Testimony of Robert A. Vito 
Regional Inspector General for Evaluation and Inspections 
Office of Inspector General 
U.S. Department of Health and Human Services 
 
 
 
Medicare Contractors Efforts to Fight Fraud  Moving Beyond 
Pay and Chase 
 
 
 
Before the 
House Energy and Commerce Committee: 
Subcommittee on Oversight and Investigations 
 
 
 
June 8, 2012 
Rayburn House Office Building  
Room 2123 
 
 
 
 
   
 
Testimony of: 
Robert A. Vito 
Regional Inspector General for Evaluation and Inspections 
Office of Inspector General 
U.S. Department of Health and Human Services 
 
 
 
Good morning Chairman Stearns, Ranking Member DeGette, and other distinguished Members 
of the Subcommittee.  I am Robert Vito, Regional Inspector General for Evaluation and 
Inspections at the U.S. Department of Health and Human Services (HHS), Office of Inspector 
General (OIG).  Thank you for the opportunity to testify about OIGs work on the fraud 
detection efforts of the Medicare benefit integrity contractors.   
 
On June 28, 2001, OIG testified before this Subcommittee on performance problems that we had 
found in the fraud detection units at Medicare claims processing contractors.  These problems 
included a lack of proactive case development, limited identification of program vulnerabilities, 
significant variation in the level of benefit integrity results across contractors, and a lack of 
uniformity and understanding of key fraud terms and definitions across contractors.  A decade 
later, many of these same vulnerabilities regarding fraud detection and preventions persist among 
the current benefit integrity contractors. 
 
THE TYPES OF MEDICARE BENEFIT INTEGRITY CONTRACTORS HAVE CHANGED BUT SIMILAR 
PROBLEMS PERSIST 
 
Types of Benefit Integrity Contractors 
For more than a decade, OIG has been conducting reviews of the benefit integrity contractors 
that the Centers for Medicare & Medicaid Services (CMS) employs to reduce Medicare fraud, 
waste, and abuse.  OIG began more than 15 years ago reviewing the anti-fraud and abuse 
activities conducted by the fraud units housed in the Medicare fiscal intermediaries and carriers.   
 
In 1999, CMS began contracting with new entities called Program Safeguard Contactors (PSC) 
to detect and deter fraud in Medicare Parts A and B.1  As a result of Medicare contracting reform 
required by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, 
CMS is currently replacing PSCs with Zone Program Integrity Contractors (ZPIC).2   
                                                           
1 Through the years, some PSCs were given responsibility for both Parts A and B while others only Part A or Part B. 
2 With ZPICs, CMS intended to align all benefits in the Part A and B programs (including home health, hospice, and 
durable medical equipment) under a single ZPIC in each of seven geographic zones. 
2  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
   
 
With the inception of the Part D program, CMS contracted with Medicare Drug Integrity 
Contactors (MEDIC) to address potential fraud and abuse related to the Part D prescription drug 
benefit.  In fiscal year 2007, CMS awarded contracts to three regional MEDICs.  Since that time, 
all Part D benefit integrity activities have been assigned to a single MEDIC.  This MEDIC also 
now has responsibility for detecting fraud in the entire Part C (i.e., Medicare Advantage) 
program. 
 
Activities Performed by Benefit Integrity Contractors 
CMSs benefit integrity contractors are generally tasked with: 
 
  Proactively pursuing different sources and techniques for analyzing data to detect fraud. 
  Conducting investigations to determine the facts and magnitude of alleged fraud and 
abuse cases. 
  Referring cases of potential fraud to OIG or other law enforcement agencies. 
  Assisting law enforcement by responding to requests for information. 
  Identifying and reporting to CMS any systemic program vulnerabilities. 
  Referring for collection any Medicare improper payments (i.e., overpayments) identified 
while conducting benefit integrity activities. 
 
Problems Persist Regarding Benefit Integrity Contractors Performance  
Over the last 10 years there have been significant changes in both the number and types of 
contractors that CMS employs to protect Medicare from fraud, waste, and abuse.  OIG reviews 
of these contractors have uncovered the following recurring issues that hinder the successful 
performance and oversight of the contractors, including:  
  Limited results from proactive data analysis. 
  Difficulties in obtaining the data needed to detect fraud. 
  Inaccurate and inconsistent data reported by benefit integrity contractors. 
  Limited use by CMS of contractor-reported fraud and abuse activity data in evaluating 
contractor performance and investigating variability across contractors. 
  Lack of program vulnerability identification and resolution. 
In addition, there is significant variance in the identification of overpayments among PSCs and 
only a small percentage of the overpayments referred by PSCs have been collected and returned 
to the Medicare program. 
BENEFIT INTEGRITY CONTRACTORS HAVE HAD LIMITED FRAUD DETECTION RESULTS FROM 
PROACTIVE METHODS 
3  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
  Proactive data analysis has not represented a significant portion of benefit integrity contractors 
activities.  Instead, much of the benefit integrity contractors fraud identification relies on 
reactive methods, such as complaints from external sources.  The lack of proactive and early 
identification of fraud results in the Medicare program relying on the familiar pay and chase 
model rather than a risk reduction model that includes early detection and prevention of 
inappropriate payments. 
As early as 1996, OIG began highlighting the limited nature of benefit integrity contractors 
proactive approaches.  In our first evaluations of the fiscal intermediary and carrier fraud units, 
OIG raised concerns about the lack of results from proactive methods.3  In the case of fiscal 
intermediaries, half of the fraud units did not open any cases proactively.  
PSCs were supposed to use innovative, proactive data analysis more than their predecessors, the 
claims processing fraud units.  Yet, in OIGs review of PSCs in 2007, OIG found minimal results 
from proactive data analysis.4  Thirteen of the 17 PSCs had less than 19 percent of their new 
investigations result from proactive data analysis.  Two of these had no new investigations from 
proactive analysis.   
As CMS has transitioned from PSCs to ZPICs, OIG has found that data provided to CMS by 
ZPICs about their fraud and abuse activities were not always accurate or uniform across 
contractors.5  However, the two ZPICs reported an average of only 7 percent of new 
investigations coming from proactive methods.   
Similarly in Medicare Part D, OIG has found that most incidents of potential fraud identified by 
the MEDICs came from external sources rather than proactive methods.  OIG found that only   
13 percent of Part D potential fraud incidents were identified through proactive methods.6 
DIFFICULTIES IN ACCESSING DATA HAVE HINDERED BENEFIT INTEGRITY CONTRACTORS 
ACTIVITIES 
The current ZPICs and MEDICs lack of access to Medicare claims data and, in the case of the 
MEDICs, medical records and prescriptions, has hindered or delayed their ability to fight fraud. 
ZPICs reported that the lack of data access hindered their ability to identify potential fraud and 
abuse, respond to law enforcement requests for information, and track overpayment collections.  
At the start of their contracts, ZPICs had difficulties obtaining data.  One ZPIC described 
                                                           
3 OIG, Carrier Fraud Units (OEI-05-94-00470), November 1996 and Fiscal Intermediary Fraud Units 
 (OEI-03-97-00350), November 1998. 
4 OIG, Medicares Program Safeguard Contractors:  Activities to Detect and Deter Fraud and Abuse  
(OEI-03-06-00010), July 2007. 
5 OIG, Zone Program Integrity Contractors Data Issues Hinder Effective Oversight (OEI-03-09-00520), 
 November 2011. 
6 OIG, Medicare Drug Integrity Contractors Identification of Potential Part D Fraud and Abuse 
 (OEI-03-08-00420), October 2009 
4  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
  difficulties obtaining claims data from a previous PSC and, therefore, decided to purchase the 
claims data on its own from another CMS contractor.  Another ZPIC stated that the data 
necessary to fulfill requests for information were not available to them or had to be generated 
from multiple sources. 
ZPICs reported that improved data access would assist them in identifying potential fraud and 
abuse.  Specifically, ZPICs indicated that having access to daily downloads of Medicare claims 
data would enable them to perform near-real-time analysis of provider and supplier billing 
activity.  
Early problems with accessing and using data also hindered MEDICs ability to identify and 
investigate potential fraud and abuse.  MEDICs reported that they need both Part D prescription 
drug event (PDE) data and Medicare Part B data to effectively identify and investigate instances 
of potential Part D fraud and abuse.  However, CMS did not provide MEDICs with access to 
PDE data until August 2007, nearly a year after their contracts began.  In addition, two MEDICs 
were not given access to Part B data until Fall 20082 years after their contracts began.  Once 
they received access to PDE data, MEDICs reported that important variables were missing from 
the datasets or entered into incorrect data fields, making effective data analysis difficult.   
Further, MEDICs lack of authority to obtain information directly from pharmacies, pharmacy 
benefit managers, and physicians hindered their ability to investigate potential fraud and abuse 
incidents.  MEDICs reported that because CMS contracts with plan sponsors, MEDICs have the 
authority to request information only from plan sponsors.  Providing MEDICs with the authority 
to request information directly from providers and pharmacy benefit managers that provide Part 
D services could improve the efficiency and effectiveness of their fraud detection efforts. 
OVERSIGHT OF CONTRACTOR PERFORMANCE IS LIMITED BY INACCURATE AND INCONSISTENT 
DATA AND BECAUSE CMS DOES NOT EVALUATE THE CAUSES OF VARIATION ACROSS 
CONTRACTORS 
Inaccuracies and Inconsistencies in Contractor Performance Data Limit the Datas 
Usefulness 
Benefit integrity contractors are required to report workload statistics related to their program 
integrity activities, including investigations and case referrals, periodically to CMS.  However, 
OIG found that workload data used by CMS to oversee ZPICs were not accurate or uniform. 
This prevented OIG from making a conclusive assessment of their activities.7   
                                                           
7 The lack of uniformity in ZPICs reporting of data is similar to problems that OIG identified 15 years ago in its 
review of fiscal intermediary fraud units.  In that review, OIG found that definitions of key fraud and abuse terms 
varied among CMS and its contractors, which hindered CMSs ability to interpret data and measure fraud unit 
performance.  
5  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
  The inaccuracies and the lack of uniformity in ZPIC data resulted from data system issues, ZPIC 
reporting errors, and ZPICs differing interpretations of fraud terms and definitions.  For 
example, the ZPICs counted and reported new investigations differently from each other in the 
workload statistics provided to CMS.  Specifically, one ZPIC explained that it included all fraud 
complaints in its number of new investigations reported to CMS, regardless of whether those 
complaints were merged into one provider investigation.  However, another ZPIC explained that 
if it received a complaint on a particular provider and started an investigation and then received 
another complaint on that provider, the subsequent complaint would not be counted as a new 
investigation in the workload statistics.  This inconsistency could explain why one ZPIC reported 
seven times more investigations originating from external sources (e.g., complaints) than the 
other.   
OIG has offered a number of recommendations to CMS about collecting a greater volume of 
benefit integrity results data, clarifying definitions of fraud terms and data definitions, and 
ensuring the validity and uniformity of this data.  While CMS now requires benefit integrity 
contractors to report additional quantitative statistics, CMS still has not developed methods to 
ensure that all data provided by benefit integrity contractors is accurate and uniform. 
CMS has not Assessed Differences in Performance Across Integrity Contractors 
While one would expect that contractors would differ somewhat from one another in activity 
levels, OIG found significant differences in fraud detection activities across ZPICs (and in earlier 
work, across PSCs and fraud units).  This variation could not always be explained by the size of 
the contractors budget or oversight responsibility.  
CMS has not systematically assessed the wide variation across contractors activity data.  In fact, 
CMSs contractor performance evaluations provide very few quantitative details about the 
contractors achievements in detecting and deterring fraud and abuse.8    
OIG has recommended that CMS perform more global assessments of performance across 
contractors; however, CMS has not performed these types of reviews.  OIG continues to 
recommend that CMS review quantitative statistics across contractors to ensure that outlier data 
are investigated and to address the causes behind the variation in contractors fraud detection 
levels. 
BENEFIT INTEGRITY CONTRACTORS ARE REQUIRED TO REPORT MEDICARE PROGRAM 
VULNERABILITIES TO CMS BUT MANY REMAIN UNRESOLVED 
Medicare benefit integrity contractors are required to help prevent fraud, waste, and abuse by 
identifying systemic vulnerabilities in the Medicare program.  However, OIG has found that 
                                                           
8OIG, Medicares Program Safeguard Contractors:  Performance Evaluation Reports (OEI-03-04-00050), March 
2006. 
6  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
  some contractors are not reporting any program vulnerabilities to CMS.  CMS defines program 
vulnerabilities as fraud, waste, or abuse identified through the analysis of Medicare data.  Our 
early review of fraud units found that more than one-third of them had not identified any 
program vulnerabilities.  In 2009, almost half of the benefit integrity contractors reviewed did 
not report any program vulnerabilities to CMS.  The remaining PSCs, ZPICs, and MEDICs 
reported a total of 62 program vulnerabilities to CMS in 2009. 9  Further, although PSCs and 
ZPICs are required to report the monetary impact of vulnerabilities, these contractors reported 
impact for only 21 of the vulnerabilities.  For the 21 vulnerabilities alone, the estimated 
monetary impact was $1.2 billion.  
As of January 2011, CMS had not resolved or taken significant action on three-fourths of the 62 
vulnerabilities reported in 2009.  CMS took significant action to resolve 14 of the vulnerabilities, 
but only 2 of these had been fully resolved.  OIG found that CMS lacked procedures to 
adequately track vulnerabilities and ensure that corrective actions are taken to resolve reported 
vulnerabilities. 
OVERPAYMENTS THAT BENEFIT INTEGRITY CONTRACTORS IDENTIFIED FOR COLLECTION DID 
NOT RESULT IN SIGNIFICANT MEDICARE RECOVERIES  
Benefit integrity contractors that are responsible for Medicare Parts A and B, i.e., the PSCs and 
ZPICs, are required to refer overpayments that they identify to the Medicare claims processors 
for collection.  In response to a request from this Subcommittee, OIG issued a series of reports in 
2010 concerning the identification and collection of Medicare overpayments referred by the 
PSCs for collection.10  OIG found that only a very small percentage of overpayments that PSCs 
referred for collection was actually collected and returned to the Medicare program. 
PSCs referred $835 million in overpayments to claim processors for collection in 2007.  Similar 
to the variation found among benefit integrity contractors fraud detection efforts, we found 
PSCs differed substantially in the amount of overpayments they referred for collection.  Only 
two PSCs were responsible for 62 percent of the $835 million referred for collection by all PSCs.   
Of the $835 million referred, only 7 percent, or $55 million, was collected by June 2008.  The 
collection status for another 8 percent, or $64 million, could not be determined.  For one out of 
every four overpayments referred by the PSCs, the claims processors reported that they did not 
receive the referrals or did not have any collection information.   
ADDITIONAL CORRECTIVE ACTIONS ARE NEEDED TO ADDRESS PROBLEMS 
                                                           
9 OIG, Addressing Vulnerabilities Reported by Medicare Benefit Integrity Contractors (OEI-03-10-00500), 
December 2011. 
10 OIG, Medicare Overpayments Identified by Program Safeguard Contractors (OEI-03-08-00031) and Collection 
Status of Medicare Overpayments Identified by Program Safeguard Contractors (OEI-03-08-00030) and Collection 
Rate for Overpayments Made to Medicare Suppliers in South Florida (OEI-03-09 00570), May 2010. 
7  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
  OIG has recommended a number of corrective actions to address issues identified during our 
benefit integrity program reviews.  CMS has implemented a number of these actions, but OIG 
continues to recommend the following additional actions to improve benefit integrity 
contractors performance.  
Oversee Proactive Identification of Fraud.   If CMS expects ZPICs and MEDICs to continue 
to use proactive methods, CMS must ensure that this is being done effectively at each contactor.   
Provide Timely Data Access.  CMS must ensure that all contractors receive timely access to 
data especially during times of contractor transition. With regard to MEDICs ability to directly 
access medical records and prescriptions, CMS should seek the authority to request medical 
records and information directly from the providers and pharmacy benefit managers that provide 
services for Part C Medicare Advantage and Part D prescription drug plans. 
Improve Accuracy of Contractor-Reported Fraud Activity Data.  CMS must develop 
methods to ensure that all data provided by benefit integrity contractors is accurate and uniform. 
CMS also needs to clearly define fraud and abuse terms that all contractor should use when 
reporting data.   
Assess Variability in Performance Across Contractors.  CMS should include more 
quantitative results in benefit integrity contractors performance evaluations.  Using both 
quantitative and qualitative data to describe achievements would provide a more comprehensive 
picture of contractor performance and provide CMS with valuable data for making contract 
renewal decisions.  It would also allow CMS to conduct a more global assessment of 
performance across contractors.  If uniform, quantitative results were included across 
contractors, CMS could investigate the causes of the significant variability of activity across 
contractors and the especially low volume of activity among certain contractors.  
Ensure Program Vulnerability Identification and Resolution.  To gain sufficient oversight of 
program vulnerabilities and reduce the risks to Medicare, CMS must have effective policies and 
procedures to (1) track vulnerabilities identified by all benefit integrity contractors, (2) ensure 
that all contractors are identifying and reporting vulnerabilities, and (3) ensure the prompt 
resolution of vulnerabilities. 
Improve Overpayment Identification and Collection. CMS should develop effective 
procedures to ensure that PSCs, ZPICs, and claims processors are able to identify and track the 
collection status of all current and future overpayment referrals by benefit integrity contractors.   
CMS is responsible for ensuring that PSCs and ZPICs perform their overpayment identification 
effectively.  To accomplish this, CMS must have complete and accurate information about 
overpayment referrals and the collection status of these referrals.   
 
8  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012 
   
OIG WILL CONTINUE REVIEWING MEDICARE BENEFIT INTEGRITY ISSUES 
With over $500 billion in Medicare benefit payments at risk each year, it is essential that all 
Medicare fraud-fighting partners do their utmost to ensure that fraud risks are minimized and 
program vulnerabilities are identified early and resolved quickly.    
CMS is just beginning to employ its new twin pillars strategy for program integrity.  The first 
pillar is the Fraud Prevention System (FPS). The FPS will utilize new contractors to perform 
predictive analytics that identify suspicious or inappropriate claims prior to payment.  The 
second pillar is the Automated Provider Screening (APS) system, which identifies ineligible 
providers or suppliers prior to their enrollment or reenrollment. 
As OIG did with prior strategies, we will review CMSs new strategy to determine its impact on 
reducing fraud and abuse in the Medicare program.  OIG will begin reviews of the new 
enrollment procedures and the prepayment identification of inappropriate Medicare claims.   
OIG is also updating our previous work on MEDICs and will review how the current MEDIC 
has undertaken its new Part C fraud detection responsibilities.  OIG is continuing to conduct 
evaluations regarding overpayments and Medicare debt collection.  We are also conducting 
reviews to examine the activities of the Medicare Administrative Contractors and Recovery 
Audit Contractors.   
Thank you for your support of OIGs mission and the opportunity to testify about benefit 
integrity contractors fraud detection activities.   
9  House Committee on Energy and Commerce 
Subcommittee on Oversight and Investigations 
June 8, 2012