Department  of Health  and Human  Sewices 
OFFICE OF

INSPECTOR GENERAL

ELECTRONIC  DATA INTERCHANGE

AND  PAPERLESS PROCESSING:

ISSUES AND  CHALLENGES

f,* SERVICE$ 
&  Lfa 
$ 7 
GIBBS BROWN 
JUNE 
g
<  Inspector  General
2 MARCH
3
%#-2#    1994 
%d~~ 
oEI-12-93-Oooso  OFFICE  OF INSPECTOR  GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 
amended, is to protect the integrity of the Department  of Health and Human SeMces (HHS) 
programs as well as the health and welfare of beneficiaries served by those programs.  This 
statutory mission is carried out through a nationwide network of audits, investigations, and 
inspections conducted by three OIG operating components:  the Office of Audit SeMces, the 
Office of Investigations, and the Office of Evaluation and Inspections.  The OIG also informs 
the Secretary of HHS of program and management problems and recommends courses to 
correct them. 
OFFICE  OF AUDIT  SERVICES 
The OIGS Office of Audit Services (OAS) provides all auditing services for HHS, either by 
conducting audits with its own audit resources or by overseeing audit work done by others. 
Audits examine the performance of HHS programs and/or its grantees and contractors in 
carrying out their respective responsibilities and are intended to provide independent 
assessments of HHS programs and operations in order to reduce waste, abuse, and 
mismanagement and to promote economy and efficiency throughout  the Department. 
OFFICE  OF INVESTIGATIONS 
The OIGS Office of Investigations (01) conducts criminal, civil, and administrative 
investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 
unjust enrichment by providers.  The investigative efforts of 01 lead to criminal convictions, 
administrative sanctions, or civil money penalties.  The 01 also oversees State Medicaid fraud 
control units which investigate and prosecute fraud and patient  abuse in the Medicaid program. 
OFFICE  OF EVALUATION  AND INSPECIIONS 
The OIGS Office of Evaluation and Inspections (OEI) conducts short-term management  and

program evaluations (called inspections) that focus on issues of concern to the Department,

the Congress, and the public.  The findings and recommendations contained in these inspection

reports generate  rapid, accurate, and up-todate  information on the efficiency, vulnerability,

and effectiveness of departmental  programs.  This report was prepared  under the direction of

Penny Thompson, Chief, Health Care Branch, Office of Evaluation and Inspections.

Participating in this project were the following primary authors:

Thomas A. Noplock, Office of Evaluation and Inspections

Stephen W. Greenfield, Office of Audit SeMces

Thomas R. Hoffman, Office of General Counsel, Inspector General Division

Thomas J. Elliott, Office of Audit Services

For additional copies of this report, please contact Thomas A. Noplock at (410) 966-3144.
 Department  of Health  and Human  Services 
OFFICE OF

NSPECTOR  GENERAL

ELECTRONIC  DATA INTERCHANGE

AND  PAPERLESS PROCESSING:

ISSUES AND  CHALLENGES

MARCH  1994  OEI-12-93-00080
 EXECUTIVE  SUMMARY

PURPOSE 
The  purpose  of this document  is to  (1) identi~  emerging  issues  in the  expansion  of the 
Health  Care  Financing  Administrations  (HCFA)  use of electronic  data  interchange 
(EDI)  and  related  technology  to achieve  paperless  processing,  and  (2) discuss the 
Office  of Inspector  Generals  (OIG)  current  plans  to provide  oversight  of HCFAS 
strategy  to implement  a paperless  environment.  We have  developed  it through  a 
review  of literature  and  consultation  within  the  OIG,  and  with HCFA  and  others. 
BACKGROUND 
Electronic  Data  Interchange  is the  electronic  transfer  of information,  such as 
electronic  media  claims,  in a standard  format  between  trading  partners.  As it relates 
to health  care,  this new technology  will allow entities  within  the  health  care  system, 
connected  by an integrated  system  of electronic  communication  networks,  to exchange 
medical,  billing,  and  other  information  and  process  transactions  in a manner  which  is 
fast  and  cost effective.  Most  of these  improvements  are  likely to result  from  the 
significant  reduction  or elimination  of paper  transactions. 
ISSUES 
The  HCFAS  far-reaching  implementation  of EDI  and  paperless  processing  contains 
many  parts  which  all relate  to the  larger  strategy  and  goals  of this initiative.  Among 
the  significant  issues  affecting  this strategy  are  the  following: 
F	 Systems--such  as the  Medicare  Transaction  System  (MTS),  Medicaid 
Management  Information  Systems  (MMIS),  and  point-of-service  claims 
management  systems  under  Medicaid--to  process  electronically  submitted  claims 
and  manage  data  more  efficiently. 
  Standardization,  to facilitate  the  electronic  flow of claims,  patient,  and 
reimbursement  data  between  providers,  payers,  and  quality-of-care  reviewers. 
  Incentives  and barriers, to encourage  providers  to submit  claims  and  patient  data 
electronically. 
	 Companion  technologies,  such as smart  cards  for  computerized  patient 
identification  and  medical  records,  and  national  data  communications  networks 
for transmission  of health  care  data  to complete  the  electronic  cycle. 
We  discuss  the  need  for a cohesive  strategic  systems  plan  covering  EDI  and  paperless 
processing,  to encourage  HCFAS  information  resources  management  program  to 
address  Medicare  contractor  systems  and  Federal  Medicaid  initiatives.  The  implementation  of these  new systems,  in particular,  carries  with it myriad 
questions  regarding  trustworthiness  and  reliability  of data  as it moves  from  one  partner 
in electronic  commerce  to another  and  from  one  process  to  another.  Specific  issues 
raised  with regard  to electronic  submission  and  processing  of claims  include: 
F	 Confidentiality  and privacy  of patient  records, to ensure  that  the  confidentiality  of 
personally-identifiable  health  insurance  data  be  strictly maintained  and 
the  privacy  of patients  be  maintained. 
	 Internal  controls, to address  the  adequacy  of management  controls  over 
operations  and  specific  requirements  for controls  to safeguard  assets 
against  waste,  fraud,  and  abuse. 
	 Audits  and  certification,  to place  more  focus  on systems  at the  provider 
level  and  to ensure  that  all EDI  and  paperless  processing  systems  are 
trustworthy  and  reliable. 
	 Contractor con.ict  of interest, to pursue  the  Medicare  contractor  conflict 
of interest  issue  as it relates  to proprietary  EDI  and  paperless  processing 
market-driven  ventures. 
F Valid contracts,  to determine  the  degree  of compliance  of current  and 
planned  Medicare  contract  requirements  with the  National  Institute  of 
Standards  and  Technology  standards. 
	 Legal  use of information  submitted,  to ensure  the  integrity  of information 
through  the  use  of provider  agreements,  a valid  chain  of custody, 
attestation  and  originator  authentication,  and  the  need  for audit  trails. 
CONCLUSION 
This  document,  prepared  in response  to HCFAS  briefing  for OIG  personnel  on EDI 
and  paperless  processing  issues  and  its request  for more  information  on the  OIGS 
concerns  and  plans,  has identified  numerous  issues  and  goals  related  to HCFAS use of 
EDI  and  paperless  processing  technology.  Issues  related  to the  overall  strategy  of this 
initiative  concern  the  development  of various  systems  which will allow HCFA  to 
process  electronically  submitted  claims  more  efficiently.  Other  broad  issues  are 
standardization,  incentives,  companion  technologies,  Medicare  contractor  systems,  and 
Federal  Medicaid  initiatives. 
This  document  also raises  issues regarding  the  trustworthiness  and  reliability  of data  as 
it moves  from  one  partner  in electronic  commerce  to another  and  from  one  process  to 
another.  These  issues include  confidentiality  and  privacy,  management  controls  over 
operations,  internal  controls,  audits  and  systems  certifications,  Medicare  contractor 
conflict  of interest,  validity  of contracts,  and  the  integrity  of information.  Besides 
having  a significant  impact  on HHS  and  HCFAS ability  to manage  the  Medicare  and 
Medicaid  programs,  these  issues  are  critical  to the  detection  of fraud  and  abuse.  We 
plan  to analyze  many  of these  issues for the  purpose  of preparing  our workplan  over 
the  next  few years. 
ii  AGENCY  COMMENTS 
The  Health  Care  Financing  Administration  (HCFA)  commented  on a draft  version  of 
this report.  The  HCFA  suggested  changes  in the  report  to better  reflect  its activities 
and  those  of the  Department  with respect  to EDI  and  paperless  processing,  made 
suggestions  about  the  focus  of OIGS work  in this area,  and  gave  us technical 
comments.  We  have  revised  our  report  to address  many  of HCFAS comments  and 
also provide  additional  comments  on HCFAS response  in Appendix  B.  The  full text 
of HCFAS comments  can be found  in Appendix  A. 
... 
111  TABLE  OF  CONTENTS

EXECUTIVE  SUMMARY

INTRODUCTION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..1

ISSUES  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...3

POLICY  DIRECTION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...3

SYSTEMS  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...3

STANDARDIZATION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...6

INCENTIVES  AND  B~RIERS  . . . . . . . . . . . . . . . . . . . . . . . . . . ...7

COMPANION  TECHNOLOGIES  . . . . . . . . . . . . . . . . . . . . . . . . . ...10

COHESIVE  STRATEGIC  SYSTEMPL~  . . . . . . . . . . . . . . . . . . . .  12

POLICY  IMPLEMENTATION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...14

CONFIDENTIALITY  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...14

INTERNAL  CONTROL  . . . . . . . . . . . . .,  . . . . . . . . . . . . . . . . . ...15

AUDITS  AND  CERTIFICATION  . . . . . . . . . . . . . . . . . . . . . . . . . ...16

CONTRACTOR  CONFLICT  OF  INTEREST  . . . . . . . . . . . . . . . . . . .  19

VALID  CONTRACTS  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...20

LEGAL  USE  OF  INFORMATION  . . . . . . . . . . . . . . . . . . . . . . . . ...21

CONCLUSIONS  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...25

APPENDIX  A - AGENCY  COMMENTS  . . . . . . . . . . . . . . . . . . . . . . . . . . . ..  A-l

APPENDIX  B - OIG RESPONSE  TO AGENCY  COMMENTS  . . . . . . . . . . . . . B-1

APPENDIX  C - ACRONYMS  USED  IN THIS  REPORT  . . . . . . . . . . . . . . . . .  C-1
 INTRODUCTION 
PURPOSE 
The  purpose  of this document  is to  (1) identify  emerging  issues in the  expansion  of the 
Health  Care  Financing  Administrations  (HCFA)  use  of electronic  data  interchange 
(EDI)  and  related  technology  to achieve  paperless  processing,  and  (2) discuss  the 
Office  of Inspector  Generals  (OIG)  plans  to provide  oversight  of HCFAS  strategy  to 
implement  a paperless  environmental  We  have  developed  it through  a review  of 
literature  and  consultation  within  the  OIG,  and with HCFA  and  others. 
BACKGROUND 
Electronic  Data  Interchange  is the  electronic  transfer  of information,  such  as 
electronic  media  claims,  in a standard  format  between  trading  partners.  As it relates 
to health  care,  this new technology  will allow entities  within  the  health  care  system, 
connected  by an integrated  system  of electronic  communication  networks,  to exchange 
medical,  billing  and  other  information  and  process  transactions  in a manner  which  is 
fast  and  cost effective.  Most  of these  improvements  are  likely to result  from  the 
significant  reduction  or elimination  of paper  transactions. 
Electronic Billing 
The  HCFA  has  encouraged  electronic  submission  of claims  under  Medicare  for 
some  time,  and  has recently  stepped  up its efforts  to lead  increased  electronic 
billing  under  the  Medicaid  program.  New incentives  for the  use  of electronic 
billing  are  now in place.  Providers  submitting  claims  electronically  are  paid 
faster  than  providers  submitting  paper  claims.  The  HCFA  also has taken  steps 
to move  towards  adoption  of nationwide  standardized  electronic  billing  formats 
for both  Part  A and  Part  B. 
lThis  document  describes  OIG  projects  which  are  either  in progress  or planned  for 
completion  by the  end  of FY  1995.  These  projects  are  subject  to change  depending 
on our  availability  of resources,  continuing  review  of priorities,  and  assessment  of new 
research  in the  field.  Electronic Adjudication  and Payment 
All payers,  including  the  Medicare  and  Medicaid  programs,  are  moving  towards 
paperless  billing  and  adjudication  and  payment  of claims.  HCFA  plans  to have 
the  Medicare  Transaction  System  (MTS)  in place  by 1998.  This system,  which 
will combine  Part  A and  Part  B of the  Medicare  program  for the  purposes  of 
claims  submission,  adjudication  and  payment,  will replace  the  14 software 
processing  programs  used  by the  48 fiscal intermediaries  and  34 carriers  that 
currently  process  Medicare  claims. 
Furthermore,  most  of the  health  care  reform  bills now being  considered  include 
provisions  for simplification  in the  administration  of health  care  benefits 
through  the  use  of standardized  electronic  billing  and  payment  procedures. 
Several  of the  reform  bills also call for use of an  electronically  readable  card  to 
be used  to verify eligibility for benefits. 
Beyond the Cliiims Environment 
Other  initiatives  will also use technology  to improve  the  health  care  information 
system.  The  Computer-Based  Patient  Record  Institute  (CPRI)  is the 
organization  that  has been  given the  responsibility  to initiate  and  coordinate  all 
activities  which will establish  the  routine  use  of computer-based  patient  records 
in all health  care  settings  by the  year  2001.  Its mission  is to support  the 
effective  and  efficient  use  of computer-based  patient  information  and  to foster 
the  computer-based  patient  record  (CPR)  as the  primay  vehicle  for  collecting 
patient  data. 
These  initiatives  are  important  ones  for the  entire  health  care  system,  and  for the 
Medicare  and  Medicaid  programs  in particular.  They  hold  out  the  promise  of more 
efficient  administration  of program  benefits,  faster  claims  processing,  reduced 
administrative  costs and  hassle  for both  providers  and  program  administrators,  and 
more  effective  coordination  of benefits  and  care  for patients.  Yet,  they  also hold  risks, 
As with  any implementation  of major  new initiatives,  thoughtful  and  careful  planning  is 
essential.  Coordination  among  groups  within  and  outside  the  Department  of Health 
and  Human  Services  must  take  place  to avoid  stumbling  blocks.  Goals,  objectives  and 
timetables  must  be  set.  All tasks  must  work  together  to form  a coherent  strategy. 
New vulnerabilities  and  problems  which  might  be  introduced  by new systems  and 
strategies  must  be  anticipated  and  overcome. 
2
 ISSUES

Major  issues  relating  to HCFAS EDI  and  paperless  processing  initiatives  can be 
grouped  into  two major  categories:  (l)policy  direction;  and(2)  policy 
implementation,  including  trustworthiness  and  reliability  of systems. 
POLICY DIRECTION 
The  HCFAS  far-reaching  EDI  and  paperless  processing  initiative,  in both  the 
Medicare  and  Medicaid  programs,  contains  many  parts.  Each  of these  parts  is worthy 
of examination  in its own right  and  as it relates  to the  larger  strategy  and  goals  of this 
initiative.  Among  the  significant  elements  of this strategy  are  the  following: 
	 Systems--such  as the  Medicare  Transaction  System  (MTS),  Medicaid 
Management  Information  Systems  (MMIS),  and  point-of-service  claims 
management  systems  under  Medicaid--to  more  efficiently  process 
electronically  submitted  claims  and  manage  data. 
E  Standardization,  to facilitate  the  electronic  flow of claims,  patient,  and 
reimbursement  data  between  providers,  payers,  and  quality-of-care  reviewers. 
F  Incentives,  to encourage  providers  to submit  claims  and  patient  data 
electronically. 
	 Companion  technolo~es, such as smart  cards  for computerized  patient 
identification  and  medical  records,  and  national  data  communications  networks 
for transmission  of health  care  data  to complete  the  electronic  cycle. 
We  also discuss the  need  for  a cohesive  strategic  systems  plan  covering  EDI  and 
paperless  processing,  to  encourage  HCFAS information  resources  management 
program  to  address  Medicare  contractor  systems  and  Federal  Medicaid  initiatives. 
SYSTEMS 
M2dicare ~ansaction  $ystern (MIX) 
The  HCFAS  48 fiscal intermediaries  and  34 carriers  currently  use  14 shared  software 
systems  to process  bilk  and  pay claims.  Under  MTS,  HCFA  plans  to replace  the 
current  Part  A and  Part  B systems  with one  unified  system.  This  new system  will 
consolidate  the  claims-processing  function  into  anywhere  from  1 to  10 contractors. 
Current  contractors  would  continue  to handle  beneficiary  inquires  and  payment 
safeguard  functions,  and  would  input  paper  claims  to electronic  format  before  sending 
them  to the  processing  centers.  The  MTS  is projected  to be  in place  by 1998 and  is 
expected  to make  it easier  for HCFA  to make  the  system  changes  required  to put  new 
Medicare  regulations  and  payment  policies  into  effect.  The  MTS  is also expected  to 
make  it easier  for providers  to inquire  about  the  status  of their  outstanding  claims. 
3
 The  HCFA  feels  that  MTS  is necessary  to help  control  the  rise in Medicare  processing 
costs since  it projects  a 50 percent  increase  in claims volume  by 1997. 
Recently,  HCFA  awarded  a $19 million,  six-year contract  for MTS  design  and 
development  support  services  to GTE  Government  Systems  Corporation.  The 
General  Accounting  Office  (GAO)  was asked  by Congress  to review  the  MTS 
procurement.  The  GAO  final report,  transmitted  to HHS  on March  1, 1994, 
recommended  that  the  Secretary  ensure  continuous  involvement  in MTS  by HCFA  top 
management,  participation  by Department  information  resources  management  officials 
and  other  experts,  and  reporting  on progress  and  project  status  each  January  to 
congressional  appropriations  and  oversight  committees. 
The  OIG  has previously  recommended  that  HCFA  undertake  a strategic  planning 
initiative  to streamline,  consolidate,  and  integrate  Medicare  claims  processing.  The 
HCFA  has indicated  that  MTS  addresses  this recommendation.  Thus,  OIG  plans  to 
review?the  MTS  systems  design  process,  with particular  emphasis  on how HCFA 
plans  to improve  payment  safeguards,  provider  accountability,  internal  systems 
controls,  and  financial  management  through  implementation  of the  system.  The 
results  of this review  should  clari~  issues  raised  by GAO  and  should  be  of use  to 
HCFA  as specifications  are  developed  for the  new MTS,  particularly  with respect  to 
the  sufficiency  of HCFAS safeguards  designed  to ensure  proper  payment. 
Medicaid Management  Infomuition  $wtems  (MUIS) 
Each  of the jurisdictions  (State  or territory)  operating  a Medicaid  program  is entitled 
to enhanced  Federal  financial  participation  for the  development  and  operation  of a 
Medicaid  claims  processing  system--referred  to by HCFA  as a Medicaid  Management 
Information  System--in  accordance  with minimum  Federal  standards.  All but  one  of 
the  Medicaid  jurisdictions  have  either  implemented  such a system  or are  in the  process 
of doing  so. 
A number  of these  systems  have  either  been  installed  initially  or have  been  replaced 
within  the  last  5 years.  Many  of these  newer  MMIS  incorporate  in their  design 
features  (such  as State-wide  data  communications  networks)  to facilitate  electronic 
billing,  adjudication,  and  payment  of Medicaid  claims.  And,  a number  of these 
systems  are  integrated  with State  Family  Assistance  Management  Information  Systems 
(FAMIS)  and  State-wide  data  communications  networks  to facilitate  EDI  and 
paperless  processing  in both  the  Medicaid  and  Aid for Families  with Dependent 
Children  programs. 
Review  of Medicare  Bill and  Claim  Processing:  Opportunities  for Long  Term 
Improvement,  A-14-91-02532,  August  1992. 
3As  art  of Electronic  Claims  Processing  - Medicare,  planned  for  completion  at 
P
the  end  of FY  1995. 
4  The  OIG  plans  to review  recent  State  efforts  to implement  MMIS  and  integrated 
FAMIS/MMISto  determine  the  adequacy  of the  planning  process,  the  thoroughness  of 
the  risk analysis,  and  the  degree  of success  in meeting  system  goals. 
MedicaidPnotiofServtce  (POS)  Claims ManagementSystems 
The  OIG  will review  the  States  use  of MMIS  data  in conducting  utilization  review  and

analysis  as part  of our  planned  work  in assessing  innovative  approaches  to Medicaid

utilization  review.

Point  of Service  claims  management  systems  use  computers  and  telecommunications

networks  to perform  one  or more  of four  related  but  distinct  claims  management

functions.  These  are  eligibility verification,  claims  submission,  claims  adjudication,  and

utilization  review.  POS  systems  allow all of these  functions  to be  performed  in a

matter  of seconds,  before  or while the  services  are  being  dispensed.  Most  existing

POS  systems  are  in the  private  sector  and  are  used  primarily  for the  management  of

prescription  drug  claims.

The  Secretary  of Health  and  Human  Services  (HHS),  in response  to requirements

included  on OBRA  1990 and  in conjunction  with the  MMIS  program,  has  encouraged

State  Medicaid  programs  to implement  POS  systems  for managing  prescription  drug

claims.  The  Federal  Government  provides  up to 90 percent  Federal  financial

participation  for the  development  of these  systems  and  has  authorized  the  Secreta~  to

waive  certain  paperwork  requirements.

The  OIG  has  performed  a study of Medicaid  POS  systems.4  In this study, the  OIG

found  that  POS  systems,  in the  two States  that  have  used  them,  have  saved  money  and

have  enhanced  program  administration.  It also found  that  few States  plan  to acquire

POS  systems.  This is due  primarily  to the  barriers  that  have  limited  States

implementation  of POS  systems  and  the  inadequate  and  confusing  information  that

many  States  have  received  about  POS  systems.  We  plan  to examine  these  issues

further  in our  upcoming  MMIS  review  and  to conduct  a further  study  of States

implementation  of the  drug  utilization  review  (DUR)  requirements  of OBRA  1990.

Since  the  OIG  study on Medicaid  POS  systems,  8 State  Medicaid  agencies  (SMA)

have  reported  implementation  systems  for pharmacies  (including  6 systems  with

utilization  review  capability).  Ten  additional  SMAS indicated  that  they were

developing  POS  modules  for implementation  by the  end  of calendar  year  1993, and  21

of the  remaining  33 SMAS noted  that  they were  considering  the  development  and

implementation  of POS  modules  for completion  by late  1994.

4 Point-Of-Service  Claims  Management  Systems  For  Medicaid,  OEI-01-91-00820, 
May  1992. 
5  STANDARDIZATION 
When  encouraging  the  development  anduseof  anynew  emerging  technology,  the 
establishment  of standards  becomes  a critical  issue which  can  make  or break  the 
technology.  Take  the  example,  from  a few years  ago,  of quad-stereo.  The  fate  of this 
superior  sound  technology  was in the  hands  of a few  manufacturers  who  could  not 
agree  on a standardized  equipment  format.  Because  of the  lack  of standardization,  the 
technology  never  made  the  market  penetration  it was expected  to achieve.  While 
EDI,  unlike  quad-stereo,  is here  to stay, the  fate  of its universal  acceptance  does  lie in 
the  hands  of those  groups  which  are  in the  position  to mandate  equipment  and 
software  standards. 
Currently,  there  is no national  group  which is responsible  for the  establishment  of a 
uniform  data  set and  uniform  data  element  definitions  with respect  to health  care 
transactions.  Informational  standard  setting  organizations,  such  as the  National 
Uniform  Billing Committee  and  the  Uniform  Claim  Form  Task  Force,  have  not  been 
given a clear  role  in defining  data  element  definitions  and  reporting  requirements. 
Also, compliance  with  the  recommendations  made  by these  groups  is generally 
voluntary.  There  is an  additional  problem  caused  by the  lack of coordination  between 
the  groups  that  develop  the  electronic  formats  (e.g. the  American  National  Standards 
Institute  or ANSI)  and  the  standard  setting  groups.  The  standard  setting  groups  are 
not  always allowed  to review  the  new EDI  transaction  data  sets developed  by ANSI 
and  others. 
The  Federal  Government  has the  opportunity  to take  the  lead  in encouraging  (if 
necessary  mandating)  and  guiding  the  development  of EDI  standards.  But,  if EDI  is 
to be  standardized  throughout  the  entire  health  care  community,  the  Federal 
Government  must  be  prepared  to modify  substantially,  if necessary,  the  current 
systems  utilized  by Medicare,  State  Medicaid  programs,  the  Department  of Veteran 
Affairs,  Civilian  Health  and  Medical  Program  of the  Uniform  Services  (CHAMPUS), 
and  the  Indian  Health  Service. 
In the  previous  administration,  Secretary  Sullivan  of HHS  established  the  Workgroup 
for Electronic  Data  Interchange  (WEDI)  to work  with the  insurance  industry  on 
standardizing  electronic  billing, remittance  advice  and  banking  formats,  and  moving 
towards  an  all-electronic  environment  for processing  of health  insurance  claims  in the 
public  and  private  sectors.  The  impetus  for this effort  was a generally-accepted 
premise  that  costs of administering  Medicare,  Medicaid,  and  private  health  insurance 
plans  and  the  paperwork  burden  imposed  on providers  by the  insurance  industry  are 
inordinately  high without  significantly  constraining  health  care  costs. 
Under  this effort,  some  progress  in standardization  was made.  The  HCFA  began 
active  participation  in the  ANSI  committee  establishing  standardized  electronic 
formats  for the  health  insurance  industry.  The  HCFA  then  issued  regulations  calling 
for the  use  of ANSI  standard  transactions  for electronic  remittance  notices  and 
6
 payments  by both  the  Medicare  and  Medicaid  programs.  The  HCFA  is planning  to 
implement  a standard  uniform  institutional  billing form  for Medicare  and  Medicaid 
over  the  next year.  Legislation,  which would  have  empowered  national  standards 
organizations  to establish  mandatory  standards  for  electronic  submission  and  payment 
of claims,  facilitated  establishment  of a national  telecommunications  network  for 
health  care  administrative  data,  and  promoted  the  clearinghouse  concept  to improve 
the  coordination  of benefits  between  various  public  and  private  payers,  was not  passed 
in the  last  session  of Congress.  However,  the  Clinton  Administration  has recognized 
the  importance  of standards  and  integrated  health  information  systems  and 
communications  networks  as a way to promote  administrative  simplification  in health 
care.  It has included  establishment  of such standards  and  networks  under  the  auspices 
of a National  Health  Board  as part  of its health  care  reform  proposal. 
We  plan  to track  and  analyze  progress  by the  Department  and  HCFA  in fostering 
standardization  as part  of our  ongoing  assessment  of HCFAS ability  to move  to 
paperless  processing  in the  age  of EDI  and  electronic  commerce. 
INCENTIVES  AND  BARRIERS 
?%ehxfidkm  Pmpective 
An obvious  obstacle  to getting  providers  to buy into an EDI  and  paperless

processing  system  is simply the  resistance  to change  to a new method  of doing

business.  Then  there  are  more  substantiated  reasons  for not  wanting  to use EDI  and

paperless  processing.  One  example  is that  some  provider  types,  especially  DME

suppliers,  have  refrained  from  using EDI  and  paperless  processing  because  there  are

no electronic  methods  for submitting  attachments.  Another  reason  for not  using EDI

is the  lack  of standard  data  sets.  This forces  many  providers  to adopt  an electronic

format  which  is compatible  with the  payer  to whom  the  provider  submits  the  majority

of their  bills.  Finally,  there  are  the  additional  costs incurred  by a provider  who wishes

to convert  to EDI  and  paperless  processing.

Issues which  may need  to be  addressed  include:

b	 What  education  programs  can be  put  in place  to help  overcome  provider 
resistance  to change? 
b  Should  HCFA  create  EDI  and  paperless  processing  benefit  models  based  on 
provider  size, geographic  location,  and  patient  mix, in order  show providers 
how the  benefits  of EDI  and  paperless  processing  relate  to them? 
	 What  incentives  are  needed  to bring  providers  into  the  EDI  and  paperless 
processing  environment?  What  about  tax incentives,  low or no-cost  software,  or 
the  elimination  of the  Medicare  floor  used  to pay claims? 
7
 	 What  needs  to  be done  to ensure  that  providers  adopt  a uniform  EDI  and 
paperless  processing  environment? 
The  HCFA  Bureau  of Program  Operations  (BPO)  is currently  studying  those 
attachments  to bills, such as Certificate  of Medical  Necessity  (CMN)  forms,  that  can 
be  standardized,  automated  or eliminated.  The  BPO  is also  enlisting  the  support  of 
national  provider  organizations  and  has  developed  a publicity  campaign  to promote 
the  adoption  of EDI  technology.  The  BPO  has two point-of-service  pilot  projects 
underway  and  has  evaluated  a number  of innovative  proposals  for EDI  and  paperless 
processing  projects. 
Providers  who decide  to implement  new EDI  and  paperless  processing  technology  will 
be faced  with incurring  four  types  of costs.  These  costs are  for hardware,  software 
purchasing  or leasing,  installation  and  training,  and  telecommunication  charges.  Since 
most  of these  costs are  relatively  fixed (they  exist whether  the  provider  submits  one 
claim,  one  hundred  claims,  or one  million  claims)  and  the  gross savings accrue  on a 
per  claim  or electronic  transaction  basis  (the  more  claims  or electronic  transactions 
the  more  savings),  overcoming  these  fixed costs is the  principal  factor  that  prevents 
low-volume  providers  from  acquiring  EDI  and  paperless  processing  technology.  This 
problem  is compounded  by the  fact  that  a significant  number  of small  providers, 
especially  rural  providers,  lack  computerized  offices.  For  these  providers,  investing  in 
the  required  costs listed  above  would  probably  not  be  cost effective. 
Issues with regard  to small  providers  include  the  following: 
	 Will small  providers,  especially  rural  providers  with small  Medicare  patient 
loads,  be  required  to invest  in EDI  and  paperless  processing  technology? 
	 What  are  the  costs  associated  with conversion,  installation,  and  maintenance  of 
these  systems  and  can  small providers  justify  these  costs?  Can  small  providers 
pool  operational  costs? 
F  What  alternatives  exist for  small providers? 
The  HCFA  BPO  is currently  taking  inventory  of all of the  low cost software  that 
Medicare  contractors  are  required  to make  available  to providers.  The  HCFA 
Regional  Offices  will then  determine  contractor  compliance.  The  BPO  is also  in the 
process  of evaluating  a number  of pilot  projects  which  are  using emerging  technologies 
in the  payment  area.  Some  of these,  one  example  being  fax imaging  technology,  may 
be  feasible  for small  providers  to use  as a cost effective  substitute  for a complete  EDI 
and  paperless  processing  system. 
The  OIG  plans  to assess  how different  providers  can be brought  into  the  EDI  and 
paperless  processing  environment,  what  barriers  exist for providers,  and  whether 
HCFAS efforts  address  those  barriers  and  provide  proper  incentives  for providers. 
8 l%e HCFAk  Peiqxctive 
For  the  short  term,  some  of the  key issues  of concern  to the  OIG  are  as follows: 
	 What  changes  have  been  made  in Medicare  claims  processing  as a result  of the 
implementation  of Medicare  national  claims  formats  and  electronic  funds 
transfer  (EFT)? 
F	 Have  these  changes  been  implemented  successfully,  i.e., is there  a probability  of 
payment  errors  or fraud? 
The  HCFA  has identified  increased  electronic  media  claims  (EMC)  and  EFT  as the 
primary  means  for  effecting  short  term  reductions  in Medicare  claims-processing  unit 
costs.s  And,  by the  end  of Fiscal  Year  1993, HCFA  will have  invested  over 
$21 million  in EMC/EFT  improvements  at the  Medicare  contractors. 
The  HCFA  as established  the  following  goals for EMC: 
F	 Increase  the  rate  of EMC  to  100 percent  for hospitals  and  75 percent  for  all 
other  providers  within  3 years. 
F	 Increase  the  rate  of EFT  for Medicare  payment  to hospitals  to  100 percent 
within  3 years. 
F  Increase  the  overall  cost effectiveness  of EMC. 
These  are  challenging  goals,  and  we are  concerned  that,  with limited  resources  and 
many  other  operational  issues that  had  to be  dealt  with  at the  same  time,  HCFAS 
planning  and  execution  to reach  these  goals  may not  have  been  adequate.  To  address 
these  concerns,  we have  initiated  a reviewG during  which we will determine  if HCFA: 
F	 Adequately  assessed  benefits  and  costs.  (The  HCFA  believes  that  it will realize 
significant  cost savings from  full EFT  implementation.) 
Based  on experience  of the  health  insurance  industry  as a whole,  HCFA  believes 
that  it is $0.50 per  claim  cheaper  to process  an electronically  submitted  claim  than  a 
hard-copy  claim.  This  difference  results  primarily  from  data  entry  of hard-copy  claims 
into  electronic  claims  processing  systems. 
The  HCFA  believes  that  even  more  savings may  accrue  from  EFT  and 
electronic  notice  of remittance,  rather  than  payment  by check  and  paper  remittance 
advice.  These  savings result  primarily  from  reduced  mail  room  and  postage  costs. 
Electronic  Claims  Processing  - Medicare,  which  is currently  in the  survey phase. 
9  F	 Adequately  assessed  potential  risks and vulnerabilities  inherent  in EMC,  EIW, 
and  paperless  processing.  (For  example,  HCFA  does  not  believe  that  benefit 
payments  made  under  EFT  will be vulnerable  to errors  and/or  fraud  because 
the  involved  EFT  parties  of the  contractors,  Medicare  banks,  and  the 
Automated  Clearing  House  operators  are  bound  by strict  operating  guidelines 
and  Federal  regulations  concerning  the  initiation,  transmission,  and  receipt  of 
EFTs.) 
	 Provided  adequate  instructions,  lead  time,  and  resources  to the  Medicare 
contractors.  (The  HCFA  has been  providing  technical  specifications, 
procedural  guidance,  and  appropriate  funding  since  1990.) 
F	 Sufficiently  track  progress  during  implementation  in a timely  and  effective 
manner  to identify  problems  and  resolve  them.  (The  HCFA  believes  that  it has 
been  diligent  in tracking  the  progress  of contractors,  providers,  and  SMAS in 
implementing  EFT.) 
We will also determine  the  degree  of success  that  the  Medicare  contractors  are  having 
in implementing  the  changes  called  for,  and  reaching  the  EMC~FT  targets  set by, 
HCFA. 
COMPANION  TECHNOLOGIES 
Smart Cards 
Smart  cards  are  wallet-sized,  machine-readable  cards  that  contain  an integrated  chip 
(its own computer)  which  can  store  an individuals  medical  history  and  other  forms  of 
data.  In its simplest  form  these  cards  allow access  to a health  care  plan  database. 
The  health  care  industry  continues  to rely on identification  cards  to recognize  plan 
members.  Because  of their  extensive  use,  cards  in one  form  or another  are  here  to 
stay.  As these  identification  cards  become  more  sophisticated  and  become  smart 
cards,  the  OIG  should  be  concerned  about  two main  issues.  These  issues  are  the  cost 
of the  cards  and  standardization. 
The  cost of machine-readable  cards  (equipment  and  installation)  and  the  necessary 
infrastructure  (training)  to support  the  cards  are  certainly  major  drawbacks  to a smart 
card  system.  A smart  card  system  according  to WEDI  could  cost hundreds  of millions 
of dollars.  Should  smart  cards  be  used  when  the  less expensive  magnetic  strip  or 
swipe card  (credit  card  or ATM  model)  may contain  all the  information  required? 
Smart  cards  must  contain  a standard  set of information.  The  issue  is the  amount  of 
information  required.  In order  to allow for an efficient  electronic  access  to 
information,  and  the  transfer  of information  between  payers  and  providers,  at a 
minimum  this information  must  be  able  to identify  the  payor  and  the  plan  member. 
The  decision  must  also be  made  as to the  amount  of patient  clinical  information  that 
should  be  put  on the  smart  card.  Should  patients  be  required  to carry  data  bases 
10
 around  in their  pockets  when  central  computer  and  communication  networks  are  a 
capable  alternative? 
Currently,  there  are  several  ongoing  experiments  on the  application  of card  technology 
for the  health  care  industry.  The  States  of New York  and  Massachusetts  use the 
magnetic  strip  card  with  an on-line  communications  network  to monitor  eligibility  and 
utilization  for their  Medicaid  populations.  Smart  cards  are  being  used  to monitor  Aid 
to Families  with Dependent  Children,  food  stamp,  and  Medicaid  populations  in 
various  States. 
Even  though  WEDI  does  not  recommend  the  use  of the  smart  cards  because  of its 
expense,  we still recommend  that  HCFA  look  at smart  cards  (e.g. for use  in verifying 
electronic  signatures)  and  that  HCFA  study the  results  of the  above  experiments,  and 
review  the  experience  of States  that  have  used  various  types  of cards  in the  design  of 
MTS  and  the  implementation  of the  computerized  patient  record. 
Computerized Patient Records 
In order  to be  able  to make  informed  health  care  decisions,  policy decisions  as well as 
clinical,  the  U.S. health  care  system  needs  better  access  to the  information  contain  in 
patient  records.  This  information,  now contained  in paper-based  systems,  is often 
fragmented,  irretrievable,  and  illegible.  The  Institute  of Medicine  (IOM),  after 
studying  this issue for  18 months,  has  recommended  that  patient  records  be  computer 
based.  In addition,  the  IOM  has  endorsed  the  establishment  of a private/public 
initiative  which  is to now called  the  CPRI.  The  CPRI,  formed  during  the  summer  of 
1991,  will be  responsible  for the  initiation  and  coordination  of all work  that  will 
eventually  establish  the  routine  use of CPRS in all U.S. health  care  settings.  The 
CPRI  has formed  five committees,  and  these  committees  will perform  much  of the 
work which  is yet to be  done. 
HHS  involvement  in this area  to date  has  consisted  primarily  of  the  establishment  of 
an HHS  computerized  Patient  Records  Council  to promote  and  coordinate  various 
Departmental  activities;  partial  funding  of the  American  National  Standards  Institutes 
Health  Informatics  Planning  Panel;  participation  in the  deliberations  leading  to the 
formation  of the  CPRI;  participation  in the  American  Hospital  Associations 
Workgroup  on Computerization  of Patient  Records  and  the  WEDI;  and  the 
establishment  of the  HCFA  Electronic  Environment  Steering  Committee. 
Because  the  establishment  of the  use  of CPRS is still in its conceptual  phase,  various 
issues face  the  OIG: 
	 What  are  the  benefits  and  the  costs of the  computerized  patient  record?  The 
OIG  should  determine  if a proper  cost/benefit  analysis  has been  performed  to 
ensure,  as best  as possible,  that  CPRS will not  only be  useful  and  accessible,  but 
also not  so prohibitive  that  providers  will not  be  able  to afford  their  installation. 
11
 F	 What  is required  to guide  the  development  of electronic  clinical  information  or 
CPRS?  What  is needed  to insure  a uniform  standard  data  set, definitions,  and 
format?  What  needs  to be  included  in patient  records  and  which  models  of 
CPRS should  be  adapted?  Will HCFA  rely entirely  on the  CPRI  to develop 
the  standards?  The  OIG  should  be  concerned  that  the  Department  have  a 
place  in the  CPRI  and  that  the  Department  give input  at the  early  stages  of the 
development  of the  CPR. 
Leadership  by HHS  in the  area  of CPRS is particularly  important  because  of the 
implications  for: 
	 The  Peer  Review  Organization  (PRO)  and  SuperPRO  activities  relating  to 
hospital  utilization  in Medicare. 
  Utilization  review  activities  of Medicare  carriers. 
  Utilization  review  activities  of the  States  in their  MMIS. 
F	 Provider  level interface  with future  health  information  systems  at the  State  and 
Federal  level. 
In the  future,  the  OIG  will monitor  the  results  from  the  work  that  is being  performed

by the  five committees.  In the  mean  time,  we plan  to address  the  issue  of

computerized  patient  records  in the  context  of our  ongoing  review  of MTS,  upcoming

review  of MMIS,  and  a planned  review  of internal  systems  controls  at the  PROS.

THE NEED FOR A COHESIVE STRATEGIC  SYSTEMS PLAN  COVERING  EDI

In a prior  report7,  we indicated  that  Medicare  contractor  systems  and  Federal

Medicaid  data  initiatives  were  not  being  addressed  in HCFAS information  resources

management  (IRM)  program;  HCFA  had  not  sufficiently  assigned  duties  to, or assured

the  independence  of, its Principal  IRM  Official;  and  the  Department  had  not

sufficiently  monitored  HCFAS IRM  activities.  Furthermore,  neither  we nor  GAO

have  been  able  to discern  any comprehensive  strategy  on HCFAS  part  related  to how

Medicare  and  Medicaid  will move  into  an all-electronic  environment.

7Review of the  Health  Care  Financing  Administrations  Implementation  of the 
Project  to Redesign  Information  Systems  Management,  A-14-91-02533.  At that  time, 
HCFA  had  elected  to move  forward  with  a strategic  planning  initiative  to streamline, 
consolidate,  and  integrate  Medicare  and  Medicaid  claims  processing,  including  EDI. 
This initiative  had  critical  goals  and  objectives  to standardize  systems,  provide 
appropriate  incentives,  and  utilize  companion  technologies. 
12  Meanwhile,  however,  private  sector  initiatives  in the  area  of EDI  standards  and 
investment  in private  sector  EDI  networks  and  systems  continues  at an accelerating 
pace.  These  efforts  are,  in large  measure,  being  driven  by the  Blue  Cross/Blue  Shield 
Association  and  its member  plans,  large  commercial  insurance  companies,  and 
commercial  clearinghouses  and  data  processors.  Each  of these  parties  is pursuing  an 
EDI  strategy  based  primarily  on business  concerns,  and  particularly  market  share.  At 
the  same  time,  numerous  legislative  proposals  are  being  offered  in conjunction  with 
health  care  reform  that  would  dramatically  affect  how EDI  for health  insurance 
information  would  be  structured  and  operate  in the  future. 
Without  a viable  Departmental  strategy  for channeling  future  EDI  developments,  we 
are  concerned  that: 
	 Medicare  and  Medicaid  may not  be  able  to make  the  most  effective  use  of 
emerging  EDI  technology. 
	 The  proliferation  of EDI  systems  in the  public  and  private  sectors  may 
accelerate. 
	 Reductions  in administrative  costs per  claim  may not  be  achieved  to the  degree 
now anticipated.  And,  issues  similar  to that  of conflict  of interest  now faced  in 
dealing  with Medicare  and  Medicaid  secondary  payer  issues will remain 
unresolved. 
We plan  to address  some  of these  issues in our  ongoing  review  of MTS  and  related 
HCFA  EDI  initiatives.  And,  we plan  to re-examine  the  efficacy  of HCFAS  strategic 
systems  planning  process  as one  of a series  of reviews  of HCFAS IRM  programs 
8Review of General  Systems  Controls  at HCFA  - Phase  I planned  for completion 
by the  end  of FY  1995. 
13  POLICY IMPLEMEhYATION 
The  implementation  of new EDI  and  paperless  processing  systems,  in particular, 
carries  with it questions  regarding  trustworthiness  and  reliability  of data  as they  moves 
from  one  partner  in electronic  commerce  to another  and  from  one  process  to another. 
Specific  questions  raised  with regard  to electronic  submission  and  processing  of claims 
include: 
F  Confidentiality  and privacy  of patient  records. 
F  Internal  controls. 
  Audits  and  certification. 
F  Contractor  conflict  of interest. 
F  Valid contracts. 
	 Legal  use of information  submitted,  stored and processed  by new systems, 
including provider  agreements,  chain  of custody, attestation  and originator 
authentication,  and  the need for paper  trails. 
CONFIDENTIALITY  AND PRIVACY  OF PATIENT  RECORDS 
Any EDI  and  paperless  processing  system  will need  to ensure  that  the  confidentiality 
of personally  identifiable  health  insurance  data  be  strictly  maintained  and  the  privacy 
of patients  be  maintained.  This  area  is made  complex  because  traditionally  the  legal 
requirements  covering  privacy  have  been  addressed  on the  State  level with each  State 
being  unique.  This is further  complicated  because  providers  and  payers  are  subject  to 
different  sets  of rules,  with additional  variation  among  types  of providers. 
The  obligation  that  a provider  must  maintain  the  confidentiality  of a patients  health 
insurance  data  is defined  by statue,  common  law, and  professional  ethics.  It is the 
same  whether  the  transmission  and  storage  of this data  is paper  or electronic.  The 
very reason  that  providers  changed  from  the  more  cumbersome  paper  records  to the 
more  efficient  EDI  and  paperless  processing  systems  is the  same  reason  that  makes 
these  systems  more  vulnerable.  While  EDI  and  paperless  processing  allows for more 
sophisticated  security  protocols,  once  these  protocols  are  breached,  it allows for a very 
efficient  method  of conducting  an unauthorized  transmission  and  review  of 
confidential  health  insurance  data. 
Because  payers  are  required  to release  health  insurance  data  to various  sources, 
especially  medical  information,  they  must  follow many  conflicting  legal  requirements 
covering  disclosure.  This  disclosure  may be  for claims  adjudication  and  payment, 
14  research,  third  party  administration  and  utilization  review,  and  audits.  EDI  and 
paperless  processing  must  allow for these  myriad  of disclosures  while  protecting  the 
privacy  of the  patients. 
Two issues before  HCFA  in the  areas  of confidentiality  and  privacy  are: 
	 What  is required  to ensure  that  all electronic  health  information  remains  at the 
required  level  of confidentiality? 
F	 Have  standards  been  established  and  have  these  standards  been  incorporated 
into  legislation  and  systems  development? 
Although  HCFA  feels  that  the  system  security  technology  available  at this time  is 
more  than  adequate,  we have  little  information  to prove  that  this will be  true  into  the 
future.  The  Privacy  Act  of 1974, 5 U.S.C.  Section  552a, is the  primary  provision 
governing  HCFA  on the  release  of confidential  health  insurance  data.  On  the 
provider  side, the  American  Medical  Associations  Principles  of Medical  Ethics 
requires  that  physicians  safeguard  confidential  patient  information  within  the 
constraints  of the  law. 
Confidentiality  and  the  Privacy Act will be  areas  that  HCFA  must  address  in the 
concept  development  and  design  phases  of MTS  and  other  EDI  and  paperless 
processing  systems.  We will be  looking  at HCFAS treatment  of the  issues  of privacy 
and  confidentiality  as part  of our  ongoing  reviews  of EMC/EFT  implementation  and 
MTS  and  in our  future  reviews  of MMIS  and  PRO  systems  internal  controls. 
INTERNAL  CONTROLS 
Section  2 of the  Federal  Managers  Financial  Integrity  Act  (FMFIA),  among  other 
things,  addresses  the  adequacy  of management  controls  over  operations  and  specific 
requirements  for controls  to safeguard  assets  against  waste,  fraud,  and  abuse.  The 
OMB  Circular  A-123,  Internal  Control  Systems, prescribes  policies  and  standards  for 
executive  departments  to implement  Section  2 of the  FMFIA  by setting  up, 
maintaining,  testing,  improving,  and  reporting  on internal  controls  in their  program 
and  administrative  activities.  Also, each  agency  is required  to report  any material 
weaknesses  in the  agencys systems  of internal  controls  and  the  planned  actions  for 
correcting  such weaknesses. 
We have  had  concerns  with HCFAS  application  of FMFIA  with  respect  to Medicare 
contractors  because  it has not  performed  reviews  sufficient  to assure  itself that  the 
Medicare  contractors  have  adequate  internal  control  systems.  Our  position  has been 
and  continues  to be  that  we are  concerned  with the  lack  of review  of contractor 
controls  under  the  FMFIA  and  in the  future  this could  impact  on the  positive 
assurance  with respect  to FMFIA  that  HCFA  is expressing  to the  Secretary  of HHS. 
Furthermore,  various  Medicare  contractors  have  previously  taken  the  position  that 
their  EMC  departments  are  proprietary  and  should  not  be  the  subject  of audits. 
15  The  HCFA  acknowledges  that  the  adequacy  of HCFAS management  controls  over 
operations  is an ongoing  issue between  HCFA  and  OIG  and  is the  subject  of extensive 
reviews  by OIG.  We believe  that  this issue  exists due  to HCFA  and  OIG  having 
different  philosophy  and  ways of performing  internal  control  reviews.  However, 
HCFA  is aware  of the  importance  of internal  controls  and  evaluation  activities  in the 
area  of EDI  and  welcomes  the  OIGS additional  thoughts  or recommendations  that 
would  strengthen  its operations.  Furthermore,  HCFA  is currently  developing  a plan 
to review  the  internal  controls  and  systems  of contractors  for compliance  with the 
FMFIA.  Because  these  reviews  have  not  taken  place,  it is unknown  whether  adequate 
controls  do exist.  Absent  reviews  of internal  controls,  no material  internal  control 
weaknesses  have  yet been  reported.  Consequently,  the  degree  of trustworthiness  and 
reliability  of Medicare  contractor  systems  in general,  and  especially  their  EMC/EFT 
systems,  is a significant  concern. 
During  the  course  of our  ongoing  review  of HCFAS implementation  to  date  of EMC 
and  EFT  in Medicare,  we will evaluate  the  sufficiency  of internal  controls  over 
Medicare  EMC/EFT  processing.  Our  objective  is to determine  the  level  of reliability 
of claims  data  and  accountability  of providers.  We will obtain  and  analyze  all Federal 
policy requirements  relating  to HCFAS  application  controls  over  Medicare  electronic 
billing and  payment.  We will identify  any deviations  between  HCFAS current  set of 
controls  and  these  Federal  requirements.  And,  we will develop  and  analyze  an 
applications  controls  matrix  to identi~  high risk areas.  Then,  we will use  the  results  of 
this analysis  to determine  if HCFA  has  noted  any deficiencies  and  taken  action  to 
address  them. 
AUDITS  AND  CERTIFICATION 
In the  past,  most  audit  interest  has been  focused  on the  main  line  processing  systems 
at the  Medicare  contractors  where  most  of the  claims  were  received  in paper  form, 
keyed  into  electronic  formats,  edited,  and  processed  through  payment.  With  Medicare 
EMC  being  used  for  claims  submission  of an ever  increasing  percentage  of claims  and 
with increased  use of EFT  and  electronic  remittance  notices  (ERN)  for payment, 
greater  focus  must  be  placed  on systems  at the  provider  level.  Also, intermediaries 
and  carriers  typically  use  the  same  departments  for Medicare  EMC/EFT/ERN  as they 
do for support  of their  private  side operations.  While  these  departments  may not 
have  been  the  focus  of prior  audit  work  because  of the  proprietary  nature  of their 
activities,  they  must  be  included  in future  work  because  their  activities  are  integral  to 
Medicare  claims  processing. 
16
 Contractor Audi& 
The  Medicare  contractors  are  responsible  for assuring  that  claims  submitted  from 
providers  areaccurate  and justified.  This  responsibility  extends  to insuring  that 
provider-based  systems  used  to submit  claims  electronically  operate  in a manner 
consistent  with HCFA  policies  and  instructions  and  in accordance  with  any additional 
requirements  established  by the  servicing  Medicare  contractor. 
In the  claims  processing  market  today,  there  are  a variety  of provider-based  systems 
and  external  clearinghouses  that  may be  used  for EMC.  Installation  and  operation  of 
these  systems  at the  provider  level, however,  is the  responsibility  of the  individual 
provider.  To  fulfill their  responsibilities,  therefore,  Medicare  contractors  need  to 
ensure  that  provider-based  systems  not  only operate  as intended,  but  also are 
governed  by sufficient  internal  controls  to assure  adequate  system  and  data  security, 
system backup,  and  availability  of supporting  documentation. 
Because  of the  large  number  of low-volume  Medicare  providers  (e.g., individual 
physician  practices),  the  wide  range  of systems  that  providers  may use  and  the  variety 
of environments  in which  the  providers  operate  these  systems,  the  resources  needed  by 
the  Medicare  contractors  to audit  provider-based  EDI  and  paperless  processing 
systems  on a 100 percent  basis  are  likely to be  prohibitive.  Furthermore,  our  ongoing 
reviews  of Medicare  contractors  suggest  that  funding  for basic  payment  safeguard 
activities  is so limited  that  the  adequacy  of selective  audits  of provider  systems  by their 
servicing  Medicare  contractors  is problematic. 
Our  primary  concern,  therefore,  is the  appropriateness  of the  criteria  used  by the 
Medicare  contractors  to select  specific  provider  systems  for audit  and  how well such 
audits  are  coordinated  with other  contractor  activities  requiring  on-site  reviews  at 
provider  locations. 
This issue  is not  being  addressed  specifically  as an objective  in our  ongoing  review  of 
EMC/EFT  implementation  in Medicare.  Rather,  it will be  addressed  in the  context  of 
the  compliance  by the  Medicare  contractors  with HCFAS  requirements  affecting 
EMC/EFT  in the  areas  of 
F  The  solicitation  and  maintenance  of provider  attestations  and  certifications. 
F	 The  issuance  of instructions  to providers  on record  keeping  in support  of claims 
submitted. 
F  The  establishment  and  maintenance  of Medicare  fraud  and  abuse  programs. 
17
 Interim Certification 
As noted  above,  the  resource  requirements  to  audit  provider-based  systems  are  likely 
to be  so substantial  that  any audits  of these  systems  by the  Medicare  contractors  is 
problematic.  The  issue of systems  certification,  therefore,  increases  in importance. 
Systems  certification  is recognized  in HCFAS EMC  strategy  as a tool  for providing 
some  assurance  that  electronic  billing systems  used  by providers  meet  basic  industry 
and  government  standards.  The  HCFA  has already  established  a two-tier  list of 
sources  for EMC  packages:  one  list for sources  meeting  basic  requirements;  the 
other,  a select list meeting  more  stringent  requirements.  There  is no requirement, 
however,  that  providers  use only those  sources  on the  selected  list. 
Furthermore,  many  providers  use  external  billing services  and/or  claims  clearinghouses, 
either  in conjunction  with, or instead  of, provider-based  EDI  and  paperless  processing 
systems.  The  HCFA  does  not  appear  to have  addressed  how such sources  should  be 
certified,  either  individually  or in conjunction  with  any systems which  the  providers 
may use in conjunction  with them. 
As part  of our  ongoing  review, we will obtain  and  analyze  sufficient  information  to 
determine  whether  the  maintainers  and  operators  of EMC/EFT  systems  used  in 
Medicare  are  in compliance  with HCFAS  requirements  for systems  certifications  and 
testing. 
Bogram  Safeguarh 
As Peter  Weiss,  a governmental  expert  on EDI,  noted  in a recent  paper,9 
trustworthiness  and  reliability  of EDI  systems  are  criteria  critical  to ensuring  the 
suitability  of electronic  data  as evidence  in a court  of law.  Also,  conformance  with 
Federal  requirements  for systems  security  (including  the  Computer  Security  Act, 
Privacy Act,  and  OMB  Circular  A-130 systems  security  requirements)  with respect  to 
data  and  access  security  is essential  if EDI  systems  are  to be  certified  as trustworthy 
and  reliable. 
This issue  is being  addressed  as a specific  objective  of our  ongoing  review  of 
EMC/EFT  in Medicare.  We will determine  whether  the  EMC/EFT  systems 
maintainers  and  operators  are  in compliance  with HCFAS  requirements  in the  areas 
of access  and  data  security  as well as the  system.  We will also review  HCFAS 
requirements  for, and  contractors  compliance  with procedures  to identi&  those  who 
9 Security  Requirements  and  Evidentiary  Issues  in the  Interchange  of Electronic 
Documents:  Steps  Toward  Developing  a Security  Policy presented  at the  Workshop 
on Security  Procedures  for the  Interchange  of Electronic  Documents,  National 
Institute  of Standards  and  Technology,  November  12-13, 1992. 
18  input  data,  as well as those  who use the  data.  We will likewise  determine  if HCFAS 
requirements  are  adequate  and  are  being  complied  with for periodic  certifications  and 
maintenance  of a chain  of custody  as the  data  move  from  user  to user  are  adequate. 
Compliance  wth C&u.lar A-127 
The  OMB  Circular  A-127  addresses  compliance  with Section  4 of the  FMFIA  and 
includes  requirements  for reviews  of systems which  collect,  process,  and  use financial 
data.  Recently,  this circular  has assumed  greater  importance  because  it is one  of the 
primary  sources  of criteria  for  determining  whether  an  agencys financial  systems  can 
provide  reliable  data  for use in preparation  of financial  statements,  as called  for under 
the  Chief  Financial  Officers  Act. 
In Medicare,  among  the  data  most  critical  to financial  management  are  claims  and 
claims  payments;  however,  HCFA,  to date,  has not  included  Medicare  contractor 
systems  in the  scope  of their  financial  systems  reviews  program  because  these  systems 
do not  feed  data  directly  into  HCFAS general  ledger  accounts.  Thus,  the  extent  of 
compliance  of EMC/EFT  systems  at the  Medicare  contractors  and  EDI  and  paperless 
processing  systems  at participating  providers  with the  criteria  for reliability  of financial 
data  established  under  A-127 is uncertain,  at best. 
This issue  is being  covered  in part  by our  ongoing  review  of MTS  and  related  EDI  and 
paperless  processing  initiatives.  This  review will address  whether  the  HCFA  has  an 
overall  strategic  plan  for the  development  and  implementation  of the  proposed  MTS 
and  the  migration  to increased  use of EDI  and  paperless  processing.  And,  if HCFA 
does  have  such a strategy,  we will determine  the  degree  to which  this strategy  is based 
on analyses  called  for under  OMB  Circular  A-127  (financial  management),  as well as 
under  OMB  Circular  A-123  (internal  controls)  and  A-130  (IRM/systems  security). 
CONTRACTOR  CONFLICI  OF INTEREST 
The  HCFA  and  the  OIG  have  become  aware  of allegations  that  certain  contractors 
refuse  to cooperate  with some  billing services  which wish to submit  Medicare  claims 
electronically.  The  HCFA  has forwarded  instructions  to the  contractors  requiring  that 
third  party  software  be  made  available  to the  providers.  Compliance  with these 
instructions  still needs  to be tested. 
Even  though  this area  was studied  in an OIG  Management  Advisory  Report  dated 
July  1992, the  following  issues will need  further  review: 
	 Are  Medicare  contractors  selling EDI  and  paperless  processing  systems 
(hardware  and  software)  with  an unfair  competitive  advantage  and  therefore  in 
violation  of antitrust  law? 
19
 F	 Is there  a conflict  of interest  with the  contractor  marketing  EDI  and  paperless 
processing  systems  to providers  and  then  being  requiredto  audit  and  look  for 
problems  in these  systems? 
The  OIG  has performed  alimited  reviewof  four  Medicare  contractors  (three

intermediaries  and  one  carrier).l  This review  found  that  the  four  contractors

appearedto  comply  with the  requirements  of Transmittal  1507 regarding  the

timeliness  with which  contractors  fill requests  for lists of edits.  It found  that  the  three

intermediaries  refused  to accept  direct  computer-to-computer  EMC  submissions  for

their  private  line  of business  unless  the  provider  uses their  subsidiarys  software  for the

transaction.  Finally,  it found  that  the  practice  of requiring  billing  services  and  health

care  providers  to use the  contractors  for-profit  subsidiaries  may violate  Federal

antitrust  laws.

Because  the  growth  in the  use  of EDI  and  paperless  processing,  its emergence  as a

major  issue in health  care  reform,  and  the  involvement  of Medicare  contractors  in

proprietary  market-driven  ventures,  the  OIG  needs  to pursue  the  conflict-of-interest

issue.  We will address  Medicare  contractor  compliance  with HCFAS current  EMC

instructions  as part  of our  ongoing  review  of EMC/EFT  implementation  in the

Medicare  program.  We  plan  to address  the  longer  term  issue  of contractor  conflict  of

interest  in our  review  of MTS  and  related  EDI  and  paperless  processing  initiatives,

and  as part  of our  continuing  work  in the  area  of Medicare  secondary  payer,

VALID  CONTRACTS

In order  to be  able  to create  valid  contracts  under  EDI  systems,  payers  (including

HCFA)  and  providers  must  recognize  that  information  that  is created,  transmitted,  or

stored  in electronic  form  does  satis~  the  legal  requirements  regarding  a written

signature  the  same  as information  that  is recorded  on paper.  But,  they  must  also

recognize  that  appropriate  security  techniques,  practices  and  procedures  must

incorporated  into  EDI  systems before  electronic  contracts  can be  considered  valid.

The  GAO  has  addressed  this issue in their  December  13, 1991 decision  memorandum,

National  Institute  of Standards  and  Technology  -- Use  of Electronic  Interchange

Technology  to Create  Valid  Obligations.  The  GAO  prepared  this memo  in response

to a request  by the  Computer  Systems  Laboratory,  National  Institute  of Standards  and

Technology  (NIST).  The  NIST  asked  GAO  if Federal  agencies  can  use EDI

technologies,  such as message  authentication  codes  and  digital  signatures,  to create

valid  contracts  consistent  with  31 U.S.C.  Section  1501.  Section  1501 establishes  the

criteria  for recording  obligations  against  the  government.  The  GAO  concluded  that

government  agencies  can  create  valid  obligations  by using EDI  systems which  meet

NIST  standards  for security  and  privacy.

10Management  Advisory  Report,  Electronic  Media  Claims  and  Contractors  For 
Profit  Subsidiaries,  OEI-12-91-O141O, July  1992. 
20  A remaining  question  in this area  is whether  EDI  systems  being  used  by the  Medicare

contractors  and  the  providers  meet  the  NIST  standards  for  security  and  privacy.  We

will determine  the  degree  of compliance  of current  and  planned  Medicare

requirements  with NIST  standards  as part  of our  ongoing  reviews  of EMC/EFT  and  of

MTS  and  related  EDI  initiatives.

LEGAL  USE OF INFORMATION  SUBMITIED

l+ovider Agreernen& 
The  integrity  of the  Medicare  and  Medicaid  programs  depend  upon  monitoring  the 
submission  of claims  and  ensuring  provider  accountability.  Consequently,  this issue 
affects  OIG  investigations  and  prosecutions  of suspected  fraudulent  or abusive 
providers.  Clear  and  uniformly  enforceable  provider  agreements  are  necessary  in 
order  to hold  providers  personally  responsible  for every  claim  submitted  and  to 
provide  sufficient  evidence  for prosecution  of fraud. 
Two recent  court  cases  provide  evidence  that  provider  agreements  may well become 
an issue in future  court  proceedings.  In United  States  v. Mostaan,  the  defense 
claimed  that  the  computerized  claims  lacked  proper  certification  that  the  provider 
submitted  claims  only for services  actually  rendered  by provider  or an employee  under 
the  providers  supervision.  The  Government  survived  a defense  motion  for  acquittal. 
In United  States  v. Lofton,  the  Government  could  not  introduce  medical  records 
because  of another  certification  problem.  The  case was eventually  dismissed  by the 
Court  on other  grounds. 
The  volume  of claims  involved  in EDI  applications  such as Medicare  EMC  means  that 
there  may not  be  any certification  by a provider  that  he or she has rendered  services 
submitted  for reimbursement.  If provider  agreements  do not  have  uniform  form  and 
content,  program  integrity  will be jeopardized  and  cases  will be difficult  to prosecute. 
According  to a HCFA  memorandum  on EMC  (written  in July or August  1992), in 
order  to submit  claims via electronic  media,  a provider  must  first receive  Automated 
Claims  Input  Authorization.  This requires  the  provider  to sign an agreement  with the 
contractor.  Any agreement  signed  between  the  provider  and  the  contractor  must 
establish  clear  guidelines  for the  handling  of claims,  as well as the  assumption  of 
responsibility  for the  completeness,  accuracy  and  truthfulness  of all claims  submitted 
via electronic  media. 
The  memo  indicated  that  HCFA  has  not yet standardized  provider  agreements,  but 
has  established  guidelines  which  have  standard  key elements  for agreements  (Blue 
Cross/Blue  Shield  Medicare  Agreement  was attached  as a model,  but  is a  1984 form). 
No certification  of accuracy  or statement  of liability  is required.  The  HCFA  memo  stated  that  most  agreements  require  the  provider  to maintain  all 
original  source  documents  and  medical  records  pertaining  to any particular  Medicare 
claim  for at least  6 years  following  the  month  of payment. 
The  HCFA  welcomes  the  OIGS review  of the  standard  EMC  agreement  currently 
being  developed  by HCFA.  The  OIG  plans  to review  provider  agreements  and 
determine  if they  are  adequate  for ensuring  accountability.  This  includes  the 
responsibilities  of all parties  in the  EDI  environment  and  the  ownership  of and 
responsibility  for Medicare  and  Medicaid  data  at each  point  in the  data  flow. 
chain of Cl@@ 
Prosecutors  must  prove  who had  custody  and  control  of claim  documentation  at each 
step  of the  billing  process  in order  to successfully  prosecute  providers  for fraudulent  or 
abusive  claims.  A valid  chain of custody will establish  who was responsible  for 
generating  and  storing  electronic  records.  Record  custodians  must  be  able  to account 
for each  link in the  chain  of events  involved  in producing  the  records.  Should  the 
Government  fail to meet  this challenge,  it likely will be  unable  to introduce  critical 
evidence. 
According  to the  HCFA  memo,  no  audit  requirements  exist for reviewing 
documentation,  validation,  or electronic  transmission  flows; nor  for reviewing  screens, 
edits,  or internal  controls.  No requirements  exist for  assessing  system  securi~,  nor  for 
reviewing  cases  for semice  appropriateness,  or for analyzing  charges  and  costs for 
services  provided. 
The  memo  indicated  that  (at  least  as of mid-1992)  audits  are  not  conducted  for bills 
submitted  electronically.  The  HCFA  requires  an annual  verification  for Medicare 
Part  B EMC.  However,  with  approved  plans,  contractors  may extend  the  annual  cycle 
for verification  of provider  records.  The  standards  require  that  the  contractor  review 
a random  sample  of one  percent  of provider-submitted  EMC.  The  verification  is 
narrow  in focus.  The  purpose  of the  review  is to establish  that  documentation  for 
EMC  is on file and  is equivalent  to that  provided  on a hard  copy claim  (a patient 
record  exists, patient  and  physician  signatures  are  on file, and  other  support 
documentation  is available). 
Based  on the  above  information,  the  audit  requirements  do not  ensure  that  a valid 
chain  of custody  has been  maintained  at  each  step  in the  system. 
As the  HCFA  paper  recommended,  some  procedures  should  be  developed  to identify 
each  individual  systems  operator  to avoid  diffusion  of responsibility,  thereby  making  it 
easier  to hold  a particular  provider  accountable.  Furthermore,  stringent  audit 
requirements  should  be  developed  to mandate  review  of internal  controls  and  systems 
security. 
22
 Adequate  systems  safeguards  are  necessary  to ensure  that  data  is not  misused  or lost, 
and  that  unauthorized  persons  cannot  access  it.  Since  the  sensitive  information 
involved  in EDI  and  paperless  processing  is subject  to considerable  fraud  and  abuse,  it 
must  be  properly  protected  to ensure  provider  accountability  and  thus  be  useful  to 
investigations  and  prosecutions. 
Attestation  and &ginator Authentication 
Attestation  and  originator  authentication  must  be  established  to show provider 
accountability  and  thus  are  important  evidentiary  items  in investigations  and 
prosecutions  of suspected  fraudulent  or abusive  providers.  Technological  advances 
may create  new efficiencies  in this.  Among  the  issues  of interest  to the  OIG  are: 
F	 Are  there  better  methods  to verify attestation  (i.e., acknowledgment  of a 
submission  by a provider)  or originator  authentication  (i.e., assurance  that  the 
source  of the  message  is the  named  originator  and  not  some  other  entity)  when 
using personal  identification  numbers  (PIN)? 
	 Has  EDI  technology  advanced  far  enough  to allow HCFA  to consider 
fingerprinting  (electronically  read  thumb  prints)  and  retina  scanning  as forms  of 
electronic  signatures? 
As part  of its review  of provider  accountability,  the  OIG  will assess whether  Medicare 
and  Medicaid  systems  allow for proper  attestation  and  originator  authentication. 
Maintaining Audit  Zlaih 
Lack  of hard  copy Medicare  claims  may adversely  affect  OIGS ability  to establish

provider  accountability  (i.e., who  submitted  what  claim  and  when,  who received  the

claim,  and whether  the  claims  accuracy  can be verified).  Without  the  necessary

documentation,  the  Government  will be unable  to prove  fraud  or abuse  since  a

provider  may contend  that  I never  reviewed  the  claim  data.  Unless  providers  are

required  to retain  hard  copy of claims,

meaningful  review which  ensures  provider  accountability  may not  be  possible.  On  the

other  hand,  retention  of hard  copies  of claims  may negate  or reduce  some  of the

benefits  of moving  to electronic  submission  of claims.

A regulation  issued  by the  National  Archives  and  Records  Administration,

Requirements  for the  Management  of Electronic  Records,  36 CFR  Part  1234, states

that  electronic  records  may be  admitted  in Federal  court  proceedings  if trustworthiness

is established.  Some  of these  requirements  should  be incorporated  by HCFA  to help

ensure  that  EMC  data  will be  admissible  in Federal  Court.

Further,  it is generally  recognized  that  the  need  for  accounts  reconciliation,  periodic

audits,  and  recovery  from  emergency/disaster  situations  in an EDI  and  paperless

processing  environment,  where  no paper  records  maybe  generated,  necessitates  the

23  establishment  of a suitable  electronic  audit  trail.  With  respect  to Medicare 
EMC/EFT/ERN,  specific  requirements  for this audit  trail  should  be based  on 
considerations  of legality  (e.g., covering  time  frames  consistent  with the  statue  of 
limitations),  audit  cycles, structure  of the  overall  Medicare  claims  process  (i.e., 
consideration  of the  number  of separate  internal  control  areas),  and  technology  (e.g., 
electronic  media  can  experience  degradation  of data  quality  after  no more  than  2-3 
years  of storage  without  use). 
In the  course  of our work  in reviewing  implementation  of EMC/EFT  in Medicare,  we 
will determine  whether  the  EMC/EFT  maintainers  and  operators  are  in compliance 
with HCFAS requirements  for  audit  trails  and  related  processing  controls,  as well as 
with requirements  covering  instructions  to providers  on record  keeping  to support 
claims  submitted. 
24
 CONCLUSIONS

BASIS FOR REPORT 
This  report  is in response  to the  Health  Care  Financing  Administrations  (HCFA) 
briefing  for the  Office  of Inspector  General  (OIG)  personnel  on electronic  data 
interchange  (EDI)  and  paperless  processing  issues  and  its request  for more 
information  on the  OIGS concerns  and  plans. 
ISSUES 
This  document  has identified  numerous  issues and  goals related  to HCFAS  use  of 
EDI  and  paperless  processing  technology.  Issues  related  to the  overall  strategy  of the 
EDI  and  paperless  processing  initiative  concern  the  development  of systems  such  as 
the  Medicare  Transaction  System,  and  the  further  development  and  use the  Medicaid 
Management  Information  Systems,  and  the  point-of-service  claims  management 
systems  under  Medicaid.  These  systems will allow HCFA  to process  electronically 
submitted  claims  and  manage  information  more  efficiently.  In order  to facilitate  the 
electronic  flow of claims,  patient,  and  reimbursement  data  between  providers,  payers, 
and  quality-of-care  reviewers,  HCFA  must  require  standardization.  To  encourage 
providers  to submit  claims  and  patient  data  electronically,  HCFA  must  eliminate  not 
only barriers  to provider  participation,  but  also develop  incentives.  Various 
companion  technologies,  such  as smart  cards  for computerized  patient  identification 
and  medical  records,  and  national  data  communications  networks  for transmission  of 
health  care  data,  will need  further  development.  Additionally,  HCFAS  overall  strategy 
must  encourage  HCFAS information  resources  management  program  to address 
Medicare  contractor  systems  and  Federal  Medicaid  initiatives. 
This  document  also raises  issues regarding  the  trustworthiness  and  reliability  of data  as 
it moves  from  one  partner  in electronic  commerce  to another  and  from  one  process  to 
another.  Issues  raised  with regard  to electronic  submission  and  processing  of claims 
include  the  requirement  that  the  confidentiality  of personally-identifiable  health 
insurance  data  be  strictly  maintained  and  the  privacy  of patients  be  protected.  In 
order  to address  the  adequacy  of management  controls  over  operations  and  specific 
requirements  for  controls  to safeguard  assets  against  waste,  fraud,  and  abuse,  internal 
controls  must  be  reviewed.  Audits  and  the  systems  certifications  must  be  performed 
to ensure  that  all EDI  and  paperless  processing  systems  are  trustworthy  and  reliable, 
and  that  there  is no Medicare  contractor  conflict  of interest.  For  electronic  contracts 
to be valid,  they must  be in compliance  with the  contract  requirements  of the  NIST. 
Finally,  HCFA  must  ensure  the  integrity  of information,  through  the  use  of provider 
agreements,  a valid  chain  of custody,  attestation  and  originator  authentication,  and 
proper  audit  trails. 
25
 FUTURE  ACTION 
Because  of the  large  number  of issues  and  the  our  limited  resources,  we cannot 
possibly  examine  nor  audit  all of the  issues related  to EDI  and  paperless  processing. 
As part  of our  oversight  function,  we plan  to analyze  all of the  various  issues  listed 
above  for the  purpose  of preparing  our workplan  over  the  next few years.  We  also 
recognize  that  HCFA  has particular  concerns  about  making  its systems  environment 
less susceptible  to fraud  and  abuse  and  about  the  development  of approaches  for 
increasing  small provider  participation  in the  EDI  and  paperless  processing 
environment.  With  respect  to fraud  and  abuse,  we are  currently  in the  survey phase 
of reviewing  electronic  controls  in the  Medicare  program  and with  respect  to small 
providers,  we are  planning  to study incentives  for and  barriers  to small  provider 
participation  in EDI  and  paperless  processing. 
AGENCY  COMMENTS 
The  Health  Care  Financing  Administration  (HCFA)  commented  on a draft  version  of 
this report.  The  HCFA  suggested  changes  in the  report  to better  reflect  its activities 
and  those  of the  Department  with respect  to EDI  and  paperless  processing,  made 
suggestions  about  the  focus  of OIGS work  in this area,  and  gave us technical 
comments.  We have  revised  our  report  to address  many  of HCFAS comments  and 
also provide  additional  comments  on HCFAS response  in Appendix  B.  The  full text 
of HCFAS comments  can be found  in Appendix  A. 
26
 APPENDIX  A 
HEALTH  CARE  FINANCING  ADMINISTRATION  COMMENTS  /- ,  Health  Care
& 
I) APARTMENT  OF HEALTH  & HUMAN  SERVICES  Finarwng  Adm:ntatr-
.  
<
Memorandum

DEC29* 
Bruce  C. Vlade~ 
Administrator  ~l&@+ 
Subject	
Office  of Inspector  Generai  (OIG)  Draft  Repo~  Electronic  Data  Interchange: 
Issues  and  Challenges  (OEI-12-93-OO080) 
To 
June  Gibbs  Brown 
Inspector  General 
We  reviewed  the  subject  draft  report  on  electronic  data  interchange  (EDI)  issues. 
OIG  does  a credible  job  in identifying  the  enormous  number  of issues,  potentia.i 
problems  and  tasks  confronting  the  Federal  governrnen~  and  the  Health  Care 
Financing  Administration  (HCFA)  in particular,  in moving  to a more  fully automated 
environment.  We  are  well aware  of the  monumental  task  facing  HCFA  with  the 
implementation  of ED I.  We appreciate  and  share  OIGS concerns  regarding  EDI  and 
believe  OIG  has  an  important  role  in its development  and  implementation.  We  l~k 
fortvard  to working  with  OIG  in this  process.  Our  comments  are  attached  for your 
review. 
Thank  you  for the  opportunity  to review  and  comment  on  this  draft  report  Please 
advise  us if you  wish  to discuss our  response. 
Attachment  Comments  of the  Health  Care  Financin~  Administration  (HCFA~ 
on  the  Office  of Inmector  General  (OIGl  Draft  Reoox-c 
.  .  Electronic  Data  Interchange:  Issues  and  Challenges 
(OEI-12-93-00080\ 
General  Comments 
OIG  clearly  demonstrates  that  it understands  our  goal of evolving  Medicare  and 
Medicaid  into  an  all-electronic  environrnen~  our  pktns  for  achieving  this  goal,  and  the 
barriers  that  must  be  crossed  before  this  goal  can  be realized.  However$  the  report 
implies  that  the  Department  of Health  and  Human  Services  (HHS)  has  not  taken  a 
leadership  role  in the  development  of computetid  patient  records.  On  page  2 of the 
Introduction  and  page  10 of the  Companion  Technologies  section,  for example,  the 
report  does  not  fully  acknowledge  HI-M leadership  in this  area.  We  think  that  the 
report  should  be  revised  to reflect  the  following: 
Establishment  of an  HHS  computerized  Patient  Records  Council  to coordinate 
various  Departmental  activities  and  promote  HHS  leadership  in the 
development  of computer-based  patient  records  systems.  The  council  has met 
twice and  wiil  presumably  be  the  focus  of HHS  activities  in this  area  in the 
future. 
- Partial  funding,  through  the  Agency  for  Health  Care  Poliq  and  Research,  of 
the  activities  of the  American  National  Standards  tititutes  Health  Informatics 
Planning  Panel  (HISPP).  The  HISPP  is coordinating  various  standard  setting 
efforts  in the  area  of health  informatics.  SUChcoordination  is essential  to the 
development  of useful  computerized  patient  records. 
Participation  in the  deliberations  leading  to  the  formation  of the  Computerized 
Patient  Records  Institute. 
- Participation  in the  American  Hospital  Associations  Work  Group  on 
Computerization  of Patient  Records.  The  work  group  was formed  at  the 
request  of former  Secretary  Sullivan  and  recently  released  its draft  report  to 
Secretary  Shalala. 
.  Establishment  of a HCFA  Electronic  Environment  Steering  Committee  and 
participation  in the  Work  Group  for  Electronic  Data  Interchange  (WEDI)  and 
the  American  National  Standards  Institute  (NSI),  to develop  and  implement 
standardization  not  oniy between  Medicaid  and  Medicare,  but  between  these 
programs  and  all  other  health  care  insurers.  Page  2 
We believe.~e  definition  of electronic  dam  ~terchange  (EDI)  is not  fully set  forth  in 
the  report.  AS sated  in the  introduction,  EDI  is the  electronic  transfer  of data,  in a 
standard  fol-ma~  between  trading  partners.  It should  be  made  clear  that  EDI  relates 
only to the  data  that  are  output  from  an  applications  system,  e.g., a providers  billing 
system,  and  how  those  data  are  transported  to another  applications  system,  e.g.,  a 
contractors  claim  payment  system.  ED1 does  not  apply  to how that  applications 
system  actually  processes  the  data. 
h  addition,  we believe  OIG  would  be  far more  effective  and  helpful  to HCFA  by 
focusing  its resources  on  those  issues  impacting  most  directly  on the  potential  for 
fraud  and  abuse  in the  Medicare  and  Medicaid  progrms  (i.e.,  certifications, 
accountability,  controls,  integrity,  confict  of interes~  contracts,  legal  use  of 
information,  audit  trails,  and  audits).  We would  we]come  OIGS recommendations 
relative  to potential  fraud  and  abuse  issues. 
Also,  we believe  O IG  has an  important  role  to play  in reviewing  the  sufficiency  of our 
safeguards  designed  to  ensure  proper  paymen~  We weicome  OIGS review  of the 
standard  Electronic  Media  Claim  (EMC)  agreement  currently  being  developed.  This 
standard  agreement  will detail  the  responsibilities  of all  parties  in the  EDI 
environmen~  and  specify  the  ownership  of and  responsibility  for Medicare  and 
Medicaid  data  at  each  point  in the  data  flow. 
Finally,  we suggest  that  OIG,  in a separate  repo~  develop  tie  issue  of small  provider 
conversion  to  EMC/electronic  funds  transfer  (ET.  Once  EDI  reaches  a criticd 
mass,  the continued  use  of manual  paper  data  systems  will become  increasingly 
inefficient.  In developing  incentive  or cost-subsidtition  programs  for small  providers, 
consideration  shouid  be  given  to the  burden  and  cost  they will create  for HCFA  if 
they  do not  interface  with  HCFAS electronic  system. 
The  following  comments  are  being  offered  under  the  designated  headings  reflected  in 
the  Issues section  of the  repow. 
POLICY DIRECTION 
Medicare  Transaction  Svstem  (MTS):  At  the  present  the,  MTS has not  addressed 
the  issue  of smart  card  technology.  The  basic  methods  of a~ess  and  entitlement 
verification  are  still  being  reviewed.  Medicare  and  Medicaid  program  staff  have 
attended  the  technical  advisory  group  (TAG)  meetings  of WEDI.  WEDI 
recommended  moving  away from  expensive  smart  card  technology  to the  use  of the 
data  base.  This  recommendation  did not  require  that  users  opt  for a plastic  card  for 
identification.  This  TAG  suggested  that  we study  the  use  of computerized  patient 
records  in our  medical  review  activities.  Page  3

Medicaid  P6iht  of Service  (POS~ Claims  Management  Smtems:  As noted  in our

comments  on a prwicms  OIG  repo~  (Point-Of-Service  Claims  Management  Systems

for Medicai&  OEI-01-91-00820,  May  1992), we are  fully committed  to improving  the

efficiency  of the  State  Medicaid  Agency  (SMA)  Medicaid  Management  information

Systems  operations  through  standardization  and  tie  use  of electronic  technology.

Since  this  OIG  report  was issue~  eight  SNIAs have  reported implementation  of POS

systems  for pharmacies  (including  six systems  with  utilization  review  capability)  MM

three  of these  systems  being  expanded  and  made  available  to providers  other  than

pharmacies.  Ten  additional  SNlk  are  currently  developing  POS  modules  for

implementation  by the  end  of calendar  year  1993, and21 of the  remaining  33 SW

are  considering  the  development  and  implementation  of POS  modules  for completion

by late  1994.

THE NEED FOR A COHESIVE STRATEGIC SYSTEMS PLAN COVERING EDI

HCFA  is moving  forward  with  a strategic  planning  initiative  to streamline,  consolidate,

and  integrate  Medicare  and  Medicaid  claims  processing,  including  EDI.  Stidiirbg

of systems,  providing  appropriate  incentives,  and  utitig  companion  technologies  are

critical  goals  and  objectives  of this  initiative.

POLICY IMPLEMENTATION

Internal  Controls  on  EDI:  This  is an  ongoing  issue  between  HCFA  and  OIG

regarding  the  adequacy  of HCFAS management  controls  over  operations  and  the

subject  of extensive  reviews  by OIG.  We  perfo~  reviews  deemed  sufficient  to ensure

that  the  Medicare  contractors  and  SMAS have  adequate  internal  controls.  In the

course  of our  oversight  activities,  we review  many  of the  procedures  and  processes

(i.e.,  internal  controls)  followed  by the  contractors.  These  oversight  activities  are

performed  by both  central  office  and  regional  office  staffs.  We  perform  reviews  that

are  formal  and  repetitive  in nature,  and  which  are  used  to  evaluate  performance.

There  are  many  other  reviews  and  contacts  that  are  less formal  which  arise  to address

specific  issues.  In both  cases,  HCFA  is aware  of the  importance  of internal  controls

and  evaluation  activities  in the  area  of EDI.

Data  Safeguards:  Any  electronic  data  exchange  system  must  safeguard  access  to  the

system  itself  in order  to protect  the  data  within.  This  requires  identify  those  who

us  to 
input  da@  as well  as those  who use  the  da~  and  it also  requires  periodic

certifications  and  maintenance  of a change  of custody  as the  data  move  from  user  to

user.
 Page  4 
In both  of the  above  area%  HCFA  is aware  of the  importance  of internal  controls  and 
evaluation  ~ckvities  in the  area  of EDI.  We welcome  OIGS additional  thoughts  or 
recommendations  that  would  strengthen  our  operations. 
Electronic  Funds  Transfer  (EF17 :  On  page  8, The  HCFA  Perspective,  OIG  expresses 
concern  about  the  changes  that  have  been  made  in Medicare  claims  processing  as a 
result  of the  implementation  of Medicare  nation~  claims  formats  and  EFT.  The  EFI 
systems  modifications  were  made  by HCFAS  standard  system  maintainers  and 
consisted  primarily  of installing  the  capability  to  initiate  EFI  with  the  Medicare  bank. 
This  function  required  system  programming  and  liaison  activities  with the  Medicare 
bank  to ensure  the  establishment  of proper  Em  transmission  protocols. 
Since  contractors  initiate  13Ts  and  send  these  transmissions  through  the  Medicare 
bank  (the  Automated  Clearing  House  (ACH)),  and  ultimately  to the  providers  bank 
evexy precaution  has  been  taken  to  ensure  the  accuracy  and  integrity  of each 
electronic  payment  transaction.  The  contracto~  Medicare  ban~  and  ACH  operators 
are  bound  by strict  operating  guidelines  and  Federai  regulations  concerning  the 
initiation,  transmission,  and  receipt  of EFIs.  The  benefits  accounting  and  reporting 
functions  that  occur  with  E17  transactions  mirror  those  that  currently  exist under  the 
checks  paid  method  of advancing  funds  under  the  Letter  of Credit  system.  Therefore, 
we do not  anticipate  that  benefit  payments  made  under  EFI will be vulnerable  to 
errors  and/or  fraud. 
Suecific  Comments 
Page  9, second  bullet  point: 
HCFAS goal  is to  increase  the  rate  of Em  for Medicare  payments  made  to 
hospitals  to  100 percent  within  3 years. 
HCFA  is currently  reviewing  public  comments  received  in response  to BPO-104-PN 
which was published  on January  1S.  This  notice  proposes  to require  hospitals  to 
submit  all inpatient  and  outpatient  bills  electronically  and  to receive  payments  and 
remittance  advices  electronically.  In response  to the  many  comments  urging  HCFA  to 
extend  the  implementation  timeframe  for BP()-1()4.PIN,  we  anticipate  that  hospitals 
will be  given at  least  6 months  from  the  date  of publication  of tii  final  notice  in which 
to comply  with  its requirements.  We  anticipate  that  the  final  version  of this  notice  will 
be published  no sooner  than  early  in fiscai year  1994.  Page  5 
Page  9, fourth-bullet  point: 
OIG  will determine  if HCFA  adequately  assessed  benefits  and  costs. 
The  full benefits  of EMC  and  EFl  are  to be  actieved  in  an integrated  anti  fully 
interactive  claims  submission  and  payment  entionmen~  Our  estimates  of the  benefits 
and  costs  of En  have  always  been  wn~rvatie  and  are  predicated  on  the  fact  that 
EIW  among  physicians  and  suppliers  will be  implemented  at  a much  slower  rate  than 
with  institutional  providers.  Because  of the  relatively  low volume  of payments  made 
to institutional  providers  we  have  yet  to realize  si~fiat  cost  savings  from  EFT 
usage.  We  anticipate  that  as the  technology  spreads  throughout  the  entire  provider 
community,  cost  savings  will increase  dramatically. 
In a recent  OIG  repo~  Electronic  Funds  Transfer  for Medicaid  Providers, 
OEI-01-91-00821,  OIG  recommended  that  HCFA  ~ist  States  in developing  billing 
agreements  for providers  who  use  electronic  c1aimq  remimce  advisorie$  and  funds 
transfers;  and  to develop  guidelines  for provider  participation  in Em.  OIG  agreed  to 
consider  conducting  an  inspection  or  audit  on tie  benefits  and  costs  of EFI  to  help 
HCFA  develop  guidelines  for  States. 
Page  9, fifth  builet  point 
OIG will determine  if HCFA  provided  adequate  i.nstruction~  lead  time,  and 
resources  to  the  Medicare  contractors. 
In early  1990, HCFA  began  exploring  Em  technology  for  tie  Medicare  program. 
Em  soon  became  a critical  component  of HCFAS co~itrnent  to establishing  a 
totally  electronic  billing  and  payment  environment  for  all  Medicare  contractors  and 
providers.  HCFA  provided  technical  specification%  procedural  guidance,  and 
appropriate  funding  throughout  the  implementation  of ~.  T&  SUpport continues 
as increasing  numbers  of Medicare  providers  elect  to  receive  payments  via  EITI. 
Page  9, sixth bullet  point: 
OIG will determine  if HCFA  is tracking  progress  during  implementation 
sufficiently  to  identify  problems  and  resolve  them  effectively  and  in a timely 
manner. 
HCFA  has been  quite  diligent  in tracking  the  progress  of contractors,  providers,  and 
SMAS in implementing  EFT.  Staff has worked  in conjunction  with  the  contractor 
community  throughout  the  implementation  process.  HCFA  circulated  draft  contractor 
instructions  for several  months  prior  to their  effective  date  to ensure  that  all concerns 
were  taken  into  consideration  in the  final  product.  All  problems  identified  by 
contractors  were  addressed  in a timely  and  professional  manner.  Page  6 
Technicai  Comments 
. . 
Page  3, last  paragraph,  fourth  line  from  bottom  - replace  transcribe  with

input.

Page  6, first  full  paragraph,  third  line  from  bottom  - remove  the  word

processing  from  the  sentence.  ANSI  fo~at,s  are  for  ~smission  of da~  not

processing.  The  they used  in the  be@ing  of the  last  sentence  needs  to be

identified.

Page  6, third  paragraph,  third  line  from  bottom  - it is not  clear  what  is meant

It
. . . that  recordkeeping  requirements  in the  insurance  industxy  as a whole

increase  papenvork  burden  . . . .  Doctors  need  to  keep  records  so that  they

know what  procedures  they  have  performed  on patien~  and  to whom  they  have

referred  the  patiens  etc.

Page  6, fouti  paragraph,  fourth  sentence  - HCFA  is not  planning  to implement

an ANSI  standard  uniform  billing  form.  ANSI  is a data  transmission  standar~

not a billing  form.

Page  6, last  paragraph,  fifth sentence  - OIG  references  specific  legislation  which

would  empower  national  standards  organizations  to  establish  mandatoxy

standards  for  electronic  transmission  and  payment  of claims  please  provide  the

bill number  and  the  session  of Congress.

page  17, Program  Safeguard~  first  paragraph  - OIG  cites  a paper  written  by

Peter  Weiss  on  EDI.  Please  provide  a citation  for  this  paper.
 APPENDIX  B

OIG  RESPONSE  TO  AGENCY  COMMENTS 
The  Health  Care  Financing  Administration  (HCFA)  commented  on a draft  version  of 
this report.  The  HCFA  suggested  changes  in the  report  to better  reflect  its activities 
and  those  of the  Department  with respect  to EDI  and  paperless  processing,  made 
suggestions  about  the  focus  of OIGS work  in this area,  and  gave  us technical 
comments.  We  have  revised  our  report  to address  many  of HCFAS  comments  and 
also provide  additional  comments  on HCFAS  response  below. 
GENERAL  COMMENTS 
HCFA  Comments 
The  HCFA  believes  that  the  OIG  would  be  more  effective  and  helpful  to focus its 
resources  on those  issues impacting  most  directly  on the  potential  for fraud  and  abuse 
in the  Medicare  and  Medicaid  programs  (i.e., certifications,  accountability,  controls, 
integrity,  conflict  of interests,  contracts,  legal  use  of information,  audit  trails,  and 
audits). 
OIG  Res~onse 
The  OIG  recognizes  that  these  areas  are  critically  important  and  does  plan  to  address 
them  in our  current  and  upcoming  reviews.  The  OIG  believes,  however,  that  the 
other  areas  identified  in this report  also will have  a direct  bearing  on Medicare  and 
Medicaid  operational  efficiency,  controls,  and  economy,  as well as on financial 
management  and  reporting.  Thus,  OIG  sees  a need  to address  a broad  range  of EDI 
and  paperless  processing  issues in its current  and  future  work  plans. 
HCFA  Comments 
Because  the  continued  use of manual  paper  data  systems  will become  increasingly 
inefficient,  the  HCFA  has suggested  that  the  OIG,  in a separate  report,  develop  the 
issue  of small  provider  conversion  to electronic  media  claims  and  electronic  funds 
transfer. 
OIG  Response 
The  OIG  has  developed  a workplan  item,  Adding  Incentives  and  Removing  Barriers 
to Provider  Participation  in EDI  and  Paperless  Processing.  The  purpose  of this study 
is to assess how different  providers  can be brought  into  the  EDI  and  paperless 
processing  environment,  what  barriers  exist for providers,  and whether  HCFAS  efforts 
address  those  barriers  and  provide  proper  incentives  for providers. 
B-1
 INCENTIVES AND BARRIERS 
HCFA  Comments 
In response  to this report  on the  issue  of HCFAS goal to increase  the  rate  of EFT  for 
Medicare  payments  made  to hospital  to  100 percent  within  3 years,  HCFA  indicated 
that  it was reviewing  public  comments  received  in a response  to its proposed  notice 
published  January  15, 1993.  This notice  was intended  to promote  the  use  of 
standardized  electronic  billing and  payment  by hospitals.  Since  then,  HCFA  concluded 
that  it had  no legal  authority  to penalize  hospitals  that  fail to comply  with the  notice. 
When  HCFA  withdrew  this notice  on January  24, 1994, HCFA  stated  that  the  hospital 
electronic  media  claims  submission  rates  exceeded  90 percent. 
OIG  Resuonse 
The  OIG  is pleased  to see that  HCFA  has  achieved  a rate  of EFT  for Medicare 
payments  made  to hospitals  exceeding  90 percent,  but  OIG  is concerned  about  the 
remaining  hospitals  that  do not  participate  in the  use  of standardized  electronic  billing 
and  payment  mechanisms.  As we have  indicated  in this report,  we plan  to look  at 
provider  participation  in EFT  as part  of our  review  of Medicare  claims  processing.  APPENDIX  C

ACRONYMS  USED  IN THIS  REPORT 
ANSI  American  National  Standards  Institute 
ATM  automatic  teller  machine 
BPO  Bureau  of Program  Operations 
CHAMPUS	 Civilian  Health  and  Medical  Program  of the 
Uniform  Services 
CMN  Certificate  of Medical  Necessity 
CPR  computer-based  patient  record 
CPRI  Computer-Based  Patient  Record  Institute 
DME  durable  medical  equipment 
DUR  drug utilization  review 
EDI  electronic  data  interchange 
EFT  electronic  funds  transfer 
EMC  electronic  media  claims 
ERN  electronic  remittance  notices 
FAMIS Family  Assistance  Management  Information 
Systems 
FMFIA  Federal  Managers  Financial  Integrity  Act 
GAO  General  Accounting  Office 
HCFA  Health  Care  Financing  Administration 
HHS  Health  and  Human  Se~ices 
IOM  Institute  of Medicine 
IRM  information  resources  management 
c-l
 MMIS  Medicaid  Management  Information  Systems 
MTS  Medicare  Transaction  System 
NIST  National  Institute  of Standards  and 
Technology 
OBRA  Omnibus  Budget  Reconciliation  Act 
OIG  Office  of Inspector  General 
PIN  personal  identification  numbers 
Pos
 point  of service 
PRO  Peer  Review  Organization 
SMA
 State  Medicaid  agencies 
WEDI  Workgroup  for Electronic  Data  Interchange 
c-2