i'SERVICES.
DEPARTMENT OF HEALTH: AND HU~IAN SERVICES
(g/tV.r-i~~ OFFICE OF INSPECTOR GENERAL
'"
+.yA;- 1I'.\SHl:'-iGTO:'-i, DC 2020 i
DEC 1,2 2013
TO:
The Secretary
Through: DS
cos
ES
FROM: Inspector General
SUBJECT: Top Management and Performance Challenges Facing the Department of
Health and Human Services in Fiscal Year 2013
This memorandum transmits the Office of Inspector General's (OIG) list of top management and
performance challenges facing the Department of Health and Human Services (Department). The Reports
Consolidation Act of 2000, Public Law 106-531, requires OIG to identify these management challenges,
assess the Department's progress in addressing each challenge, and submit this statement to the
Department annually.
The OIG's top management and performance challenges for fiscal year 2013 are:
1) Overseeing the Health Insurance Marketplaces
2) Transitioning to Value-Based Payments for Heath Care
Prescription Drugs in Medicare and Medicaid
3) Ensuring Appropriate Use of 
4) Protecting the Integrity of an Expanding Medicaid Program
5) Fighting Fraud and Waste in Medicare Parts A & B
6) Preventing Improper Payments and Fraud in Medicare Advantage
Care in Nursing Facilities and Home- and Community-based Settings
7) Ensuring Quality of 
8) Effectively Using Data and Technology to Protect Program Integrity
9) Protecting HHS Grants and Contract Funds from Fraud, Waste, and Abuse
Food, Drugs, and Medical Devices
10) Ensuring the Safety of 
OIG looks forward to continuing to work with the Department to identify and implement strategies to
protect the integrity of the Department's programs and the well-being of the beneficiaries of these
programs. If you have any questions or comments, please contact me, or your staff may contact Erin
Extemal Affairs, at (202) 205-9523 or Erin.Bliss@oig.hhs.gov.
Bliss, Director of  ~~~
Daniel R. Levinson
Attachment OIG's Top MANAGEMENT AND PERFORMANCE CHALLENGES FACING THE DEPARTMENT OF HEALTH AND HUMAN
SERVICES IN FISCAL YEAR 2013
Management Challenge 1: Overseeing the Health Insurance Marketplaces
Why This Is a Challenge
The Health Insurance Marketplaces (Marketplaces), also known as the Health Insurance Exchanges, add a
substantial new dimension to the Department's program landscape.
The Marketplaces include State, Federal, and Partnership Marketplaces, each of which must implement and
successfully operate a complex set of program requirements. Individuals use the Marketplaces to get information
about their health insurance options, be assessed for eligibility (for, among other things, qualified health plans,
premium tax credits, and cost sharing reductions), and enroll in the health plan of  their choice. Sufficient
enrollment, including enrollment of relatively healthy individuals, is essential for producing a stable and effective
insurance market.
The Department faces significant challenges in several key areas, including eligibility systems, payment accuracy,
contractor oversight, and data security and consumer protection. Coordination among Federal and State agencies,
private insurers, and contractors is necessary to achieve program objectives and poses an additional challenge to
the Department.
Eligibilitv Svstems. The Federally Facilitated Marketplace (FFM) operates via the Department's healthcare.gov
website. Healthcare.gov also serves as a gateway for consumers to reach State-run Marketplaces. The
Department has acknowledged that it faces significant, well-publicized challenges in ensuring that healthcare.gov
operates successfully. These reported challenges include hardware and software issues. The Department must
ensure that healthcare.gov verifies consumers' personal information; accurately determines eligibility for
Marketplace insurance, tax credits, and cost-sharing subsidies; operates effectively and easily for consumers; and
transmits complete, accurate, and timely information to insurers regarding enrollees. The Marketplaces must also
successfully facilitate Medicaid enrollment for those who qualify (see Challenge 4, Protecting the Integrity of an
Expanding Medicaid Program).
CMS operates and oversees the Data Services Hub (Hub), which allows for exchange of data between the
Marketplaces and Government databases to verify applicant eligibility, in coordination with partners at the Social
Security Administration, Internal Revenue Service (IRS), Department of Homeland Security, Department of Justice
(DOJ), and the States.
The Department must also be attentive to State Marketplace operations to ensure States' compliance with
requirements, including requirements for making eligibility determinations and for transmitting accurate and
timely data used for purposes of Federal payments, such as determinations related to subsidies.
Contractor Oversight. Contractors have played, and will continue to play, a vital role in building, maintaining, and
fixing the systems that underpin the FFM. Early reports reflected that these systems, as constructed, did not
function as they were intended. The Department must ensure, to the greatest extent possible, that the
Government obtains specified products and services from its various contractors on time and within budget. The
Department faces a challenge to ensure proper management of, and payment under, the various contracts
the FFM, including the Hub. This challenge is heightened by,
entered into for implementation and operation of 
among other things, the large number of contracts and the need to coordinate work across multiple contractors.
For general information on challenges associated with contract administration, see Management Challenge 9.
Payment Accuracy. Ensuring accurate payments related to the Marketplaces also poses a substantial
management challenge. The Department needs to implement financial management and payment systems to
Page i ensure accurate and timely payments to insurers of advance premium tax credits, cost-sharing subsidies, and
premium stabilization payments. These payments involve complex calculations and offsets, adjustments, and
reconciliations, which pose challenges for making accurate payments. Monitoring and accounting for these
payments can also be challenging. In addition, some payments will rely on information obtained from private
insurers. The Centers for Medicare & Medicaid Services (CMS) will need to work closely with insurers to ensure
that information is timely, complete, and accurate. Given the amount of Federal funds involved, the Department
should undertake a thorough risk assessment and, where appropriate, develop error rates to measure the integrity
of program payments.
Security. Effective operation of the Marketplaces requires rapid, accurate, and secure integration of data from
numerous Federal and State sources and individuals who use the Marketplaces. It requires means for real-time
communication among many Federal and State systems on a large scale. Because these systems handle
consumers' sensitive personal information, security of data and systems is paramount. Where the Department
offers consumers alternate pathways for enrollment that do not require consumers to use healthcare.gov, such as
submitting paper applications or using a call center, the Department also must ensure that those pathways
incorporate effective security and eligibility safeguards and work well for consumers and insurers.
Another key responsibility is educating consumers about the Marketplaces and how to use them. It is also
important to educate consumers about protecting themselves from fraud schemes, such as identity theft, since
criminals often take advantage of new programs. Potential fraud schemes include identity thieves posing as
legitimate assisters offering to help individuals purchase insurance in exchange for money or personal identifying
information; imposters misleading Medicare beneficiaries into falsely believing they need to purchase new
insurance; and sham websites that appear to be legitimate. The Department must also ensure that navigators,
agents and brokers, and other assisters are qualified and properly trained to help consumers and provide reliable
information.
Progress in Addressing the Challenge
On December 1, 2013, the Administration reported significant improvement in the operations of healthcare.gov.
The report identified improvement on several system performance metrics, including response time, error rate,
system stability, and number of concurrent users.
With respect to the Hub, CMS obtained its necessary security authorization on September 6, 2013. OIG had
reviewed CMS's implementation of security controls for the Hub from March through June 2013. CMS has
reported that all key steps that remained at the time of our review have since been completed.
CMS has issued regulations and guidance regarding numerous aspects ofthe Marketplaces and the related
subsidies and premium stabilization p'rograms. This includes a final rule on program integrity provisions for the
Marketplaces and related programs intended to safeguard Federal funds and protect consumers. In addition to
these regulations, CMS reports providing technical assistance and other support to States regarding Marketplace
implementation.
The Department and Office of Inspector General (OIG) are working closely with Government partners, including
the Federal Trade Commission (FTC), DOJ, and State Attorneys General, among others, to prevent and respond to
consumer fraud in connection with the Marketplaces. DIG and the Department have conducted consumer
education and outreach on how to protect oneself against fraud and identity theft. The FTC and States have
primary jurisdiction for responding to consumer fraud allegations, and OIG has updated the OIG fraud hotline to
seamlessly route consumer fraud complaints to the FTC, as well as routing consumer inquiries about the
Marketplaces to CMS.
What Needs To Be Done
The Department must continue to upgrade and improve healthcare.gov, including both the front-facing consumer
functions, as well as the back-end administrative and financial management functions. The Department also must
Page 2 ensure that alternate pathways for enrollment operate with integrity and that consumers' personal information is
secure. The Department must ensure that issuers and consumers receive accurate enrollment and subsidy
information and that systems for paying insurers operate with sound safeguards and internal controls. States and
consumers must receive accurate information about potential Medicaid enrollment. Vigilant monitoring and
testing of the Marketplaces and rapid mitigation of identified vulnerabilities are essentiaL.
The Department must address challenges in the short run to facilitate the ongoing open enrollment for 2014, when
most people will be required to have health insurance. In addition, where the Department uses temporary
mechanisms for the current enrollment period, the Department must develop permanent solutions that ensure
the smooth and successful operation of the Marketplaces for special enrollment periods, the 2015 open
enrollment period that is scheduled to start on November 15, 2014, and beyond. Moreover, the Department must
address full implementation of  the online SHOP Exchange.
The Department must also complete its development and implementation of financial management and payment
systems and ensure that payments to insurers, which are scheduled to begin in January 2014, are accurate. While
in the near-term the Department faces immediate challenges related to healthcare.gov operations, eligibility
verification, payment accuracy, contracting, and security of data, the Department will face continuing challenges as
the program evolves over time. The Department will need to adjust its management and oversight approaches
accordingly to ensure that problems are prioritized and addressed. As with other new programs, the Department
must monitor for known fraud, waste, and abuse risks and detect emerging new risks to protect the Federal
investment in health care reform. Iffraud schemes are identified, the Department must respond quickly and
effectively.
Further, the Department must continue to coordinate closely with States and with other Federal agencies to
monitor the operations and security of the Marketplaces and to implement the subsidies and other programs that
begin on January 1, 2014. OIG will monitor the implementation and operations of the Marketplaces and plans to
conduct oversight work initially focused on core risk areas, such as eligibility systems, payment accuracy, IT
security, and contracting. In particular, OIG will conduct an audit of safeguards to prevent the submission of
fraudulent or inaccurate information pursuant to the mandate at Public Law 113-46, Section 1001(c). OIG is
coordinating closely with its oversight partners at GAO, other IGs (such as the Treasury IG for Tax Administration),
and State auditors to develop complementary work and maximize the Government's limited oversight resources.
Key OIG Resource
 DIG testimony on security controls for the data services hub, September 2013
Management Challenge 2: Transitioning to Value-Based Payments for Heath Care
Why This Is a Challenge
To secure the future of the public health care programs, the Department must be vigilant in reducing waste and
increasing value in health care. The Institute of Medicine (10M) estimated that 20-30% of U.S. Health Spending
(public and private) in 2009-roughly $750 billion - was wasted. Other estimates suggest similar levels of waste.
Waste in health care programs is a multi-dimensional problem. The 10M report identified six major areas of waste:
unnecessary services, inefficient delivery of care, excess administrative costs, inflated prices, prevention failures,
and fraud. OIG work has identified waste in these areas; see also Management Challenges 3, 4, 5, 6, and 7 for
more discussion on issues specific to prescription drugs, Medicaid, Medicare Parts A & B, Medicare Advantage
(MA) and quality of care.
There is widespread agreement among experts that the incentives created by paying for health care based on the
volume of items or services furnished, generally known as a fee-for-service system, contributes to waste in health
care by encouraging unnecessary utilization and fragmented, poor quality care. Moreover, poor quality care
harms beneficiaries and can result in additional costs; for example, OIG found that adverse events (I.e., patient
harm caused by care) for hospitalized Medicare beneficiaries cost over $4 billion in one year. For these and other
Page 3 reasons, the Department is transitioning to value-based payments in Medicare and Medicaid intended to produce
higher quality care at lower costs, in part by rewarding high-quality care, penalizing low -quality care, or enhancing
care coordination. These models include, for example, value-based payments for hospitals, penalties for hospital
readmissions, pay-for-performance systems, shared savings programs, gainsharing, care coordination payments,
and bundled payments. These new models hold promise for improving health care delivery and efficiency; at the
same time, they present long-standing and new program-integrity challenges.
Aligning Incentives. In a complex health care system, designing payment mechanisms that encourage desired goals
(e.g., quality outcomes and cost efficiencies) while avoiding incentives that lead to unintended and undesirable
outcomes (e.g., overutilization or stinting on care) is a key challenge. This is a particular challenge for models that
use the traditional fee-for-service payment structure alongside, or in addition to, value-based payments, such as
the Medicare Shared Savings Program, which includes both fee-for-service payments and shared savings
payments. When considering such hybrid payment methodologies, it is important to carefully assess: (1) the
financial incentives that arise from each payment component, (2) new or different financial incentives that might
arise from their combination, and (3) the potential fraud, waste, and abuse risk areas corresponding to the
multiple types of payment. Longstanding program and enforcement experience illustrates that how Medicare and
Medicaid pay for services influences the types of misconduct that arise. For example, fee-for-service payments
raise the risk of overutilization and payment for unnecessary services; some risk-based or bundled payments may
reduce overutilization risks, but increase risks of underutilization or stinting on care. For models that are untested
for the Department and for providers under Medicare and Medicaid, it can be challenging to anticipate and
account for all of the potential impacts - both benefits and risks - of significant changes in payment methodology.
An additional challenge arises because certain initiatives could raise costs in one part of a program but lead to
greater savings elsewhere. For example, greater investments in chronic disease management could improve
patients' overall health and reduce the need for expensive emergency care. Similarly, effective care coordination
across multiple programs - such as for individuals eligible for both Medicare and Medicaid -- is important not only
because of the potential for better patient care, but also because costs may increase for one program but decrease
under another. For example, increased use of personal care services (covered by Medicaid) may increase Medicaid
and therefore States' costs while saving money for Medicare and the Federal Government by reducing or avoiding
hospitalizations. The Department needs to be mindful of these incentives when structuring cross-cutting care
coordination initiatives.
Program Design and Integrity. Designing, implementing, and overseeing many new and sometimes complex
payment models and demonstrations, combined with the complexity and scope of the Medicare and Medicaid
care landscape, poses significant management and program integrity challenges.
programs and evolving health 
Designing payments and programs with incentives in mind is essential, but it is only one facet. The Department
must track and coordinate new models to ensure effective administration and must be alert to issues that impact
more than one program, such as provider participation and beneficiary alignment. The Department must
continually review the underlying market and provider practice assumptions, including those related to quality, on
which payment structures and the resulting payments are based. The Department must be alert to new program
integrity risks that may emerge as a result of changing financial incentives and deploy appropriate program
integrity tools to prevent and detect fraud, waste, and abuse.
Getting value-based payment structures and rates right can be difficult. OIG work has illustrated the challenges in
structuring accurate bundled payments, which cover related services and/or products or an episode of care. For
example, OIG found that Medicare's bundled payment for global surgery fees, which provides one fee for the
surgery and related pre- and post-surgical care, has not been adjusted to reflect evolving physician practices. As a
result, the payment model assumes more services than are typically provided, resulting in inflated payments.
Examples of other design and rate setting challenges include ensuring that payment bundles avoid creating
incentives and opportunities to furnish and bill for services outside the bundle to increase payments, that
providers participating in multiple incentive payment programs are not receiving duplicative incentive payments,
and that payment mechanisms encompassing services furnished across multiple provider settings work properly
and reimburse correctly.
Page 4 Integrity ofJnformation. When payments are linked to quality, outcomes, or performance, the Department must
ensure the reliability of underlying data. Many value-based payment mechanisms rely on complex data, electronic
health information, and sophisticated quality and performance measures. To ensure reliable results, data must be
accurate, complete, and timely. Measures must be appropriate and meaningfuL. Outcomes must be correctly
assessed to ensure correct payment. When quality or performance is determined on the basis of Medicare or
Medicaid claims billed, ensuring accurate and reliable claims information - and detecting improper claims -- is also
criticaL.
In addition, the data CMS provides to the industry must be accurate. For example, programs such as the Pioneer
Accountable Care Organization (ACO) Model, the Medicare Shared Savings Program (MSSP), and the Medicare fee
for service (FFS) Physician Feedback Program call for CMS to provide performance or clinical data to providers so
they can use it to improve the care they furnish. To be effective, the data must be correct, the metrics meaningful,
and the information usable.
In sum, the linkage between quality, performance, and payment presents new challenges for administering
Medicare and Medicaid payment systems.
Progress in Addressing the Challenge
The Department is continuing to implement value-based payment programs and develop new demonstration
programs. CMS recently reported positive initial results from the first year of the Pioneer ACO program - all ACOs
achieved quality goals, and 13 ACOs generated a total savings of $87.6 million, of which $33 million was returned
to the Medicare Trust Fund. In 2013, CMS began implementing the Bundled Payment for Care Improvement (BPCI)
Initiative, which includes four models testing different payment mechanisms that include quality and
i accountability measurements. CMS continues to develop, implement, and test new value-based payment
~ structures.
The Department has taken steps to foster integrity in these new programs, as illustrated by the regulations for the
MSSP and Participation Agreements for the BPCI Initiative, which incorporate various safeguards intended to
mitigate potential vulnerabilities. It is too early to assess the outcomes of these program integrity efforts, but
CMS's attention to, and integration of, safeguards into the design of  the MSSP and BPCllnitiative demonstrate a
focus on program integrity that should be replicated in all programs.
CMS has reported that it is developing management and  tracking systems and procedures to support new value-
based payment structures and other new models. CMS also reports that it has established internal review
processes to promote the use of effective measurement strategies, to coordinate across components regarding
quality measurement, and to identify areas where beneficiaries are impacted by more than one value-based
payment initiative. CMS also provides technical assistance to participants in new models.
What Needs To Be Done
The Department should continue to prioritize the effective transition to value-based payment mechanisms and the
development and refinement of quality, outcomes, and performance metrics. Data systems supporting programs
that link payment to quality and value must be scrutinized for timeliness, accuracy, and completeness. The
Department should continue to develop and maintain internal controls to ensure effective coordination among
value-based payment programs and to avoid duplicative payments and operational inefficiencies. The Department
must scrutinize bundled payments, shared savings programs, and other value-based payments to ensure that
payment methodologies are appropriate, payments are calculated accurately, and that performance-based
incentives are aligned with beneficial outcomes for Medicare, Medicaid, and patients. CMS should also continue
its efforts to provide technical assistance to participants in its demonstration and other value-based programs.
CMS should continue to strengthen its program integrity tools and apply them as needed to ensure integrity in
new models. In overseeing new models, the Department should monitor financial incentives to ensure that they
achieve quality and efficiency goals and do not result in undesirable outcomes. The Department's oversight is
Page 5 critical and must consider the full range of potential risks. For example, shared savings or bundled payments may
pose a heightened risk of stinting or underutilization compared to traditional fee-for-service payments, for which
the larger risk may be provision of unnecessary care or overly expensive care. Models that incorporate both types
of payments may raise both types of risks or different risks. CMS must continue to assess emerging fraud, waste,
and abuse risks in new models and, as necessary, develop and implement new tools to detect and prevent them.
Moreover, the Department should continue to monitor cost, quality, utilization, outcomes, and experience of care
and to disseminate lessons learned to improve new programs.
As demonstration programs continue to unfold, the Department should carefully monitor for successes and
benefits that can be scaled and replicated, as well as for potential problems -- including inefficiencies, misaligned
incentives, or abuses. The Department must rigorously evaluate results of demonstration programs and other new
value-based purchasing payment mechanisms. As with any innovation and experimentation, missteps may occur;
it is critical that the Department address missteps effectively and take appropriate actions to prevent their
recurrence.
Management Challenge 3: Ensuring Appropriate Use of Prescription Drugs in Medicare and Medicaid
Why This Is a Challenge
Ensuring the appropriate use of prescription drugs by Medicare and Medicaid beneficiaries is vital for financial
reasons as well as patient safety and quality of care. In 2012, Medicare Part D provided prescription drug coverage
to more than 37 million beneficiaries at a cost of almost $67 billion. In 2010, Medicaid provided prescription drug
coverage to 28 million beneficiaries at a cost of $19 billion. The following are concerns about appropriate
prescribing and dispensing of drugs as well as deficiencies in the safeguards intended to protect beneficiaries and
the programs from drug overutilization, fraud, and abuse.
Prescription Drug Diversion and Abuse. The Centers for Disease Control and Prevention (CDC) has characterized
prescription drug abuse as an epidemic, and in 2010, overdose of prescription painkillers was one of the leading
causes of accidental death in the United States. Prescription drug abuse is a serious and growing problem for
Medicare Part D and Medicaid - OIG's investigations of abuses in this area have increased dramatically over the
past 5 years. Prescription drug diversion is a complex crime that involves many co-conspirators, ranging from
simple street traffickers to complex criminal enterprises of health care professionals, pharmacies, and even
patients. Fraud schemes bill Medicare and Medicaid for services and drugs that are unnecessary or never
loss to the program.
provided, resulting in patient harm and financial 
Prescription drug fraud and diversion often involve controlled drugs but can also include billing for unnecessary
non-controlled prescriptions. For example, an OIG investigation led to the conviction of a pharmacist who owned
26 pharmacies and used an elaborate web of physicians, pharmacists, and patient recruiters to fraudulently bill
Part D and Medicaid. This pharmacist paid kickbacks, bribes, and other inducements to physicians to write
unnecessary prescriptions for controlled drugs and expensive non-controlled drugs. The physicians directed their
patients to fill their prescriptions at 1 of the 26 pharmacies, which then billed Medicare and Medicaid for
unnecessary controlled substances it dispensed to the beneficiaries and for expensive non-controlled drugs that it
did not dispense.
Prescriber Qualifications. As a basic safeguard, prescription drugs must be prescribed in accordance with State law
by an appropriate medical professional to qualify for Part D reimbursement. This safeguard is not operating as
effectively as it should; Medicare Part D inappropriately paid $5.4 million in 2009 for 72,552 prescriptions written
by unauthorized prescribers, such as massage therapists, veterinarians, and athletic trainers. Medicare should
never pay for drugs ordered by unauthorized individuals.
Questionable Prescribing and Billing Patterns. OIG has identified questionable prescribing by hundreds of general-
care physicians. Some 736 physicians demonstrated extreme patterns of prescribing relative to their peers with
respect to: number of drugs prescribed per beneficiary; number of pharmacies filling their prescriptions;
Page 6 !
percentages of expensive brand-name drugs; or percentages of Schedule II drugs like morphine and oxycodone,
which are more susceptible to abuse. In total, Medicare paid $352 million for Part D drugs ordered by
questionable prescribers in 2009.
In addition, OIG uncovered questionable billing patterns by 2,637 retail pharmacies nationwide with billing
patterns far outside the norm. These pharmacies billed extremely high numbers of drugs per beneficiary or per
prescriber or billed extremely high percentages of Schedule II or '" drugs, brand-name drugs, or refills relative to
other pharmacies. In 2009, Medicare paid these pharmacies a total of $5.6 billion. It is important to note that
while these practices are not necessarily fraudulent they raise flags that warrant further attention.
Schedule 1/ Refills. Federal  law requires an original prescription each time a Schedule II drug is dispensed;
nonetheless, OIG found that Medicare Part D inappropriately paid $25 million for Schedule II drugs billed as refills
in 2009. Part D plan sponsors should not have paid for Schedule II refills. Paying for refills of these addictive drugs
raises public health concerns and may contribute to the diverting of controlled substances. Three-quarters of Part
D plan sponsors paid for these refills, indicating that many do not have adequate controls in place.
Atypical Antipsychotic Drug Use In Nursing Homes. DIG has raised concerns about overmedication of Medicare
nursing home residents, particularly the use of atypical antipsychotic drugs for beneficiaries with dementia. More
than 20 percent of claims for atypical antipsychotic drugs for Medicare patients in nursing homes indicated a
failure to satisfy Federal standards that protect nursing home residents from unnecessary drug use. DIG also
found that nursing homes generally were not meeting all requirements for assessments and care plans for
residents receiving antipsychotics.
Ineffective Oversight of  Part D Utilization. Part D plan sponsors and CMS's Medicare Drug Integrity Contractor
(MEDIC) are key lines of defense in identifying and addressing drug overutilization, fraud, and abuse. However,
DIG found evidence that oversight is inconsistent across sponsors and may be lacking overalL. Some plan sponsors
did not identify any potential fraud, waste, and abuse incidents; most potential fraud, waste, and abuse incidents
were associated with only a small number of plan sponsors. In addition, the MEDIC has not fully utilized data
analytics to identify potential fraud, waste, and abuse.
Progress in Addressing the Challenge
CMS has taken steps to strengthen oversight of appropriate drug utilization in Medicare Part D. For example, CMS
responded to a prior OIG recommendation by requiring that all Part D claims submitted to CMS include a valid
National Provider Identifier for the prescriber - this safeguard is one step toward ensuring and monitoring
appropriate prescribing. Plan sponsors are required to maintain compliance programs to help detect, prevent and
correct fraud, waste, and abuse. CMS also provided guidance and educational outreach to sponsors and providers
about the overutilization of prescription drugs, including support for State Prescription Drug Monitoring Programs.
Moreover, CMS has increased monitoring of prescribers through the Part D Recovery Audit Contractors (RACs),
which identify and recover Part D improper payments. CMS has also reported providing information and guidance
to sponsors about high risk pharmacies and prescribers to combat prescription drug diversion. In addition, CMS
has reported taking steps to redirect the MEDIC to focus more acutely on proactive data analysis.
CMS has also described its efforts to curb overprescribing by developing metrics at the beneficiary level that
trigger follow-up actions. If a beneficiary's drug use exceeds certain clinical standards, this triggers a review of the
beneficiary's medical management by his/her physician(s). If  this review does not substantiate a clinical need for
the high utilization, the Part D plan will implement prior authorization reviews for that beneficiary's claims.
In March 2012, CMS launched the National Partnership to Improve Dementia Care (the Partnership), aimed at
improving behavioral health and safeguarding nursing home residents from unnecessary antipsychotic drug use.
The Partnership set a goal to reduce antipsychotic drug use in nursing homes by 15 percent by the end of 2012,
and CMS reported a national drop in antipsychotic use of 11.4 percent by the second quarter of 2013. CMS also
provided guidance and training in May 2013 to assist surveyors in determining whether nursing homes are meeting
minimum standards of care governing antipsychotic drug use.
Page 7 What Needs To Be Done
In addition to the steps described above, CMS must take further action to ensure that each claim for a prescription
contains both a valid identifier and authorized prescriber. Additionally, CMS should ensure that the MEDIC
routinely analyzes billing data to detect pharmacies and providers with extreme billing patterns. CMS should also
require that sponsors identify and refer potential fraud, waste, and abuse to CMS for further review. CMS must
also better ensure that Part 0 plans do not pay for prohibited refills of Schedule II drugs. In addition, CMS needs to
implement its plans described to DIG to develop predictive models and utilize data analytics that will target
aberrant billing patterns in the future.
OIG remains concerned that some instances of atypical antipsychotic drug use by nursing home residents may not
represent the best clinical care for the patients; in addition, inappropriate Part D payments for some of these
prescriptions may persist. CMS should facilitate access to information, like diagnosis codes, that are necessary to
ensure appropriate care and accurate coverage and reimbursement determinations.
Key OIG Resources
. Testimony of Deputy Inspectors General on Curbing Prescription Drug Abuse in Medicare. June 24, 213
. Medicare Atypical Antipsychotic Drug Claims For Elderly Nursing Home Residents. May 2011
Management Challenge 4: Protecting the Integrity of an Expanding Medicaid Program
Why This Is a Challenge
In 2014, States have the option to expand Medicaid eligibility to qualifying adults earning up to 133 percent of the
Federal poverty leveL. In addition to the challenges in implementing this expansion, increases in the Medicaid
population and spending also heighten the urgency of addressing the program integrity challenges that Medicaid
already faces. These include reducing waste associated with excessive payment rates, avoiding or recovering
Medicaid improper payments and payments for which a third party is liable, and preventing fraud, waste, and
abuse in Medicaid managed care programs. (Other key challenges for Medicaid are addressed elsewhere-
prescription drug abuse in Management Challenge 3; vulnerabilities in nursing homes and home- and community-
based settings in Challenge 7; and limitations in the national Medicaid database in Challenge 8.)
Medicaid Eligibility. For individuals who are "newly eligible" under the Affordable Care Act (ACA)
Expansion of 
expanded income limits, the Federal Government will pay the full costs of their care through 2016; after which the
Federal share gradually falls to 90 percent by 2020 and continues at 90 percent thereafter. For other Medicaid
beneficiaries, the Federal Government will continue to share costs with States according to its standard Federal
Medical Assistance Percentage (FMAP), which ranges by State from 50 to 74 percent. These eligibility expansions
are expected to increase the number of Medicaid beneficiaries and Federal spending on Medicaid significantly.
Many individuals eligible for Medicaid will use the ACA created Marketplaces to enroll in Medicaid and thus the
Marketplaces must effectively facilitate that enrollment (see Challenge 1, Overseeing the Health Insurance
Marketplaces.)
Challenges involve the implementation of this expansion and the financial and internal controls needed to ensure
that the Federal Government pays the appropriate share of costs for each beneficiary depending on the criteria
under which he or she qualified for coverage. It may be challenging to apply Medicaid eligibility requirements
accurately, and to the extent that States miscategorize beneficiaries, the financial implications for the Federal and
State financial shares could be significant.
Problems Identifying and Recovering Improper Payments. OIG found that CMS Federal Medicaid Integrity
Contractors (MIC) had limited success identifying Medicaid overpayments. Review MICs initially identified over
audits, the Audit MICs found
113,000 providers with potential overpayments of $282 million, but after performing 
actual overpayments to only 25 of these providers, totaling less than $300,000.. Likewise, 80 percent of the audits
Page 8 that OIG reviewed either did not find an overpayment or were unlikely to find overpayments. OIG found similarly
limited results for Medicaid from the Medicare-Medicaid Data Match program (Medi-Medi Program). Of the total
$46.2 million in expenditures recouped through the program during 2007 and 2008, more than three-quarters-
$34.9 million - was recouped for Medicare.
OIG has also found that longstanding challenges persist in recovering payments from third parties. Millions of
Medicaid beneficiaries have additional health insurance through third-party sources. If beneficiaries have another
insurance source, it should pay before Medicaid does, up to the extent of its liability. However, since 2001, States
have consistently reported challenges in getting third parties to provide complete coverage information and to
process or pay claims. As a result, as of 2011, $4 billion in claims remained at risk of not being recovered.
Program Integrity in Managed Core Programs. As of 2011, almost three-quarters of all Medicaid beneficiaries
were enrolled in some type of managed care system. The private plans and Medicaid share financial risk; fraud,
waste, and abuse by health care providers or beneficiaries drive up costs for both the plans and Medicaid. Fraud
or abuse by the managed care plan (e.g., manipulating its bids) can further increase Medicaid costs.
CMS's guidelines identify six areas of fraud, waste, and abuse in Medicaid managed care: (1) managed care
contract procurement, (2) marketing and enrollment, (3) underutilization of services, (4) claims submission and
billing procedures, (5) fee-for-service payments within managed care, and (6) embezzlement and theft. OIG found
that the predominant concerns of both States and plans were provider fraud - billing for services that were not
provided, medically unnecessary, or upcoded - and beneficiary fraud including prescription drug abuse.
Excessive Payments to Public Providers. DIG has raised long-standing concerns about States' Medicaid payment
rates to public providers. For example, we found that in 2009, New York Medicaid paid $2.27 billion ($1.13 billion
Federal share) to 15 State-run developmental centers. New York's payments to these centers were not based on
actual costs. If New York had used actual costs in its rate-setting, Medicaid reimbursements to the developmental
centers could have been up to $1.41 billion lower that year, saving the Federal Government up to $701 million.
In some cases, the excess Medicaid payments are returned to the State and not retained by the facilities to provide
care to Medicaid beneficiaries. In essence, this can serve as a mechanism for States to use Federal Medicaid funds
to subsidize non-Medicaid costs.
Progress in Addressing the Challenge
CMS has reported that it is working to promote program integrity with respect to the Medicaid expansion by
providing tools and technical assistance to the States, developing new procedures and practices for ensuring
eligibility verification and payment accuracy, and training State staff on reporting and accounting for expenditures
associated with newly eligible individuals.
CMS has also reported actions to improve the MIC and Medi-Medi programs consistent with OIG
recommendations, such as assigning more Medicaid audits through the collaborative process, which showed
greater success than the traditional process. This progress includes assigning 516 collaborative audits in 32 States
as of August 2013. CMS is also reconfiguring its approach to Medicaid program integrity contractors, including
letting the Review MIC contracts expire. In the future, CMS expects to develop a Unified Program Integrity
Contractor model in which program integrity contractors will cover Medicare and Medicaid.
In addition, CMS stated that it will continue working with States and third parties to address problems identified by
States with identification and collection from liable third parties. CMS also stated that it will review existing
authorities to identify options for increased enforcement to deal with uncooperative third parties.
In 2011, OIG reported that States and managed care plans were taking important steps to protect against fraud,
waste, and abuse. These included providing program integrity training to managed care plans' staffs and to
providers in their networks. States conduct desk reviews of managed care plans' compliance plans, and many
site reviews. States also reported requiring managed care plans to disclose ownership
States also conducted on 
Page 9 and control information. CMS is working to update guidelines to States on program integrity in Medicaid managed
care settings.
Finally, CMS is continuing to work with New York to revise its methodology for Medicaid payments to State-run
developmental centers to better align them with costs. In addition, CMS issued guidance on Medicaid upper
payment limits and is requiring all States to demonstrate annually the upper payment liability to the Federal
Government for services that are subject to these limits.
What Needs To Be Done
CMS should continue its efforts to develop robust oversight for the Medicaid expansion. CMS must be vigila'nt in
addressing program integrity risks associated with the expansion, including monitoring States' compliance with
eligibility requirements and FMAP expenditures.
CMS should continue to build on its progress addressing MIC and Medi-Medi performance in identifying Medicaid
overpayments. In particular, CMS should expand its use of collaborative audits to ensure that all States and the
District of Columbia are actively engaged with the MICs in the identification and auditing of providers.
CMS should work with States to explore options to strengthen enforcement of third party liability. CMS could
levels.
facilitate a conversation with States about additional enforcement authorities at the State and Federal 
Given that concerns about identifying fraud and abuse remained among States and plans, particularly with respect
to provider and beneficiary fraud, CMS should update guidance to States to reflect these concerns. CMS should
work with States to ensure that contracts with managed care organizations contain adequate provisions for the
identification and referral of potential fraud cases.
OIG recommends that Medicaid payments to public providers be limited to the costs of providing services. In
2008, CMS issued a final rule that, among other things, would limit Medicaid payments to public providers to their
costs of providing care, but the rule was ultimately vacated by Federal District Court. CMS should issue new
regulations to prevent excessive payments to public providers.
Key OIG Resources
. Office of Inspector General testimony on Medicaid overpayments to public providers. September 20,2012
. Office of Inspector General testimony on Medicaid contractors. June 14 2012
. Medicaid Third-Party Liability Savings Increased, But Challenges Remain. January 2013
. Medicaid Managed Care: Fraud and Abuse Concerns Remain Despite Safeguards. December 2011
Management Challenge 5: Fighting Fraud and Waste in Medicare Parts A & B
Why This Is a Challenge
While all fraud is waste, not all waste is fraud. Waste is inefficiency that may be, for example, a medically
unnecessary service, inefficient delivery of care, inflated prices, excess administrative costs, or prevention failures,
and as such, addressing it is a multi-dimensional problem. (For challenges related to maximizing value in health
care, see Management Challenge 2.) The Department must take necessary steps to address improper payments
and payment inefficiencies that waste Medicare dollars and divert finite resources away from beneficiary care and
services. In fiscal year (FY) 2013, CMS reported an error rate of 10.1 percent for Medicare Fee-for-Service. This
exceeds the 10-percent threshold set by the Improper Payments Elimination and Recovery Act of 2010 (IPERA) and
is an increase from FY 2012.
Waste. OIG work has spotlighted various types of waste in Medicare Parts A & B:
. Hospital Billing Errors: Our reviews of hospital's billing compliance have consistently found inappropriate
claims for inpatient and outpatient services. Some of the most common problems include billing for short
Page 10 inpatient stays that should have been billed as outpatient or outpatient-with-observation services, transfers to
other hospitals or post-acute care, incorrect diagnosis codes that result in higher payments, same-day
discharges and readmissions, billing separately for services that should be bundled into the inpatient bill, and
unreported credits from medical device manufacturers.
 Improper Payments to Skilled Nursing Facilities (SNFs): SNFs billed one-quarter of all claims in error in FY 2009,
resulting in $1.5 billion in inappropriate Medicare payments. The majority of the claims in error were
upcoded, i.e., the SNF reported a higher level of  therapy than was provided, resulting in an inflated payment.
In other cases, a SNF provided a higher level of therapy than the Medicare patient needed or could benefit
from.
 Misaligned Payment Rates: OIG compared Medicare payments for 20 high-volume/high-expenditure lab tests
to payments by State Medicaid and Federal Employees Health Benefit plans and found that Medicare paid
between 18 and 30 percent more than other payers. Medicare could have saved up to $901 million in 2011 if
it had paid providers at the lowest established rate in each geographic area. In another example, Medicare's
bundled payments for global surgery fees have not always been adjusted to reflect evolving physician
practices; in certain instances, the OIG has found that fewer services are provided than assumed in Medicare's
payment modeL. Revising the payment methodology to more closely reflect the services typically provided in
medical care today could result in more efficient provision of surgical services.
RACs are one important tool that CMS uses to identify and recover improper payments. In FYs 2010 and 2011,
RACs identified errors in half of all claims they reviewed, resulting in improper payments totaling more than
$1 billion. CMS took corrective actions to address the majority of vulnerabilities identified by the RACs in FYs 2010
and 2011. However, CMS may not be taking full advantage of this tool, as it did not evaluate the effectiveness of
its corrective actions therefore, significant improper payments continue. In addition, CMS's RAC performance
evaluations did not include metrics to evaluate compliance with all contract requirements.
Fraud. Fraud is one significant cause of waste in Medicare, resulting in funds being paid for services or products
that were not rendered, were not medically necessary, or did not meet quality standards. Curbing fraud is vital to
conserving scarce health care resources and protecting beneficiaries, and the Department must continue to direct
all necessary resources toward fraud prevention, detection, and remediation. Adding to this challenge, fraud is a
crime of deception, and perpetrators design their schemes to make claims appear legitimate.
Fraud schemes shift over time, but certain Medicare services have been consistent targets. OIG work has
consistently raised concerns about fraud in Medicare Parts A & B. For example, OIG investigations continue to
uncover durable medical equipment (DME) suppliers, home health agencies, community mental health centers,
ambulance operators, and outpatient therapy providers that are defrauding the Medicare program. In national
assessments, OIG has identified questionable billing patterns by home health agencies and community mental
health centers and is conducting similar analysis of questionable billing by ambulance providers.
CMS's contractors playa key role in fighting Medicare fraud. However, there are indications that CMS is not
realizing the full potential of  this oversight tool. In 2011, OIG found that four of  the Zone Program Integrity
Contractors (ZPICs) did not identify any vulnerabilities related to home health, despite this being a source of
numerous fraud investigations and convictions at that time, and the ZPICs varied substantially in their efforts to
detect and deter fraud. Medicare also inappropriately paid some home health agencies with suspended or
revoked billing privileges. In another review, we found that only one of nine Medicare Administrative Contractors
(MACs) performed activities to detect and deter fraud by community mental health centers (another provider type
known to have high risk for fraud) in 2010; most of these activities were part of a CMS-Ied special project. Other
contractors performed minimal activities to detect and deter fraudulent billing by community mental health
centers, despite having jurisdiction over fraud-prone areas. Additionally, Medicare paid community mental health
centers that did not comply with its requirements after their revocations were effective and while their
revocations were being processed.
Page 11 Progress in Addressing the Challenge
The Department has made progress in its fight against fraud in Medicare Parts A & B. The Health Care Fraud
Prevention and Enforcement Action Team (HEAT) operations, including the Medicare Fraud Strike Force teams,
have demonstrated reductions in claims submitted to Medicare and payments made by Medicare for Part A & B
services susceptible to fraud, including DME suppliers, home health agencies, and community mental health
centers. Medicare Fraud Strike Force operations also have taken down ambulance and outpatient therapy fraud
schemes. Significantly, CMS for the first time used the provider enrollment moratoria authority granted by the
ACA. CMS instituted 6-month moratoria on the enrollment of new home health agencies in the Miami and Chicago
areas, and ambulance suppliers in the Houston area. CMS continues to use its payment suspension authority to
stop payments to certain providers and suppliers suspected of fraud. Another of CMS's major tools in fraud
prevention is the Fraud Prevention System - this is discussed in Management Challenge 8.
CMS reported that it has improved its performance metrics for the ZPICs for all contracts that take effect in FY
2014. According to CMS, these new metrics will evaluate the contractors' performance in critical program integrity
areas, including the accuracy and timeliness of implementing payment suspensions and revocations. CMS also
reported efforts to improve coordination between RACs and ZPICs. It added to the RAC Statement of Work a
requirement to meet with the ZPICs at least quarterly to discuss potential fraud referrals and trends they are
seeing in the applicable jurisdictions.
The Department has also made progress in combatting waste in Medicare Parts A & B. CMS issued a final rule to
implement its Hospital Readmissions Reduction Program, effective October 1, 2012, under which Medicare
payments may be reduced to applicable hospitals with high patient readmission rates. In that same final rule, CMS
also expanded its list of existing hospital-acquired conditions with some updated billing codes and added two new
conditions to this list. CMS also issued a final rule in August 2013 that modifies and clarifies review and payment
lower improper
rules regarding inpatient hospital admissions and services under Parts A & B, which it expects will 
payments in this problem area.
In addition, the Department continues to implement the Competitive Bidding Program for DME, which holds
promise for addressing prior OIG findings that Medicare paid significantly more than market prices for many types
of DME. Regarding global surgery fees, CMS indicated that it will continue to work in conjunction with the
American Medical Association Relative Value Update Committee and relevant specialty societies to identify
potentially mis-valued services. CMS annually reviews hundreds of codes, many of which are codes with global
surgery periods. CMS also continues to monitor hospice claims at each MAC through inclusion of hospice as part
of their medical review strategies for the year.
What Needs To Be Done
Fraud in Medicare Parts A & B remains a major challenge, and experience shows that schemes migrate among
provider and supplier types as well as geographically. The Department must improve its use of data and program
integrity tools to address shifting fraud schemes. For example, CMS should consider instituting additional
temporary enrollment moratoria for certain types of providers in geographic areas at significant risk for fraud.
Also, CMS should implement the surety bond requirement for home health agencies, and CMS should consider
increasing surety bond amounts above $50,000 for those home health agencies with high overall Medicare
payment amounts.
eMS should continue to build on its progress in addressing program integrity contractor performance and
oversight challenges, including developing additional performance evaluation metrics, particularly for high-risk
providers such as home health agencies and community mental health centers in fraud-prone areas. CMS also
should facilitate increased collaboration between RACs and program integrity contractors and provide training to
RACs to help them refer potential fraud, as appropriate.
More needs to be done to reduce improper payments. For instance, CMS should increase and expand reviews of
claims by SNFs and follow up with SNFs that billed in error. CMS should also address payment inefficiencies, such
Page 12 as adjusting bundled payments for surgery fees, and should seek legislative fixes where necessary, for example, by
seeking legislative authority to reduce Medicare payments for lab tests.
Key Resources
 Example of one of numerous hospital audits (North Shore Medical Center). March 2013
 DIG Spotlight on "Bad Bargains" (payment misalignments). August 2013
 DIG Spotlight on Skilled Nursing Facilities. February 2013
 Summary of Medicare Fraud Strike Force cases and accomplishments in DIG's Semiannual Report to Congress,
April 2013. (See pages 35-36)
 Selected OIG reports on CMS contractors - RAC oversight and actions to address improper payments, August
2013; ZPICs' and MACs' oversight of home health. December 2012
 DIG report on questionable billing by community mental health centers. August 2012
Management Challenge 6: Preventing Improper Payments and Fraud in Medicare Advantage
Why This Is a Challenge
Improper payments to MA plans pose a significant vulnerability for CMS and cost taxpayers billions of dollars. In FY
2013, the Department reported an error rate of 9.5 percent for MA, corresponding to an estimate of almost $11.8
billion in improper payments (consisting of about $9.3 billion in overpayments and about $2.6 billion in
underpayments). The MA error rate measures errors related to risk-adjustment payments.
In general, Medicare makes capitated payments to MA organizations to deliver a specified set of health care
benefits to qualified beneficiaries. MA organizations submit bids to CMS related to their expected costs for the
upcoming year to calculate a standard monthly payment rate per beneficiary. This standard rate is then risk-
adjusted (increased or decreased) based on the health characteristics of individual enrolled beneficiaries; i.e.,
Medicare will make higher monthly payments on behalf of sicker beneficiaries. To calculate risk-adjustment
payments, MA organizations submit beneficiaries' clinical diagnoses to CMS. If a diagnosis submitted is not
supported by the beneficiary's medical record, the risk-adjustment will be inaccurate and result in payment errors.
OIG has audited risk-adjustment payments to MA organizations. In DIG audits of six MA organizations' risk data
from payment year 2007, we identified approximately $650 million in aggregate extrapolated overpayments to
these plans because the medical records did not support the reported diagnosis.
Improper payments by MA organizations to providers (including those resulting from provider fraud) also raise
concerns. These improper payments are not measured or reported in the MA error rate because CMS does not
reimburse MA organizations on a c1aim-by-claim basis. However, such improper payments raise costs for MA
organizations, and in turn, raise costs for Medicare and beneficiaries.
MA organizations share risk with the Government and have incentives to detect and prevent fraud; however, not
all MA organizations have done so effectively. DIG found wide variability across MA organizations in their
identification and reporting of fraud and abuse incidents (ranging from 1 incident to 1.1 million incidents). In
addition, not all MA organizations took appropriate steps to respond to suspected fraud incidents.
Further, DIG found that from 2010 to 2011, eMS's contractor charged with oversight of MA program integrity
(known as the MEDIC) produced limited results and faced significant barriers to effectively safeguarding this
program. For example, lack of a centralized MA data repository hindered the MEDIC's ability to identify and
investigate MA fraud and abuse. The MEDIC also lacked administrative authority to recommend recoupment of
payments associated with inappropriate services.
Page 13 Progress in Addressing the Challenge
CMS's reported error rate for MA decreased from 11.4 percent for FY 2012 to 9.5 percent for FY 2013. CMS
described changes to its process for measuring MA payment errors in FY 2013 intended to ensure that the error
rate reflects MA organizations' submissions of inaccurate diagnoses and not "false positives" associated with the
procedures for submitting medical record documentation. These changes included extending the time allotted for
MA organizations to submit medical records, providing interim feedback on the validity of those records, and
providing preliminary coding results to MA organizations.
CMS has reported that it is implementing three initiatives to reduce the errors in risk-adjustment data and
resulting improper payments. One is by contracting for audits of risk-adjustment data to verify the accuracy of
plan-reported diagnoses through medical record review and recouping improper payments identified by these
audits. CMS launched these audits in November 2013 and plans to audit about 30 MA contracts per year. The
second is conducting training for MA organizations about accurate diagnosis reporting, including identifying the
diagnoses most often resulting in errors. The third is educating physicians to improve their medical record
documentation in support of patient diagnoses.
Building on a model for identifying and collecting overpayments for Medicare Parts A & B, the ACA required CMS
to develop a RAC program for MA. CMS is working to implement this requirement.
CMS has updated its reporting requirements for the MEDIC to better oversee its performance in safeguarding MA
program integrity. CMS has reported that the MEDIC has access to a new data source, which facilitates analysis of
a large volume of data and increases data storage capacity. CMS expects that this will help the MEDIC perform
proactive analyses targeting MA fraud and abuse in the future.
What Needs To Be Done
CMS needs to ensure that MA organizations submit accurate beneficiary diagnoses for setting risk-adjustment
payments and recoup overpayments that were based on inaccurate data reported by plans. It should continue to
monitor the effectiveness of its initiatives aimed at this goal and take additional steps if error rates remain high.
CMS should also develop administrative mechanisms to recover or otherwise remedy overpayments that MA
organizations have made to providers so that these do not increase costs for Medicare. Implementation of the
RAC program in MA may provide such an opportunity.
CMS should work with MA organizations to ensure that they implement effective programs to detect, correct, and
prevent fraud, waste, and abuse, as required in their compliance plans. In addition, CMS should require MA
organizations to report suspected fraud incidents to the CMS and/or the MEDIC for further review and potential
referral to law enforcement. CMS should also develop a centralized repository of MA data, and provide access to
that repository to the MEDIC, to facilitate more effective program oversight. CMS should continue working to
ensure that the MEDIC successfully carries out proactive data analyses targeting MA fraud and abuse, as planned.
Key Resources
. OIG audit of risk adjustment data (Excellus Health Plan, one of six audits). October 2012
. DIG report on MEDIC integrity activities in Parts C & D. January 2013
. DIG report on MA organizations' identification of fraud and abuse. February 2012
Management Challenge 7: Ensuring Quality of Care in Nursing Facilities and Home- and Community-Based
Settings
Why This Is a Challenge
As the median age of Americans continues to age and as more Americans live with chronic medical conditions, the
Department faces challenges in ensuring that beneficiaries who require nursing facility services receive high quality
Page 14 care. It is also critical to ensure that appropriate home- and community-based care is available, allowing
beneficiaries whose needs and preferences are better served by remaining in their own homes or other
community-based settings to avoid institutionalization. Nursing facility and home- and community-based services
are important for individuals' well-being and can often prevent the need for acute inpatient hospitalizations. OIG
work has uncovered various problems with nursing home care, including inadequate staffing, failure to provide
adequate nutrition and hydration, inadequate wound care resulting in pressure wounds (bedsores), inappropriate
medication practices, failure to develop adequate care plans, and excessive therapy services that are medically
unnecessary or even harmful to beneficiaries.
Medicaid is a major payer of personal care services, spending more than $12 billion annually. The Department is
committed to ensuring that Medicaid beneficiaries enjoy adequate home- and community- based care options and
as such, expenditures for personal care services may be expected to increase. Many Medicaid programs support
beneficiary-directed models for the delivery of personal care services. While these systems offer certain
advantages for promoting patient choice and preferences, OIG investigators have found such systems particularly
vulnerable to fraud and abuse.
Progress in Addressing the Challenge
The Department has taken steps to improve quality of nursing home and home- and community-based care. For
example, the Department has initiated a review of the requirements for nursing homes to participate in the
Medicare and Medicaid programs. This review promises to emphasize patient-centered care, quality
improvement, and preventable rehospitalization. The Department has long recognized problems with patients
cycling between nursing homes and acute care hospitals.. As part of  the Partnership for Patients Initiative, the
Department specifically committed $300 million towards a Community-Based Care Transition Program to improve
patient outcomes following hospital discharge. The Department has launched the National Nursing Home Quality
Care Collaborative that proposes to identify best practices from high performing facilities and promote
dissemination and replication of those practices to improve care. Increased involvement of Quality Improvement
Organizations also offers potential improvement in quality of nursing home care. Through its Nursing Home
Compare initiative, the Department also attempts to disseminate information about nursing home quality that
may help inform beneficiaries and their families when selecting facilities. In 2013, CMS also released guidance that
strengthens nursing home requirements in areas such as: the use of unnecessary medication, access and visitation,
handling linens and infection control, and the provision of basic life support services for residents.
OIG continues to pursue enforcement actions against nursing homes that render substandard care. CMS and OIG
continue to work closely with law enforcement partners at the Department of Justice and through the Federal
Elder Justice Interagency Working Group to promote better care for elderly persons and to prosecute providers
that subject them to abuse or neglect. Additionally, State Medicaid Fraud Control Units (MFCUs), which receive
oversight and funding from OIG, devote substantial resources to the investigation and prosecution of patient
abuse and neglect in both Medicaid-funded facilities and board and care facilities. The President's FY 2014 Budget
includes a legislative proposal to expand MFCU jurisdiction to review patient abuse and neglect in home- and-
community based settings, as welL.
The decision to force a nursing home to shut down or stop serving Federal health care program beneficiaries is
never taken lightly, as the experience of being transferred may be traumatic to displaced beneficiaries and locating
nearby facilities to adequately serve them can be challenging. Therefore, OIG invests substantial efforts in helping
facilities improve. OIG has developed an innovative quality-oriented corporate integrity agreement process to
work with facilities so they may properly serve beneficiaries. OIG has placed more than 750 nursing homes under
corporate integrity agreements that include quality-monitoring provisions designed to ensure that beneficiaries
receive the care they deserve.
Ensuring high quality home- and community-based services, enabling beneficiaries to avoid institutionalization,
relies heavily on appropriate personal care services. In another promising initiative, the Department funded the
National Direct Service Workforce Resource Center to develop the Road Map of Core Competencies for the Direct
Service Workforce. A planned component of this initiative is to develop nationally validated core competencies for
Page 15 personal care service providers and reduce State variation. As DIG has previously noted, developing the standards
will be a good first step, but getting States to adopt them may require more forceful action from the Department.
What Needs To Be Done
The Department should continue to prioritize quality of nursing home and home- and community-based care. DIG
has offered recommendations that can assist the Department in this mission. For example, OIG suggested
enhancements to nursing home oversight to ensure that Medicare does not pay nursing homes to overmedicate or
otherwise inappropriately medicate beneficiaries (See Challenge 3 for more information). The Department should
worthless and work with
also continue denying payments for services of such low quality that they are virtually 
DIG to exclude providers that have rendered grossly substandard care, thereby preventing additional harm to
vulnerable beneficiaries.
The Department should ensure integrity of Medicaid-funded personal care services by establishing minimum
Federal qualification standards for providers, improving CMS's and States' ability to monitor billing and care
quality, and issuing operational guidance for claims documentation, beneficiary assessments, plans of care, and
supervision of attendants. The Department should also issue guidance to States regarding adequate prepayment
controls and help States access data necessary to identify overpayments. CMS should continue developing and
then implement its comprehensive action plan, including the input it gathered from the roundtable it held in April
2013 to consider feasible and effective practices for improving program integrity in personal care services.
Key OIG Resources
. Personal Care Services: Trends, Vulnerabilities, and Recommendations for Improvement. November 2012
. DIG Spotlight on Skilled Nursing Facilities. February 2013
. Example of Fraudulent Substandard Care: press release on nursing home operator health care fraud
sentencing. August 2012
Management Issue 8: Effectively Using Data and Technology to Protect Program Integrity
Why This Is a Challenge
The Department compiles an enormous amount of data related to Federal health insurance programs, public
health and human services, and the beneficiaries whom they serve. It continues to face challenges in effectively
using these data to detect and prevent improper payments and to ensure consumer and patient safety and quality
of care. It also faces challenges to protect the privacy and security of the data it collects and maintains.
Medicaid Data. Federal Medicaid payments are expected to increase an average of
Improving the Effectiveness of 
8 percent each year from 2013 through 2023, according to recent Congressional Budget Office estimates. As
Medicaid expands, it is imperative that CMS have a functional, national Medicaid database so that CMS may
monitor Medicaid payments and services. DIG work has found that the current national Medicaid data are not
complete, accurate, or timely and that additional data are needed to conduct national Medicaid program integrity
activities. OIG has recommended several actions for improvement, including that CMS establish a deadline for
when national Medicaid data of sufficient completeness and quality will be available and ensure that States submit
required data. CMS has attempted to improve the access and quality of Medicaid data, most recently through the
Information System (T-MSIS) initiative. Although implementation is still early,
Transformed Medicaid Statistical 
analysis completed in January 2013 showed that T-MSIS has made limited progress in addressing Medicaid data
concerns. (For additional information on challenges related to Medicaid, see Challenge 4).
Demonstrating Impact from the Fraud Prevention System (FPS). As the Department continues to implement
predictive analytics technologies to help identify fraudulent claims before they are paid, it must produce reliable
information demonstrating the effectiveness of these technologies. The Small Business Jobs Act of 2010 required
CMS to use predictive analytics to identify and prevent the payment of improper claims in the Medicare fee-for-
service program. In response, CMS implemented the FPS in 2011 and now uses the predictive analytics program to
Page 16 identify potential health care fraud, waste, and abuse. However, after its first year of implementation, challenges
remain in demonstrating the FPS's impact. OIG found that some reporting requirements were not met and that its
methodology for calculating estimates on savings, recoveries, and return on investment included some invalid
assumptions that may have affected the accuracy of those amounts.
Ensuring HHS Data and Systems Are Secure. All information collected, processed, transmitted, stored, or
disseminated by HHS agencies, their contractors, States, and hospitals must be adequately protected pursuant to
the Privacy Act, Office of Management and Budget (OMS) guidelines, and other authorities. OIG has identified
vulnerabilities in a variety of information systems controls, including implementation of directives and guidance on
information security controls, access controls, and configuration management controls, which may lead to
unauthorized access to and disclosure of sensitive information or disruption of critical operations and limit the
ability to ensure the confidentiality, integrity, and availability of critical information and systems. As discussed in
Challenge 1, the Department also faces challenges in the development of systems for and effective operation of
the Marketplaces, which require rapid, accurate, and secure integration of data from numerous Federal and State
sources and individuals who use the Marketplaces.
Protecting Information Contained in Electronic Health Records (EHR) and Guarding Against Fraud. With the
enactment of  the Recovery Act and the HITECH Act, the Department has played a leading role in the nationwide
adoption of EHRs and other health IT. These innovations offer opportunities for improved patient care and more
efficient practice management. However, as the volume of electronically-stored medical information grows,
protecting the privacy, security, and integrity of EHRs has become more criticaL. Data security breaches and
medical identity theft are growing concerns, with thousands of cases reported each year. i The Department faces
challenges as it maximizes implementation of promising health IT while maintaining the privacy and security of
sensitive health information.
Experts in health information technology caution that use of EHRs can make it easier to commit fraud. In the
Department's efforts to promote EHR adoption, it focused largely on developing criteria, defining meaningful use,
and administering incentive payments. It has given less attention to the risks EHRs may pose to program integrity.
Certain features, such as cut-and-paste and auto-fill templates may be used to mask true authorship of the medical
record and distort information to inflate health care claims. An examination of hospitals that received Medicare
incentive payments as of March 2012 revealed that while nearly all hospitals had recommended audit functions in
place, they may not be using them to their full extent. For example, nearly half of hospitals reported being able to
turn off audit logs, and few hospitals report using audit logs to identify potentially fraudulent or abusive practices.
Progress in Addressing the Challenge
CMS has taken action to improve its data and technology capabilities. Beginning in 2012, CMS partnered with 12
volunteer States on the planning and development of T-MSIS. OIG found that the 12 States had made some
progress in implementing T-MSIS. CMS stated that all States are expected to participate in T-MSIS by the end of
2013 and to demonstrate operational readiness to submit timely T-MSIS data by July 1, 2014. CMS issued a letter
to State Medicaid Directors in August 2013 that included a deadline for when all States are expected to
demonstrate operational readiness to submit T-MSIS files, transition to T-MSIS, and submit timely T-MSIS data.
CMS also reports that it has added terms and conditions "to various Medicaid funding mechanisms to provide
incentive for States to report timely, complete and accurate data. CMS created a set of tools to help States
prepare to submit T-MSIS data, including establishing a CMS liaison for States and the creation of a T-MSIS State
collaboration workgroup.
In implementing FPS in July 2011, CMS met legislative timeline requirements and implemented the largest scale
predictive analytics program used to identify potential health care fraud, waste, and abuse ever developed. With
i CMS tracks nearly 300,000 compromised Medicare-beneficiary numbers. The Office for Civil Rights has received
more than 77,000 complaints regarding breaches of health information privacy and completed more than 27,000
investigations, which have resulted in more than 18,000 corrective actions.
Page 17 regard to demonstrating the impact of FPS, CMS has shown leadership by coordinating and leveraging
relationships with public and private entities to discern best practices for measuring the impact of program
activities. CMS has also continued to take steps to refine its methodologies for calculating cost savings
integrity 
from costs avoided due to FPS.
Some HHS agencies, States, and hospitals have made progress in addressing recommendations made by DIG in
audits of information security systems. However, CMS continues to have significant deficiencies in its planning,
implementation, and execution of its overall information security directives and guidance; and implementing
controls to prevent unauthorized access to sensitive information.
Through its EHR adoption incentive programs regulations and its EHR certification criteria regulations, HHS has
addressed privacy and security matters in limited ways. The Office of the National Coordinator for Health IT (ONe),
which coordinates the adoption, implementation, and exchange of EHRs, awarded a contract to develop
recommendations to enhance data protection; increase data validity, accuracy, and integrity; and strengthen fraud
protection in EHR technology; however, the Department did not directly address all recommended safeguards
through certification criteria and meaningful use requirements. CMS has acknowledged the potential for EHRs to
the copy/paste feature in
be used to commit fraud and intends to develop guidelines to ensure appropriate use of 
EHRs. Additionally, CMS audits providers who received EHR incentive payments to gauge the accuracy of, among
other things, attestations that risk analyses designed to protect electronic health information were conducted. If
the Department takes steps to that ensure meaningful use requirements include necessary safeguards, these
audits may be a helpful oversight tool.
What Needs To Be Done
CMS and the 12 volunteer States participating in T-MSIS have made some progress, particularly toward planning
for T-MSIS implementation. However, early implementation outcomes raised questions about the completeness
and accuracy of T-MSIS data upon national implementation. CMS should continue to work with States to ensure
the submission of complete, accurate, and timely data. It should also establish a deadline for when T-MSIS data
will be available for use. If States fail to begin submitting T-MSIS data by the implementation deadline, CMS should
use its statutory enforcement mechanisms or seek legislative authority to employ alternative tools to compel State
participation.
To ensure effective operations during the planned expansion and enhancement of FPS over the next few years,
CMS will need to address FPS's reporting and measurement vulnerabilities. OIG will continue monitoring the FPS
and analyze future modifications or refinements to it.
The Department, States, and hospitals should continue improving systems controls to help ensure that system
assets are protected from unauthorized usage and that only authorized personnel are granted access to data and
programs.
The Department should continue to focus on oversight and enforcement of privacy and security protections to
ensure that sensitive data are protected. It should also do more to ensure that EHRs contain safeguards and that
providers use these safeguards to protect against health care fraud involving electronic systems. The Department
should also provide additional guidance on information technology security standards and best practices that the
health care industry should adopt for EHRs.
Key OIG Resources
. Not All Recommended Fraud Safeguards Have Been Implemented in Hospital EHR Technology. December
2013
. Early Outcomes Show Limited Progress for the T-MSIS. September 2013
. The Department and CMS Financial Statement Reports which can be found on the HHS website after December
16, 2013. Fiscal Year 2013
. Security Gaps May Threaten Electronic Health Records. June 2011
Page 18 . Protect Yourself Against Medical  Identity Theft.
Identity Theft. October 2012
. eMS Response to Breaches and Medical 
. DIG report on implementation predictive analytics. September 2012
Management Issue 9: Protecting HHS Grants and Contract Funds from Fraud. Waste, and Abuse
Why This Is a Challenge
HHS is the largest grant-making organization in the Federal Government, and its funding of health and human
services programs touches the lives of almost all Americans. In FY 2012, the Department awarded over 81,000
grants totaling approximately $347 billion. Of these, approximately 80,000 grants totaling approximately $90
billion were for programs other than Medicare or Medicaid. According to HHS's Tracking Accountability in
Government Grants System, in FY 2013, HHS issued over 20,000 new awards totaling over $272 million. These
grants include those added to the HHS grant portfolio by the ACA and the Recovery Act, thus expanding the
oversight responsibilities of grant managers and project officers.
HHS is also the third largest contracting agency in the Federal Government; in FY 2013, HHS awarded over $19
billion in contracts across all program areas. Under ACA, contractors have played, and will continue to play, a vital
role in building, maintaining, and fixing the computer systems that underpin the implementation of Marketplaces
and the Data Hub. HHS faces a challenge to ensure proper management and oversight of these contracts. (See
Challenge 1 for more information on ACA contractor management and oversight.) Additionally, several HHS
Operating Divisions (OPDIVs) funded Small Business Innovation Research (SBIR) and Small Business Technology
Transfer (STIR) grants and contracts. In calendar year 2012, HHS spent $755 million for grants and contracts in
these programs. In contracts alone, HHS awarded $13 million in SBIR contracts and $463,000 in STIR contracts in
FY 2013. HHS is the second largest payer under the SBIR and STIR programs (the Department of Defense is the
first).
The size and scope of departmental awards make their operating effectiveness crucial to the success of programs
designed to improve the health and well-being of the public. Yet OIG has noted weaknesses in the oversight of
grantees, as demonstrated by late or absent financial and related reports, insufficient documentation on progress
toward meeting program goals, and failure to ensure that grantees obtain required annual financial audits.
At the grantee level, a common problem uncovered by our reviews is that grantees lack robust financial
management systems. Some grantees cannot even account for specific grants on a grant-by-grant basis. Without
this basic ability, grantees cannot account for costs associated with specific grant awards. Accountability suffers as
a result. Collectively, when combined with frequent significant findings of unallowable expenses, these conditions
suggest the need for more purposeful oversight and consistency in oversight processes.
Additionally, OMB is in the process of finalizing extensive revisions to the grants management circulars and
associated cost principles for Federal grant awards, which will result in implementation challenges for the
Department, including changes to HHS regulations and potential adjustments to some grant oversight practices.
With respect to contracts, OIG raised concerns about HHS's use of appropriations to fund contracts as well as its
efforts to monitor contractor performance. OIG audits of NIH contracts revealed instances of improper funding in
11 of 18 contracts. Follow-up audit work is underway to assess the effectiveness of the remedial actions outlined
by the Department in its 2011 report of Antideficiency Act violations.
OIG has also identified weaknesses in contracting processes and contract management. An audit of CDC contracts
revealed that CDC failed to meet Government requirements for contractor performance assessments. Failure to
conduct these assessments and make contractor evaluations available through the Federal Awardee Performance
valuable
and Integrity Information System (FAPIlS) deprives CDC's and other agencies' contracting officers of 
performance information that should be used in determining whether a contractor is responsible and should
Page 19 receive another Federal award. During FY 2013 the Department focused on contractor performance assessments
and posting performance information in the FAPIIS, resulting in an overall improvement from 7.91% (baseline FY
2009 - FY 2012) to 14.88% (FY 2009 - FY 2013).
With respect to misconduct involving grants or contracts, HHS faces various challenges pursuing criminal, civil or
administrative actions. While HHS has established a suspension and debarment program, in FY 2013, the
implementation of this tool to impose suspensions and debarments remains limited. HHS faces the challenge of
educating its grant and contract officers on these administrative remedies and encouraging their use.
Progress in Addressing the Challenge
HHS is strengthening its program integrity efforts by working with its OPDIVs and Staff Divisions (STAFFDIVs) to
implement a uniform risk management approach. The Department has established a Program Integrity
Coordinating Council to look across programs for common challenges and solutions. Additionally, HHS has actively
participated in the Government-wide grants reform guidance project, and is in the process of updating its own
internal grants administration manual to foster greater program integrity, accountability, and transparency
throughout the grants lifecycle.
With respect to systemic contract funding problems, the Department continues to provide its contracting
workforce with an online reference tool for contract funding, formation, and appropriations law compliance. The
Department conducts appropriations law compliance reviews of all contract actions exceeding $5 million or $10
million, depending on the type of requirement reviewed and the awarding OPDIV or STAFFDIV. HHS has also
revised its contract funding guidance to more accurately describe appropriations law and policy; these revisions
incorporated best practices and lessons learned. All Heads of Contracting Activities have developed guidance for
their contracting workforce on contractor performance evaluation.
With respect to grant and contract misconduct, the Department has participated in training related to fraud, waste
and abuse in the grant and contract area. OIG, a member of the President's Financial Fraud Enforcement Task
Force Grant Fraud Subcommittee, collaborated to produce guidance to be used by all Federal agencies as a
framework for grant training to reduce grant fraud risk and has offered to assist the Department in developing
training specific to HHS OPDIVs.
In outreach efforts, OIG provided fraud, waste, and abuse training to SBIR/STTR program staff in multiple OPDIVs
and to staff at CMS's Center for Medicare and Medicaid Innovation. OIG created an Intranet Web Page for HHS
OPDIV officials to use to refer allegations of fraud or to submit questions about fraud to OIG.
With respect to suspension and debarment, the Suspension and Debarment Official (SDO) and her staff continue to
have monthly coordination meetings with OIG, the Office of Research Integrity and the Office of the General
CounseL. The SDO is also developing procedures and tools to assist HHS grants and contracts officials.
What Needs To Be Done
Sustained focus by the Department is needed to address vulnerabilities in its grant programs and contract
administration. With respect to grant oversight, OPDIVs need continued vigilance in monitoring grant resources
stemming from the ACA, the Recovery Act, and other grant programs. Implementation of planned program
integrity initiatives, such as evaluating and mitigating risks, identifying and addressing cross-cutting issues,
resolving grantee audit findings, and sharing best practices across the Department will better position HHS to
integrate program integrity into all aspects of its operations and culture.
OIG is continuing to examine grants management practices across the Department. For example, OIG is reviewing
the extent to which OPDIVs mitigate grantee risks and share information about high risk grantees. We are also
reviewing OPDIVs' oversight of the SBIR program as it pertains to ensuring grantee compliance with program
eligibility requirements.
Page 20 With respect to contract funding, the Department has advised that it is focused on preventing new violations and
that it is taking legally appropriate actions to ensure that there are no further violations of the Antideficiency Act
among ongoing contracts. OIG continues to recommend that the Department correct the improper funding of
contracts that resulted in appropriations violations and continue to ensure that appropriate officials attend
mandated training, that future contracts are funded properly, and that policy guidance is consistently followed.
The Department and OIG should continue to provide training on identifying and pursuing misconduct in HHS grants
and contracts. The Department also needs to continue to refine its Suspension and Debarment Procedures,
including streamlining the referral and decision process, setting up a department-wide tracking system, training
officials throughout the Department on suspension and debarment, and decreasing the processing time of
suspension and debarment referrals.
Key OIG Resources
. OIG Spotlight on Grants Management and Oversight. February 2013
. OIG review of CDC's contract monitoring. July 2013
Management Issue 10: Ensuring the Safety of Food. Drugs. and Medical Devices
Why This Is a Challenge
The Department, through the Food and Drug Administration (FDA), is responsible for protecting public health by
ensuring the safety, efficacy, and security of drugs, medical devices, biologicals, and much of our Nation's food
supply. The Department must ensure that once a drug, biologic, or device has been approved for use, it is
marketed appropriately. During a food emergency, the Department is also responsible for finding the
contamination source and overseeing the removal by manufacturers of these products from the market. However,
OIG work has revealed weaknesses in FDA's ability to adequately oversee the safety of drugs, biologics, medical
devices, and food. These challenges include:
drug safety. A fall 2012 nationwide meningitis outbreak caused by contaminated injections
Limited oversight of 
raised major concerns about the use of drugs supplied by compounding pharmacies. OIG reviewed hospitals' use
of compounded drugs and found that in 2012, 92 percent of hospitals used compounded sterile preparations
(CSPs). Additionally, we found that 56 percent of hospitals made changes or planned to make changes to CSP
sourcing practices in response to the fall 2012 meningitis outbreak. In recent congressional hearings about
vulnerabilities in the oversight of compounding pharmacies, FDA has raised concerns that its enforcement
authority might not be sufficient to take action against inappropriate compounding practices.
Similarly, OIG's review of Risk Evaluation and Mitigation Strategies (REMS) raised concerns about FDA's monitoring
of the risks associated with drugs that have known or potential risks that may outweigh the drugs' benefits. REMS
are enforceable, structured plans to manage specific risks associated with these drugs. We found that nearly half
of sponsor assessments for the REMS we reviewed did not include all information requested in FDA assessment
plans. Moreover, FDA does not have the authority to take enforcement actions against drug sponsors that do not
include all information requested in FDA assessment plans.
Inadeguate food facility and dietary supplement manufacturer recordkeeping. In the past, OIG have found that
keeping requirements impedes the Department's ability to
food facilities' failure to comply with FDA's record 
ensure the safety of the Nation's food supply. OIG found that 59 percent of selected food facilities did not comply
In recent reviews of manufacturers of dietary supplements, OIG found
with FDA's record  keeping requirements. 
that 28 percent of contacted companies failed to register with FDA as required. Of the companies that did
register, 72 percent failed to provide the complete and accurate information required in the registry.
dietary supplements. The Government Accountability
Potentially misleading claims made by manufacturers of 
Office (GAO) and public interest groups have raised concerns about a specific type of claim called a
Page 21 structure/function claim that manufacturers may use on dietary supplement labels. Manufacturers have used
these claims to promote health benefits of their products. Stakeholders have urged FDA to strengthen oversight of
these claims because they are potentially misleading and may lack scientific support. Manufacturers must have
competent and reliable scientific evidence to show that claims are truthful and not misleading, but they do not
have to submit the substantiation to FDA, and FDA has only voluntary standards for it. A manufacturer must notify
FDA when it uses structure/function claims. OIG found that substantiation documents for the supplements
reviewed were inconsistent with FDA guidance on competent and reliable scientific evidence. OIG also found that
FDA could not readily determine whether manufacturers had submitted the required notification for their claims.
These results raise questions about the extent to which structure/function claims are truthful and not misleading.
Ensuring Compliance With Marketing Reguirements. Manufacturers of drugs, biologicals, and medical devices gain
approval for sale of their products for specific uses once FDA determines that the products are safe and effective
for those uses. Once approved for sale, qualified medical providers may prescribe them for any uses on the basis
of their medical judgment. However, manufacturers are prohibited from promoting products for uses for which
FDA has not specifically approved them (known as off-label uses). DIG, in conjunction with its law enforcement
Investigations, has investigated many instances in which manufacturers
partners, including FDA's Office of Criminal 
illegally promoted products for off-label uses. Off-label promotion can undermine the system intended to ensure
that drugs are safe and effective and can put patients at risk. Additionally, this illegal off-label promotion may lead
to fraudulent claims for payment submitted to Federal health care programs, including Medicare and Medicaid.
FDA faces ongoing challenges in adequately monitoring and preventing illegal off-label promotional activities.
Progress in Addressing the Challenge
Since September 2009, FDA has required food facilities to report to a new registry all instances when there is a
reasonable probability that a food might cause serious adverse health consequences and to investigate the causes
of any adulteration reported if the adulteration may have originated with the food facility. The Food Safety
Modernization Act (FSMA), signed into law in January 2011, provides FDA important new authorities to better
protect the Nation's food supply. OIG will continue to oversee the Department's management of food safety
issues and FSMA implementation.
The Food and Drug Administration Safety and Innovation Act (FDASIA), enacted in July 2012, expands the FDA's
authorities and strengthens its ability to safeguard public health by authorizing the collection of user fees to fund
reviews of drugs and devices; promoting innovation to expedite the development and review of certain new drugs;
increasing stakeholder involvement in FDA decision making; and enhancing the safety of the drug supply chain.
FDA has established a 3-year plan to implement these provisions, and the agency's progress is updated monthly on
a website.
OIG is continuing to work with law enforcement partners to investigate and prosecute drug and device
manufacturers that engage in illegal activity. This year, as in past years, the Government entered several
settlements with drug and device manufacturers relating to alleged off-label promotion. For example, in
December 2012, Amgen Inc. agreed to pay a total of $762 million to resolve allegations of off-label promotion and
other improper conduct. Amgen pled guilty to misdemeanor misbranding charges, entered a civil settlement
agreement, and entered a comprehensive corporate integrity agreement with OIG to resolve its criminal, civil, and
administrative liability for the improper conduct. In July 2013, TranS1, a medical device manufacturer, agreed to
pay $6 million to resolve allegations under the False Claims Act that it caused false claims to be submitted to
Medicare and Medicaid by, among other things, promoting its medical device for uses not approved or cleared by
the FDA.
FDA has made progress in addressing DIG recommendations. For example, as a result of OIG's identifying
vulnerabilities in FDA's oversight of regulatory decisions, FDA implemented new operating procedures for resolving
scientific disagreements. However, other concerns raised by our office, such as weaknesses in ensuring the
adequate monitoring of adverse-event reporting for medical devices and the accuracy of FDA's National Drug Code
Directory, remain unaddressed.
Page 22 What Needs To Be Done
The Department and FDA will need to continue issuing the rules and guidance documents necessary to fully
implement the various provisions in FDASIA. In addition, FDA will need to continue its efforts to fully implement
FSMA to better protect the Nation's food supply. FSMA addresses many of OIG's recommendations; however, we
continue to recommend that FDA vigorously use its new authorities to remedy identified weaknesses in its
inspections and recall procedures. FDA should also ensure that States properly conduct contracted food facility
inspections. The Department also needs to focus on eliminating off-label promotion to protect patients and HHS
health care programs.
Key 016 Resources
 OIG reports on food facility safety inspections (December 2011), structure/function claims by dietary
supplements (October 2012), Risk Evaluation and Mitigation Strategies for drug safety (February 2013), and
hospital outsourcing of high-risk compounded drugs (April 2013)
.. DOJ press release: resolution with Amgen, Inc. settlement. December 19, 2012
.. DOJ press release: resolution with TranS1, INC. July 3,2013
Page 23