Testimony of: 
Robert A. Vito 
Regional Inspector General for Evaluation and Inspections 
Office of Inspector General 
U.S. Department of Health and Human Services 
 
 
Good morning Chairman Pitts, Ranking Member Pallone, and other distinguished Members of 
the Subcommittee.  I am Robert Vito, Regional Inspector General for Evaluation and Inspections 
at the U.S. Department of Health and Human Services, Office of Inspector General (OIG).  
Thank you for the opportunity to testify about the Centers for Medicare & Medicaid Services 
(CMS) oversight of Medicare contractors. 
 
CMS relies on contractors to administer the Medicare program and is responsible for overseeing 
the contractors performance.  CMS contracts with Medicare Administrative Contractors 
(MACs) to process Parts A and B claims; Medicare Advantage (MA) plans to provide managed 
care services under Part C; Part D plans to provide prescription drug coverage under Part D; and 
benefit integrity contractors, which serve to protect Medicare from fraud, waste, and abuse. 
 
RECURRING ISSUES LIMIT CMSS OVERSIGHT OF MEDICARE CONTRACTORS  
 
Two years ago, OIG testified before this Committee and outlined problems with CMSs 
oversight of its benefit integrity contractors activities.1  These problems included CMSs limited 
use of contractor-reported program activity data for oversight activities, significant variation in 
results across contractors, and a lack of uniformity and understanding of key fraud terms and 
definitions across contractors.  
 
My testimony today is based on recent evaluation reports, as well as a larger body of OIG work 
identifying vulnerabilities in CMSs oversight of contractors.  Today, OIG is issuing two reports 
on CMSs oversight of its Medicare Parts C and D contractors that highlight problems similar to 
those that we identified with its benefit integrity contractors.2  Earlier this year, OIG issued  
two reports on MACs activities that also highlight the need for more timely and targeted 
oversight of the contractors administering Medicare Parts A and B.3 
                                                           
1 Testimony of Robert A. Vito, Regional Inspector General for Evaluation and Inspections, before the Subcommittee 
on Oversight and Investigations of the House Committee on Energy and Commerce on Medicare Contractors' 
Efforts to Fight Fraud - Moving Beyond "Pay and Chase."  Available at 
http://oig.hhs.gov/testimony/docs/2012/Vito_testimony_06082012.pdf. 
2 OIG, CMS Regularly Reviews Part C Reporting Requirements Data, But Its Followup and Use of the Data Are 
Limited (OEI-03-11-00720), March 2014, and Less Than Half of Part D Sponsors Voluntarily Reported Data on 
Potential Fraud and Abuse (OEI-03-13-00030), March 2014. 
3 OIG, Medicare Administrative Contractors Performance (OEI-03-11-00740), January 2014, available at 
http://oig.hhs.gov/oei/reports/oei-03-11-00740.pdf, and Over Four Million Medicare Summary Notices Mailed to 
Beneficiaries Were Not Delivered in 2012 (OEI-03-12-00600), January 2014, available at 
http://oig.hhs.gov/oei/reports/oei-03-12-00600.pdf. 
 
1  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  Regardless of the type of Medicare contractorParts A and B fee-for-service, MA, or  
Part Dthere are common issues that limit CMSs oversight of its contractors.  CMS has not: 
 
  leveraged contractor-reported data to improve oversight; 
  investigated variation in data across contractors to determine underlying causes, 
especially when it is not explained by the size or geographical jurisdiction of contractors; 
  addressed underperforming contractors timely and required corrective actions for all 
performance standards that were not met; or 
  shared information with beneficiaries and other stakeholders that could assist antifraud 
efforts. 
 
CMS HAS NOT LEVERAGED CONTRACTOR-REPORTED DATA TO IMPROVE ITS 
OVERSIGHT OF MA AND PART D PLANS 
 
With more than $200 billion in expenditures and millions of Medicare beneficiaries covered 
under MA and Part D, it is paramount that CMS perform regular and rigorous oversight of its 
MA and Part D plans.  This oversight ensures that beneficiaries are served well by the plans and 
that payments made on behalf of the programs are legitimate and appropriate.  However, the 
two reports released today demonstrate that CMS has not fully leveraged contractor-reported 
data to improve its monitoring and oversight of MA and Part D plans.  CMS also has not 
investigated extreme variations in contractor-reported MA and Part D data to determine the 
underlying causes. 
 
CMS has made limited use of Part C data to oversee MA plans despite investments in 
contractor reviews of the data 
CMS has collected data from MA plans under the Part C Reporting Requirements since 2009.  
These reporting requirements include data on serious reportable adverse events, grievances, and 
appeals.  The Part C Reporting Requirements data are a significant resource for oversight and 
improvement of the MA program because they pertain to the performance of MA plans and often 
are not available to CMS from other sources.    
 
In its report released today, OIG found that, while CMSs contractor had performed regular and 
extensive analytics to identify inaccuracies and outliers in the Part C data, CMS did not use the 
data to inform its oversight of the MA plans. 
 
CMSs contractor identified issues with the Part C data reported by MA plans.  CMS 
contracted with Acumen to review and analyze all Part C Reporting Requirements data 
submitted by MA plans, identify data issues, and notify affected MA plans.  We found that 
Acumen has performed the required reviews and supplied both CMS and MA plans with 
information about the data issues it identified.  For 2010 and 2011, Acumen identified 2,134 data 
issues across 513 of the 638 MA plans that submitted data.  Specifically, the data issues included 
1,904 outlier incidents, 147 incidents of overdue data, 50 incidents of inconsistent data, and 
2  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  33 incidents of placeholder data.4  These data issues could signal performance problems that 
CMS could target for review. 
 
CMS did not follow up with MA plans about data issues and did not use reported data to 
oversee MA plan performance.  Acumen provided CMS with information about each data issue 
it identified before notifying the MA plans on CMSs behalf.  Many MA plans received notices 
about submissions of outlier data, but CMS did not determine whether these outliers reflected 
inaccurate reporting or atypical plan performance.  CMS did not contact any MA plans to 
determine the cause of the outlier data values, ensure that inconsistent data were corrected, or 
address data submitted with placeholder values.  
Part C regulations authorize CMS to find an MA plan out of compliance with contract 
requirements when the plans performance represents an outlier relative to the performance of 
peer organizations.  However, CMS has not used analytics and data reports provided by Acumen 
to inform the selection of MA plans for audits or to issue compliance notices to MA plans for 
performance concerns. 
 
CMS has not shared the Part C Reporting Requirements data with the public.  As far back as 
2009, CMS indicated that one purpose of Acumens contract was to create Public Use Files.  To 
date, CMS has not released any Public Use Files regarding the Part C Reporting Requirements 
data.  Additionally, CMS has not included any of the Part C Reporting Requirements measures in 
its calculation of the star ratings for MA plans.  These ratings are posted for consumers on the 
Medicare Plan Finder Web site and are used to award value-based bonus payments to MA plans. 
 
CMS has not required mandatory reporting of fraud and abuse data by Part D plans nor 
has it taken advantage of the voluntarily reported data to monitor plans  
 
MA and Part D plans efforts to identify and address potential fraud and abuse are crucial to 
protecting the integrity of the Parts C and D programs.  Since 2008, OIG has repeatedly 
recommended that CMS require mandatory reporting of fraud and abuse data by MA and Part D 
plans.  CMS has disagreed and, therefore, does not require mandatory reporting of fraud and 
abuse by these plans.  Instead, since 2010, it has encouraged Part D plans to voluntarily report 
fraud and abuse. 
 
OIG is releasing a report today that determines the extent to which Part D plans voluntarily 
reported fraud and abuse data and determines whether CMS used these data to monitor and 
oversee plans activities to identify fraud and abuse.  We found that CMS has not used the data 
to monitor the success of its Part D plans fraud and abuse identification activities. 
 
                                                           
4 An MA plan is considered to have submitted Part C data that contain placeholders if it submitted values of zero for 
two or more measures in a reporting period.  An MA plan submitted inconsistent data if it submitted data values for 
a measure that contradict one another.  An outlier data value is a data value that falls outside a specified range of 
reported values, or falls above or below a predetermined benchmark value. 
 
3  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  More than half of Part D plans did not voluntarily report fraud and abuse data.  Between 2010 
and 2012, no more than 40 percent of Part D plans reported any fraud and abuse data to CMS.  
The percentage reporting declined each year40 percent of plans reported data in 2010, 
37 percent in 2011, and 35 percent in 2012.  The sponsors that did not voluntarily report any data 
for all 3 years covered 14.5 million beneficiaries in 2012, or 46 percent of the total number of 
beneficiaries enrolled in Part D plans.  Therefore, CMS does not have data on incidents of 
potential fraud and abuse for plans covering almost half of the beneficiaries enrolled in Part D.   
While CMS has instituted voluntary rather than mandatory reporting, it has stated that it is 
difficult to draw conclusions from the data that can be shared among plans and law enforcement 
because the reporting of the data is voluntary. 
 
Identification of fraud and abuse varied significantly across Part D plans, and important 
details about fraud abuse are not collected.  Overall, plans identified 64,135 incidents of 
potential fraud and abuse between 2010 and 2012.  The number of such incidents identified 
varied significantly among the 320 plans that voluntarily reported data.  More than one-third did 
not identify any incidents of potential fraud and abuse in at least one year.  In contrast, in 2012, 
just three Part D plans identified more than two-thirds of all reported fraud and abuse incidents 
that year.  The number of incidents that plans identified annually ranged from 0 to 13,919, with a 
median of 4 incidents per plan.   
 
The variability in the number of incidents identified was often not explained by the size of the 
plans enrollment.  However, CMS did not perform any work to determine the underlying cause 
of the variability.  Without conducting this analysis, CMS cannot determine whether plans are 
reporting incorrect data, have ineffective programs to detect fraud, or lack a common 
understanding of what constitutes a potential fraud and abuse incident. 
 
Moreover, CMS does not collect detailed information on the incidents, such as who committed 
the potential fraud, and other case-specific details that could assist in followup.  Without this 
detailed information, CMS may be missing the opportunity to discover and alert plans to new or 
expanding fraud and abuse schemes. 
 
More than a quarter of Part D plans reported initiating no inquiries and corrective actions 
regarding incidents of potential fraud and abuse.  CMS requires plans to conduct a timely, 
reasonable inquiry and to carry out appropriate corrective actions in response to potential fraud 
and abuse.  From 2010 to 2012, 28 percent of plans that identified fraud reported initiating no 
inquiries and corrective actions with regard to any of the incidents.  In that timeframe, these 
74 plans identified 4,028 incidents of potential fraud and abuse.  Though they are not required to 
do so, Part D plans can also refer incidents of potential fraud and abuse to CMS, Federal and 
local law enforcement, and State agencies.  Sixty-one percent of the plans did not refer any 
identified incidents to these entities.  
 
CMS did not use the reported data to monitor Part D plans fraud detection and prevention 
efforts.  CMS reported that it did not use the voluntarily reported data for monitoring or 
oversight purposes.  CMS did not follow up with plans about their fraud and abuse control 
4  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  activities related to the voluntarily reported data.  More than 2 years after receiving the data, 
CMS has not used the data to assess plans fraud prevention and detection efforts.  However, 
CMS stated that it is formulating processes to follow up with Part D plans and to use the reported 
data to monitor and oversee them.   
 
Additionally, CMS reported that it did not share the data on potential fraud and abuse with plans 
or law enforcement but did begin sharing the data with its Medicare Drug Integrity Contractor 
(MEDIC) in 2013. 5  According to CMS, the MEDIC has developed methodologies to analyze 
the data.  CMS stated that it is discussing and formulating processes for sharing data with plans 
and law enforcement. 
 
MACS DID NOT MEET ALL PERFORMANCE STANDARDS, TWO MACS CONSISTENTLY 
UNDERPERFORMED, AND CMS REVIEWS OF MAC PERFORMANCE WERE NOT 
ALWAYS CONDUCTED TIMELY  
 
MACs process hundreds of billions of dollars in Parts A and B fee-for-service claims every year.  
CMS awarded $4.3 billion over a 5-year period to the 16 MACs that were operational in 2013.  
Given the billions of dollars awarded to MACs and the critical role they play in administering 
Medicare Parts A and B, effective oversight of MACs performance is important to ensure that 
they are adequately processing claims and performing other assigned tasks.  In January 2014, 
OIG issued a report that describes the extent to which MACs met performance standards and 
CMS assessed and monitored MACs performance.   
 
CMSs performance reviews of MACs were extensive, but they were not always completed 
timely 
 
Overall, CMS conducted extensive activities to review MACs performance.  This is important 
because MAC reviews provide vital performance information and can be used by CMS to 
support future award decisions.  However, for the same reasons, it is also important that CMS 
complete these reviews timely.  While CMS goes through an extensive process to finalize 
MACs performance evaluations, it did not always do so timely.  For the 25 evaluations that had 
a final report date in the performance reporting system, the time between the end of the 
performance period and the date the report was finalized ranged from 8 months to more than 
2 years.  If performance evaluations are not completed timely, the information they contain 
cannot be used to support future contract award decisions.   
 
 
 
 
                                                           
5 The MEDIC is responsible for detecting and preventing fraud, waste, and abuse in Medicare Parts C and D 
nationwide. 
 
5  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  MACs met the majority of quality assurance standards reviewed by CMS; however, a 
quarter of unmet standards were not resolved   
 
There were 1,201 standards included in CMSs quality assurance reviews of MACs across  
2 performance periods.  Overall, MACs met 74 percent (891) of these standards and did not meet 
26 percent (310).  CMS conducts quality assurance reviews to ensure that MACs are providing 
the quality of services required in their contracts.  MACs did not meet over 40 percent of 
standards in each of three areasprocessing of provider enrollment applications, processing of 
claims in which Medicare is not the primary payer, and managing the timeliness and accuracy of 
the Medicare appeals process.  MACs had not resolved issues with 27 percent of unmet standards 
and CMS did not require action plans for 12 percent of unmet standards.  OIG found that unmet 
standards without action plans were almost four times more likely to have issues go unresolved.  
  
Two MACs consistently underperformed across various CMS reviews 
 
Two MACs did not meet a high percentage of quality assurance standards.  One of the MACs 
had the highest percentage of unmet standards (48 percent), and over half of the issues identified 
through its reviews had not been resolved.  The second MAC did not meet 31 percent of the 
quality assurance standards.   
 
CMS award fee distributions also indicated underperformance by these two MACs relative to the 
others.  MAC contracts include an award fee that a MAC may earn if its performance exceeds 
basic requirements.  There was an overall award fee pool of $39 million, of which MACs earned 
two-thirds, or $26 million.  CMS awarded the lowest percentage of award fees to the two 
underperforming MACs35 and 40 percent of their respective award fee pools.  The two MACs 
were the only MACs that did not earn any award fee for the contract administration metric 
during one performance period.  This metric evaluates a MACs overall ability to manage its 
contract, specifically in areas such as communication, flexibility, staffing, and cost management.   
 
Despite performance issues, CMS renewed all of the contract option years for these two MACs.  
However, when the contract for one MACs jurisdiction was recompeted, CMS awarded the 
contract to a different contractor.  At the end of 2013, the second MACs contract was still in 
effect and the recompete for the jurisdiction had not yet been completed.  According to CMS 
staff, the agency has considered not renewing contract option years for MACs performing at 
substandard levels.  However, it takes approximately one year for CMS to solicit and award a 
new contract.  With only 4 option years for each contract, CMS reported that the resources and 
risk involved in conducting an unforeseen procurement to replace a poorly performing MAC 
made such a decision impractical. 
 
 
 
 
6  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  CMS IS MISSING THE OPPORTUNITY TO ENLIST MILLIONS OF MEDICARE 
BENEFICIARIES IN THE FIGHT AGAINST FRAUD THROUGH LACK OF GUIDANCE TO 
MACS ON UNDELIVERED MEDICARE SUMMARY NOTICES 
 
As part of its efforts to reduce Medicare fraud and abuse, CMS relies on beneficiaries to report 
suspicious activity identified on their Medicare Summary Notices (MSNs).  MSNs are paper 
forms that summarize Parts A and B processed claims.  MACs are responsible for processing 
MSNs and mailing them to beneficiaries.  A CMS official stated in June 2013 that beneficiaries 
best defense against fraud includes checking their MSNs for accuracy.  If MSNs go undelivered, 
beneficiaries do not have the opportunity to review the services or items billed to Medicare.   
 
In January 2014, OIG released a report that provided information on the quantity of undelivered 
MSNs and the procedures that MACs6 use to track and follow up on undelivered MSNs.    
 
Over 4 million MSNs were not delivered to beneficiaries in 2012 
 
OIG found that CMS did not monitor how many MSNs failed to reach Medicare beneficiaries 
during 2012.  In 2012, MACs mailed 194 million MSNs to beneficiaries.  According to the 
MACs, approximately 4.2 million MSNs were returned as undeliverable in 2012.  MACs could 
not provide the total Medicare payment amounts associated with these undelivered MSNs.  
However, the allowed amounts associated with a sample of 1,445 undelivered MSNs returned in 
January 2013 totaled $2.7 million.  Of 1,445 undelivered MSNs, 51 included paid claims that 
were associated with beneficiary or provider numbers that had been compromised in some way, 
e.g., identity theft.  
 
Tracking and followup on undelivered MSNs is limited and varies across contractors 
 
CMS requires MACs to provide MSNs to Medicare beneficiaries, but it has not issued guidance 
regarding whether or how to track and follow up on undelivered MSNs.  In practice, not all 
MACs track or follow up on undelivered MSNs, and those that do utilize a variety of methods.  
Half of MACs attempt to verify addresses on undelivered MSNs, but few conduct any further 
followup.   
 
MACs reported that incorrect or invalid addresses were the most common reasons MSNs were 
undeliverable.  Eight years ago, CMS had recognized that beneficiary address data were not 
transferring correctly from its system to its contractors shared systems.  CMS instructed system 
maintainers to modify the system to accept the complete addresses.  From a sample of 
undelivered MSNs, OIG identified incomplete addresses that appeared to result from incorrect 
transfers of address data into MACs shared systems. 
                                                           
6 There were 17 MACs, 1 fiscal intermediary, and 1 carrier processing MSNs during OIGs review. 
 
7  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  Because of the large number of MSNs that fail to reach beneficiaries and the lack of CMS 
guidance to MACs on how to address the underlying cause of this failure, CMS is missing the 
opportunity to solicit beneficiaries assistance in its fraud detection efforts. 
 
ACTIONS TO IMPROVE CMSS OVERSIGHT OF MEDICARE CONTRACTORS  
 
The effective oversight of Medicare contractors is a continuous, demanding, and often  
resource-intensive process.  However, OIG has discovered a number of recurring issues that limit 
CMSs oversight across all contractor types.  For MA and Part D plans, CMS has taken steps to 
collect potentially useful data, but has not followed up to determine the causes of outlier or 
questionable data.  These data could assist CMS in uncovering potential performance issues with 
its contractors.  CMS has developed a multitude of methods to review MAC performance and 
identify performance issues, but does not always have the tools in place to ensure that issues are 
corrected.  There are a number of actions that CMS should take to improve its oversight of 
Medicare contractors.  CMS has stated that it is considering implementing some of these actions.  
For example, after many years of not concurring with OIG recommendations to analyze variation 
in contractor-reported data, CMS has recently agreed to begin reviewing the variations among 
MA and Part D plans data. 
 
To ensure that CMS has accurate and complete data for its oversight, CMS should: 
  Amend regulations to require MA and Part D plans to report to CMS, or its designee, 
their identification of and response to incidents of potential fraud and abuse. 
  Provide MA and Part D plans with specific guidelines on how to define and count 
incidents of potential fraud and abuse, related inquiries, and corrective actions. 
 
To address significant variation in contractor performance, CMS should: 
  Determine whether outlier data values submitted by MA plans for the Part C Reporting 
Requirements reflect inaccurate reporting or atypical performance.  
  Review data from plans to determine why certain plans reported especially high or low 
numbers of incidents of potential fraud and abuse, related inquiries, and corrective 
actions. 
 
To monitor, improve, and address poor contractor performance, CMS should: 
  Use appropriate Part C Reporting Requirements data as part of its reviews of MA plans 
performance. 
  Seek legislative change to give CMS more flexibility in awarding new contracts when 
MACs are not meeting CMS performance requirements. 
  Require action plans for all unmet quality assurance standards for MACs. 
  Use results of MAC quality assurance reviews to help select award fee metrics.  
  Establish and meet reasonable timeframes for issuing MAC performance reports.   
 
 
 
8  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014 
  To increase the sharing of information with beneficiaries and other stakeholders that 
would lead to improved awareness of the quality and integrity of Medicare services, CMS 
should: 
  Provide guidance to MACs about the handling and review of MSNs that are returned as 
undeliverable. 
  Ensure that the beneficiary address information used by MACs to print addresses on 
MSNs is complete and properly formatted. 
  Establish a timeline for releasing the Part C Reporting Requirements Public Use Files. 
  Share plans reported data on potential fraud and abuse with all plans and law 
enforcement. 
 
OIG WILL CONTINUE TO REVIEW THE OVERSIGHT OF CMS CONTRACTORS 
 
CMS contractors are responsible for administering more than a half a trillion dollars in Medicare 
benefits each year.  Because of the importance of contractors in ensuring the effectiveness of 
CMS programs and OIGs mission to protect the integrity of the Medicare program and the 
health and welfare of the beneficiaries it serves, OIG will continue to broaden its body of work 
on contractor oversight.  OIG has work underway to review the landscape of contracts awarded 
at CMS with an emphasis on CMSs contract closeout procedures.  OIG is continuing to review 
performance across all types of Medicare benefit integrity contractors.  OIG also is engaged in 
reviewing CMSs contracting for the new health insurance marketplaces under the Affordable 
Care Act, including the awarding and oversight of, as well as contractor performance under, 
those contracts. 
 
Thank you for your support of OIGs mission and the opportunity to testify about CMS oversight 
of contractor activities. 
9  House Committee on Energy and Commerce 
Subcommittee on Health 
March 4, 2014