes fraud alerts, and provides other 
guidance to the health care industry concerning the anti-kickback statute and other OIG 
enforcement authorities.