of:
Testimony 
Robert A. Vito
Acting Assistant Inspector General
Centers for Medicare & Medicaid Audits
Office ofInspector General
Health & Human Services
u.s. Department of 
the Subcommittee. I am Robert Vito,
Good morning, Mr. Chairman and members of 
Acting Assistant Inspector General for the Centers for Medicare & Medicaid Audits at
Inspector General
the U.S. Departent of  Health & Human Services' (HHS) Office of 
(OIG). In March ofthis year, I testified before this Subcommittee regarding OIG's body
of work on program integrty and payment accuracy safeguards in the Medicare Part D
prescription drug program (Medicare Part D). i At that hearing, I stated that oversight by
the Centers for Medicare & Medicaid Services (CMS) and its contractors had been
limited and that as a result, the Medicare Part D program was vulnerable to fraud, waste,
and abuse.
Recent OIG work ilustrates that because of such vulnerabilties, Medicare has paid for
substantial numbers of questionable claims for prescription drugs under Part D. OIG's
June 2010 report, Invalid Prescriber Identifers on Medicare Part D Drug Claims,
the most
reveals that CMS and its plan sponsors have not adequately performed one of 
basic oversight checks in Medicare Part D - ensuring that a drug was prescribed by a
physician.2 As a result, Part D sponsors and beneficiares paid pharmacies $ 1.2 bilion in
2007 for claims in which the prescriber identifiers listed on the claims did not correspond
to practicing physicians. Because prescriber identifiers are a key indicator on Part D
claims that link prescribing physicians, dispensing pharmacies, and Medicare
beneficiaries, they playa critical role in program integrty efforts. Without a valid
prescriber identifier, CMS and its contractors cannot determine if a physician even
prescribed a drug, much less verify that the physician was appropriately licensed or had
not been excluded from the Medicare program. Furthermore, invalid prescriber
identifiers inhibit OIG investigations by making it more diffcult to identify questionable
prescribing patterns and the parties responsible for potential fraud.
In my testimony, I wil provide more details about the findings of our June 2010 study
related to invalid prescriber identifiers on Part D claims and offer recommendations to
help prevent potentially improper payments associated with this vulnerabilty in the
future. Unfortnately, this is not the first time that OIG has identified problems with
1 DIG, Oversight Challenges in the Medicare Prescription Drug Program. Testimony of 
Robert A. Vito
before the Senate Committee on Homeland Security and Governent Affairs Subcommittee on Federal
Financial Management, Governent Information, Federal Services, and International Security.
March 3,2010.
2 DIG, Invalid Prescriber Identifers on Medicare Part D Drug Claims, OEI-03-09-00140, June 2010.
Robert A. Vito, HHS OIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15,2010
1 invalid prescriber identifiers, and my testimony wil also describe earlier OIG work on
the issue involving Medicare claims for durable medical equipment (DME).
Use of Invalid Prescriber Identifers on Part D Claims Is a Signifcant Program
Vulnerabilty
the most basic safeguards in paying for medical care - be it Medicare, Medicaid,
One of 
or private payers - is ensuring that an item or a service was performed, provided, or
prescribed by an appropriate medical professionaL. However, a recent OIG study, Invalid
Prescriber Identifers on Medicare Part D Drug Claims, found that this basic safeguard
is not always operating effectively.
CMS contracts with plan sponsors to administer the Medicare Part D benefit and pay Part
D claims. Sponsors must submit an electronic record, called a prescription drug event
(PDE) record, to CMS for any covered prescription that is filled. CMS requires that most
PDE records contain an identifier for the drug's prescriber, which is to be entered by the
dispensing pharmacy when the claim is submitted to the sponsor.3 This requirement not
only helps to ensure that a physician, and not an unqualified provider, prescribed the
drug, but also is fundamental to successful program integrty efforts, including:
. verifying a prescribing physician's licensing or disciplinary information,
. examining unusual prescribing patterns by a physician,
. verifying that a beneficiary has had an offce visit with a prescribing physician,
. comparing the geographic location of a prescribing physician to the location of a
beneficiary to determine if they are in the same area,
. determining whether the specialty of a prescribing physician matches the
indications of a prescrbed drug, and
. requesting a beneficiary's medical records from a prescribing physician to
determine whether a drug was medically necessary.
for $1.2 bilion in prescription drug claims
Beneficiaries and Medicare Part D paid 
containing invalid prescriber identifers in 2007
In our June 2010 report, we found that more than 18 milion PDE records contained
invalid prescriber identifiers in 2007, representing 2 percent ofthe nearly 1 bilion PDE
records submitted to CMS that year.4 These identifiers either were not listed in the
appropriate provider identifier directories or had been deactivated or retired before
3 CMS does not require a prescriber identifier on Part D drug claims submitted to plans in nonstandard
formats, such as beneficiary-fied claims and paper claims.
4 Given that the new national provider identifier (NPI) initiative had yet to be fully implemented in 2007,
these records (95 percent) had the prescriber identifiers coded as Drug Enforcement
almost all of 
Administration numbers. Of the remaining 5 percent, 3.6 percent were coded with NPIs, 1.3 percent were
coded with State medical license numbers, and less than one-tenth of 1 percent were coded as unique
physician identification numbers.
Robert A. Vito, HHS OIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15, 2010
2 January 1, 2006. Part D sponsors and Medicare beneficiaries paid pharmacies $1.2
bilion in 2007 for claims containing these invalid prescriber identifiers.
Identifers on 17 percent of the drug claims with invalid prescriber identifers did not
conform to format specifcations
Based on our analysis of claims data from 2007, CMS and plans were not successfully
verifying that prescriber identifiers on Part D claims were in the proper format. In 17
percent of cases, the invalid prescriber identifiers listed on PDE records did not have the
correct number of characters and/or contained inappropriate letters, numbers, punctuation
marks, or symbols. These PDE records represented $213 milion in payments by
sponsors and beneficiares in 2007. One invalid prescriber identifier that did not meet
format specifications was a string of nine zeros (000000000). This single invalid
identifier accounted for almost 40,000 PDE records worth $3.7 milion in 2007.
Ten invalid identifers accounted for 17 percent of the drug claims with invalid
prescriber identifers
In total, approximately 0.50 milion different invalid prescriber identifiers were used on
paid Part D claims in 2007. However, just 10 of these invalid identifiers accounted for
the questionable PDE records. In fact, one invalid prescriber
almost one-fifth of 
identifier (AAOOOOOOO) was recorded on almost 1.8 milion PDE records in 2007,
representing $105 milion in paid claims for 151,269 beneficiaries who were enrolled
with 248 different Part D sponsors. In other words, 10 percent of all PDE records with
invalid prescriber identifiers contained this one invalid identifier.
Furthermore, although most of the top 10 invalid prescriber identifiers were submitted on
claims by thousands of pharmacies in 2007, one particular invalid identifier, ZZ4567890,
was used on drug claims submitted by just 37 different pharmacies. In 2007, virtally all
the PDE records that listed ZZ4567890 as the prescriber identifier were associated
of 
with a single company (a large pharmacy benefit manager and mail-order pharmacy)
under multiple provider numbers that reflect a number of the company's locations across
the country.
It is important to note that an invalid prescriber identifier does not automatically indicate
that a prescription was inappropriate or that a pharmacy claim was unnecessary.
However, without valid prescriber identifiers, CMS and plan sponsor efforts to determine
Part D claims wil be limited, as it
the validity, medical necessity, or appropriateness of 
can be difficult to determine the name of, or any details about, the physician who
prescribed the drug in question.
Robert A. Vito, HHS OIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15,2010
3 Part D Claims With Invalid Prescriber Identifers Should Be Subjected to Further
Review
OIG recognizes the difficult balancing act CMS faces in trying to ensure beneficiary
access while also preventing improper payments. Therefore, we recommended that
rather than implementing prepayment edits (which could at times prevent beneficiaries
from getting needed medication), CMS conduct periodic reviews to ensure the validity of
prescriber identifiers used on PDE records. CMS could also require sponsors to institute
procedures that would identify and flag for review any Part D claims with invalid
identifiers in the prescriber identifier field. The success of these intermediate steps would
depend on whether CMS, the sponsors, and program integrty contractors take
appropriate actions when questionable claims are identified.
CMS concurs with these recommendations, and in response to our June 2010 report,
acknowledged that issues with invalid prescriber identifiers are hindering oversight
efforts. However, CMS also emphasized that there have been significant improvements
in the use of prescriber identifiers since the period covered by our analysis. According to
National Provider
CMS, a major reason for these improvements is the implementation of 
Identifiers (NPI) as the standard method for identifying prescribing physicians on Part D
claims.s OIG recognizes that the movement toward NPls is a positive step, as the use of
a single identifier, rather than the multiple types of identifiers previously used, wil
facilitate efforts by sponsors and CMS to validate prescriber identifiers listed on claims.
Nevertheless, we believe that NPls wil not completely eliminate the vulnerabilities
identified in our report. In fact, although only about 35 milion PDE records (3.6 percent)
them (almost 1 percent)
were coded with NPls in 2007, we found that over 300,000 of 
contained invalid prescriber identifiers. Therefore, the recommendations listed above
apply equally to Part D claims containing NPls, and CMS must remain vigilant in the
invalid identifier issue.
Ongoing OIG Work on Invalid Prescriber Identifers Is Focusing on Specifc
Geographic Areas and Schedule II Drugs
the prescriber identifier issue, OIG has provided to CMS
Recognizing the importance of 
data from our report on invalid identifiers in Part D. In addition, OIG is conducting
additional analysis on invalid prescriber identifiers, and we have identified specific
geographic areas with unusually large numbers of questionable claims.
OIG is further reviewing invalid prescriber identifiers related specifically to Schedule II
5 NPIs are unique 10-digit identification numbers intended to be a single identifier to replace multiple other
identification numbers (such as Drug Enforcement Administration numbers, State medical license numbers,
etc.) used by providers on claims.
Robert A. Vito, HHS DIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15,2010
4 drugs, like Oxycontin, which are highly susceptible to abuse and fraudulent activity.6
Claims for this type of drug containing invalid identifiers should be considered highly
suspect. Our review focuses not only on whether PDE records contain invalid prescriber
identifiers, but also on what steps CMS and sponsors undertake to ensure that the valid
identifiers are listed on Part D claims.
Invalid Prescriber Identifers Have Also Presented Vulnerabilties for Part B Claims
Vulnerabilities with prescriber identifiers have not been confined to Medicare Part D
claims. OIG has identified similar problems in claims for durable medical equipment,
such as wheelchairs and diabetic supplies, covered under Medicare Part B. In July 2008,
I testified before the Permanent Subcommittee on Investigations and discussed two OIG
reports that found Medicare paid for milions of dollars in questionable claims that did
not accurately identify the physicians that supposedly ordered the items, including many
claims that listed deceased doctors as the prescribers.7
Medicare regulations require DME suppliers to provide on the claim form the identifier
of the physician who ordered the equipment. 8 As with prescription drugs, Medicare
relies on physicians to act as gatekeepers to ensure that only medically necessary
equipment and supplies are ordered. In conducting our DME-related work, OIG learned
that Medicare claims-processing systems verified only that the physician identifier listed
on a claim met certain format requirements - automated checks were not performed to
ensure that the identifier listed on a claim was valid and active. A November 2001 OIG
report OIG found that as a result, Medicare and its beneficiaries paid $91 milion for
DME claims with invalid or inactive physician identifiers in 1999.9 Almost $8 millon of
the $91 milion involved identifiers for physicians who were deceased prior to the dates
6 The Controlled Substances Act of 1970 classifies certain federally regulated drugs as controlled
substances and divides them among five schedules based on their medical use and potential for abuse and
addiction. Schedule II drugs have high abuse risk, but also have safe and accepted medical uses in the
United States. These drugs can cause severe psychological or physical dependence. Schedule II drugs
include certain narcotic, stimulant, and depressant drugs.
7 OIG, Medicare Payments for Claims with Identifcation Numbers of Dead Doctors. Testimony of  Robert
A. Vito before the Senate Committee on Homeland Security and Governent Affairs Permanent
Subcommittee on Investigations. July 9,2008.
g On May 5, 2010, CMS issued a rule that institutes new requirements for DME suppliers biling Medicare.
Part B items and services, a provider or
According to this rule, to receive payment for certain types of 
the following requirements: (1) the items and services must have been ordered or
supplier must meet all of 
referred by a physician or, when permitted, an eligible professional; (2) the claim from the part B provider
or supplier must contain the legal name and the National Provider Identifier (NPI) of  the physician or the
eligible professional who order or referred the item or service; and (3) the physician or the eligible
professional who ordered or referred the item or service must have an approved enrollment record or a
valid opt-out record in the Provider Enrollment, Chain and Ownership System.
9 OIG, Medical Equipment and Supply Claims with Invalid or Inactive Physician Numbers, OEI-03-01-
00110, November 2001. For this study, DIG defined an invalid identifier as one that had never been
assigned by Medicare; or an inactive identifier had been assigned but all the practice settings associated
with it had been deactivated.
Robert A. Vito, HHS OIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15,2010
5 service entered on the claims. OIG recommended that CMS (1) revise claims-
of 
processing edits to ensure that the physician identifiers listed on DME claims are valid
using accurate physician
and active and (2) emphasize to suppliers the importance of 
identifiers when submitting claims.
Although CMS informed us that it had taken steps to address these recommendations, a
followup OIG report in February 2009 showed that invalid and inactive identifiers on
DME claims were stil a problem almost a decade later.10 OIG found that Medicare paid
almost $34 milion in 2007 for medical equipment and supply claims with physician
identifiers that had never been issued or had been deactivated by CMS. This figure
included $5 milion for claims with dates of service after the physicians identified on the
claims had died.
Other Recent OIG Oversight Work Has Focused on the Error Rate and Recovery
Audit Contractors
Comprehensive Error Rate Testing (CERT) Program
1 1 CMS
OIG issued a report just yesterday analyzing data from CMS' s CERT program. 
established the CERT program to determine the error rate for Medicare fee-for-service
claims. The national paid claim error rate for fiscal year (FY) 2009 was 7.8 percent
($24.1 bilion), a significant increase over the FY 2008 error rate of 3.6 percent ($10.4
bilion). According to CMS's FY 2009 Improper Medicare Fee-for-Service Payments
Report, the increase in the error rate was attributable to substantial changes in the CERT
medical record review methodologies.
providers that caused the
OIG analyzed the CERT data and identified the types of 
majority of improper payments and the most significant types of payment errors made by
these providers in FY 2009. Our results indicate that six types of providers accounted for
94 percent of the improper payments. These provider types were inpatient hospitals,
durable medical equipment suppliers, hospital outpatient departments, physicians, skiled
nursing facilities, and home health agencies. The most significant types of payment
errors attributable to these six provider groups were: (1) insuffcient documentation, (2)
miscoded claims, and (3) medically unecessary services and supplies.
Recovery Audit Contractors (RACs)
In February 2010, OIG issued a report that determined the extent to which RACs referred
cases of potential fraud to CMS.12 CMS contracts with RACs to identify improper
10 OIG, Medicare Payments in 2007 for Medical Equipment and Supply Claims With Invalid or Inactive
Referring Physician Identifers, OEI-04-08-00470. February 2009.
11 DIG, Analysis of  Errors Identifed in the Fiscal Year 2009 Comprehensive Error Rate Testing Program,
A-Ol-10-0I000, July 2010.
12 DIG, Recovery Audit Contractors' Fraud Referrals, OEI-03-09-00130, February 2010.
Robert A. Vito, HHS OIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15,2010
6 Medicare Part A and Part B claims. From March 2005 through March 2008,
payments of 
CMS conducted a RAC demonstration project that was designed to (1) detect and correct
past improper payments in the Medicare fee-for-service program and (2) provide
information to CMS and the Medicare claims-processing contractors that could help
protect the Medicare trust funds by preventing future improper payments.
According to CMS, the RACs' primary focus is the identification and correction of
improper payments, not the identification of potential fraud. In fact, RACs receive
payment based on the amount of improper payments identified. However, given the
nature ofthe RAC reviews, fraudulent payments could also potentially be identified and
referred to CMS or 010. In our February 2010 report, 010 found that during the 3-year
demonstration project, RACs identified over $1 billon in improper payments. However,
RACs referred only two cases of potential fraud to CMS during that time period.
Because RACs do not receive their contingency fees for fraud referrals, there may be a
disincentive for the RACs to refer these types of cases. In addition, during the
demonstration project, CMS did not provide the RACs with any formal training regarding
the identification and referral of potential fraud.
To address the issues identified in the report, we recommended that CMS follow up on
the two referrals, implement a database system to track fraud referrals, and require that
RACs receive mandatory training on the identification and referral of fraud. CMS
concurred with our recommendations.
Conclusion
Ensuring that Part D claims contain valid prescriber identifiers is fundamental to
successful program oversight. Without valid and accurate prescriber identifiers, CMS
and its contractors have difficulty performing oversight functions, such as verifying the
prescriber's licensing information, determining whether the prescriber has been the
subject of disciplinary actions for inappropriate activities, or tracking potential over-
prescribing issues. OIO's recent work has shown that safeguards for identifying claims
with invalid identifiers have not functioned effectively for Par D claims, and these
problems in Medicare Part D parallel those we have identified with respect to Part B
DME claims over the past decade. However, CMS's implementation ofNPI and its
agreement to take steps to address the recommendations of our most recent report
indicate that the agency plans to address these vulnerabilities. To ensure this is the case,
010 wil continue to monitor the use of invalid identifiers on Part D claims. I would be
happy to answer any questions at this time.
Robert A. Vito, HHS DIG, before U.S. Senate Committee on Homeland Security and
Testimony of 
Governent Affairs, Subcommittee on Federal Financial Management, Governent Information, Federal
Services, and International Security. July 15,2010
7