Department of Health and Human Services
OFFICE OF 
 
INSPECTOR GENERAL 
  
 
 
 
 
CMS I
S  MPLEMENTATION OF 
 
S D F
AFEGUARDS  URING  ISCAL 
 
Y 2  006 T P
EAR    O  REVENT AND 
 
D F A
ETE CT  RAUD AND  BUSE       
 
M P
IN  EDICARE  RESCRIPTION 
 
  D P  
RUG  LANS 
 
 
 
 
 
 
 
Daniel R. Levinson  
Inspector General 
 
October 2007 
OEI-06-06-00280 
     
 
 
Office of Inspector General 

 
http://oig.hhs.gov 
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452,  
as amended, is to  protect the integrity of  the Department of Health and Human Services 
(HHS)  programs, as well as the health and welfare of beneficiaries  served by those 
programs.  This statutory mission  is  carried  out through  a nationwide network  of  audits, 
investigations, and inspections conducted by the  following operating components:  
Office of Audit Services 
The Office of Audit Services (OAS) provides all auditing services  for HHS, either by  
conducting audits with its  own audit resources or by overseeing audit work done by others.   
Audits examine the performance of HHS programs and/or its grantees and  contractors  
in carrying out  their respective responsibilities and are intended  to provide independent  
assessments of  HHS programs and operations.  These assessments help reduce waste, 
abuse, and mismanagement  and  promote economy and  efficiency throughout HHS. 
Office of Evaluation and Inspections  
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on 
significant issues.  Specifically, these evaluations focus on preventing fraud,  waste,  or  
abuse and promoting  economy, efficiency, and effectiveness  in departmental programs.  
To promote impact, the reports also present practical recommendations for improving 
program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative  
investigations  of  allegations of wrongdoing  in HHS  programs or to HHS  beneficiaries  
and of unjust enrichment by  providers.  The investigative  efforts  of OI lead to  criminal  
convictions, administrative sanctions,  or  civil monetary penalties.  
Office of Counsel to the Inspector General 
The  Office of Counsel to the Inspector General (OCIG)  provides  general legal services  to  
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support in OIG's internal operations.   OCIG imposes program exclusions and civil 
monetary penalties  on health care providers and litigates  those actions  within HHS.   
OCIG also  represents OIG in the global settlement of  cases  arising under the Civil False 
Claims Act, develops and monitors corporate integrity agreements, develops compliance 
program guidances, renders advisory opinions on OIG sanctions to  the health care  
community,  and issues fraud alerts  and other industry  guidance.  
 
     
 
 
E X E C U T I V E   S U M M A R Y  
  E X E C U T I V E   S U M M A R Y  
OBJECTIVE 
To determine the extent to which the Centers for  Medicare &  Medicaid 
Services (CMS) implemented safeguards during fiscal year (FY) 2006 to  
prevent and detect fraud and abuse in Medicare  prescription drug plans 
(PDP). 
BACKGROUND 
CMS is responsible for safeguarding the Medicare Part D program 
against fraud and abuse.  CMS is statutorily required to perform  
financial audits of PDPs contracted to provide drug benefits to Medicare 
beneficiaries. Beyond this requirement, CMS holds considerable 
discretion in structuring  safeguards for the program.  In total, we 
identified six major safeguard activities conducted by CMS:  a complaint 
process, data-monitoring activities, financial audits, monitoring PDP  
sponsor compliance with contract requirements, oversight of PDP efforts 
to reduce fraud and abuse, and providing education and guidance to a 
number of stakeholders  on fraud and abuse identification.  CMS 
contracted with one Medicare Prescription Drug Integrity Contractor 
(MEDIC) in FY 2006 to perform some of these functions, including 
complaint investigation. 
To identify the status of  safeguard implementation and to provide an 
early assessment of progress, we reviewed documents provided by CMS 
and the MEDIC describing and documenting current and planned 
efforts during FY 2006 and conducted a series of structured interviews 
with CMS and MEDIC staff.  Although our focus was on PDPs, some of 
the concerns raised may also be applicable to Medicare Advantage 
Prescription Drug Plans and the Retiree Drug Subsidy. 
FINDINGS 
CMS implemented safeguard activities throughout FY 2006; 
however, further development or application  of these activities is 
needed 
Some of CMSs safeguards have been functioning since enrollment 
began, while others were implemented in a limited capacity or had not 
yet begun.   For example, the complaint process  has been in  place since  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   i 
    E X E C U T I V E   S U M M A R Y
   
November 2005, but other safeguards, such as data analysis for fraud 
detection, had not yet begun by the end of FY 2006.  Compliance audits, 
an important tool for monitoring PDP sponsor compliance, had not 
begun, but CMS staff underwent extensive preparations, including 
protocol development and staff training.  CMS reported that initial 
preparation for financial audits began in FY 2006, with the first audits 
expected to begin in January 2008.  CMS issued initial guidance for 
PDP compliance plans and is conducting education initiatives; however, 
the slow release of two important guidance documents raises concern.  
In FY 2006, CMS relied largely  on complaints to identify  potential 
fraud and abuse in the Medicare  Part D program; however, not all  
complaints were investigated timely    
During the first year of the programs operation,  CMS relied largely on  
complaints to identify potential fraud schemes and abusive practices.  
Fraud complaints are handled by the MEDIC, which evaluates the 
merit of each complaint, conducts investigations, and makes referrals to 
law enforcement, as appropriate.  At the end  of our data collection,       
24 percent of the 6,132 complaints that the MEDIC had received were 
open cases, apparently the result of insufficient staff.  In addition, CMS 
does not track Medicare Part D fraud and abuse complaints made to     
1-800-MEDICARE, nor does it know if these callers actually follow 
through with instructions to make additional calls to the MEDIC 
hotline. 
Limits to legal authority, jurisdiction, and CMSs ability to monitor 
enrollees switching plans complicate CMSs efforts to safeguard 
Medicare Part D PDPs  
We identified three impediments to  the effective oversight of Medicare 
Part D, specifically in the areas of financial auditing, Part D  marketing, 
and utilization management.  For example, CMS does not have the legal 
right to go  onto the premises of pharmaceutical benefit managers to 
verify that plans accurately report all remuneration and must rely on 
PDP sponsors to include sufficient requirements in their own  contracts.  
Further, CMS has limited authority over insurance brokers, one of the  
most frequent subjects of fraud complaints.  Lastly, coordination of 
information between plans about beneficiaries suspected of 
inappropriate utilization had not occurred because the plan sponsors 
have concerns over the Health Insurance Portability and Accountability 
Act of 1996 privacy laws. 
 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   ii  EE XX EE CC UU TT II VV EE    SS UU MM MM AA RR YY
    
RECOMMENDATIONS 
To ensure that CMSs program integrity safeguard activities are 
implemented in a manner that is sufficient to protect the Medicare 
Part D program, we recommend that CMS: 
Develop a comprehensive safeguard strategy  for Medicare Part D 
PDPs with specific activities and target dates and ensure that all 
activities are progressing in a timely manner. CMS should develop a 
comprehensive strategy with specific activities and target dates and assign 
staff to follow up on progress. Further, CMS should make Medicare Part 
D safeguard activities a sufficient priority in the budgeting process to 
support their timely and effective administration. 
Ensure that all fraud complaints receive proper attention.   CMS should 
have a process in place to monitor the number of open complaints and  
take action if backlogs occur. Additionally, CMS should investigate 
options to immediately transfer fraud complaints submitted to 1-800-
MEDICARE to the appropriate MEDIC.   
Address legal concerns that may impede program integrity efforts.   
Specifically, CMS should: (1) require PDP sponsors to include standard 
wording regarding requirements for record retention and accessibility 
within subcontractor contracts, (2) enforce appropriate sanctions for  
plans whose brokers violate permissible marketing practices, and         
(3) utilize the MEDICs as intermediaries for PDPs to share information 
about their beneficiaries suspected of inappropriate utilization.   
AGENCY COMMENTSAND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
In its comments to the draft report, CMS responded that many of its 
ongoing activities already satisfy our recommendations. It further 
stated that the report does not fully explain the immense workload  
required for CMS to develop and administer the benefit in its first year 
and indicated that processes and procedures have improved  over time.  
CMS additionally reported several advances in this safeguard strategy 
that occurred after the end of our data collection period (FY 2006). We 
revised the draft report, as appropriate, based on these comments. CMS 
did not indicate whether it concurred with our recommendations. We 
ask that, in its final management decision, CMS indicate whether it 
concurs with our recommendations and what steps, if any, it will take to  
implement them. 
OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   iii   
 
 
  T A B L E   O F   C O N T E N T S  
E X E C U T IV E   S U M M A R Y  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i
  
 
 
I N T RO DUC T I ON . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  1 
  
 
 
F I N D IN GS  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8  

  CMS implemented safeguard activities in FY 2006  . . . . . . . . . . . . 8
 
  CMS relied largely on complaints  . . . . . . . . . . . . . . . . . . . . . . . . .  12
  
  Legal authorities, jurisdiction, and monitoring enrollees. . . . . . .  14
  
   
R E COM MEN DA T I ON S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  17
  
Agency Comments and Office of Inspector General Response. . . .  19 

 
 
A P P EN D IX E S  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  23
  
  Appendix A:  Medicare Part D Benefits and Operation. . . . . . . . .  23
  
  Appendix B:  Agency Comments. . . . . . . . . . . . . . . . . . . . . . . . . . .  25
  
 
 
A C KN O WL E D GM EN T S   . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  29
  
      I N T R O D U C T I O N  
OBJECTIVE 
To determine the extent to which the Centers for  Medicare &  Medicaid 
Services (CMS) implemented safeguards during fiscal year (FY) 2006 to  
prevent and detect fraud and abuse in Medicare  prescription drug plans 
(PDP). 
BACKGROUND 
This inspection is an early implementation review of CMSs efforts to  
prevent and detect fraud in Medicare Part D PDPs.  A separate Office of  
Inspector General (OIG) inspection, Prescription Drug Plan Sponsors  
Compliance Plans, addressed efforts made by the plans themselves.1  
Medicare Part D Prescription Drug Program  
The Medicare Prescription Drug, Improvement, and Modernization Act 
of 2003 (MMA) established the Medicare Part D prescription drug 
program. Effective January 1, 2006, this program provides an optional 
outpatient prescription drug benefit, which is available to all 42 million 
Medicare beneficiaries.2 3  Beneficiaries generally have the option to 
enroll either in a stand-alone PDP for their drug coverage and receive 
all other benefits through traditional Medicare fee-for-service or enroll 
in a Medicare Advantage plan and receive all Medicare benefits, 
including drug coverage, through managed care.4   
The MMA required an aggressive implementation schedule for the 
Medicare Part D benefit.  In the approximately 2 years between passage 
of the law and the effective date of Medicare Part D coverage, CMS and 
plan sponsors were conducting implementation activities, including the 
development of procedures, data systems, and infrastructure to carry 
out all necessary functions. Applications for the first PDPs were due in 
March 2005 and beneficiaries began electing coverage in  
November 2005. As of July 2006, approximately 24 million Medicare 
 
1  OEI-03-06-00100. 

2  Social Security Act  1860D-1. 

3 Centers for Medicare & Medicaid Services, Medicare Enrollment:  National Trends
  
1966-2005.  Available online at 

http://www.cms.hhs.gov/MedicareEnRpts/Downloads/HISMI05.pdf. Accessed on March 

22, 2006. 

4 CMS, Final Rule, Medicare Prescription Drug  Benefit, 70 Fed. Reg. 4194   
      
(January 28, 2005). 

  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   1  I N T R O D U C T I O N
   
beneficiaries were enrolled in a Medicare Part D drug plan.5   A 
summary of the benefit and its operation is included in Appendix A. 
During 2006, the first full year of the benefit, expenditures totaled more 
than $47 billion.6  To implement the program, CMS received $1 billion 
for startup costs to be used in FYs 2004 and 2005.7  Of that $1 billion, 
CMS used 44 percent for education  and outreach, 5 percent for payroll 
expenses, and the balance primarily for information technology 
improvements.8  It is unclear what portion of the $1 billion was 
dedicated to program integrity efforts.  In addition, CMS received a one-
time increase of $100 million from the Deficit Reduction Act (DRA) of 
2005 for Medicare program integrity activities conducted during FY 
2006. 9  A portion of these funds was allocated to activities designed to 
protect Medicare Part D from fraud and abuse.  Future funding sources  
for Part D program integrity activities have yet to be determined.  
Program Integrity Staff and Medicare Prescription Drug Integrity Contractors 
Numerous groups within CMS have responsibility for overseeing 
aspects of Part D administration, including the Center for Beneficiary 
Choices, the Office of the Actuary, and the Office of Financial 
Management.  However, the Medicare Modernization Act Integrity 
(MMAI) group within the Office of Financial Managements  Program 
Integrity Group is focused specifically on fraud  prevention and detection  
in Part D. The MMAI group conducts training, reviews regulations, and 
provides guidance to the Department of Health and Human Services on  
what fraud-related vulnerabilities exist and how they should be 
addressed.   It is also responsible for overseeing the Medicare  
Prescription Drug Integrity Contractors (MEDIC).   
 
5 Center for Medicare & Medicaid Services, Medicare Advantage, Cost, PACE, Demo, 

and Prescription Drug Plan Contract Report  Monthly Summary Report. September 

2006. Available online at 

http://www.cms.hhs.gov/PrescriptionDrugCovGenIn/02_EnrollmentData.asp.   Accessed 
 
on October 18, 2006. 

6 2007 Annual Report of the Boards of Trustees of the Federal Hospital Insurance and 

Federal Supplementary Medical Insurance Trust Funds, p. 5.  Available online at 

http://www.cms.hhs.gov/ReportsTrust Funds/downloads/tr2007.pdf.   

Accessed on July 24, 2007. 

7 Public Law 108-173  1015. 

8 Centers for Medicare & Medicaid Services, Budget Facts. February 7, 2005.   Available 

online at http://www.cms.hhs.gov/apps/media/ press/release.asp?Counter=1350. Accessed 

on May 30, 2006.  

9 Deficit Reduction Act  5204 amending Social Security Act  1817(k)(4)C. 

  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   2  I N T R O D U C T I O N
   
MEDICs are private firms with which CMS contracts to perform fraud 
prevention and detection activities, including complaint tracking and 
investigation and data mining.  Only one MEDIC contract was awarded 
for work conducted during FY 2006 and that contract was awarded on a 
reduced-scope basis. CMS attributed this decision to funding 
limitations.  That MEDIC provided the staff dedicated to investigating 
prescription drug fraud complaints during the first year of the Medicare 
Part D benefit.  Three regional MEDICs and a data-focused MEDIC 
were each awarded 1-year contracts in September 2006 (after release of 
the DRA funds) with operations beginning in December 2006. 
Fraud and Abuse Strategy  
CMS is responsible for preventing and detecting fraud and abuse in 
Medicare Part D.  However, the only activity statutorily required of 
CMS is to conduct financial audits of one-third of  the plans each year.10   
Beyond that, CMS exercises considerable discretion in safeguarding the 
program. CMSs publicly announced plans to combat fraud and abuse 
in Medicare Part D include a range of prevention and detection 
activities; however, the complete strategy has not been laid out as a 
single comprehensive plan.  Accordingly, we analyzed CMSs various 
press releases and guidance documents to identify CMSs safeguard 
activities. 
In an October 2005 press release, CMS announced that it would be 
expanding its efforts in  fighting fraud and abuse in Medicare [Part D] 
by using state of the art  systems and expertise to prevent problems 
before they  occur.11  It further discussed a general three-pronged 
approach to  safeguarding the Medicare Part D program which includes:   
(1) implementing new and innovative techniques to monitor and analyze  
data to help identify fraud; (2) working with key  partners, such as law 
enforcement and consumer groups; and (3) providing tips for 
beneficiaries to protect themselves.   In this same press release, CMS 
announced the selection of eight MEDICs that would then be eligible to  
bid on contracts for future MEDIC work.  Also in October 2005, CMS 
released a document titled Part D Oversight Strategy for 
 
10 Social Security Act  1860D-12(b)(3)(C). 
11 CMS Fact Sheet:  The New Medicare Prescription Drug Program:  Attacking Fraud 
and Abuse.  October 7, 2005.  Available online at  
www.cms.hhs.gov/apps/media/press/release.asp?Counter=1693. Accessed on 
November 20, 2006. 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   3  III NNN TTT RRR OOO DDD UUU CCC TTT III OOO NNN     
Contractors/Industry.12   This document states that oversight  will be 
data driven to the extent possible and identifies four functions that will 
feed into oversight: contractor management, auditing, compliance and 
enforcement, and the functions performed by MMAI and the MEDICs.    
SAFEGUARD ACTIVITIES 
We have defined safeguard activities  as any activity or process that is 
able to prevent or detect fraud and abuse, as some activities identified  
as safeguards are not designed explicitly for that purpose. From CMSs 
press releases, the oversight strategy document, and interviews with 
CMS staff, we identified the following six major types of safeguard 
activities: 
1. Complaint ProcessThis process involves the intake, tracking, and 
investigation of fraud complaints. Complaints may arise from 
beneficiaries, pharmacists, plan staff, or any other person  with a fraud  
complaint pertaining to Medicare Part D. Complaints provide a source 
of direct information about potential fraud. 
2. Data MonitoringData monitoring describes the use of data systems 
to assess transactions and look for anomalies that might suggest fraud. 
This includes automated data edits, trend monitoring, and data mining. 
3. Financial AuditsFinancial audits verify that plan-reported financial 
data are credible and accurate. The MMA specified that a financial 
audit should be conducted on one-third of all Medicare Part D plans 
each year.  Financial audits could cover a wide range of topics and 
would potentially reveal problems that may result in overpayment to  
plans, including misrepresentation  of bids, underreporting of rebates, 
and inaccurate prescription drug event data. 
4. Monitoring PDP Sponsor ComplianceCMS conducts a number of 
monitoring activities designed to oversee the operation of PDPs. If 
problems are identified  through these activities, CMS can implement  
intermediate sanctions  or terminate a PDP contract. The activities 
include account management activities, compliance audits, and  
operational safeguards. 
 
12 Centers for Medicare & Medicaid Services, Part D Oversight Strategy  for 
Contractors/Industry. October 24, 2005. 
OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   4  I N T R O D U C T I O N
   
 	  Account managementCMS account managers act as a nerve center 
into which all types of PDP information feeds and are tasked with 
educating PDP sponsors on new, revised, or misunderstood  policies.  
They hear complaints from the PDPs about CMS operations and  
receive regular reports about beneficiary complaints and PDP-
reported data.   
 	  Compliance auditsCMS staff use compliance audits to measure 
PDP sponsors adherence to 14 broad elements that are required of 
them.13  These audits are designed to ensure that plans have 
management controls in  place to  enable all necessary functions, 
including beneficiary enrollment and claims processing. 
 	  Operational SafeguardsA wide range of management controls 
used in the routine operation of Medicare Part D have both a 
primary role in administration of the benefit and a secondary role of 
fraud prevention and detection.   Two examples  of operational 
safeguards are the bid review and the formulary and benefit 
review.14  15   
5. Oversight of PDP Efforts To Reduce Fraud and AbuseAs part of the 
contract to administer PDPs, CMS requires PDPs to have in place 
effective fraud control programs and recommends some specific 
 
13 The 14 elements addressed in the audit protocol are:  (1) Enrollment and  
Disenrollment; (2) Provider Communication; (3) Marketing and Beneficiary Information; 
(4) Privacy and Confidentiality; (5) Drug  Utilization Management, Quality Assurance,  
and Electronic Prescribing; (6) Pharmacy Access; (7) Formulary, Transition Process, and 
Pharmacy  & Therapeutics Committee; (8) Medication  Therapy Management;                  
(9) Coordination of Benefits/True-Out-of-Pocket Costs; (10) Compliance Plan;                
(11) First-Tier and Downstream Contracts/Maintenance of Records; (12) Claims 
Processing  and Payment; (13) Grievances, Coverage Determinations, and Appeals; and 
(14) Licensure and Solvency. 
14 The actuarial aspect of the bid  review process is conducted  by  CMSs Office of  the 
Actuary.  CMS staff and contractors review bids  to determine whether the assumptions 
underlying financial projections are appropriate  and reasonable.  Included in this review  
is a detailed statistical analysis  to identify outlier values in the bid components.  When  
outliers are identified, a more thorough review is initiated and values are substantiated 
prior to approval.  Some specific aspects of the review  may enable CMS to identify  
inappropriate cost manipulation  tactics that could affect total Part D costs. 
15 CMS conducts a formal review to ensure that a PDPs formulary and benefit structure 
meet minimum  specifications, ensuring that beneficiaries have access to a full range of 
medications.  The formulary review process is an automated  process that checks for these 
specifications.  If the formulary  does not pass the review, CMS returns the formulary to 
the plan  for revision.  A similar process is used to ensure that the plans benefit package 
matches its formulary.  For example, if a plans benefit package indicates a certain 
number of cost tiers, the formulary  must show  drugs available in each of the tiers.  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   5  I N T R O D U C T I O N
   
activities to identify potential fraud and abuse.16   With the ability to 
monitor drug transactions and implement utilization controls that could  
serve as an alert for fraud, PDPs are uniquely situated to identify fraud  
committed by beneficiaries or pharmacies.   
6. Education and GuidanceCMS has an initiative to educate 
beneficiaries about potential fraud schemes and how to protect 
themselves.  Training for law enforcement, CMS staff, and other 
Government agencies is also designed to address fraud issues 
developing in Medicare  Part D.   
SCOPE 
This review describes the implementation status of CMS safeguard  
activities related to stand-alone PDPs during FY 2006.  We did not 
describe safeguard activities conducted by the PDPs themselves. As the 
prescription drug benefit is still new,  we also did not seek to determine 
the effectiveness of the safeguards that are in place or planned.   We also  
excluded issues of data integrity and security, which is being addressed 
by a separate OIG inquiry. Although our focus was on PDPs, some of 
the concerns raised may also be applicable to MA-PDs and the Retiree 
Drug Subsidy.17  18  
METHODOLOGY 
We reviewed a variety of documents and conducted a series of 
interviews with CMS and MEDIC staff to determine the 
implementation status of safeguard activities at the time of our review.     
Document Review  
We reviewed publicly available documents as well as internal 
documents provided to  us by CMS and the MEDIC.  Documents 
included press releases,  guidance documents, standard operating 
procedures, budget documents, contracts, and training materials. 
 
16 42 CFR  423.504(b)(vi)(H). 

17 Medicare Advantage plans offer a complete range of health benefits including  hospital
  
and physician coverage.  They may choose to offer an additional prescription drug benefit 

through Medicare Part D. 

18 The Retiree Drug Subsidy encourages private employers to provide Part D benefits to 

their retirees by subsidizing the cost for Medicare-eligible beneficiaries. 

  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   6  II NN TT RR OO DD UU CC TT II OO NN    
Interviews  
We conducted 19 interviews, either in  person or by telephone, primarily 
during August and September 2006. These interviews were with CMS 
staff in the Office of Financial Management, the Center for Beneficiary 
Choices, and the Office of the Actuary. Our discussions addressed 
specific program integrity issues involved in various operations of the 
Medicare Part D program.   
Site Visit 
We conducted a site visit with the Enrollment and Eligibility MEDIC, 
Delmarva Foundation, in Easton, Maryland. Delmarva Foundation was 
the only MEDIC in operation at the time of our data collection. During 
this visit, we interviewed managers  and senior staff regarding their 
contracting process, operations, and perspectives on fraud 
vulnerabilities. Additionally, we observed the intake of beneficiary 
complaints to the MEDIC fraud hotline by telephone operators, toured  
the facility, and observed the use of the MEDICs data systems. We also 
reviewed documentation of the complaint statistics, standard operating 
procedures, and training sessions conducted by MEDIC staff. 
Direct Observation 
Several internal management systems were demonstrated for us by 
both CMS and the MEDIC. At CMS, we observed several modules of 
the Health Plan Management System (HPMS) in use, including bid 
review, formulary submission and review, plan benefit package review, 
and compliance audits.19   During the MEDIC site visit we observed use 
of the Complaint Tracking Module of HPMS, as well as internal MEDIC 
complaint-tracking and data analysis systems.   We also used the 
MEDICs complaint-tracking data to determine the overall number of 
complaints. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspections issued by the Presidents Council on Integrity and 
Efficiency and the Executive Council on Integrity and Efficiency. 
 
19 The HPMS is a Web-enabled information system that supports the ongoing operations  
of the Medicare Advantage and  Part D programs by facilitating  electronic communication  
between CMS and plans.  
OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   7    F I N D I N G S  
Some aspects of CMSs strategy to 
CMS implemented safeguard activities throughout 
safeguard Medicare Part D have 
FY 2006; however, further development or 
been operational since enrollment 
application of these activities is needed   began in November 2005. Others 
were implemented in a limited 
capacity or had not yet begun.  Below are descriptions of each of the six 
safeguard activities, i.e., complaint process, data monitoring, financial 
audits, monitoring PDP sponsor compliance, oversight of PDP efforts to  
reduce fraud and abuse, and education and guidance, and their 
implementation status as of the end of FY 2006.   
Complaint ProcessComplaint investigations resulted in 312 referrals 
related to the $299 Ring scam and 122 other fraud referrals  
The process  to handle complaints has been in place since November  
2005. Generally, complaints are submitted through a public number  
(1-800-MEDICARE) and are routed to regional staff for followup and 
resolution.  However, complainants that suggest fraud are advised to 
call to the MEDIC, which receives calls through a toll-free hotline 
number (1-877-7SAFERX) that is dedicated to complaints about 
potential Part D fraud. The MEDIC is responsible for evaluating the 
merit of fraud complaints and conducts investigations to determine 
whether referrals to law enforcement agencies or State insurance 
commissions are appropriate.  Shortly after the  end of the fiscal year,  
the MEDIC had investigated 1,421 complaints and made 434 fraud 
referrals.20  Specifically, the MEDIC referred 38 cases to OIG, 80 cases 
to State insurance commissioners, and 4 cases to local or State law 
enforcement.21  Additionally, the MEDIC referred 312 cases for a 
particular type of fraud, known as the $299 Ring scam.  The $299 
Ring scam involved a scheme whereby perpetrators called potential 
enrollees and requested bank account numbers to withdraw payment 
for enrollment into a nonexistent PDP. 
Data MonitoringNeither CMS nor the MEDIC had conducted any significant 
data analysis for fraud detection purposes  
Data-driven fraud detection was mentioned in multiple press releases 
as a critical part of CMSs fraud control strategy.  However, those efforts  
have been slow to materialize.  Electronic systems were put in place to 
ensure proper formatting and logical consistency in Part D claims data 
 
20 The MEDIC complaint descriptors reflect complaints received until October 30, 2006. 
21 A case referral may include numerous individual complaints.  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   8  F I N D I N G S  

and controls were put in place to ensure that the extra benefits for low-
income  enrollees are designated appropriately.  However, no significant 
data analysis had been  conducted specifically to  detect or prevent fraud 
and abuse. 
CMS staff reported that they did not expect to begin these efforts 
immediately and that efforts were further delayed by a lag in data 
submissions.  The data lag occurred because it took time for the PDPs to  
submit claims data properly, a consequence of a complex and quickly 
designed system. Additionally, CMS experienced some data problems  
during the early phases of implementation.  One example is that some  
beneficiaries appeared to be incorrectly enrolled in two PDPs 
simultaneously, allowing drug transactions to be billed to the incorrect  
PDP.  This problem was eventually resolved, but the process of 
correcting those errors did not begin until August 2006.  
Another barrier to conducting data analysis was the lack of a 
centralized data repository.  In September 2006, CMS contracted with 
Electronic Data Systems to be the One Program Integrity System 
Integrator (One PI).  The One PI will warehouse Medicare data for 
prescription drugs, physician services, and inpatient care, among other 
data. This contract represents a significant step towards the use of 
data-driven fraud detection methods, but no actual data analysis is 
expected until the summer of 2007. When operational, this group will 
be responsible for using data analysis techniques to uncover fraud, 
waste, and abuse. It will also offer powerful data analysis tools and 
make data accessible to  CMS program integrity staff and other 
appropriate parties via a Web-based portal. 
Financial AuditsCMS let a contract to develop the financial audit program  
just before the end of FY 2006, with an expectation that the first audits will  
begin in January 2008 
The final reconciliation between CMS and the PDP sponsors is scheduled 
to begin in September 2007, following the June 30, 2007, deadline for 
PDPs to submit rebate information.  CMS staff do not plan to begin 
conducting financial audits until the reconciliation is complete, which 
means that the earliest financial audits will likely begin in January 2008.  
These first audits will be designed to verify financial data for plan year 
2006. 
CMS is required to conduct audits on one-third of Medicare Part D 
organizations, including PDPs, each year.  However,  the one-third  audit 
requirement does not specify that CMS audit every plan within a 3-year 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   9   F I N D I N G
  S  
period or any other timeframe.  Therefore, it is conceivable that some  
plans would not be audited during the Part D programs initial 3-year 
period.  
In addition, CMS staff expressed concern that funding limitations may 
constrain the depth and/or breadth of the audits.  Although CMS took a 
significant step in preparation for the audits by  hiring a contractor in  
September 2006 to develop the audit process and protocols, further and 
more costly steps are still needed.  By September 2007, CMS expects to 
have a final audit process and protocol, including thresholds for audit 
findings and timelines for conducting audits, but still needs to hire and 
train additional contractors to conduct the audits.  The number of staff 
required has not yet been determined but will likely be significant and 
costly.  For the financial audits to proceed as planned, CMS will need to 
identify them as a high priority when making budget decisions. 
Monitoring PDP Sponsor ComplianceEfforts to monitor PDP sponsor 
compliance are in place, but compliance audits have been delayed 
Although routine account management activities and operational 
safeguards were in place prior to the first beneficiary enrollment period, 
compliance audits had not started as of the end of FY 2006.  CMS staff 
have, however, undergone extensive preparations for conducting 
compliance audits.  Audit protocols have been developed and many staff 
at CMS are reportedly trained and ready to begin the audit process.  
Compliance audits were scheduled to begin in the summer of 2006 but 
were delayed because the data system that enables CMS to schedule 
and track compliance audits encountered technical problems. Staff 
anticipated that the first audits would be conducted in early 2007. 
Oversight of PDP Efforts to Reduce Fraud and AbuseCMS issued 
requirements for PDP sponsors fraud, waste, and abuse compliance plans  
As a part of their contracts, PDP sponsors must agree to implement fraud 
control programs.22  CMS issued guidelines to PDP sponsors before the 
benefit began and then updated guidance with the release of the initial 
chapter (issued as chapter 9) of its Prescription Drug Benefit Manual in 
April 2006. This chapter describes specific requirements for PDP 
sponsors fraud, waste, and abuse compliance plans which address 
primarily basic infrastructure.23  Specific fraud detection activities are 
 
22 42 CFR  423.504(b)(vi)(H). 

23 Centers for Medicare & Medicaid Services, Prescription Drug  Benefit Manual, 

chapter 9.
  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   10  F I N D I N G S  

recommended but are not required.  CMS expected that PDPs would  
incorporate CMS guidance into their compliance plans by January 2007.  
An OIG report, Prescription Drug Plan Sponsors Compliance Plans, 
found that although all PDP sponsors had a plan to detect, correct, and 
prevent fraud, waste, and abuse in place by January 1, 2006, few PDPs 
addressed all of CMSs recommendations for specific fraud and abuse 
detection activities.24 
Education and GuidanceMany education efforts were under  way, but the 
slow release of two key documents raises concern   
By the end of FY 2006, CMS and the MEDIC had conducted numerous 
training sessions for beneficiaries,  PDP sponsors, and law enforcement  
entities. Other educational efforts included advisory opinions, direct  
mailings, training, and conferences.  These efforts contribute to 
beneficiary protection, as well as information sharing between law 
enforcement groups working on Medicare Part D integrity issues.   
Despite these efforts, the delayed release of two critical documents 
raises concern.  First, although CMS makes most of its Medicare Part D  
guidance materials available on the Internet, the agency has not yet 
completed the Prescription Drug Benefit Manual.  As of the end  of FY 
2006, five chapters had been released in final form, including the 
following:  2, Part C and D Marketing Guidelines, 3, PDP Enrollment  
and Disenrollment Guidance, 9, Fraud Compliance Plans,                 
14, Coordination of Benefits, and 18, Grievances, Coverage 
Determinations, and Appeals. As a result, PDP sponsors are expected  
to cull the information about Medicare Part D requirements from a 
variety of letters and guidance documents.  Second, CMSs only 
Medicare Part D fraud alert issued during the first year of the program 
took several months to release.  The alert regarded the $299 Ring 
scam.  A consumer alert was released in June 2006, but the fraud alert, 
which is intended to be an early alert for law enforcement entities and 
PDP sponsors, had not been released by the end  of the fiscal year.25   
CMS staff explained that the delay was due to CMSs writing, editing, 
and clearance process, as well as its perception that the warning was 
most pertinent during periods of plan marketing and open enrollment, 
which occurred in November 2006. 
 
 
24 OEI-03-06-00100. 

25  The fraud alert was released in November 2006. 

  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   11   F I N D I N G S  

With aspects of CMSs fraud protection 
In FY 2006, CMS relied largely on complaints to 
program not in place at the time  of our 
identify potential fraud and abuse in the 
review, CMS relied largely on complaints 
Medicare Part D program; however, not all 
to identify potential fraud schemes and 
complaints  were investigated timely  
abusive practices in the first fiscal year of 
Medicare Part D operation. CMS staff 
described complaints as an effective  fraud and abuse protection tool, 
indicating that beneficiaries are frequently vocal about their 
experiences  and often report suspected wrongdoing.  Further, CMS staff 
suggested that some types of fraud are best identified by beneficiaries 
reporting directly on their experiences.   
Although complaints are a valuable source of information, we noted two 
weaknesses in the complaint process.  First, the MEDIC was battling a 
sizeable number of open complaint cases deemed worthy of 
investigation, and second, Medicare Part D fraud complaints submitted 
to 1-800-MEDICARE are not tracked, allowing for the possibility of 
missing important information from valid fraud complaints.   
Shortly after the close of FY 2006, 24 percent of the 6,132 complaints  
received by the MEDIC were open, most of which required further 
investigation  
At the time  of our data collection, a single MEDIC (Delmarva 
Foundation), contracted to focus on enrollment and eligibility fraud in 
the early months of Medicare Part D operation, was responsible for  
tracking and investigating all fraud complaints and referring cases of 
merit to law enforcement.  The MEDIC conducted complaint intake and 
triage on 6,132 complaints received during FY 2006.26  The triage 
process is used to determine a priority level for further investigation 
and helps to ensure that the most serious fraud complaints are quickly 
identified.27   A few complaints are quickly referred to an enforcement 
agency without ever being investigated by the MEDIC, and  many others  
are quickly closed  or referred to the PDP because it is clear that fraud is 
not the issue.  The remaining complaints are considered open until the 
case is referred to and accepted by law enforcement or closed as a result  
of insufficient evidence.  
 
26 The MEDIC complaint data reflect complaints received through October 30, 2006. 
27 The triage process involves evaluating each complaint on  five criteria:  patient abuse, 
geographic scope of impact, monetary impact, ability to prosecute, and  pattern of fraud.  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   12  F I N D I N G S  

Shortly after the end of FY 2006, the MEDIC had 1,475 open complaints 
in various stages of investigation. These included complaints awaiting 
review, active investigations, and cases in the preliminary stages of 
referral to law enforcement agencies.  Of these, almost half had been 
open for at least 150 days and a few had been open for 300 days or more.   
The significant number  of open complaints appears to be the result of an 
insufficient number of investigative staff.  The first MEDIC contract 
funded only primary activities, such as complaint intake and 
investigation, forcing the MEDIC to reduce its original plan for the 
range  of efforts employed and resources dedicated to fighting fraud.  
Although the MEDIC maintained all complaint intake activities, only 
three full-time and three part-time investigative staff were assigned to 
conduct follow-up investigations.  Staff at CMS and staff at Delmarva 
Foundation were optimistic that, with the addition of the three regional 
MEDICs beginning operations in December 2006, the number of open 
complaints would be dramatically reduced. 
Medicare Part D fraud and abuse complaints submitted to 1-800-MEDICARE 
are not logged or tracked   
Both 1-800-MEDICARE and 1-877-7SAFERX are publicized phone 
numbers, but 1-800-MEDICARE is designed as a resource to answer 
general questions and receive all types of Medicare complaints, 
including Medicare Part D fraud complaints.  In contrast, 1-877-
7SAFERX is dedicated to complaints about Medicare  Part D fraud.  
Although the customer service representatives at 1-800-MEDICARE  
enter most complaints into the Complaint Tracking Module of HPMS, 
Medicare Part D fraud complaints are not entered.  When Medicare 
Part D fraud is suspected, the customer service representative advises 
the caller to call the MEDIC at 1-877-7SAFERX.  CMS does  not track 
how many people have been advised to call the MEDIC, nor does it  
conduct any followup to ensure that the complainant actually called the 
MEDIC. To the extent that callers are not following through with calls 
to 1-877-7SAFERX, valid complaints could be slipping through the 
cracks. 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   13  FF II NN DD II NN GG SS  

Limits to legal authority, jurisdiction, and CMSs  Despite the operation of six types 
of safeguard activities, we  
ability to monitor enrollees switching plans 
identified three impediments to 
complicate CMSs efforts to safeguard 
the effective oversight of Medicare 
Medicare Part D PDPs 
Part D, specifically in the areas of 
financial auditing, Part D marketing, and utilization management.  
Although these impediments are not  insurmountable, they do make  
CMSs Medicare Part D oversight responsibility more difficult to fulfill. 
CMS has limited ability to  verify that direct and indirect remuneration are 
accurately reported by PDP sponsors 
After the plan year has ended, PDPs must report to CMS all outstanding 
financial information, including direct and indirect remuneration. 
Remuneration received  by PDP sponsors may reduce the PDP sponsors 
cost of providing Medicare Part D drugs. Such remuneration includes 
manufacturer or pharmaceutical benefit manager rebates, chargebacks, 
discounts, goods in kind, or grants.   Remuneration is deducted from PDP 
losses (or added to PDP profits) for the year and may have a significant 
impact on the final payment reconciliation between CMS and PDP 
sponsors, because it directly affects the amount of money that CMS will 
reimburse or recoup from PDPs. Underreporting remuneration could 
result in significant losses to the Medicare Part D program.   The onus is  
on PDPs to accurately and completely report this information. However,  
CMSs ability to check the veracity of this self-reported data is limited to 
financial audits, and auditors will be faced with the difficult task of 
identifying any remuneration that is not reported by PDPs or their 
subcontractors. 
Additionally, CMS staff do not currently have the legal authority to go 
onto the premises of the  pharmaceutical benefit managers to verify the 
flow of goods and money. Instead, CMS must rely on PDP sponsors to  
include sufficient requirements in their own contracts with subcontractors. 
Regulations require that a PDP sponsor agrees to require all related 
entities, contractors, or subcontractors to allow CMS access to documents 
and information for the  purpose of audits.28 However, if the PDP sponsors 
fail to include sufficient access provisions in their contracts with 
subcontractors, the regulations afford CMS no direct regulatory authority 
to independently access information.  
 
28 42 CFR  423.505(i)(2). 
OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   14  F I N D I N G S  

CMS has limited authority  over insurance brokers, one of the most 
frequent subjects of fraud complaints  
Brokers are paid a commission to enroll eligible beneficiaries into a 
plan.  Brokers may represent any number of PDPs and receive different 
commissions based on which plan is  selected by the beneficiary.  
Dishonest brokers may inappropriately steer potential enrollees to  
particular plans by providing false or limited information.  Some of the 
most egregious complaints received  to date involve brokers enrolling 
beneficiaries without their consent.  Because brokers assist in boosting 
enrollment  numbers, plans have few incentives to rein in dishonest 
brokers.  CMS requires that plan subcontractors, including brokers, 
comply with all Medicare Part D regulations, but this proves difficult to 
enforce with respect to brokers for several reasons.  First, if CMS learns 
that a broker is not in compliance with Part D marketing and 
enrollment requirements, it cannot take direct corrective action against 
the broker itself.  Rather, CMS would have to take enforcement actions  
against the PDP sponsor who contracted with the broker.  Second, 
because brokers are regulated by State insurance commissions, the 
MEDIC must refer alleged broker misconduct to  the appropriate State 
insurance commission and rely on it to take corrective actions against 
the broker.   Third, privacy restrictions contained in the Health 
Insurance Portability and Accountability Act of 1996 (HIPAA) 
necessitate that the MEDIC obtain consent from  the enrollee before  
sharing case-specific information with the State insurance commission.  
With the cases that have been referred, the MEDIC experienced delays 
and sometimes difficulty getting such consent.   
Overutilization of drugs for the purpose of personal drug abuse or selling 
prescription drugs for profit poses a significant cost risk to Medicare  
Part D; however, plans are limited in their ability to monitor suspect 
enrollees   
Although the inappropriate costs per individual may be small, the 
suspected widespread nature of this type of fraud poses a significant 
risk to the program. The MEDIC staff is aware of approximately 60,000  
persons who were identified by State Medicaid programs because they  
demonstrated unusual drug utilization patterns prior to their transition 
to Medicare Part D.  Some State Medicaid programs conducted routine  
data checks to identify potentially inappropriate utilization by 
individuals, known as overutilizers, and took steps to control their 
drug access  through management structures, such as prior 
authorizations and pharmacy restrictions. Information about specific, 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   15  F I N D I N G S  

known overutilization risks in State Medicaid programs was not 
transferred to PDPs when the Medicare Part D benefit began.  Thus, 
PDPs must  conduct their own analysis to identify these risks.  PDPs 
face further difficulty in developing and maintaining knowledge about 
potential overutilizers because most  beneficiaries are able to change 
plans every year and Medicare/Medicaid dually eligible beneficiaries are 
able to change plans every month. PDPs and the MEDIC have  
interpreted HIPAA privacy provisions as prohibiting communication 
about suspected overutilizers.  As such, plans must develop a new 
utilization profile for an enrollee each time the enrollee changes plans.  
HIPAA provisions allow PDPs to communicate about beneficiaries 
suspected of inappropriate behavior, as long as each PDP currently has 
or previously had a relationship with the beneficiary in question.  
However, there is currently no mechanism by which PDPs can identify 
which other PDPs have or previously had a relationship with a 
beneficiary. 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   16    R E C O M M E N D A T I O N S  
CMS is making progress towards fulfilling its plans for preventing and 
detecting fraud and abuse in PDPs; however, some activities were not 
fully implemented by the end of FY  2006.  CMS staff report that some 
activities would have been premature or point to funding and data 
limitations as a rationale for delays.  Although we recognize the short 
timelines and significant challenges that CMS faced in rapidly 
implementing the Medicare Part D program, the impact on beneficiaries 
as well as the large magnitude of outlays (i.e., $47 billion in 2006) call 
for commensurate safeguard activities.  In an effort to continue 
improving CMSs safeguard strategy, we recommend that CMS:  
Develop a comprehensive safeguard strategy for Medicare Part D PDPs with 
specific activities and target dates and ensure that all activities are 
progressing in a timely  manner 
CMS had begun implementation activities in all safeguard areas, but 
CMS staff could not provide timelines for final implementation.  CMS 
should develop a comprehensive written strategy document with specific 
activities and target dates and assign staff to follow up on progress.  
This document should serve as a management tool to coordinate 
different CMS groups that may have a role in safeguarding Medicare 
Part D PDPs and aid in identifying areas that may not be  adequately 
protected by the safeguards that are in place.  It should also be used as 
a prompt to  notify appropriate senior staff if implementation activities 
fall behind schedule. Further, CMS should make Medicare Part D 
safeguard activities a sufficient priority in the budgeting process to  
support their timely and effective administration.  Of foremost concern  
are commencement of the financial audits, sufficient MEDICs to 
investigate fraud complaints, and the pursuit of innovative data-driven 
techniques to identify potential fraud and abuse.   
Ensure that all fraud complaints receive proper attention 
As the number of MEDICs and staff assigned to investigate complaints 
increases, CMS should have a process in place to  monitor the number of 
open complaints and take action if backlogs occur.  Additionally, CMS 
should investigate options for customer service representatives to 
directly transfer fraud complaints received by 1-800-MEDICARE to the 
appropriate MEDIC.  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   17  R E C O M M E N D A T I O N S  

Address legal concerns that may impede program integrity efforts 
Three concerns in particular require attention:  
Require PDP sponsors to include standard wording regarding requirements for 
record retention and accessibility within subcontractor contracts.  
Verification that PDPs report all remuneration is intrinsically difficult.  
For this reason, it is critical for CMS to have full access to primary 
documentation about remuneration, including that maintained by a 
pharmaceutical benefit manager or other subcontractor.   Further, CMS 
should not be limited in its ability to access critical information because 
only general or nonspecific requirements are included in subcontractor 
contracts.  The standard wording should include provisions for (1) CMS 
accessing information directly from subcontractors; (2) timelines for 
both records maintenance and accessibility; (3) special circumstances, 
such as terminated contracts; and (4) penalties for noncompliance with 
records access provisions.  Further, the inclusion of this language 
should be verified through either the financial audits or compliance 
audits. 
Enforce appropriate sanctions for PDPs whose brokers violate permissible 
marketing practices. 
The prevalence of complaints from  FY 2006 indicates that improper 
broker marketing practices pose a significant risk for the Part D 
program.  Although CMS may be unable to directly penalize brokers 
who are conducting illegal marketing practices, the PDPs have ultimate 
responsibility for their subcontractors.29  CMS guidance requires PDPs  
to monitor the performance of subcontractors, including marketing 
practices.  CMS Part D regulations also require that PDP subcontractor 
contracts include a provision allowing CMS or the PDP to take 
corrective action if either CMS or the PDP determines that the 
subcontractor is not performing satisfactorily.30 CMS should be vigilant 
in its oversight of insurance brokers and ensure strong enforcement of  
Part D marketing standards. 
 
29 42 CFR  423.505(i). 

30 42 CFR  423.505(i)(4)(ii). 

  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   18  R	 E C O M M E N D A T I O N S  

Utilize the MEDICs as intermediaries for PDPs to share information about their 
beneficiaries suspected of inappropriate utilization.  
Currently, there is no way for information about extreme or unusual 
utilization by a particular beneficiary to be communicated between the 
beneficiarys prior PDP to his or her next PDP.  Allowing the MEDICs 
to act as repositories of information about beneficiaries suspected of 
fraud would improve PDPs ability to identify and monitor drug-seeking 
and drug-selling behavior. Further,  early identification of these 
individuals would limit the effectiveness of a beneficiary switching 
plans to avoid targeted  actions by the PDPs to  prevent fraud. In 
implementing this activity, CMS should explore whether this  
recommendation can be addressed by revising MEDIC contracts. 
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL  
RESPONSE 
In its comments to the draft report, CMS did not indicate whether it 
concurred with our recommendations, but did provide comments 
regarding each recommendation (see Appendix B).  CMS responded that 
many of its ongoing activities already satisfy our recommendations.  It 
further stated that the report does not fully explain the immense 
workload required for CMS to develop and administer the benefit in its 
first year and indicated that processes and procedures have improved  
over time.  In its technical comments, CMS reported several advances in 
its safeguard strategy that occurred after the end of our data collection 
period (FY 2006). The advances CMS reported include:  
 	  continued progress towards commencement of the financial 
audits. Audits are still scheduled to begin by the end of calendar 
year 2007; 
 	  successful negotiations to allow MEDICs sufficient access to  
PDP data so that data-driven fraud detection activities can 
begin; 
 	  improvement in processing complaints timely.  Specifically, CMS 
reported that of 5,286 complaints received by the MEDICs 
between December 2006 and June 2007, only 2 are older than 30 
days; 
   commencement of routine PDP compliance audits in February  
2007; 
   issuance of  a self-assessment tool to  assist PDPs in improving 
their fraud, waste, and abuse compliance plans; and  
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   19  R	 E C O M M E N D A T I O N S  
 	  release of four new chapters of the Prescription Drug Benefit 
Manual. 
  
Comprehensive safeguard strategy  
Regarding our recommendation to develop a comprehensive safeguard 
strategy with specific activities and target dates, CMS stated that the 
MEDIC task orders and Umbrella Statement of Work (USOW) are 
CMSs comprehensive safeguard strategy for the Part D program.  
Additionally, CMS responded that the broader strategy for fighting 
fraud, waste, and abuse is the three-pronged strategy.  Although OIG 
agrees that the task orders and USOW provide an important framework  
for enacting many safeguard activities, these documents are specific to 
the MEDIC activities and do not address the broad coordination that is 
needed between different groups within CMS that each have a role to  
play in safeguarding Medicare Part D.  With regard to CMSs three-
pronged strategy, the documents we reviewed lacked the details, 
deliverables, and timelines that would extend its use from  a broad  
strategic concept to a useful management tool.  Therefore, we continue  
to recommend that CMS create a comprehensive safeguard strategy 
that includes specific activities across the range of its existing and  
planned program integrity efforts and tie these activities to target dates 
so that implementation progress can be monitored, strengths  can be 
identified, and delays can be addressed.  
Fraud complaints 
Regarding our recommendation to ensure that all fraud complaints 
receive proper attention, CMS stated that ensuring all complaints are 
addressed promptly is a top priority.  CMS also expressed concern that 
our draft report misrepresented the MEDICs activities in responding to 
complaints but acknowledged early difficulties with the volume of 
complaints.  Further, CMS stated that the three MEDICs contracted for 
FY 2007 would be sufficient to fully investigate and resolve fraud 
complaints.  
Because of CMSs concern that we  misrepresented the MEDICs 
activities in responding to complaints, we made revisions to avoid 
characterizing open complaint cases as a backlog and to more fully 
describe the status of the open cases  at the time  of our data collection.  
However, the number of open cases and the time  that some cases 
remained  open suggest that the complaint process is susceptible to 
backlogs. Consequently, OIG continues to recommend that CMS devote 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   20  RR EE CC OO MM MM EE NN DD AA TT II OO NN SS  
sufficient resources to ensure that all fraud complaints receive proper 
attention, including implementing a system to monitor the complaint 
caseload for potential backlogs. 
CMS also stated that it will explore the feasibility of transferring Part D  
fraud calls from 1-800-MEDICARE directly to the MEDIC hotline and 
that, until a decision is made, 1-800-MEDICARE customer service 
representatives will remain responsible for making determinations as 
to whether calls should be sent to MEDICs. We clarify that the intent of 
this recommendation is to ensure that once a fraud complaint is 
identified, complainants should be directly connected to the MEDIC, 
rather than being advised to call the MEDIC hotline. We expect that 
customer service representatives will continue to be responsible for 
identifying which calls should be directly connected to the MEDIC. 
Address legal concerns  
Regarding our recommendation to pursue legal authority to obtain 
records directly from subcontractors and to explicitly require 
subcontractors to retain their documents, CMS stated that it currently 
has authority to obtain records from subcontractors and that 
requirements  for record retention already exist. OIG interprets the 
existing authority as being dependent on the inclusion of sufficient 
contractual language by PDP sponsors within their subcontractor 
contracts.   We modified this recommendation to more specifically 
address this underlying concern. 
Regarding our recommendation to enforce appropriate sanctions for 
PDPs whose brokers violate permissible marketing practices, CMS 
described its authority and a range  of potential sanctions it is able to 
impose in the event of noncompliance with marketing guidelines. 
Regarding our recommendation to utilize the MEDICs as intermediaries 
for PDPs to share information with each other about suspected  fraud,  
CMS stated that it will evaluate the possibility and potential 
implications of having the MEDICs serve as the intermediaries for PDP  
data.  
Request for final comments 
We ask that, in its final management decision, CMS indicate whether it 
concurs with our recommendations and what steps, if any, it will take to  
implement them. 
OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   21    A P P E N D I X   A     
Medicare Part D Benefits and Operation 
Medicare Part D benefits are provided by private insurers, either in the 
form of a stand-alone PDP or as part of a comprehensive Medicare 
managed care plan, known as a MA-PD.  PDP plans provide  Medicare  
beneficiaries access to prescription  drugs for low monthly premiums and 
copayments. The MA-PD plans include hospital and physician 
insurance, as well as the prescription drug benefits.  For 2006, there 
were 1,429 PDPs and 1,314 MA-PDs. 
Medicare Part D plans provide coverage that is at least actuarially 
equivalent to a defined standard benefit.  The defined standard benefit 
in 2006 provided coverage in four progressive phases: (1) a $250 
deductible; (2) beneficiary coinsurance of 25 percent of drug costs 
between $250 and $2,250; (3) coverage gap with the beneficiary 
responsible for all drug costs between $2,250 and $5,100; and  
(4) catastrophic coverage with a beneficiary coinsurance of 5 percent for  
all drug costs over $5,100. Most drug plans offered in 2006 opted for an 
alternative benefit structure, but the defined standard benefit still 
serves as the baseline.   Although beneficiary-paid premiums and other 
cost sharing cover approximately 25 percent of the programs expected 
cost, the remaining 75 percent is drawn from the Medicare Trust Fund.    
Medicare Part D Program Operations 
Managing the Medicare Part D program requires many coordinated  
activities. For each year, prospective sponsors must submit an 
application demonstrating that all qualifications will be met, including 
an acceptable formulary. CMS staff review the applications and 
formularies to determine an intent to comply with program 
requirements.  Accepted  applicants may then submit bids, which 
include the benefit designs and attestations that the benefit is 
actuarially equivalent to the defined standard benefit; the expected  
costs of the program; and any cost utilization controls that will be 
employed.   Once the bid is deemed acceptable, a contract is let with the  
plan sponsor and the private organization agrees to abide by all 
Medicare Part D regulations. 
Plans may begin marketing activities the October prior to the beginning  
of the plan year.  All marketing materials must either use standardized 
language that is on file with CMS or have CMS review the materials for 
accuracy and appropriateness.  Open enrollment begins on        
November 15, which allows enrollees to select a plan or change their 
plan designations.  Enrollees may evaluate plan options by their use of 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   22  A P P E N D I X   A  

premiums, deductibles, and copays; the drugs allowed through the 
formularies; restrictions that may be  placed on drug utilization; and the 
benefit designs to determine which plan best accommodates their needs.  
Several resources are available to assist beneficiaries in making their 
selections, including the Web-based plan finder and 1-800-MEDICARE  
staff. Some enrollees with low income qualify for additional financial 
assistance to cover the costs of premiums, deductibles, and copays.  
Enrollees that are dually eligible for Medicare and Medicaid will be 
automatically assigned to plans if they do not select plans themselves. 
Once the plan year begins, enrollees are entitled to the prescription 
drug benefits offered by their selected plans.  The plans record each 
pharmacy transaction and report summary information about the 
transaction to CMS.  The information reported to CMS is called the 
Prescription Drug Event and is used  for a year-end reconciliation.  The 
plans, however, hold the primary responsibility for tracking each 
beneficiarys total drug costs and out-of-pocket expenses.  Beneficiary 
drug costs and out-of-pocket expenses (formally called true-out-of-
pocket, or TrOOP) determine when the beneficiary enters particular 
phases of the benefit.  Specifically, total drug costs determine when a 
beneficiary enters the coverage gap and TrOOP determines when the 
catastrophic benefit begins. 
CMS pays plans prospectively; however, certain payments are 
reconciled after the end  of the plan year.  CMSs payments to plans 
include:  (1) a risk-adjusted prospective payment for each beneficiary 
enrolled, each month; (2) a subsidy to account for  the lower premiums, 
deductibles, and copayments offered to qualifying low-income enrollees; 
(3) reinsurance for a portion of drug  costs incurred by plans during the 
catastrophic coverage phase; and (4) a payment adjustment (positive or  
negative) for a predetermined risk-sharing agreement. The 
reconciliation process does not begin until plans have fully disclosed 
their direct and indirect remuneration, e.g., rebates, due approximately 
6 months after the end  of the plan year.  Consequently, payments are 
not fully adjudicated until several months after the plan year, at a 
minimum.  
 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   23   A P P E N D I X   B    
 
Agency Comments 
  OEI-06-06-00280  SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG PLANS  24  A  P P E N D I X   B  
 
  OEI-06-06-00280  SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG PLANS  25  A P P E N D I X   B  
 
  OEI-06-06-00280  SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG PLANS  26  A P P E N D I X   B  
 
  OEI-06-06-00280  SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG PLANS  27    A C K N O W L E D G M E N T S
This report was prepared under the direction of Kevin K. Golladay, 
Regional Inspector General for Evaluation and Inspections and   
A. Blaine Collins, Deputy Regional Inspector General for Evaluation 
and Inspections in the Dallas regional office.   
Amy Ashcraft served as the team  leader for this study, and Tom 
Browning served as the lead analyst. Central office staff who 
contributed include Linda Abbott. 
  OEI-06-06-00280   SAFEGUARDS TO PREVENT AND DETECT FRAUD AND ABUSE IN MEDICARE PRESCRIPTION DRUG  PLANS   28