Depktment  of Health and Human Services 

OFFICE OF 

INSPECTOR  GENERAL 

CARRIER  MAINTENANCE  OF 

MEDICARE  PROVIDER  NUMBERS 

Richard  P. Kusserow 
INSPECTOR GENERAL 
OEI-06-89-00870  .. 
EXECUTIVE  SUMMARY 
PURPOSE 
This report describesmaintenanceefforts by Medicare carriers to I) ensurethe accuracy of 
provider information and 2) identify and restrict payments to providers who have lost the legal 
authority to practice. 
BACKGROUND 
Medicare carriers assignprovider numhcrs to q&cd  providers of Part B sewices who furnish 
servicesor supplies to Medicare beneficiaries. The numbers arc usedfor processing both 
assignedand nonassignedclaims. Additionally,  the numbers are usedin establishing Medicare 
pricing and utikation  profiles.  If the provider of servicesdoes not have a provider number, 
payment may not bc madc.for services. To obtain a provider number from a caxzier,providers 
need to complete the carriers application form and  criteria specified by Medicare 
met 
mgulations. 
METHODOLOGY 
This inspection consisted of three phasesin addition to a review of relevant Health Care 
Fiiancing  Administration  (HCFA) policies and Medicare laws and discussionswith HCFA staff. 
Fit,  we contacted 38 car&s  to discussmabtcnance issues. Carriers completed mailout 
questionnaires followed by telephone or onsitc interviews.  Second,we mailed questionnairesto 
professional licensing authorities in each Statewhich am responsible for licensing physicians 
(121 respondents). Finally, we conducted computer matchesbetweencarriers and licensing 
authorities at four carriers to determine how well carriers deactivate numbers belonging to 
providers not legally authorized to pm&c.  The selection of the four carriers for computer 
matching was purposive. We s~lcctcdfour carriers in Stateswith large physician populations 
and whose professional licensing authority for physicians agrcui to produce a computer file of 
providers who wcrc no longer legally authorized to practice their profession. 
FINDINGS 
HCFA's &&on  to carriers is inadequate. 
> 	 We bciicve inadequate direction by HCFA hasrtsuitcd  in weaknessesin carrier controls to 
maintain the integrity of Medicam carrier provider numbers. We beiieve this constitutes a 
rnatmial internal control wcakncss within the meaning of the Federal Managers Fiiancial 
Integrity  Act and should be reported to the Sccrntary along with plans for corrective action. 
i  Weaknessesexist in canier  contds  to maintain Medkareprovider  numbers. 
>  Most cankrsdonot systematically updateprovider Eles. 
Communications benvetn carriers and professional licensing authorities are weak. 
> 
l 	 Many carriers do not haveadequatecontrols to identify and deactivate provider numbers 
belonging to providers who have lost the legal authority to practice. 
l 	 Many providers who have lost the legal authority to practice still have active provider 
numbers which they may use and, in somecasts, are using to bill Medicare services. 
> 	 Inaccurate or missing information in somecarrier ffies may hamper effective useof State 
Iicensing authority information. 
Improvemhs  through  various ruiminisbrrtivc actions orpmgrams  are possible. 
> 	 Carriers can reduce the number of active provider numbers,reduce Medicams 
vulnerability  to abuse,and saveadnk&mdve  costsby periodically deactivating provider 
numbers with no billing  history. 
> 	 Computer matching with licensing authorities could help many carriers identify providers 
not legally authorized to practice. 
Carrier efforts under HCFAs physician identification and registration program (UPIN) 
have improved the accuracyof provider number records of physicians. 
RECOMMENDATIONS 
The HCFA should require carriers to: 
>  update plwidcrrccoKls  pcliodically. 
l  deactivate aUprovider numberswithout current billing  history. 
l 	 estabiish adequatecontrols to ensureproviders not legaily authorized to practice are 
identified and their provider numbersdeactivated. As a part of thesecontrols, carriers 
should: 
negotiate with State licensing authorities to obtain license and registration 
information at a minimum cost to the Medicare program. 
ii  assessthe feasibility of computer matcheswith Statelicensing authorities and 
perform suchmatchesroutinely, if practicaL 
maintain the license or certification number of providers in its provider file. 
develop computer data entry edits for license numbersto ensureuniformity  and 
consistencywith the licensing authoritys method of recording license numbers. 
The HCFA should: 
> 	 evaluatecarrier provider number controls establishedaboveasa part of its regular carrier 
Contractor PerformanceEvaluation Program 
l  negotiate with Statelicensing authorities, which carriers report to be uncooperative,to 
obtain license and registration information at a minimum cost to the Medicare program. 
HCFA COMMENTS  AND OIG RESPONSE 
The HCFA acknowledgesthe needto improve its instructions to Medicare carriers regarding the 
maintenanceof provider numbers. However, HCFA doesnot concur with all OIG 
recommendations. Additionally, HCFA doesnot believe our fmdings constitute a material 
internal control weakness. 
The OIG continues to believe a material  internal  control  weakxess exists and 
each recommendationshould be implemented.  IdentQied weaknessesin carrier 
. 
maintenance  efforts and HCFAs direction  meet several of the criteria  upon 
which a materiai  weakness designation  is determined.  In accoraknce  with the 
Fe&&  Managers  Financial  Integrity  Act, the HCFA should  report this as a 
tnaterial  internal  con&  weakness through the SecreraTyto the President 
and Congress.  A detailed  discussion of the material  weakness riesignation  can 
be found  in Appendix B. (SeeAppendix B also for  a more complete discussion 
of HCFAs comments and the OIGs response. Appendix  C includes the@1  text 
of HCFAs comments.) 
. . . 
ul  TABLE  OF  CONTENTS 

EXECUTIVESUMMARY 

INTRODUCTION  .....................................................................................*................1 

................................................................................................................ 1 

Purpose 
Background .........................................................................................................1 

Methodology  ................................................................................................-......4 

FINDINGS  ................................................................................................................8.. 

HCFAs direction to cad&s  is inadequate .......................................................8. 

Weaknessesexist in cakier  contds  to main&in 

Medicam pmvidkr  numbers ................................................................................8 

Lack of f?le updating ...............................................................................8. 

Weak communication with State licensing authorities.............................9 

Inadequatecontrols to identify unautbrid  providczs.........................12 

UnauthM  providers with active numbers.........................................14 

In&curate or missing information in carrier records .....I......................15 

Improvements thmugh  va&ws  administrative actions 

orpmgmms  m  possible .................................................................................. 17 

Deactivating providers with no billing  history .......................................17 

Computer matching with Statelicensing authoxities.............................. 18 

Carrier efforts and UPIN .......................................................................2.0 

RECOMMENDATIONS  .......................................................................................2..2 
ENDNOTES .................................................................................................-..-.....---2.4 
 -- 
APPENDIX  A:  Carrier Survey Respondents........................................................ A-l 
APPENDIX  B:  Summary of HCFAs Commentsand OIGs Response.................B-l 
APPENDIX  C:  HCFA Commentsto the Draft Report..........................................C-l  INTRODUCiION 
PURPOSE 
This report describesmaintenanceefforts by Medicare carriers to 1) ensurethe accuracyof 
provider information and 2) identify and restrict paymentsto providers who have lost the legal 
authority to practice. 
Specific objectives were to: 
1)  describe how carriers maintain the accuracyof provider information, 
2) 	 determine whether Part B providers who lose legal authority to practice are identified by 
carriers, and 
3) 	 determine the feasibility of routine computer matchesbetweenState licensing authorities 
and carriers to identify providers having no legal author@ to practice. 
An upcoming report entitled Carrier Assignment of Medicare Provider Numbers, preparedin 
conjunction with this inspection, describesand assesseshow carriers assignprovider numbers. 
BACKGROUND 
Medicare is a Federal program authorized by title XVIII  of the Social Security Act (42 U.S.C. 
1395). The program pays for much of the health care costsfat eligible personsage 65 or older 
and certain individuals under 65 who are disabled or have chronic kidney disease. The Health 
CareFinancing Administration (HCFA) administers the program through a network of 
conuactors which processclaims, make payments,and provide various other servicesto 
beneficiaries and providers. 
Medicare consistsof two types of insurance,Part A and Part B. Part A covers servicesfurnished 
primarily  by hospitals, home health agencies,and skilled nursing facilities.  Medicare Part B 
typically coversphysicians care and various other medical servicesand supplies. Contractors 
under Part A am referred to asintermediaries;  those under Part B are called cambers. 
Under Part B, cIaims are assignedor nonassigned. If a claim is assigned,the provider submits it 
to the contractor for payment and agreesto acceptthe contractors determination of the allowed 
charge. The beneficiary remains responsible for any coinsurance,which is the percentageof the 
allowed charge for covered medical expensesa beneficiary pays, and the deductible, which is the 
covered medical expensesa benefichry  must pay before Medicare pays. If the claim is 
nonassigned,the provider is required to submit the claim to the contractor, which pays the 
btntfkary.  The beneficiary then pays the provider and is responsible for the coinsurance 
1  .  amount, any unmet deductible, noncoveredcharges,and any difference betweenthe providers 
actual charge (up to the maximum allowable actual charge)and the Medicare-allowed charge. 
Carrier  Prvvidkr  Numbers 
Under most  situations, carriers require providers of Medicare servicesto submit information 
sufficient for the carrier to assignthe provider a unique carrier identification number (hereafter 
referred to as a provider number). &ricrs  assignprovider numbersto qualified providers of 
Medicare Part B reimbursablesetices  or supplies.(SeeFigure 1.) 
FIGURE 1 
Provider  Types 
Physkians 
Doctors of Medicine  Doctors of Osteopathy  Dentists 
Chiropractors  optometrists Podiatrists 
-
Suppliers  and  Nonphysician  Pmctitlonen 
Physician Assistants  Certified Nurse Anesthetists  Nurse Midwives 
Xnical  Psychologists  Nurse Practitioners  Physical Therapists 
Jccupational  Therapists  Speech Therapists  Audiologists 
linical Social Workers  Durable Mediil  Equipment  Clinical Labs 
nbulatofy  Surgery  Centers  Rehabilitation  Centers  Ambulance 
agnostic  Testing Centers  Independent  Physiobgical  Labs 
kkr  numbersare usedfor processingboth assignedand nonassignedclaims. The number is 
.  . usedin establishing Medicaxepricing and utihition  profiles.  If the provider of services 
dti::; not have a provider number, payment may not be madefor services. To obtain a provider 
number tirn  a carrier, providers need to complete the carriers application form and meet 
critezia specified by Medicare regulations. 
Through the provider number application processand maintenancepractices,carriers must 
ensureproviders meet qualikadons  specified by Medicare. Federal laws and regulations 
governing the Medim  program acknowledge the Statesprimary role in regulating many 
prov ders. For example, the Medicare law requirescoveredphysician servicesbe renderedby 
licenxd  physi&ns  who are legally  authorized to practice (Social Security Act, Section 1861) 
by the State in which the servicesare rendered. 
Although qualifications for other Medicare provider types (Figure 1) may include Stateliccnsure 
or cetication,  someproviders are required to meet additional education, work experience,staff, 
or equipment needsin order to participate in the Medicare program (e.g., ambulancecompanies). 
Additionally,  someproviders require HCFA approval  However, this is not to say every provider 
type must meet specified criteria.  Someproviders, such asdurable medical equipment @ME) 
suppliers, generally do not have to meet any criteria except to possessa Social Security number 
or an employer identification number.  a.-
2  A provider may legitimately have more than one provider number. Somecarriers give a 
physician who practices in both a group and a so10practice a number for each. If a provider has 
a practice in more than one reasonablechargelocality, carriers may assignthe provider different 
numbersor mod&u-s to an existing number. Also, providers receive Werent  numbersor 
modifiers if practicing under different specialties.  . 
Groups or clinics composedof multiple physicians require special processing. Most carriers 
assigngroups or clinics a provider number. Additionally,  the cti(rr  must be able to identify 
eachphysician in the practice. Carriers accomplish this by assigning a number or modifier to 
each physician regardlessof any other number(s) the physician may have. In the group practice 
setting, the physician should list this number on the HCFA 1500claim form to show who 
performed the service. 
Federal  Interest  in Provider  Quaiifications 
The Federal governmentcontinues to show an interest in ensuring providers have adequate 
qualifications.  The Consolidated Omnibus Budget Reconciliation Act of 1985 mandateda 
registry of physicians and the useof a unique practitioner identifier number (UPIN) to prevent 
duplicate paymentsfor hospital-basedphysicians and interns under the Medicare program and to 
more accurately track federally sanctionedpractitioners. This registry is monitored by HCFA. 
Another database,the National Practitioner Data Bank, has beenfunded and recently began 
o-on  to monitor State licensed health practitioners. This data bank maintains records of all 
adverseactions (e.g., license revocation, malpractice) taken against medical providers and 
entitimafter  the opening of the databank. The databank was authorized by the Health Care 
Quw  Improvement Act of 1986 (P.L. 99460,  title IV) and the Medicare and Medicaid Patient 
and Program Protection Act of 1987 (P.L. 100-93, sectior~5).  This databankis monitored by the 
Public Health Service (PHS). 
These two databasesprovide the Federal governmentwith addedtools to monitor providers. 
However, the responsibility for ensuring Medicare providers meet licensing arid other 
requirements specified by StateandFederal law rests ultimately with catriers. 
State Licenszm  and Ce@ication 
Licensing and certifying providers axeprimarily  Statefunctions.  Individuals or entities must 
meet Statecriteria to obtain and maintain a license or cert%cation. The Statesare responsible 
for regulating the practice of those they have licensedor c&f&xi.  They PIEalso responsible for 
ensuring all providers meet standardsof professional competenceand personalintegrity 
considered necessaryto protect the public. 
The State license or ccrdficate demonstratesthe provider satisfiesthe Statesestablished 
standardsin such areasaseducation, experience,and ethics. Once licensed or certified, the 
provider must then comply with the Statesprescribedstandardsfor the practice of the profession 
and any other specified criteria for maintaining a license or certification.  Failure to meet these 
kquirements may result in the Statesuspendingor restricting the license or certificate to provide 
3 
 semices. When a provider losesthe legal authority to practice, no servicesof the provider art 
covered by Medicare. 
Prior OIG Study 
An audit (A-04-87-02011) of physicians by the Office of Inspector Generalin 1987 found 
managementcontrols at the Florida carrier were inadequateto prevent continued participation by 
and reimbursementto physicians who had lost their authority to practice asa result of State 
actions. Becauseof this inadequacy.the Medicare carrier and Stak agencyallowed chargesin 
excessof $15.8 million  to 463 physicians who continued to practice afkr  losing legal authority 
to practice. Further, an additional 789 physiciansmaintained Medicare and/or Medicaid 
provider numbers under which they could havepotentially billed the programsafter losing legal 
authority to pm&cc. 
METHODOLOGY 
This inspection con&cd  of three phasesin addition to a review of relevant HCFA policies and 
Medicare laws, discussionswith HCFA staff, and review of the above audit findings. 
Reviewing Caker  iUai&nance  Procedurts 
We visikd  three caniers and mailed surveys,with klephone followup, to 35 other carriers. (See 
Appendix A for a complek list of carrier respondentsand Stak jurisdictions.)  Questions 
addressedprovider number maintenanceproctdurts carriers follow  and were directed to the 
departmentwhich is responsiblefor assigningnumbersto Medicare providers. 
hrveying  State Licensing Authorities 
Many (121) Stak authorities responsiblefor licensing one or more typts of medical providers 
who can receive reimbursementunder Medicare Part B respondedto our survey. The number of 
licensing authority respondentsranged from a high of 28.Staks for dentiststo a low of 15 States 
for psychologists. (SeeFigure 2.)  flGURE  2 
State  Licen$ing  Authority  Respondents 
I 
Number  of States  Responding 
TLpe of Licensing  Authotity 
Dentists 
 28 
Doctors of Osteopathy 
 25 
Optometrists 
 25 
24 
Doctors of Medicine 

21 
Chiropractors 

Podiatrists 
 18 
Physicii  Assistants 
 18 
15 
Psychologists 

Note:  Someof the stak licensing authorities monitored licensing of severalor all of the types 
of providers listed (e.g., a single agencyin Nebraskamonitors all providers hkd,  while in Texas 
separateboardsrepresenteachprovider type, with the exception of the TexasMedical Board 
which monitors  medical and osteopathicphysicians and physician assistants). 
Computer Matching 
We conducted computer matchesbetweenlicensing authorities and carkrs  responsible for three 
Statejurisdictions (New York, Pennsylvania,and Texas). The carriers involved were Empire 
Blue Crossand Blue Shield, Blue Shield of WesternNew York, PennsylvaniaBlue Shield, and 
TexasBlue Cross and Blue Shield. Thesecarriers were selectedbecauseof 1) the high number 
bf providers within the Stateand 2) the capacity and willingness to provide us with a computer 
file of all licenseeswho have lost the legal author@ to practice in the Stak. The computer 
matcheswere conducted to determine the number of active provider numbersin carrier files 
belonging to providers not 1egaUyauthorized to practice according to the applicable State 
licensing authority. 
In order to limit  the scopeof this study, we limited our review of providers to physicians and 
severalnonphysician practitioners. Entities such as labs, diagnostic testing centers,ambulatory 
surgery centers,etc. were not reviewed. 
Each canier provided a copy of its provider Ne on computer tape. The file contained all 
provider num&rs in its computer systemwhich are approved to bill Medicare. Each stak 
licensing authority provided a computer fde listing all providers who have lost the legal 
authority to practice in their State. Pigure 3 indicates the types of licensed providers supplied on 
the computer tape by the specified Statelicensing authority. 
5 
 FIGURE 3 
- Types  of  Medical  Providers  on Licensing  Tape 
Texas  Pennsylvania 
Doctors of Medicine 
 n  m 
Doctors of Ostetrpathy 
 n  m 
Dentists 
 m 
Podiatrists 
 m 
Chiropractors 
 n 
Optometrists 
 m 
Psychologists 
 m 
Audiologists 
 l 
Physical Therapists 
 m 
Occupational  Therapists 
 n 
The Stak licensing authority dekrmined loss of legal authority. The following  are typical 
actions resulting in loss of legal authority to practke: 
Discipiinq  Actions 
Revocation or suspensionof license or certificate 
Negotiated surrenderof license 
Other Actions 
Failm-eto renew the license or ccnificate 

Retirement or death 

Failure to complete continuing education 

Afkr  the license is issued, Statesrequire licenseesto maintain a current rtgisuation  to be legally 
authorized to prxfice.  This generally involves payment of a registration fee at intervals 
determined by the Staot. Additionally,  it might involve presentingevidenceof completing State 
approved continuing education. Failure to maintain a current regisuation may lead, in some 
staks,to canceling the license (e.g., TexasMedical Board).  In other Staks, the license is simply 
recorded as inactive (e.g., Florida and New York).  SeveralStak laws provide penalties for 
pracricing without a valid license and registration. For example, North Carolinas law governing 
the practice of medicine staks: 
any person [who]  shall practice  medicine or surgery without  being duly licensed and 
registered . . . shall  not be allowed  to maintain  any action  to collect any fee for  such 
6 
 services. The person so practicing without Licenseshall be guilty of a misdemeanor, and 
upon comktion  thereof shall befined hot lessthanfifry dolkzrs ($50.00) nor more than one 
hundred dollars ($1OO.OOo),r imprisoned at the discretion of the court for  each and every 
offense. (Section 90-18, North Carolina Medical Practice Act) 
. .  FINDINGS  . 
~aistoricaUy, management has not recognized the importance of 
maintaining  accurate and up-to-date information  on providers in our 
corporate file.  
-A Carrier  Provider Number Dept. Manager 
HCFAS  DIRECTION  TO CARRIERS  IS INADEQUATE. 
. 
Although Medicare  regulations specify qutications  a provider must meet before being 
reimbursed by Medicare, HCFA hasissuedno directives concerning a carriers responsibility to 
ensurewhether a provider is still qualified at somelater date after an initial provider number is 
issued. Additionally,  little guidance hasbeengiven conckrning how and at what frequency 
carriers should determine the accuracyof provider-supplied information (e.g., practice location).
-
In f?e absenceof suchrcqiremcnrs,  the extent of updating, if done, varies from one carrier fo 
the 12xt. For example, Nationwide Insuranceof Ohio updatesphysician assistantrecordsevery 
ye:  . :exti&d  nurse anesthetistsand nursemidwives every 2 years,and ambulancecompanies 
e\  1 3 years. On the other hand, Empire Blue Crossand Blue Shield updatesDME suppliers 
are-.  .y. 
WC  :. I eve inadequatedirection by HCFA hasresulted in weaknessesin carrier controls to 
miz- .1z1the integrity of Medicare carrier provider numbers. We believe this constitutesa 
ma:. .-al internal control weaknesswithin the meaning of the Federal Managers*Financial 
Ihi  rity Act and should be reported to the Secretaryalong with plans for conective action. 
WEAKNESSES  EXIST  IN CARRIER  CONTROLS  TO MAINTAIN  ME?XARE 
PROVIDER  NUMBERS. 
Although virtdy  all caxrkn report the ptwider  number assignmentprocessis Very  important 
to the integrity of the Medicare program, we found little carrier effort to ensurethe information 
maintained OQprovidu~ is accurateand up-to-date. 
Most canicrs  do not systematically up&z& providerfle~ 
b 
Many carriers  repott little effott to updateprovider files except in responseto changes 
(22) 
submitted by the provider, to returned mail, or aspart of group mcmbershipvalidation.  Most of 
the rexnining  cakrs  (17) which do report periodically seeking updateinfotmation generally do 
SOonly on an asrequired basis and only in responseto a perceivedproblem or need. 
8 
 Typically, carriers reported the following  reasonsfor not routinely updating or recertifying 
providers after a number hasbeenissued: 
lack of staffing, 
lack of funding, 
no perceived need for Ne review, or 
no HCFA requirement to do so. 
An  Effective  Practice 
One practice  involves routinely  sending out b$ormation vetificafion  leners to 
providers.  As an example, Montana Blue Shield set&  out an infotmation 
gathering  lener each year w all providers  except durable  medical  equipment 
suppliers  and hospital  based physicians.  Providers  are required  to firr  out the form 
and return  it.  Providers  not  responding ore called by carrier  stq@  The answers 
given on the ques&tnai~s  are ver@ed again  &a  already on file for 
&crepancies. 
Physician Group/Clinic  Membership  Updating 
.  ..
;. ,L 
One of th6few provider types for which carriers do conduct some typt of routine updating 
involves physician groups and clinics.  In connection with the physician identification and 
registration program (UPIN), HCFA requires catriers to maintain accurategroup membership 
information.  Specii?cally,carriers arc required to 1) inform groups of their obligation to report 
any group member additions or deletions and 2) perform an annual survey of groups to detect 
any chm  not reported by the group during the yeaz 
Carriers typicaily  noti@ groups to report membershipchanges,both at the time numbersare 
given out and periodically in cazricr newsietters. S&I, a-hers  teport such changesare not 
always qorted.  Six of 38 carriers surveyedreport membersjoining  a group or clinic are only 
sometimesrepor%& while 19 report Embers  leaving ate only sometimesrqorted. 
>  Communications betweencarriers andprofessiond  kensing  authorities are weak 
Lack  of Reporting 
Many of the licensing authorities we contacteddo not routinely shareinformation with carriers 
when a provider  losesthe legal authority to practice. However, medical and osteopathic 
licensing authorities routinely report more often than any other  (SeeFigure 4.) 
Lack of reporting is especially notable with regard to nondiscipiikuy  actions. Of the authorities 
who reported routinely sharing information with the hkdicare  carrier, less than 24 percent (12 of 
51) report nondiscipiinary actions as weiL 
9 
 FIGURE 4 
Many  Ucensing  Authorities  Do Not Share  Information 
With  Carriers 
Licsnslng  AuthoHty  States  Surveyed  .  Do Not Sham  Share 
Doctors of Mediiine  23  26%  74% 
71% 
pot;  Osteopathy  2147   2  35% 
optofnetrists  14  74%  28% 
Chiropractors 74%  26% 
Dentists  2  78%  24% 
Psychologists  14  88%  14% 
Somepossible reasonswhy licensing authorities do not routinely report actions to Medicart 
carriers include a lack of staff or resources,not being awareMedicare needsthe information, and 
privacy considerations. However, according to the Federationof StateMedical Boards. only 
four medical boards (Connecticut, New Hampshire, South Dakota, and Wyoming) do not 
consider formal board actions or agreementsa matter of public record. 
Organizational  Differences 
Each Stateis different in the way it has setup authoritieszesponsiblefor licensing medical 
professionals. At one exmme, WCfound Stateswhere one agencymaintains information on 
actions taken by severalboards (hezeafterreferred to asan umbrella agency). In somecases, 
boardsact only as advisory bodies to the umbrella agency. At the other extreme, we found States 
where individual boardsare completely independentfrom other boards,and no central authority 
rphkors  board actions tie&g  a licenseesauthority to practice. 
The Federation of Medical Boards classifies Statemedical boardsinto four broad categories 
which describe board suucture and operation (seeFigure 5): 
l  Independent  The board exercisesall licensing and discipiinaq  powers, 
though someclerical seniccs may be provided by 
an umbrcila agency. 
l  Se~4aubnomous  The board exercisesmost key powers; an umbrella agency 
provides  most clerical and administrative services 
and makessomedecisions. 
l  Subordinate  The board exe&es  few key powers; an umbrella agency 
pm&s  semicesandmakesmost decisions. 
>  Advisory  The board actsin a purely advisory role to the unibrcila agency.  FIGURE5 
- Most  State  Medical  Boards  are Independent 
Board  Structure 
0  Independent 
w  Subordinate 
EZlSemi-iutonomous 
I  Advisory  Body 
Source:  Federation  of State Medical Boards  1989-90 Exchange 
As illustrated in Figure 5, most medical physician licensing boards are independent. However, at 
least 15 of the 38 independent boardsrely on other Stateagenciesfor most administrative 
functions (e.g., maintaining computer systems~collecting renewal fees,etc.). This meansat least 
54 percent of all Statesand the District of Columbia are monitored by umbrella agencies. 
These umbrella agenciescan greatly assist a carrier in obtaining complete licensing information. 
Although the boards often must be consulted for specifk &tails  about discipiinaxy actions, the 
umbrella agency maintains adequateinformation in its computer systemto provide information 
on the legal statusof a licensed professional. Carriers needonly contact the umbmlla agency to 
coordinate any exchangeof information. 
On the other hand, autonomousboardslacking an umbrella agencyrequire the carrier to contact 
each individual board for information.  Since autonomousboards are generally small and 
burdened with many aspectsof licensing (e.g., administering examinations and collecting license 
renewal fees), they are less likely to have the resources(e.g., staRand degreeof automation) to 
respond to carrier requestsfar information.  In such situations, it may be more feasible to contact 
providers directly to submit proof of cutrent licensurc or certification. 
11 
 -. 
Automated  Record Keeping 
Responsesti  completed surveysby 121 licensing authorities indicate Statelicensing 
authorities have the capacity to generatelistings of providers who are actively registeredin a 
profession. Nearly 90 percent of respondentsrepcxtlictnscc information is maintained in a 
computer system  Only one licensing authority for medical physicians,WestVirginia, reported 
no computer. (However, they indicated a micro computer would be purchasedby the end of the 
year.) Boards with a small licenseepopuiation (e.g., psychologists) were least !;keiy to keep 
records in an automatedsystem 
Many State licensing authorities keep recordsin a mair&ame or mini computer. However, 
licensing authorities which do not shareresourceswith other Statelicensing authorities 
(e.g., smalI autonomousboards) typically keep information in a personalcomputer. Of the 73 
licensing authorities which provided information on the type of computer systemused,71 
percent use a mai&ame  or mini computec others usepersonalcomputers. 
Whether computerized ornot,  eachlicensing authority hasthe ability to provide listings of 
providers who have the authority to practice. Such listings take the form of periodic publications 
or computer listings generatedat the time of the request  Virtually  all authorities we contacted 
produce such listings at no or minimal cost ($10 to $100). WCcontacteda few of the licensing 
authorities reporting higher costs($200 or more) to discusswhether the cost could be lowered 
for a Federal Medicare contractor since its usewould be to monitor providers the board reports 
to be not legally author&d  to practice. As an example, Colorados quote of $320 for a complete 
listing would be lowered at least by half to the cost other Stateentities are paying. 
l  Many  can&m  do  twt  have  adhquute  contds  to  icient@  and  deactivate  provider 
.  numbers belonging to providers who have los! the Legala&on*@  to practice. 
Many carriers do not have arrangementswith Licensingauthorities to receive notice of all actions 
(ciisciplin&y or other) affecting the legal authorization of providers to practice. Failure to 
receive this information and take appropriate action leavesthe carrier vulnerable to making 
paymentsfor serviceswhich are noncoveredby Medicare. 
Discipiinary  Actions 
While many canicrs report they haveestablishedcommunication with licensing authorities to 
receive discip%rary actions, somehave not.  (SeeFigure 6.) Generally, licensing authorities 
report disciplinary actions in the form of a board order. The order statesthe type of action taken 
and its duration.  For most carriers who report receiving actions, the board order is sentto the 
medical review or program integrity deparrmcntwhere a decision is made on whether the 
providers number should be deactivatedor flagged for postpay or prepay review. 
12 
 FIGURE 6 

Not-All  Carriers  Receive  Notices  of Disciplinary  Actions 
Ts  of Ptvviders 
 Number  and  Penzent  of Cafriem  Receiving  Notice 
Doctors of Medicine 
 30  79% 
Doctors of Osteopathy 
 74% 
Chiropractors 
 ::  53% 
Optometrists 
 19  50% 
Podiatrists 
 19  50% 
Dentists 
 19  50% 
Psychologists 
 19  50% 
Physical Therapists 
 18  47% 
Occupational  Therapists 
 17  45% 
Ambulance  Companies 
 15  39% 
Certified  Nurse Midwives  13  34% 
and Anesthetists 
Source:  Survey of 38 Carriers 
Other Actions 
Although loss of authority to practice for nondisciplinary reasons@onpaymentof renewal fees, 
death, retkment,  voluntary surrenderof license,etc.) causea providers servicesto be 
noncoveredby Medicare, many carriers do not identify such providers.  (SeeFigure 7.) 
FIGURE 7 
L 
Even  Fewer  Carriers  Receive  NOtic8S  of  Nondiscipiinary  Actions 
TLpes  of Providers  Ntamber and  Perc8m  uf Carrbm  Recekving Notice 
Doctors  of Mediine 
 25  66% 
Doctors  of Osteopathy 
 23  61% 
Chiropractors 
 14  37% 
Optometrists 
 13  34% 
Podiitrists 
 14  .  37% 
Dentists 
 13  34% 
14  37% 
PSY~W-

Physical Thmpbts 
 13  34% 
OccupatbnalThera@sts 
 12  32% 
AmbulanceCompanies 
 11  29% 
Certlfled  Nurse Michnives 
 11  29% 
and Anesthetists 
Source:  Survey of 38 Camws 
Our review  af four carriers revealed vulnerabilities in this area. Although each canier  reported 
receiving nondisciplinary actions from licensing authorities, we found many active provider 
numbers belonging to providers not legally authorized to practice for other than disciplinary 
13 
 reasaIS. None of the carriers had askedfor or receivedcomplete listings of providers adequate 
to ide ltify  all providers not legally authorized to practice. 
As  w: tl  our computer match States,caxricrswho rtport receiving notice of nondisciplinary 
actionI may not usethe information or may receiveincomplete or untimely infotmation.  This is 
evidecced by many carxiersreporting they deactivatevery few, if any, providers who lose State 
legal authority to practice for other than disciplinary actions. 
An  Effective  Practice 
A formal  agreement with licensing  authorities  prescribing  exactly what actions 
will  be commurucated to the carrier,  at what times, and to whom the infomtion 
will  be sent is a good practice.  Such an agreement adds confidence that all 
actions affecting  a licemees  legal author@  to practice  will  be commuu cared in 
atimelymanner. 
L  \ 
-
* 	 i   ny providers wit0 have lost the &gal autiwdty  to practke  still have adve  provider 
.-tiers  which they may use and, in somecases,are using to bill  Medicare  services. 
Throc  i  x computer matches,we identified 4,770 active carrier provider numbersbelonging 
to prc  :  s who had lost the legal authority to pracrice. (SeeFigure 8.) 
-. 
FIGURE 6 
h  ..ry Providers  Not Legally  Authorized  to  Practice  Have Active  Numbers 
Wts  - Provider  Numbem  BelongIng  to Pfov  lers  Not Author&d 
P8re8nt of.  M8wlYa!38mpl8dfor  s8mpld  Provldw 
An  Allowd  ClutQu whlk  NumbamWithAllowed 
Carriers 
-bY 
Numkn  NotAtiM  chug88 
mrlpunvr   
QJqoct to 
COUtIt  PerCent  Count  Allowed 
Ymcil 
Empire  Blue  Shield  1,426  5%  I  2.5%  I  160  1  11%  21  $132,567 
31~0 Shield  of 
217  2.5%  j  2.0%/  104  /  47.9%  19  $81 ,160 
Nester-n  New  York 
aennsylvania  Blue 
1,590  &XI  j  1.1%  /  121  /  7.6Yo  9  $78,416 
shield 
Texas Blue  Shield  1,537  39  $12,311 
I  849I 
Total  4,no  88  $304,454 
14  Approximately  10 percent (88 of 849) of sampledprovider numbers had allowed charges2while 
the provider was not legally authorized to practice. This percentagevaried slightly at each 
canicr.  For examplk, at the 95 percent confidence level as few as 8.1 percentor as many as 18.1 
percent of the 1,426 provider numbersidentified at Empire Blue Shield had allowed charges. 
When a 95 percent confidence level was computed for Blue Shield of WesternNew York, the 
estimatedpercentageof provider numberswith allowed chargeswas within the interval of 
12624.0  percent 
We found over $300,000 in allowed chargesto the provider numberssampledat the four 
carriers. These allowed chargesranged from $18.30 for one ScrYiceby one provider to over 
$100,000 for 3.018 servicesby another. Becauseof this extreme variability  and the small 
number of provider numberswith allowed chargeswhile the provider was not legally authorized 
to practice, any resulting projections will  be very imprecise. This does not mean any projections 
of the allowed chargesto the unsampledpopulation would be inaccurate. However, it does mean 
with the sample data we do not have sufficient power to provide a preciseestimateof the 
allowed chargesto providers not legally authorized to practice. 
Still, theseresults r&for&  past OIG findings.  The review of Florida physicians between 1980 
and 1985 showed carrier allowed chargesin excessof $15 million  for sckccs  renderedby 439 
providers after they had lost legal authority to practice. 
> 	 Inaccurate or missing information  in somecanierj?les  may hamper effective  use of 
State licensing authori~  information 
Esp+lly  in the caseof computer matches,certain carrier records must be maintained 
accurately. Two fields are especially important - provider name and license number. Theseare 
the &lytwo  fields we arc certain both licensing authoritieasnd carriers COkL 
Missing Carrier  License Numbers 
While few carriers do not record provider license numbers,a considaable number of carriers 
have only recently begun to enter thi  license number in a computer file.  As a consequence,in 
many older provider records set up previously, the license number fields arc empty. Records 
were missing license numbers in eachof the carrkrs where we conductedcomputer matches. 
Figure 9 ilIustratcs the degreeof missing license numbersat Empire Blue Shield and Blue Shield 
of WesternNew York 
As indicated in Figure 9, the percentageof license numbersdifkrcd  markedly depending on the 
type of provider  For example, physicians had the highest rate of license numbers while 
practitioners such asphysical therapistshad the lowest  This may be an indication of the impact 
of HCFAs UPIN project  The license number hasbeen termed a critical element to be collected 
by carriers when setting up a physician number. However, HCFA does not require the license 
number in order to issue a UPIN. 
15 
 FIGURE a 
Missing  License  Numbers 
Numbers  RevIewed  Percent  Missing  Number 
Donors  of Medicine  and Osteopathy  32,446  29% 
ggwa~P=  2,337  14% 
774  17% 
Podiatrists  1,712  18% 
Psychologists  2,641  93% 
Audiibgists  141  9% 
Physical Therapists  377  99% 
Dentists  226  3% 
Total  w= 
- Blue  Shield  of Western  New  York 
Numbem  Reviewed  Percent  Missing  Number 
Doctors of Medicine  and Osteopathy  12,162  38% 
Chiropradbrs  577  77% 
optometrists  501  42% 
Podiatrists  354  3% 
Psychobgists  246  44% 
Audiologists  20/9 
Physical Therapists  2::  53% 
Dentists  262  63% 
. 
Total  14,351 
Soutce:  Review of Camer Pfvvklef  Files 
Inaccurate  Carrier  License Numbers 
Even if the license number is entered,carriers may not be ensuring the accuracyof the number or 
may not be entering the number in a form which will  correspondto the licensing authoritys 
number. To illustrate, we encounteredErrol and inconsistencyin the way our samplecarriers had 
entertd license numbers. Transposingdigits in the number was the most fkquently  encountered 
error. To a lesserextent, somelicense numberswere incomplete, had too many digits, or 
included inappropriate prefixes. 
Provider  Name Irregularities 
Review of car&r  files in which we conductedcomputer matchesrevealedcarriers enter the 
nameas given by the provider on the application. For example, one provider might be listed as 
Robert Stanley Smith, Jr. on the licensing authoritys file, while the ctier  might haveentered 
16 
 the name as Bob Smith or R Smith on the carriers file.  This createsan unwarrantedpotential 
for confusion.  Carriers could easily ask providers for complete legal namesand verify the name 
spelling with that of the licensing authority when the providers qualifications are verified (i.e., 
license number is checked). 
IMPROVEMENTS  THROUGH  VARIOUS ADMINISTRATIVE  ACTIONS  OR 
PROGRAMS  ARE POSSIBLE. 
Many types of caxrieractivity can improve the accuracyand reliability  of information 
maintained in provider records. Often, suchactivities can be accomplishedat little cost to the 
Medicare program through largely automatedrather than manual verification procedures. The 
following  are a few examplesof specific maintenanceactivities. Also, we include a short 
discussionof the actual beneficial effects to physician provider records obtained by carriers 
during UPIN associatedactivity. 
w 	 Carriers can reduce the number of active provider numbers, reduce Medicares 
vulnerabili@ to abuse, and saveadministrative costsby periodcally  deactivating 
provider numbers with no billing  history. 
One simple and cost effective method for updating provider files, followed by nearly two-thirds 
of carriers surveyed,is to deactivatethe numberswhich belong to providers without recent 
billing.  The effects of removing inactive providers could be significant 
*Atone carrier not routinely deactivating provider numberswith no billing  history, nearly 30 
percent of active provider numbers belonged to inactive providers. (SeeFigure 10:) 
(Ipactive providers were &f&d  asprovider records with no Medicare billing for the past 27 
months.) titters  were sent to providers to determine if they still wished to participate in the 
Medicare program. Almost 78 percent of theseproviders failed to respond or requested 
termination of their number. Ultimately,  15,215or 76.6 percent of provider numberswith no 
billing  history were canceledbecauseof this project  Not only doesthis reduction in provider 
numbersincreasethe manageability of the carriers provider file, it translatesto an administrative 
cost savingsto the Medicare program. Such activities as yearly profile calculations, file 
maintenanceactivity, and routine mailings will  not be required. 
17 
 FIGURE 10 

Many  Provider  Numbers  With  NO Billing  Could  be Canceled 
Texas  Blue  Cross  and  Blue Shields  Experience 
Numbers  Wlth  No Blllina  Cancelled  Provider  Numbers 
Active 
Type of  Percent  of 
Provider  Percent  of  Percent  of
Provider  Numbers  Active  NUtllbMS 
Numbers  No Bllllng  all Numbers
Numbers 
Doctor  of 
Medicine  42,932  11,842  27.6Or6  9,819  82.9%  22.9% 
Drug  and 
Medical  6,348  2,013  31.7%  1,752  87.0%  27.6% 
SUPPlY 
Dentist  6,123  3,250  53.1%  2,274  70.0%  37.1% 

Doctor  of

3steopathy  2,646.  672  25.4%  *  567  64.4%  21.4% 

Zertified 
Uurse  1,960  617  31.5%  300  48.6%  15.3% 
Anesthetist 
ZhiropraAor  1,750  203  11.6%  130  64.0%  7.4% 
sychologist  1,236  688  55.7%  312  45.3%  25.2% 
odiatrist  624  75  12.0?&  60  80.0%  9.6% 
kcupational 
Therapist 7  1  14.3%  1  100.0%  14.3% 
Total  63,626  19,361  30.4%  15215  76.6%  23.9% 
Computer matching with licensing authorities could help many cawiers identifi 
l 
ptvvi&rs  not legally authorired  to practice. 
Our experiencewith computer matching to identify providers not legally authorized to practice 
hasproven such activity is an effective tool to maintain the integrity of provider records and 
reduce Medicares vulnerability to l&d  and abuse. Additionally,  suchfries can have other uses. 
Not only could the file be used to conduct computer matching, lists of authorized providers 
could be produced for departmnts  responsiblefor assigningprovider numbers. In fact, carriers 
could incorporate the licensing authoritys file into a canier computer program screensuchthat 
all carrier departmentswould not have to manually look up licensing information on providers, 
but could query the computer instead 
18 
 . . 
All  of the licensing authorities which indicated having a computer systemalso teported they 
could generatea computer file of all licensedproviders. Of these,over 50 percent also have the 
capacity to generatelistings only of providers who have lost the legal authority to practice. 
Apparently, somelicensing authorities keep only recordsof actively registeredproviders. Any 
licenseefailing  to renew a license is purged from its system 
Medical physician licensing authorities teported chargesfor such files ranged from no charge to 
a government agency to severalcentsper record. Somt of the estimatedcosts were asfollows: 
costof File 
Medicai Physician Licensing 
Rhode Island 
 $50 
Nevada 
 $50 
oklahoma 
 $75-150 
Idaho 
 $100 
TCxaS 
 $100 
Alabama 
 $150 
Ohio 
 $150 
N&&ii 
 $175 
North Carolina 
 $250 
FlOrida 
 $260 
COMCCtiCUt 
 $65 pcrprofession plus $25 for a tape 
Vermont 
 $5 processingfee plus five centsper record 
North Dakota 
 $0.05 per physician record 
Missouli 
 No chargeto Federal government agency 
New York 
 No chargeto Federal government agency 
.  California  No chargeto Federal government agency 
Costsfor smaller boardssuch as chiropractic or optometry were generally between $25 and $50. 
It should also be noted Statelicensing authorities may lower processingcosts,if they realize the 
purpose of Medicares requestfor the information and that the carrier is a Medicare contractor. 
As an example, Ohio sells a computer tape of licensedphysicians for $1,500 to private entities. 
However, certain Stateand Federal agencies(including Medicare) can receive the tape for as 
little as $150. 
19 
 An  Effective  Practice 
Carriers fo;  3 States (Flonkia,  Missouri  and Tkxas) reported obtaining  a computer 
file from  a licensing  board in order to i&nrifL  providers  not legally  awhonzed to 
Each carrier  teports use of such a computer file  to be an inexgenrive, yet 
effective, method to aktect providers  not legally  authorized  to practice. 
In  1989,  Florid0  reported the deactimtion of appro.xkztely  300physician 
provider  numbers for failure  to renew their license.  In 1990, Texar deactivated 
nearly  1,500 provider  numbers for physicians  not legally  authorized  to practice. 
I iow costly are computer matches? 
1he effectivenessand cost of computer matching dependsupon stverai factors. Someof these 
fi ctors are: 
the ctiers.computer  capabilities, 
Wrier  programming costs* 
licensing authority ability to produce a useableftie at a reasonablecost, 
adequateidentifiers for matching (license number, name,birth date, etc.), and 
sufficient integrity of the carriers and licensing authoritys provider file (e.g., if 
matchedon the license number, all carrier recordsmust have iicense numbers). 
practical example of the cost of computer matching, Florida Blue Crossand Blue Shield 
i  ratedits match cost for start-up and yearly follow-up: 
$1,120  Initial  developmentfor first match 

$  260  Computer tape purchasecost f%omStatelicensing authority 

$  200  Adminisuativt  coststo run match (e.g., computer CPU time, 

letter generationto providers without a valid License,staff time 
to receive and file provider responses) 
$  250  Maintenance (activity associatedwith updating match programs) 
$lW  Total Cost for Initial  Match 
$  710 	 Cost for Subsequent Matches (the $1,120 initial 
development is no longer required) 
> 	 Camer e#orts under HCFAs physician identip&*on  and registration program  (UPIN) 
have improved the accuracy of provider  number mcordr of physicians. 
St:venty percent of caniers responding to our survey statedthat, in the courseof fulfilling 
re ;1kementsfor HCFAs physician identification and registration program (WIN),  it 
substantially cleanedup physician records. In total, 18 carriersreported the identication  of 
20 
 approximately 11,500physicians whose numbersneededto be canceledor deactivated. Some 
other cakcrs  respondedon a percentagebasis;from 10 to 20 percent of physicians in its system 
had their numbersd&activatedor canceled. The primary reasonsfor deactivation were death, 
rekxnent,  or no longer practicing in the State. 
r 
Matetial  Weakness 
Inadequate  HCFA oversight and direction  of the provider  number process is a 
basic systemic weakness that compromises the integrity  of the trurtfud  and could 
remit  in significant  losses. In accordnnce with the Federal  Managers  Financial 
Integrity  Act, the HCFA should repon  this as a material  internal  control  weakness 
through  the Secremy  to the President and Congress. A detailed  discussion of the 
material  weakness designation  can be found  in Appendix B. 
21 
 .. 
RECOMMENDATIONS 
The HCFA should &rim  carriers to: 
l  updateprovider recordsperiodically.   
l  deactivateall provider numberswithout current billing  history. 
l 	 establish adequatecontrols to ensuit providers not legally authorized to practice are 
identified and their provider numbersdeactivated  As a part of thesecontrols, carriers 
should: 
- negotiate with Statelicensing authorities to obtain license and 
registration information at a minimum cost to the Medicare program. 
- assessthe feasibility of computer matcheswith Statelicensing authorities 
and perform suchmatchesroutinely, if practicai. 
- maintain the licenseor certifkation  number of providers in its provider 
file. 
-	 &velop  computer data entry edits for license numbersto ensure 
uniformity  and consistencywith the licensing authoritys method of 
recording license numbers. 
Tie  HCFA should: 
l 	 evaluatecarrier provider number controls establishedaboveas a part of its regular 
carrier Contractor PerformanceEvaluation Program. 
l 	 negotiate with Statelicensing authorities, which carriers report to be uncooperative,to 
obtain license and registration information at a minimum cost to the Medicare 
HCFA COMMENTS  AND OIG RESPONSE 
The HCFA achowledges  the needfor improvement in its instructions given to Medicare carriers 
regarding the maintenanceof provider numbers,but does not believe our fmdings constitute a 
control weakness. The HCPA maintains that UPKNrequirements firmly 
material  intcmal 
establishedboth a meansand a HCPA commitment to maintaining accurateprovider number 
information. 
22  .  TheHCFA concurswithourrecommendatiotnospcddically updateproviderrecords and 
conditionally concurswithourrecommendatioton d eactivatneu  mberswith no recent billing 
activity.  The HCFA doesnot concur with recommendatiornesquiringca&rs  to implement 
conaols which are adequateto ensureproviders notlegallyauthorizedtopractice are identified 
and their provider numbersdeactivated..The HCFA citesthe OIGs sanctionrole and several 
impediments precluding the implementation of computer matching. Additionally,  HCFA does 
not believe a CFZP standardis warranted to ensureand evaluatecarrier maintenanceactivity. 
The HCFA incorrectiy  argues the resporrsibility for  ensuring providers  losing legal 

authority  to practice  are idennified rests with the OIG.  The OIGs sanction  role is 

timiled  and does not take away the responsibility  of camers to ensure payments 

are not made to unqualified  providers.  The Physician  Registry does not ensure 

maintenance  of the accuraq  of provider  nwnber  infomation  as indicated  by 

HCFA,  exceptfor  detecting sanctioned physicians.  Finally,  carrier  effons to 

maintain  the integrity  of provider  numbers warrants  evaluation  during  HCFAs 

annual  camer  smey  process. 

The OIG continues w believe a materiai  internal  control  weakness txists. 

The HCFAs l&k  of direction  has resulted in vuinerabiiities  which meet several 

of the criterb  upon which a mate&l  weakness designation  is detemined. 

SeeAppendix B for a summary of HCFAs commentsto ;he draft report and a complete 
discussioonf  the OIGs responseA. lso, this discussionincludes factors consideredin
determining a material weakness3designation exists (Appendix B, pages4-S). Appendix C 
includes the full  text of HCFAs comments. 
23 
 ENDNOTES 

1. 	 According to information in the Federations 1989-W Exchange,Section 3: 
Physician Licensing Boards and Physician Discipline. 
2. 	 Allowed chargesrepresentthoseamountsdetemined by the carrier basedon the lower of 
the USLU&customary,or prevailing chargesfor the service. 
3.  Material weaknesscriteria are specfied in OMB Circular A-123.  APPENDIX  A 

CARRIER RESPONDENTS ad  STATE JURBDKTIONS 
381 
Blue Crossand Blue Shield tf  Alabama    Alabama 
Aema Life  and Casualty  Arizona, Nevada 
Arkansas Blue Crossand Blue Shield, Inc.  Arkansas,Louisiana 
Blue Shield of California  California 
TransamericaOccidental Life Insurance  California 
Travelers Insurance  Connecticut 
FlOlidil 
Blue Crossand Blue Shield of Plorida, Inc. 
Aetna Life and Casualty  Georgia 
Hawaii 
Aetna Life and Casualty 
Equicor  Idaho 
Health Care Service Corporation  Illinois 
Associated Insurance  Indiana 
Blue Shield of-Iowa  Iowa 
Blue Crossand Blue Shield of Kentucky  Kentucky 
Blue Crossand Blue Shield of Maryland  Maryland 
Blue Crossand Blue Shield of Michigan  Michigan 
General American  Life  MissoLlIi 
Blue Crossand Blue Shield of KansasCity  Missouri, Kansas(Johnsonand 
Wyandotte Counties] 
Travelers Insurance 
 Minnesota 
Travelers Insurance 
 Mississippi 
Blue Crossand Blue Shield of Montana, Inc. 
 Montana 
Blue Shield of WesternNew York 
 New York 
Empire Blue Crossand Blue Shield 
 New York 
Group Heahh Incorporattd 
 New York 
E4uicor 
 NorthCarolina 
Blue Crossand Blue Shield of North Dakota 
 North Dakota, South Dakota, 
Wyoming 
Nationwide Mutual 
 Ohio, WestVirginia 
Aema Life and Casualty 
 Oklahoma, New Mexico 
Aetna Lift  and Casualty 
 Gregon, Alaska 
PennsylvaniaBlue Shield 
 Pennsylvania,Maryland (Prince 
Georges& Montgomery Counties), 
Delaware, District of Columbia, 
New Jersey 
Blue Crossand Clue Shield of Rhode Island 
 Rhode Island 
Blue Crossand Blue Shield of South Carolina 
 South Carolina 
Blue Crossand Blue Shield of Texas,Inc. 
 Texas 
Equicor 
 Tennessee 
Blue Crossand Blue Shield of Utah 
 Utah 
Travelers Insurance 
 Virginia 
Washington Physicians Service 
 Washington 
Wisconsin Physicians Service 
 Wisconsin 
A-l 
 _. 
APPENDIX  B 

SUMMARY OF HCFAS COMMENTS TO SPECIFIC  RECOMMENDATIONS 
AND OIGS RESPONSE 
RECOMMENDATION  1: 	 HCFA should require carriers to update provider records 
periodically. 
HCFA Comments 
The HCFA concurs with this recommendation. 
0 IG Response 
The OIG is pleasedHCFA acknowledgescarrier responsibility to ensurethe accuracyof provider 
records through periodic updating. 
ECOMMENDATION  2: 	 HCFA should sequin can$ers to deactivateall provider numbers 
without current billing  histov. 
ZFA Comments 
e HCFA concurs with this recommendationand further proposesimplementing carrier 
xtivation  asan annual activity to be implemented by carriers when funds becomeavailable. 
IG Response 
TheOIG does not believe deactivating inactive provider numbersshould be delayed  This 
-ctivity is important to maintaining the integrity of carrier provider flies and may also result in 
n administrative cost savingsto the carrier. Additionally, requiring carriers to perform this 
ctivity  will only affect about a third of the carriers. As referred to in the repor& the other 
I tiers  already pcrfom  this function. 
I?ECOMMENDATION  3: 	 HCFA should require Carrie= to estiiish  adequate controls to 
ensure providers not leg&y  authorized to practice are identified 
and their provider numbers deactivated 
L;CFAComments 
7 1eHCFA does not concur with this recommendation. The HCFA believesproblems exist 
Primarily, HCFA believesthe 
w lich limit  or prohibit implementation of computermatching. 
k~nefit to the integrity of the Medicare program is too small to justify  the cost  However, HCFA 
B-l  will  encouragethosecarriers which canestablishdata exchangeswith Statelicensing authorities 
without charge and with minimal administrative coststo conduct computer matches. Finally, 
HCFA  believes UPIN establishesboth a meansand a HCFA commitment to maintaining 
accurateprovider number information. 
0 IG Response 
Medicare law does not allow carriers to make payment to providers not legally authorized to 
practice in tire State where servicesate rendered. Consequently,HCFA cannot permit carriers to 
ignore a Stateslegal authorization requirements. 
We acknowledge the existing differencesamong Statesconcerning Statelicensing authorities 
ability to provide computerized registration information.  Also, we understandcanier differences 
which may impact on the cost and effectivenessof implementing this recommendation. 
However, we do not suggestthat computer matching with licensing agenciesis the only means 
available to carriers. We suggestonly that carriers study the feasibility of conducting computer 
matching. Manual procedurescan be effectively and cffL5ently usedwhen computer matching 
is infeasible or not cost effective. 
Proceduresmust be tailored to fit the carrier and State. Somecarriers will encounter less success 
or more cost in meeting this requirement. However, this does not justify  not requiring catxiersto 
implement proceduresto deactivateall providers not legally authorized according to State law. 
If excessiveor unsurmountableproblems exist in achieving the integrity of provider ncords, 
HCFA should seeklegislative relief. 
The HCFA arguesour report does not indicate they can expect a significant return on its 
investment  Specifically, HCFA believesdetermini
ng legal authorization is not cost effective. 
Becausecarriers have not yet studied the feasibility of conducting suchmatches,we question 
HCFAs estimate that coststo implement computer matching may exceedone million  dollars. 
While an exact cost estimateof Medicare overpaymentsis not determinable, we believe our 
repon shows a sign&ant  vulnerability which warrantscarrier action. 
We agreeUPIN activity hasimproved the accuracyof physicians records and can be usedto 
effectively detect sanctionedphysicians. However, improvements to physician records were due 
primarily  to carrier review and contact with licensing boardsand/or physicians to develop for 
missing data or nonassignmentof a UPIN.  The UPIN databasehas little real impact on 
maintaining the accumcy of provider records beyond detecting sanctionedphysicians. 
Carrier 
action is required to identify thoseproviders losing legal authorization to practice who are not 
subject to sanction under Medicare law or are nonphysiciansexcluded from UPIN. 
B-i  RECOMMENDATION  4: 	 HCFA should evaluateprovi&r  number controls established 
above as a part of its regular carrier Contractor Pevormance 
Evaluation Program (CPEP). 
HCFA Comments 
The HCFA doesnot concur with the establishmentof a CPEPstandard(s)for provider number 
maintenance. HCFA refers to deactivation of inactive provider numbersasa small area of 
claims processing. The HCFA arguesthat c&ing  CPEPstandardsusedto measureadherenceto 
HCFAs policies will evaluatecompliance with our recommendationto deactivateprovider 
numberswith no billing activity. 
OIG Response 
Carrier maintenanceis not a relatively small areaasimplied by HCFA; rather, it warrants serious 
HCFA review. Establishing a specific standard(s)for provider number maintenancewould be 
critical to ensurecarriers implement controls recommendedin this report 
-
CPEPcontains 10 functional criteria which contain a total of 79 standardsplus two test 
standards. Four of thesestandardsalone involve the Physician Registry (UPIN).  Certainly, 
carrier maintenancewarrantsadequatereview as well 
The OIG does not agreecarrier deactivation of inactive provider  numberswould be adequately 
evaluatedby any existing CPEPstandard. Adequateevaluation under existing standardscould 
only be accomplishedby altering HCFAs method of evaluating a standardto include specifically 
assessingcarrier deactivation policies. 
RECOMMENDATION  5:  HCFA should negotiate with State licensing authorities, which 
can-&s  report to be uncooperative, to obtain license and 
regism*on  infonntrtion  at a minimum cost to the Medicare 
pwmm 
HCFA Comments 
The HCFA doesnot concur with our recommendationto negotiate with Statelicensing 
authorities to obtain license and registration information at a minimum cost to the Medicare 
PWmm-
OIG Response 
The OIG continues to believe intervening on behalf of carriers could be critical  The OIG does 
not fully  understandthe reasonsfor HCFAs nonconcurrencewith this recommendation. 
The HCFA believescarriers should updateprovider recordsperiodicdly  and acknowledges 
verifying provider statuswith licensing authorities has merit  Further, HCFA proposesto 
.. 
B-3  encouragecarriers to establish data exchangeswith licensing authorities. However, HCFA is 
unwilling  to negotdc  with Statelicensing authorities on behalf of carriers wishing to obtain 
licensing information (computer or hardcopy). 
Additionally,  if carriers arerequired by HCFA to deactivateproviders losing legal authority, 
HCFAs intervention to assistcarriers in negotiating with licensing agenciescould be critical. 
MATERIAL  WEAKNESS 
DESIGNATION: 	 The OIG believesina&quate  direction by HCFA has resulted in 
weaknessesin carrier controls to maintain the integrio  of 
Medicare carrier provider numbers. The OIG believesthis 
constitutes a material intemal  control weaknesswithin the 
meaning of the Fe&ml  Managers  Financial  Integrily Act and 
should be reported to the SecrerpIy along with plans for 
corrective  action. 
HCFAComments  -
The HCFA does not believe a material internal control weaknessexists in HCFAs direction to 
carriers or in provider number controls. The HCFA believes the material weaknessdesignation 
does not meet the Office of Managementand Budgets or the Departmentsdefinition of a 
materiai weakness. However, HCFA doesagreeproblems exist with timely carrier 
identification and restriction of paymentsto providers losinglegal authority to practice. Yet, 
.HCFA believes the solution to the problem is more involvement by OIGs sanction staff, rather 
than more carrier effort 
OIG Response 
The OIG continuesto believe a material internal control weaknessexists. The material weakness 
designation is basedon inadequateHCFA direction and carrier efforts to maintain the integrity of 
Medicare provider numbers. 
The HCFA incorrectly arguesthat OIG, through its sanctionrole, is responsiblefor ensuring 
providers losing the legal authority  to practice arc identified.  The resportsibiliry for  the integrity 
of Medicare  pmvider  murders  rests with takers. 
The OIG sanction processapplies only to thoseproviders committing actions sanctionableunder 
Section 1128of the Social Security Act.  Yet, severalStateactions can causea provider to lose 
Statelegal authtity  to practice without necessarily justifying  program exclusion. Additionally, 
the sanction processcan be lengthy. 
Carriers are responsible for understandingState-imposedpxacticerequirements,maintaining 
adequatecommunication with licensing agencies,and administering provider files; consequently, 
carriers can most effectively and effkicntly  establishproceduresto identify test&ted  providers. 
B-4 
 Material  WeaknessCriteria 
The Office of Managementand Budget (OMB) hasspecified many criteria upon which a 
material weaknessdecision should be based. Findings meeting any single criterion constitute 
noncompliance with the Integrity Act and thus, should be classified as a material weakness. The 
following  examplesillustrate how our fmdings meet severalcriteria substantiatinga material 
weaknessdesignation: 
l  Does the weakxess violate statutory or regulatory  requirements? 
As a result of inadequatecontrols, carriersfail to identify and deactivateall provider 
numbersbelonging to providers no longer legally authorized to provide servicesin 
the carriers jurisdiction.  This violates Medicare law which does not allow payment 
to providers not in compliance with local, State,or Federalrequirements. 
l 	 Does the weakxess significantly  impact on the safeguards against waste, loss, 
unauthotized  use offundr,  property,  or other resources? 
While we were unable to determine a precisefinancial vulnerability, the potential for 
abuseis high.  In Florida, from 1980 to 1985,the carrier allowed chargesof over 15 
million dollars for physicians not legally authorized to practice. Carriers do not have 
controls in place to identify loss of legal authorization except for thoseproviders 
excluded from program participation (sanctioned). 
l 	 Is the weakness of high political  sensitivity such that it would resuLt in embarrassmenr 
to the Department? 
Beneficiaries trust the Medicare program to ensureproviders are in compliance with 
Federal, State,and local rquirements.  The HCFA, through carriers, is responsible 
for assuringthis ttust is not betrayed. However, report findings raise concernsthat 
carrier maintenanceactivity doesnot adequatelyscrutinize providers once provider 
numbershave beenissuedto ensurethe provider is still qualified and that payment 
variables are correctly determined. Substanti  Medicare paymentsto providers not 
legally authorized to practice would, indeed, be politically  sensitive and embarrassing 
to the Department 
l  Is the weakness a crosscutting  weakness which indicates major  systemic problems? 
Inadequateprovider number maintenanceis a major systemicproblem within 
Medicare. Errors in the provider number affect 
the ability  to detect@ud  and abuse, 

coverage and pricing  of Medicare  services, and 

- investigations  of particular  individuais  or business. 
While this inspection involved only Medicare carriers, the OIG believes vulnerabilities identified 
in this report may exist in other programswhich assignprovider numbersto providers 
(e.g., Medicaid).  APPENDIX  C 

HEALTH  CARE  FINANCING  ADMINISTRATION  COMMENTS 
C-l  MemorG 

F&i 
28199l 
Gail R  Wensky,  PbD.  e 
Administrator 
OIG  Draft Report -. Carrier Maintenance of Medicare Provider Numbers, 
OEI-06-89-00870 
The Inspector General 
office  of the Secretary 
We have reviewed the subject draft report which concernsMedicare carriers 
efforts to ensure the accuracyof provider numbers and to identify  and restrict 
paymentsto providers who have lost their legal authority to practice. 
-
The report found that some Medicare carriers are not periodically updating 
provider records.  OIG  recommendsthat HCFA improve the maintenance of 
provider numbers by requiring carriers to periodically update provider records, and 
suggestsspecific requirements for these updates. 
HCPA acknowledgesthe need for improvement in the instructions given to 
Medicare carriers regarding the maintenanceof provider numbers.  However, we 
believe that this situation clearly does not constitute a material internal control 
weakness. Our specific commentson the reports recommendationsare attached 
for your consideration. 
Thank you for  the opportunity to review and comment on this draft report. 
Pleaseadviseus whether you agree with our position on the reports 
recommendationsat your earliest convenience. 
Attachment  Commentsof the Health Care Financinp Administration 
(HCFA\  on the OTG Draft  Report  - Carrier Maintenance of 
Medicare Provider Numbers. OEI-06-89-00870 
Recommendation 1 
HCFA  should require carriers to update provider records periodically. 
. 
Resnonse 
HCFA  concurs with this recommendation. 
>  .  Recommendation 2 
HCFA  should require carriers to deactivate all provider numbers without current 
billing  history. 
Resnonse 
HCFA  concurs with this recommendation.  We propose that this be an annual 
activity.  The national start-up cost has been estimated to be approximateiy 
%200,000and the annual cost for  all carriers to conduct the purge would be 
approximately %26,ooO.This requirement will  be incorporated into the Medicare 
. Carriers Manual.  When the funds necessaryto start this project are available, 
HCFA  will  instruct the carriers to implement this recommendation. 
Recommendation 3 
HCFA  should require carriers to establish adequate controls to assurethat 
providers not legally authorized to practice are identified and their provider 
numbers deadted.  As part of these controls, carriers should: 
m 	 negotiate with State licensing authorities to obtain license and registration 
information at a minimum cost to the Medicare program. 
assessthe feasibility of computer matcheswith State licensing authorities 
and perform such matches routinely, if  practical. 
maintain the license or certification number of providers in their provider 
file.  Page 2 
develop computer data entry edits for license numbers to assure 
m 	
uniformity and consistencywith the licensing authoritys method of 
recording license numbers. 
Recommendation5 
HCFA  should negotiate with State licensing authorities, that carriers report to be 
uncooperative,to obtain license and registration information at a minimum cost to 
the Medicare program. 
Resnonseto Recommendation3 and 5 
HCFA does not concur with these recommendations. While the recommendation 
that carriers should use State licensing authorities when verifying the Iicensingstatus 
of providers has merit, we anticipate problems that will  preclude its implementation. 
Some States have privacy laws which prohrbit or limit  the release of license and 
registration information.  Some States do not have automated files, which eliminates 
the possibility of a computer match.  Also, there is no legislative authority for 
requiring States to cooperate with a computer match.  Any one of these problems 
could severelyrestrict carriers successin accessingthe information maintained by 
State authorities. 
. 	 Our primary concern with the computer match proposal, however, is the return for 
the cost of such an operation.  We project costs of over $1 million nationally to 
implement such a data exchangeat all carrier sites and over $250,000annually for 
ongoing activities.  The data included in the OIGs report does not indicate that we 
can expect a significant return on our investment. Becauseof the severebudget 
restrictions under which we operate, we do not believe that this data match wiil be 
cost effective.  However, if carriers can establishdata exchangeswith State licensing 
authorities without charge and with minimal administrative costs,we will  certainly 
encouragethem. 
We believe that the Unique PhysicianIdentification Number (UPIN)  requirements 
firmly  establishedboth a means and a HCFA  commitment to maintaining accurate 
provider number information.  The physicianscovered by the UPIN  requirements 
(medical doctors, doctors of osteopathy,dentists, optometrists, chiropractors and 
podiatrists) make up the majority of the Medicare providers subject to license 
requirements.  In the future, the UPIN  may include additional limited license 
practitioners, such as clinical psychologists,clinical social workers and certified 
registered nurse anesthetists.  Page3 
The UPIN  processrequires the following from carriers when a LlPIN is established: 
0  verification of State licensure to practice, 
0  verification that a physician is not sanctioned,and 
0  information about prior  out-of-State practice, if any. 
After  establishinga record on the UPIN  Registry, which servesas a national 
clearinghouse,carriers.receive physician-specificsanction information from the 
Registry on a quarterly basis. This data is taken from OIGs report on Medicare 
fraud and abuse and other sanctions. Caniers use this data to ensure that 
sanctioned physiciansdo not have active status in the provider Gles. 
In addition to the UPIN system,HCFAs Health Standardsand Quality Bureau 
(HSQB)  maintains a.certification processwhich requires State licensure for 
Medicare participation by ceti  other providers and suppliers.  Included in 
HSQBs certification processare physical therapists, occupational therapists, 
independent laboratories, ambulatory surgical centers and cardiac rehabilitation  . 
centers. 
Recommendation 4 
HCFA  should evaluate provider number controls establishedabove as a part of its 
regular carrier Contractor Performance Evaluation Program (CPEP). 
Resnonse 
HCFA  does not concur with  this recommendation. With the issuanceof the carrier 
manual revision proposed in responseto the second recommendation,the existing 
CPEP standard used to measure carrier adherenceto HCFAs policies will  evaluate 
compliance with  this new requirement.  Establishing a specific standard for provider 
number control would create problems associatedwith  the measurementof a 
relatively small area of carrier claims processingresponsibility.  : 
Allegation of the Existence  of a Material  Weakness 
HCFA  does not agree that a material internal control weaknesserdstsin HCFAs 
direction to carriers, or in the provider number carrier controls.  This situation 
clearly does not meet the Office of Management and Budgets or the Departments 
definition  of a material weakness.  Page 4. 
HCFA  believes that OIG did not consider the integral part that sanctionsunder 
Section 1128(b)(4) of the Social Security Act  (the Act)  play in maintaining the 
integrity of provider numbers. 
Traditionally,  HCFAs sanction staff collected information from Medical Licensing 
Boards and imposed sanctionsprohibiting those providers who had lost their legal 
authority to practice from participating in the Medicare and Medicaid programs 
under Section 1128(b)(4) of the Act.  Medicare carriers were informed of the 
Licensing Board adverseactions during the development of the sanction .case,and 
when the sanction itself was imposed.  HCFA  relied on the sanctionsprocessto 
ensure that all Medicare carriers were informed of Medical Licensing Board adverse 
actions.  However, a number of years ago, HCFAs Program Integrity function was 
transferred permanently to OIG, along with the staff and budget for that function. 
Sanctioning of Medicare providers then became the responsibility of OIG.  We 
believe that a continuation of this effort  is essentialin maintaining the integrity of 
provider numbers. 
OIGs rationale for determining that a material internal control weaknessexists, 
appears to be based on OIGs findings that HCFAs carriers are unable to timely  . 
identify and restrict paymentsto providers who have lost their  legal authority to 
practice becauseof adverseactions by Medical Licensing Boards.  HCFA  agrees 
this problem exists and believes that the solution to the problem will  require more 
involvement by OIGs sanction staff.