Department of Health and Human Services 
OFFICE OF 
 
INSPECTOR GENERAL 
 
 
 
 
 
M :
EDICARE   
 
 
V R
ULNERABILITIES  ELATED 
 
 
P E
TO  ROVIDER  NROLLMENT 
 
 
O
AND  WNERSHIP 
 
  D  
ISCLOSURE
 
 
 
 
 
 
 
 
 
Suzanne Murrin 
Deputy Inspector General for 
Evaluation and Inspections 
 
May 2016 
OEI-04-11-00591   
   
EXECUTIVE SUMMARY  MEDICARE:  VULNERABILITIES RELATED TO 
PROVIDER ENROLLMENT AND OWNERSHIP DISCLOSURE 
OEI-04-11-00591 
 
WHY WE DID THIS STUDY  
The Centers for Medicare & Medicaid Services (CMS) can prevent inappropriate payments, 
protect beneficiaries, and reduce time-consuming and expensive pay and chase activities by 
ensuring that providers that intend to engage in fraudulent or abusive activities are not allowed to 
enroll in Medicare.  For CMS to identify potentially fraudulent providers, as well as those that 
may be associated with excluded individuals or entities, providers must disclose accurate and 
timely information about their owners (i.e., individuals or corporations with a 5-percent or more 
ownership or controlling interest; agents; or managing employees).   
 
HOW WE DID THIS STUDY 
For selected providers, we compared three sets of owner names:  (1) those on record with 
CMS for Medicare enrollment purposes, (2) those submitted by providers directly to the 
Office of Inspector General (OIG) for this evaluation, and (3) those on record with State 
Medicaid programs for Medicaid enrollment purposes.  When we compared names, if we 
found owner names that were not identical but were reasonably similar, we considered 
the names to match.  Additionally, we surveyed CMSs Medicare Administrative 
Contractors regarding their checking of exclusions databases when they process Medicare 
enrollment applications. 
 
WHAT WE FOUND 
Over three-quarters of Medicare providers in our review had owner names on record with 
CMS that did not match those that providers submitted to OIG.  Further, nearly all 
providers in our review had owner names on record with CMS that did not match those 
on record with State Medicaid programs.  The prevalence of nonmatching owner names 
raises concern about the completeness and accuracy of information about Medicare 
providers ownership.  It also demonstrates that providers may not be complying with the 
requirement to report ownership changes to CMS.  Additionally, 2 of the 11 CMS 
contractors did not check all required exclusions databases, which could allow providers 
with excluded owners to enroll in the Medicare program.  The two contractors reported 
that they checked only one of two exclusions databases, and this database does not 
always have the most current information on excluded individuals and entities.  Taken 
together, these findings reveal vulnerabilities that could allow potentially fraudulent 
providers to enroll in the Medicare program and limit CMSs ability to provide adequate 
oversight.   
 
WHAT WE RECOMMEND 
We recommend that CMS (1) review providers that submitted nonmatching owner names 
and take appropriate action, (2) educate providers on the requirement to report changes of 
ownership, (3) increase coordination with State Medicaid programs on the collection and 
verification of provider ownership information in Medicare and Medicaid, and (4) ensure 
that its contractors check exclusions databases as required.  CMS concurred with all of 
our recommendations.   
   
   
TABLE OF CONTENTS 
 
Objectives ....................................................................................................1 
Rationale ......................................................................................................1 
Background ..................................................................................................2 
Methodology ................................................................................................6 
Findings........................................................................................................8 
The prevalence of nonmatching owner names raises concern about 
the completeness and accuracy of information about Medicare 
providers ownership ........................................................................8 
Two of eleven CMS contractors reported that they did not check 
exclusions all required exclusions databases, which could allow 
providers with excluded owners to enroll in Medicare ....................9 
Conclusion and Recommendations ............................................................ 11 
Agency Comments and Office of Inspector General Response .....13 
Appendixes ................................................................................................14 
A: Detailed Methodology ..............................................................14 
B: Agency Comments ....................................................................19 
Acknowledgments......................................................................................21 
 
 
 
   
   
OBJECTIVES 
To determine the extent to which: 
1.  Owner names on record with the Centers for Medicare & Medicaid 
Services (CMS) matched the names submitted to the Office of 
Inspector General (OIG) for this evaluation and the names on record 
with State Medicaid programs.  
2.  CMSs contractors checked exclusions databases as part of the 
Medicare enrollment process. 
RATIONALE 
CMS can prevent inappropriate payments, protect beneficiaries, and 
reduce time-consuming and expensive pay and chase activities by 
ensuring that providers that intend to engage in fraudulent or abusive 
activities are not allowed to enroll in Medicare.1  For CMS to identify 
potentially fraudulent providers, as well as those that may be associated 
with excluded individuals or entities, providers must disclose information 
on owners and others with control interest in the business.   
However, in some health care fraud schemes, individuals have concealed 
providers true ownership from the Medicare program.  For example, in 
October 2009, an individual in southern California was indicted for 
a scheme in which he allegedly recruited relatives and street gang 
members to pose as the nominee owners2 of various companies selling 
durable medical equipment.3  The nominee owners then allegedly 
submitted fraudulent claims to Medicare, totaling more than $11 million.  
This individual later pled guilty to one felony count of Medicare fraud and 
faced up to 10 years in prison.4  Additionally, in February 2013, an 
                        ____________________________________________________________ 
1 Provider means a hospital, critical access hospital, skilled nursing facility, 
comprehensive outpatient rehabilitation facility, home health agency, or hospice, that has 
in effect an agreement to participate in Medicare; or a clinic, rehabilitation agency, or 
public health agency that has in effect a similar agreement but only to furnish outpatient 
physical therapy or speech pathology services; or a community mental health center that 
has in effect a similar agreement but only to furnish partial hospitalization services.  
42 CFR  400.202. 
2 A nominee owner is a straw ownersomeone who is an owner in name only. 
3 Department of Justice (DOJ), Justice News:  Los Angeles Medicare Fraud Strike Force 
Charges 20 in Health Care Fraud Cases Involving Durable Medical Equipment, 
October 21, 2009.  Accessed at http://www.justice.gov/opa/pr/los-angeles-medicare-
fraud-strike-force-charges-20-health-care-fraud-cases-involving-durable on December 9, 
2015.  
4 California Criminal Attorney Blog, Santa Ana Man Pleads Guilty to $26-million 
Medicare Fraud Scheme, April 23, 2010.  Accessed at 
http://www.californiacriminalattorneyblog.com/2010/04/santa_ana_man_pleads_guilty_t
o.html.  
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 1 
   
   
individual in Florida pled guilty for his role in using a holding company to 
purchase facilities that fraudulently billed Medicare $28.3 million.5  This 
individual and his co-conspirators then sold the facilities to nominee 
owners in an attempt to disassociate from the facilities fraudulent 
operations.  This individual later pled guilty to conspiracy to commit 
health care fraud and faces up to 15 years in prison.6 
There are also concerns about provider ownership information in 
Medicaid.  In a companion report issued concurrently with this report, 
OIG found that few State Medicaid programs requested that providers 
disclose all required ownership information.7  In addition, 14 State 
Medicaid programs reported that they did not verify the completeness or 
accuracy of provider ownership information.  OIG also found that 14 State 
Medicaid programs reported that they do not check all required exclusions 
databases.  Additionally, when we compared the owner names on record 
with State Medicaid programs with the owner names that providers 
submitted to OIG for this review, most did not match. 
BACKGROUND  
Medicare Ownership Disclosure 
When enrolling in Medicare, providers must disclose specific information 
to CMS, including the identity of any person who has an ownership or 
controlling interest of 5 percent or more, or is an agent or managing 
employee.8  (In this report, we refer to all four types as owners.)  
Providers enrolling in Medicare must also disclose whether any owners 
have been convicted of a criminal offense, subjected to any civil monetary 
penalties, or excluded from participating in federally funded health care 
programs.9   
                        ____________________________________________________________ 
5 DOJ, Justice News:  Leader of $28.3 Million Medicare Fraud Scheme Pleads Guilty, 
February 3, 2014.  Accessed at http://www.justice.gov/opa/pr/leader-283-million-
medicare-fraud-scheme-pleads-guilty on December 9, 2015. 
6 Herald-Tribune, Florida man pleads guilty to Medicare fraud, February 4, 2014.  
Accessed at http://www.heraldtribune.com/article/20140204/ARTICLE/140209890 on 
December 11, 2015.  
7 OIG, Medicaid:  Vulnerabilities Related to Provider Enrollment and Ownership 
Disclosure (OEI-04-11-00590), May 2016. 
8 Social Security Act  1124(a)(2)(B) and 1124A(a)(1)-(2); 42 CFR  420.206(a)(1).  
In Medicaid, providers that are enrolling must also disclose the name and address of any 
person (individual or corporation) with an ownership or control interest or managing 
employee.  42 CFR  455.104(b) and 420.206(a)(3). 
9 42 CFR  420.204(a)(3).  In Medicaid, providers that are enrolling must disclose 
whether any owners have been convicted of a criminal offense related to the providers 
involvement in Medicaid or Medicare.  42 CFR  455.106(a)(1)-(2). 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 2 
   
   
Once enrolled in Medicare, providers must report changes of ownership or 
control to CMS within 30 days of the change.10  In addition, providers 
must revalidate (i.e., resubmit and recertify) enrollment information every 
5 years and suppliers must revalidate every 3 years.11 
Regulations require CMS not to enroll providers that fail to disclose all 
required information, and to terminate any existing agreements or 
contracts with such providers.12  Additionally, CMS may revoke providers 
from the Medicare program if any requirements, such as reporting changes 
of ownership or control within 30 days, are not met.13  Although CMS 
states that it generally does not take administrative action against 
providers for not updating their enrollment records, CMS will do so in 
certain situations where the failure to report the change would have caused 
the provider to be ineligible for enrollment in the Medicare program.14 
Collection and Verification of Provider Ownership Information 
CMS contracts with Medicare Administrative Contractors (MACs) to 
conduct several tasks, such as processing and verifying providers 
ownership information.  To enroll in Medicare or update existing 
enrollment information, providers enter information into the Internet-
based Provider Enrollment, Chain, and Ownership System (PECOS) or 
use the paper enrollment application process (e.g., CMSs 855A Form), 
which MACs then process through PECOS.15   
PECOS is an electronic Medicare enrollment system through which 
providers can submit and track the status of Medicare enrollment 
applications; view, print, and update enrollment information; complete the 
                        ____________________________________________________________ 
10 42 CFR  424.516(e)(1).  In Medicaid, enrolled providers must report changes of 
ownership to State Medicaid programs within 35 days of the change.  42 CFR 
 455.104(c)(1)(iv). 
11 42 CFR  424.515.  State Medicaid programs must revalidate provider enrollment 
information every 5 years.  42 CFR  455.114. 
12 42 CFR  420.206(c). 
13 Section 15 of Forms CMS-855A and CMS-855B.  Accessed at 
https://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/downloads/cms855a.pdf and 
http://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/Downloads/cms855b.pdf, 
respectively, on July 16, 2015.   
14 CMS, Frequently Asked Questions:  Will there be a penalty for not reporting the 
ownership change?  Accessed at 
https://questions.cms.gov/faq.php?id=5005&faqId=9674 on November 12, 2014. 
15 42 CFR  424.510.  See also CMS, Medicare Program Integrity Manual, Pub. 100-08, 
ch. 15,  15.1.3.B. 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 3 
   
   
revalidation process; and voluntarily withdraw from the Medicare 
program.16, 17  
MACs are required to review providers disclosed information, including 
ownership information, to determine its completeness and whether all 
required information and supporting documentation has been submitted.18  
Specifically, MACs must ensure that the provider has completed all 
required data elements in PECOS or on the CMS-855 form, that all 
supporting documentation has been furnished, and that the application was 
completed in accordance with instructions.19  If an application is 
incomplete, MACs inform providers by letter and request that missing 
information be submitted within 30 days.20   
MACs are also required to verify all disclosed information using the most 
cost-effective methods available.21  The general purpose of the verification 
process is to ensure that all data furnished on applications are accurate.22  
Examples of verification techniques include, but are not limited to, visiting 
provider Web sites; using third-party sources for data validation; checking 
Web sites for professional licensure and certification in the State (e.g., 
a medical boards Web site); checking State business Web sites23; and 
checking the Yellow Pages.24  If MACs cannot verify providers 
information, they request additional information and, if necessary, conduct 
site visits. 
                        ____________________________________________________________ 
16 CMS, PECOS for Physicians and Non-Physician Practitioners, July 2015.  Accessed 
at https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-
MLN/MLNProducts/downloads/MEDEnroll_PECOS_PhysNonPhys_FactSheet_ICN903
764.pdf on December 9, 2015. 
17 CMS has provided State Medicaid programs with limited access to PECOS to 
determine if a provider is currently enrolled, is enrolling, or has been denied enrollment 
in the Medicare program.  CMS, CMCS Informational Bulletin:  Medicaid/CHIP 
Provider Screening and Enrollment, December 23, 2011.  Accessed at 
http://www.medicaid.gov/Federal-Policy-Guidance/downloads/CIB-12-23-11.pdf on 
October 28, 2015. 
18 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15,  15.1.3.C. 
19 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15,  15.7 and 15.1.3.B. 
20 CMS, Frequently Asked Questions:  Will I be contacted if my application is found to be 
incomplete or missing information?  Accessed at 
https://questions.cms.gov/faq.php?id=5005&faqId=9190 on November 12, 2014. 
21 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15,  15.7.1.3.  
22 Ibid. 
23 For example, the Web sites of the respective Secretaries of State. 
24 Ibid. 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 4 
   
   
MACs approve, deny, or reject providers enrollment applications based 
on their review.25 
Program Exclusions   
As part of the process of enrolling providers in Medicare, MACs are 
required to confirm that providers disclosed owners are not excluded by 
OIG or listed as excluded in the General Services Administrations 
Excluded Parties List System (EPLS).26, 27  To do so, MACs must check 
providers against OIGs List of Excluded Individuals/Entities (LEIE) and 
the EPLS.28  The LEIE is a database that contains all individuals and 
entities currently excluded by OIG from participating in federally funded 
health care programs.29  The EPLS is a Governmentwide database with 
information on individuals and entities that have been suspended or 
excluded from receiving Federal financial assistance and benefits.30  If the 
provider or any of its owners are excluded, then the MAC must deny the 
enrollment application.31    
Off-Cycle Revalidation of Provider Enrollment Information 
In addition to the regular once-every-5-years provider revalidation 
process, CMS has the authority to conduct off-cycle revalidations to 
assess and confirm the validity of enrollment information maintained in its 
systems.32  Factors that can trigger off-cycle revalidations include random 
checks, local problems with health care fraud, national initiatives, 
complaints, or other reasons that cause CMS to question providers 
compliance with Medicare enrollment requirements.33  As a result of the 
Patient Protection and Affordable Care Act, CMS must use the new 
                        ____________________________________________________________ 
25 42 CFR  424.502, 424.525, and 424.530.  See also CMS, Medicare Program 
Integrity Manual, Pub. 100-08, ch. 15,  15.1.1.  A decision of deny means that the 
enrolling provider has been determined to be ineligible to receive Medicare billing 
privileges.  Reject means that the providers enrollment application was not processed 
due to incomplete information or that additional information or corrected information 
was not received from the provider in a timely manner.  
26 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15,  15.1.3.C.   
27 In July 2012, the EPLS was consolidated with other Federal procurement systems into 
the System for Award Management (SAM).  Phase I consolidation included the Central 
Contractor Registration/Federal Agency Registration, the Online Representations and 
Certifications Application, and the EPLS.  What is SAM?  Accessed at 
https://www.sam.gov/sam/announce1.htm on September 1, 2015. 
28 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15,  15.1.3.C.  
76 Fed. Reg. 5866, 5884 (Feb. 2, 2011). 
29 OIG, List of Excluded Individuals and Entities Background Information.  Accessed at 
http://oig.hhs.gov/exclusions/background.asp on October 28, 2015.   
30 71 Fed. Reg. 7051570516 (Dec. 5, 2006). 
31 42 CFR  424.530(a)(2)(i).  See also CMS, Medicare Program Integrity Manual, 
Pub. 100-08, ch. 15,  15.8.4. 
32 42 CFR  424.515(d). 
33 Ibid. 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 5 
   
   
enrollment criteria to complete an off-cycle revalidation for each provider 
that was enrolled in Medicare prior to March 25, 2011.34 
METHODOLOGY 
We used multiple data collection activities and sources for this report.  
First, for selected providers, we collected and compared three sets of 
owner names:  (1) those on record with CMS for Medicare enrollment 
purposes, (2) those submitted by providers to OIG for this evaluation, and 
(3) those on record with State Medicaid programs for Medicaid enrollment 
purposes.35  We collected this information between December 2013 and 
April 2014.  For 110 providers enrolled in Medicare, we compared the 
owner names on record with CMS to those that providers submitted to 
OIG.  For the 58 of these providers that were enrolled in both Medicare 
and Medicaid, we also compared owner names on record with CMS to 
those on record with State Medicaid programs for Medicaid enrollment 
purposes. 
We also completed an additional analysis on owner names submitted to 
OIG that were not on record with CMS.  Specifically, we analyzed the 
effective dates for a given owners ownership to determine whether the 
dates fell within the 30-day window during which providers are required 
to notify CMS of such changes.  If dates fell within this window, providers 
still had time to notify CMS of the change.  In January 2015, 
approximately 1 year after providers submitted owner names to us for this 
evaluation, we collected and reviewed the updated owner names for these 
providers in PECOS to determine whether the providers had notified CMS 
of their ownership changes. 
Next, in August 2012, we sent an electronic questionnaire to 11 MACs.36  
The electronic questionnaire collected information on how each MAC 
collects and processes ownership information disclosed by providers.  In 
particular, we asked whether each MAC compared ownership information 
that providers disclosed to the LEIE and EPLS. 
See the Appendix for a detailed description of the methodology.     
                        ____________________________________________________________ 
34 The Patient Protection and Affordable Care Act, P.L. No. 111-148 (March 23, 2010), 
as amended by the Health Care and Education Reconciliation Act of 2010, P.L. 
No. 111-152 (March 30, 2010),  6401(a).  76 Fed. Reg. 5866 (Feb. 2, 2011) outlines 
new enrollment screening criteria. 
35 Provider types in our review are ambulatory surgical centers, ambulance services, 
independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 
health agencies, hospices, and renal disease facilities. 
36 Eleven MACs were operational at the time of our data collection in August 2012. 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 6 
   
   
Limitations 
We did not attempt to collect information not reported or verify 
information that providers submitted to OIG.  For example, providers did 
not always report the effective date for a given owners ownership.  We 
did not attempt to collect these dates if providers had not reported them, 
nor did we did not attempt to verify such dates if providers had reported 
them.   
Additionally, the matching of owner names across two or more sources did 
not necessarily mean that ownership information was complete and 
accurate.  Providers could have submitted information that was incomplete 
and/or inaccuratebut that matchedto CMS, OIG, and/or State 
Medicaid programs.   
Finally, the results of comparisons are not projected and pertain only to 
the providers in our review included in each comparison. 
Standards 
This study was conducted in accordance with the Quality Standards for 
Inspection and Evaluation issued by the Council of the Inspectors General 
on Integrity and Efficiency.   
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 7 
   
   
FINDINGS 
The prevalence of nonmatching owner names raises 
concern about the completeness and accuracy of 
information about Medicare providers ownership  
Overall, very few (4 of 58) providers in our review had owner names that 
matched across all 3 sources (i.e., CMS, OIG, and State Medicaid 
programs).  The prevalence of nonmatching owner names raises concern 
about the completeness and accuracy of information about Medicare 
providers ownership. 
For over three-quarters of providers in our review, owner 
names on record with CMS did not match those submitted to 
OIG 
When we compared the owner names on record with CMS for Medicare 
enrollment purposes to those that providers submitted to OIG for this 
evaluation, we found that 77 percent of providers in our review (85 of 
110) had at least one nonmatching owner name.  For 80 providers, some 
owner names matched and some did not match.  For five providers, none 
of the owner names matched.  Table 1 shows the extent to which owner 
names matched for the 110 providers in our review. 
Table 1:  Extent to Which Owner Names On Record With CMS Matched 
Those Submitted to OIG, 2013 
Number of  Percentage of 
Description 
Providers  Providers 
Not all owner names matched  85  77.3% 
-  Somebut not allowner names matched     80  72.7% 
-  No owner names matched  5  4.5% 
All owner names matched  25  22.7% 
     Total  110  100.0% 
Source:  OIG analysis of ownership information on record with CMS and ownership information submitted to OIG, 
2015. 
 
Additionally, it appears that some providers in our review did not notify 
CMS of changes in ownership within the required timeframe.  
Forty-eight providers in our review submitted 168 owner names to OIG 
that were not on record with CMS.  Of these 48 providers, 39 reported the 
effective dates of ownership for 127 owners.  For 91 percent of these 
owners (115 of 127), the effective dates fell outside the 30-day window 
during which providers are required to notify CMS of ownership changes.  
Approximately 1 year later, PECOS did not contain the information for 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 8 
   
   
6 of the remaining 12 owners, indicating that CMS continued to be 
unaware of these ownership changes.   
For nearly all providers in our review, owner names on record 
with CMS did not match those on record with State Medicaid 
programs 
Although Medicare and Medicaid ownership information is collected and 
maintained separately, CMS and State Medicaid programs should have the 
same owner names for providers enrolled in both programs.  However, 
when comparing owner names on record with CMS for Medicare 
enrollment purposes to those on record with State Medicaid programs for 
Medicaid enrollment purposes, we found that 90 percent of providers in 
our review (52 of 58) had at least one nonmatching owner name.  For 
44 providers, some owner names matched and some did not match.  For 
eight providers, none of the owner names on record with CMS matched 
those on record with State Medicaid programs.  Table 2 shows the extent 
to which owner names matched for the 58 providers in our review. 
Table 2:  Extent to Which Owner Names On Record With CMS Matched 
Those On Record With State Medicaid Programs, 2013 
Number of  Percentage of 
Description 
Providers  Providers 
Not all owner names matched  52  89.7% 
-  Somebut not allowner names matched     44  75.9% 
-  No owner names matched  8  13.8% 
All owner names matched  6  10.3% 
     Total  58  100.0% 
Source:  OIG analysis of ownership information on record with CMS and ownership information on record with State 
Medicaid programs, 2015. 
Two of eleven CMS contractors reported that they did 
not check all required exclusions databases, which 
could allow providers with excluded owners to enroll 
in Medicare 
MACs are required to check two databasesthe LEIE and the EPLSas 
part of the Medicare enrollment process to confirm that individuals or 
entities that providers disclosed as owners are not excluded.  Nine of 
eleven MACs reported that they check both the LEIE and the EPLS to 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 9 
   
   
confirm this.  The remaining two MACs reported that they do not check 
the LEIE but do check the EPLS.37   
The two MACs that reported that they checked only the EPLSnot the 
LEIEcould inadvertently enroll providers with excluded owners.  
Although the EPLS includes information from the LEIE on excluded 
individuals and entities, there is a delay between when that information is 
posted to the LEIE and when it is uploaded to the EPLS.  If a MAC 
searches the EPLS during that delay, the EPLS will be less current than 
the LEIE. 
   
                        ____________________________________________________________ 
37 CMS conducts automatic checks of providers in PECOS against its Medicare 
Exclusion Database (MED) on a monthly basis.  The MED is similar to the LEIE, but the 
MED contains more personally identifiable information.   
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 10 
   
   
CONCLUSION AND RECOMMENDATIONS 
CMS can prevent inappropriate payments, protect beneficiaries, and 
reduce time-consuming and expensive pay and chase activities by 
ensuring that providers that intend to engage in fraudulent or abusive 
activities are not allowed to enroll in Medicare.  For CMS to identify 
potentially fraudulent providers, as well as those that may be associated 
with excluded individuals or entities, providers must disclose accurate and 
timely information about their owners. 
However, very few providers in our review had owner names that matched 
across all three program sourcesi.e., CMS, OIG, and State Medicaid 
programs.  The prevalence of nonmatching owner names raises concerns 
about the completeness and accuracy of information about Medicare 
providers ownership.  Further, the matching of owner names across two 
or more sources does not mean that ownership information is complete 
and accurate because providers could have submitted information that was 
incomplete and/or inaccuratebut that matchedto CMS, OIG, and State 
Medicaid programs.  Additionally, we found that 2 of 11 MACs did not 
comply with the requirement to check both the LEIE and EPLS to confirm 
that individuals or entities that providers disclosed as owners were not 
excluded.   
Taken together, these findings reveal vulnerabilities that could allow 
potentially fraudulent providers to enroll in the Medicare program and 
limit CMSs ability to provide adequate oversight.  Therefore, we 
recommend that CMS: 
Review providers that submitted nonmatching owner names 
and take appropriate action 
In a separate memorandum, we will refer to CMS the 85 providers that 
had owner names on record with CMS that did not match those submitted 
to OIG.  CMS and/or its contractors should review these providers 
enrollment records in PECOS.  After this review, CMS should determine 
and take an appropriate course of action. 
Educate providers on the requirement to report changes of 
ownership 
CMS should educate providers on the requirement to report changes of 
ownership to CMS within 30 days and the actions it may take if providers 
do not comply with this requirement.  CMS could communicate this 
information to providers through the Medicare Learning Network or could 
instruct the MACs to conduct outreach and education on this issue.   
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 11 
   
   
Increase coordination with State Medicaid programs on the 
collection and verification of provider ownership information 
in Medicare and Medicaid 
CMS should coordinate with State Medicaid programs on the collection 
and verification of ownership information for providers enrolling or 
enrolled in Medicare and Medicaid.  For example, CMS could encourage 
State Medicaid programs to use their access to PECOS when verifying 
provider ownership information and to notify MACs when nonmatching 
information is identified.  State Medicaid programs and MACs could then 
collaborate to determine why provider ownership information does not 
match and address the issue. 
In the longer term, CMS should consider working toward consolidating 
into one centralized system the ownership information for providers 
enrolling or enrolled in Medicare and/or Medicaid.  This would make 
processes more efficient by reducing the burden on providers and 
streamlining the enrollment processproviders would no longer have to 
separately disclose ownership information both to CMS and to their 
respective States Medicaid programs. 
Ensure that its contractors check exclusions databases as 
required 
CMS should ensure that all MACsas part of their respective Medicare 
provider enrollment processescheck the LEIE and EPLS, as required, to 
confirm that individuals and entities that providers disclosed as owners are 
not excluded.  The checking of exclusions databases is an important 
safeguard that helps ensure that excluded individuals and entities are kept 
out of the Medicare program.  CMS could ensure that MACs conduct 
these required checks as part of its performance evaluations of MACs 
and/or through some other process (e.g., by requiring MACs to attest that 
they conduct the exclusions checks).   
In the aforementioned referral memorandum, we will refer to CMS the 
two contractors that reported not checking the LEIE.   
 
 
 
 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 12 
   
   
AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 
RESPONSE 
CMS concurred with all four of our recommendations.  In its comments, 
CMS stated that it is strongly committed to Medicare program integrity 
efforts and is continuously working to enhance the process for provider 
enrollment and screening.  CMS stated that since 2011, when it finalized 
regulations to require the revalidation of Medicare providers, it has taken 
several actions to address this requirement.  For example, CMS 
deactivated billing privileges for more than 543,000 providers and 
suppliers as a result of revalidation and screening efforts.   
CMS stated that it will implement a number of actions to address OIGs 
recommendations.  For example, CMS will review the list of providers 
and suppliers that OIG identified as having owner names on record with 
CMS that did not match those submitted to OIG.  CMS will develop 
educational materials for providers and suppliers and work with States and 
other relevant stakeholders to enhance processes for collecting and 
verifying provider ownership information.  CMS also stated that it has 
already taken action to address our fourth recommendation.  OIG provided 
preliminary information to CMS regarding the two contractors that 
reported checking one but not both of the required exclusions databases.  
CMS followed up with these two contractors, and the contractors attested 
to checking these exclusions databases.  The two contractors stated that 
that they had mistakenly provided incorrect information to OIG.  
The full text of CMSs comments is provided in Appendix B.  We did not 
make changes to the report based on CMSs comments.  
 
 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 13 
   
   
APPENDIX A 
Detailed Methodology 
    
Provider Selection 
We selected a random sample of 170 providers that were enrolled in 
Medicare and/or Medicaid as of January 1, 2012, in specific provider 
types.38  We designed the sample such that the results of our review would 
be projectable.  However, as our data analysis progressed, it became clear 
that providers enrolled in two State Medicaid programs were 
overrepresented in the population because duplicate providers had not 
been removed before we selected our sample.39 
We selected the 170 providers using 2 population files in such a way that 
30 providers were enrolled in Medicare, 30 providers were enrolled in 
Medicaid, and 110 providers were enrolled in Medicare and Medicaid.   
  The first population file consisted of 34,984 records for providers 
enrolled in Medicare as of January 1, 2012, in our specified provider 
types.  To create this file, we extracted identification and contact 
information from PECOS.40  In particular, for each provider, we 
collected the name, provider type, address, phone number, national 
provider identifier (NPI), and tax identification number (TIN).  We 
then selected from this file 30 records that were associated with 
30 distinct providers enrolled in Medicare. 
  The second population file consisted of 35,394 providers enrolled in 
Medicaid as of January 1, 2012, in our specified provider types.  To 
create this file, we requested and received identification and contact 
information from each of the 52 State Medicaid programs on 
individual and nonindividual providers, including those in our 
specified provider types, enrolled as of January 1, 2012.41  In 
particular, for each provider, we requested the name, provider type, 
                        ____________________________________________________________ 
38 Provider types in our review are ambulatory surgical centers, ambulance services, 
independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 
health agencies, hospices, and renal disease facilities. 
39 To project the results of our analysis, we would have needed to remove duplicate 
providers from the population, sample providers again, and collect ownership information 
again.  Because we did not identify this duplication until our data were collected, we did 
not do this because of the time and resources it would require.  Therefore, we do not 
make projections in this report. 
40 We used a snapshot of PECOS to ensure that this population file consisted of providers 
enrolled in Medicare as of January 1, 2012. 
41 The 52 State Medicaid programs consist of all 50 States, the District of Columbia, and 
Puerto Rico.  We requested information on individual providers for separate OIG 
evaluations. 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  14   
   
address, phone number, Medicaid provider identification number, NPI, 
TIN, Social Security number (SSN), and State license number.  To 
compile this file, we combined information received from each 
Medicaid program and created a separate record for each unique 
combinationby Medicaid programof Medicaid provider 
identification number, NPI, TIN, SSN, and State license number.  
Once we had compiled this information, we limited the file to our 
specified nonindividual provider types, thus reducing it from 
2.86 million to 35,394 providers.  From this subset, we selected 
140 providers enrolled in Medicaid, of which at least 110 appeared to 
also be enrolled in Medicare. 
Collection of Provider Ownership Information 
We collected three sets of current (i.e., as of the date of our data 
collection) owner names and other information:  (1) those on record with 
CMS for Medicare enrollment purposes, (2) those submitted by providers 
directly to OIG for this evaluation, and (3) those on record with State 
Medicaid programs for Medicaid enrollment purposes. 
We first collected owner names directly from selected providers.  From 
November 2013 to January 2014, we sent electronic questionnaires to the 
170 selected providers and requested ownership information (e.g., owner 
names, dates each owners ownership took effect, TINs, and SSNs) as of 
the date the provider received the questionnaire.  We sent up to two 
written requests by mail and attempted to contact nonresponding providers 
by telephone and email, if this information was available.  We received 
responses from 119 providers and did not receive responses from 
29 providers.  The remaining 22 providers were considered ineligible 
because they did not meet our selection criteria regarding provider type 
and/or enrollment timeframe. 
As part of the questionnaire, we also asked providers whether they were 
enrolled in Medicare and/or Medicaid.  If providers indicated that they 
were not enrolled in one or both programs, we no longer classified them as 
being enrolled in the program(s).  Of the 119 responding providers, 
113 indicated they were enrolled in Medicare.  Further, 100 of the 
113 providers also indicated that they were enrolled in Medicaid.  
Next, we collected owner names on record with CMS for Medicare 
enrollment purposes.  From December 2013 to April 2014, we extracted 
ownership information (e.g., owner names, ownership roles) from PECOS 
for selected providers. 
Finally, we collected owner names on record with State Medicaid 
programs for Medicaid enrollment purposes.  From December 2013 to 
February 2014, we collected ownership information for selected providers 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  15   
   
from State Medicaid programs.  State Medicaid programs provided 
electronic and hardcopy documents showing ownership disclosures, as 
well as extracts from ownership-disclosure databases.  We received 
information from State Medicaid programs for 71 of the 100 providers 
enrolled in Medicare and Medicaid. 
Analysis of Provider Ownership Information 
We conducted two comparisons of the three sets of owner namesthose 
on record with CMS, those submitted by providers to OIG, and those on 
record with State Medicaid programs.  Each comparison involved 
(1) confirming that information being compared was for the same provider 
and (2) evaluating the similarity of owner names. 
Comparison of Ownership Information on Record With CMS and 
Ownership Information Submitted to OIG.  The first comparison 
determined the extent to which owner names on record with CMS for 
Medicare enrollment purposes matched those submitted to OIG for this 
evaluation.   
We first manually compared each providers NPI, TIN, and/or name and 
address in the information on record with CMS to those submitted to OIG.  
We confirmed that 110 of the 113 providers were the same.  We removed 
the remaining three providers from our analysis because we were unable 
to confirm that the CMS records and the OIG records were for the same 
provider. 
Next, we compared owner names on record with CMS to those that the  
110 providers submitted to OIG.  We identified names that matched, 
meaning that the name was on record with CMS and submitted to OIG.  
We also identified names that did not match, meaning that the name was 
on record with CMS but not submitted to OIG or vice versaand called 
these names nonmatching.  When we compared names, if we found 
owner names that were not identical but were reasonably similar, we 
considered the names to match.  For example, if owner names were not 
identical but were reasonably similar (e.g., James Harris and 
Jim Harris), we considered the names to match.  See Figure 1 for an 
illustration of a provider that had two names that matched as well as both 
types of nonmatching names. 
   
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  16   
   
Figure 1:  Illustration of Providers Owner Names That Did and Did Not 
Match 
Name Submitted by  Name Submitted by 
Match Versus Nonmatch 
Provider to CMS  Provider to OIG  
James Harris  Jim Harris  Match 
Jane Smith  Jane Smith  Match 
Business A    Nonmatch 
  Company B  Nonmatch 
Note:  Blanks illustrate that the individual or entitys name was not on record with CMS or not submitted to 
OIG.  
 
Additionally, we completed two analyses on owner names submitted to 
OIG that were not on record with CMS.  First, we analyzed the dates on 
which these owners ownership took effect to determine whether the dates 
fell within the 30-day window during which providers are required to 
notify CMS of such changes.  If dates fell within this window, providers 
still had time to notify CMS of the change.  In January 2015, 
approximately 1 year after providers submitted owner names to us for this 
evaluation, we collected and reviewed the updated owner names in 
PECOS for these providers to determine whether the providers had 
notified CMS of their ownership changes.  Second, we searched the LEIE 
and EPLS for owner names submitted to OIG that had not been submitted 
to CMS to determine whether these individuals or entities were excluded.  
Because these names were not in CMSs ownership information, CMS 
could not have previously searched for them in exclusions databases.  We 
did not find any of these names in the LEIE or EPLS at the time of our 
review. 
Comparison of Ownership Information on Record With CMS and 
Ownership Information on Record With State Medicaid Programs.  The 
second comparison determined the extent to which owner names on record 
with CMS for Medicare enrollment purposes matched those on record 
with State Medicaid programs for Medicaid enrollment purposes.   
We manually compared each providers NPI, TIN, and/or name and 
address in the information on record with CMS to those on record with 
State Medicaid programs.  We confirmed that 58 of these 71 providers 
were the same.  We removed the remaining 13 providers from our analysis 
because we were unable to confirm that the records from CMS and the 
records from the State Medicaid programs were for the same providers. 
Next, we compared owner names on record with CMS and State Medicaid 
programs for each of the 58 providers.  For our comparison of these owner 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  17   
   
names, we used the same methodology as for our comparison of owner 
names on record with CMS and owner names submitted to OIG.  
MAC Electronic Questionnaire 
In August 2012, we sent an electronic questionnaire to the 11 MACs that 
were operational at the time of our data collection.  The electronic 
questionnaire collected information on how each MAC collects and 
processes ownership information disclosed by providers.  We received 
responses to all applicable questions from each MAC by October 2012.  
We reviewed and analyzed responses to determine whether each MAC 
compared ownership information that providers disclosed to the two 
exclusions databasesi.e., the LEIE and EPLSthat MACs are required 
to check as part of the Medicare enrollment process. 
 
   
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  18   
   
APPENDIX B 
    Agency Comments 
 
 
 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  19   
   
 
 
 
 
 
 
 
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  20   
   
ACKNOWLEDGMENTS 
This report was prepared under the direction of Dwayne Grant, Regional 
Inspector General for Evaluation and Inspections in the Atlanta regional 
office, and Jaime Stewart, Deputy Regional Inspector General.  
Rachel Bessette served as the lead analyst for this study.  Other Office of 
Evaluation and Inspections staff from the Atlanta regional office who 
conducted the study include David Samchok and Janna Sayer.  Central 
office staff who provided support include Clarence Arnold; 
Eddie Baker, Jr.; Scott Horning; Kevin Manley; Scott Manley; and 
Christine Moritz.  
We would also like to acknowledge the contributions of other Office of 
Evaluation and Inspections regional office staff, including 
Deborah Cosimo and Vincent Greiber.   
Medicare:  Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591)  21   
Office of Inspector General
http://oig.hhs.gov  
 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as  
amended, is  to protect the integrity of the Department of  Health and Human Services  
(HHS) programs, as  well  as the health  and welfare of individuals served by those programs.  
This statutory mission is carried  out through a nationwide network of audits, investigations,  
and inspections conducted by the following operating components: 
Office of Audit Services 
The Office  of  Audit Services  (OAS) provides auditing services  for HHS, either by  conducting  
audits  with its own audit resources or by  overseeing  audit work done by others.  Audits  
examine the performance of HHS programs and/or its grantees and contractors in carrying  
out their respective responsibilities and are intended  to provide independent assessments of 
HHS programs and operations.  These assessments help reduce waste, abuse, and  
mismanagement and promote economy and efficiency  throughout  HHS. 
Office of Evaluation and Inspections 
The Office  of  Evaluation and Inspections (OEI)  conducts national evaluations to  provide 
HHS, Congress, and the public with timely, useful, and reliable information on significant 
issues.  These evaluations focus on preventing fraud,  waste, or abuse  and promoting  
economy, efficiency, and effectiveness of departmental programs.  To promote impact, OEI 
reports also present practical recommendations for improving program operations.  
Office of Investigations 
The Office of Investigations (OI) conducts criminal, civil, and administrative investigations  
of fraud and misconduct  related to HHS programs, operations, and individuals.  With  
investigators working in all 50 States and the District of Columbia, OI  utilizes its resources 
by actively  coordinating with the Department  of Justice  and other Federal, State, and local 
law enforcement authorities.  The investigative efforts of OI often lead to  criminal 
convictions, administrative sanctions,  and/or  civil monetary  penalties.  
Office of Counsel to the Inspector General 
The Office of Counsel to the  Inspector  General (OCIG) provides general legal services to 
OIG, rendering  advice and opinions on HHS programs and operations and  providing all  
legal support for OIGs  internal operations.  OCIG represents  OIG in all civil and 
administrative fraud and  abuse cases involving HHS programs, including False Claims Act, 
program exclusion, and civil monetary penalty cases.  In  connection with these cases, OCIG 
also negotiates and monitors corporate integrity agreements.  OCIG renders advisory 
opinions, issues compliance program  guidance, publishes fraud alerts, and provides other  
guidance  to  the health care industry concerning the anti-kickback statute and other  OIG  
enforcement authorities.