Department of Health and Human Services 
OFFICE OF 
INSPECTOR GENERAL 
MEDICAID 
Proactive Safeguards 
JUNE GIBBS BROWN 
Inspector General 
JULY 2000 
OEI-05-99-00070  OFFICE OF INSPECTOR GENERAL 
The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, is to 
protect the integrity of the Department of Health and Human Services programs as well as the 
health and welfare of beneficiaries served by them.  This statutory mission is carried out through a 
nationwide program of audits, investigations, inspections, sanctions, and fraud alerts.  The 
Inspector General informs the Secretary of program and management problems and recommends 
legislative, regulatory, and operational approaches to correct them. 
Office of Evaluation and Inspections 
The Office of Evaluation and Inspections (OEI) is one of several components of the Office of 
Inspector General.  It conducts short-term management and program evaluations (called 
inspections) that focus on issues of concern to the Department, the Congress, and the public.  The 
inspection reports provide findings and recommendations on the efficiency, vulnerability, and 
effectiveness of departmental programs. 
OEI's Chicago Regional Office prepared this report under the direction of William C. Moran, 
Regional Inspector General and Natalie A. Coen, Deputy Regional Inspector General.  Principal 
OEI staff included: 
REGION  HEADQUARTERS 
John M. Traczyk, Project Leader  Jennifer Antico, Program Specialist 
To obtain copies of this report, please call the Chicago Regional Office at 312-353-4124. 
Reports are also available on the World Wide Web at our home page address: 
http://www.hhs.gov/oig/oei/  E X E C U T I V E   S U M M A R Y  
PURPOSE 
This is the first of three reports describing Medicaid program safeguards.  This report 
discusses proactive  safeguards.  The second report discusses claim processing safeguards 
and the third report discusses post payment safeguards. 
This report is intended to provide information about and increase awareness of Medicaid 
proactive safeguards.  Proactive safeguards anticipate problems and attempt to thwart, or 
ward off, wrong doers.  They occur before a patient receives services and before a claim 
for services is generated for payment. 
PROACTIVE SAFEGUARDS 
Provider/Vendor Enrollment (including revised enrollment forms, onsite visits,

background checks and fingerprinting, surety bonds and improved verification procedures)

makes it more difficult for unqualified and unscrupulous providers to gain access to

Medicaid systems.

Periodic Provider Re-enrollment helps screen out  inactive providers and providers not

engaged in legitimate businesses. 

Provider Number Termination reduces the likelihood that they will be misused by

unscrupulous persons to defraud Medicaid. 

Provider, Patient and Employee Education should be the first line of defense against

Medicaid fraud and abuse. 

Prior Authorization is used by States to control problematic providers and abused

medical services.

Certificates of Medical Necessity are frequently used by States to obtain information

about the medical need for specific services, supplies and equipment.

Prime Vendor Contracts reduce the price of products and services by permitting  a

private business entity to function as the primary source for specific services or products. 

OPPORTUNITIES FOR IMPROVEMENT 
Based on our prior studies and information gathered during this study, we encourage 
States to consider the following opportunities for improving program safeguards: 
<<	 Target high risk providers for extensive application review and verification. 
Extensive reviews of all enrollment applications may not be cost effective; 
however, it appears that extensive reviews of specific providers and improved 
information verification techniques deter unscrupulous persons from obtaining a 
provider number. 
1 
Proactive Safeguards  OEI-05-99-00070  <<	 Expand the use of local field offices to conduct onsite visits to verify the 
legitimacy of problematic providers.  Onsite visits appear helpful in establishing 
the legitimacy of high risk provider number applicants.  Some States have 
increased the number of onsite visits and controlled the costs associated with 
onsite visits by using their local field offices. 
<	 Conduct more frequent and better education of providers concerning their 
obligation to protect their provider number(s) from unauthorized use and the 
need to notify Medicaid when their employment relationships with clinics 
and other providers terminates. Evidence suggest that many physicians do not 
adequately protect their provider numbers.  Unscrupulous persons circumvent 
provider enrollment safeguards by stealing a legitimate providers billing number or 
purchasing the billing number of a legitimate provider.  Some physicians are totally 
unaware that billing number information they have shared with former and 
potential employers has been used to defraud Medicaid. 
<<	 Strengthen Federal and State laws to hold physicians and other Medicaid 
providers financially and criminally liable for participating in any deception 
that allows others to use their credentials and business to defraud or cause 
financial harm to a State Medicaid program.  We believe that government 
programs need to address the vulnerability in their system safeguards stemming 
from physicians who permit others to use their identity to circumvent program 
safeguards or who permit the use of their professional licenses and places of 
business as a front to deceive Medicaid. 
<	 Identify and register all clearinghouses and third-party billers and improve 
safeguards to ensure that electronic claims are accepted only from authorized 
sites and terminals.  Todays Medicaid systems do not ensure that claims 
originating from billing agencies have been properly authorized by the physician 
under whose name claims are submitted.  Most Medicaid programs cannot identify 
billing companies that submit claims nor can they determine which physicians use 
which billing companies. 
<<	 Centralize responsibility for, and improve, employee fraud and abuse 
awareness training.  With some exceptions, it appears that fraud and abuse 
awareness training may be too fragmented to be effective. 
We intend to do additional in depth studies on proactive safeguards used by States. 
AGENCY COMMENTS 
The HCFA believes that the opportunities for improvement described in this report provide 
valuable information that will be shared with the State Medicaid programs. 
2 
Proactive Safeguards  OEI-05-99-00070  T A B L E   O F   C O N T E N T S  
PAGE 
EXECUTIVE SUMMARY

INTRODUCTION  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  4

PROACTIVE SAFEGUARDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  6

Provider/Vendor Enrollment  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  6

Application Forms 
Onsite Visits 
Background Checks & Fingerprinting 
Surety Bonds 
Third Party Verification  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  9

Periodic Provider Re-enrollment  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  9

Provider Number Termination  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  10

Provider, Patient & Employee Education . . . . . . . . . . . . . . . . . . . . . . . . . . .  11

Prior Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  12

Second Opinion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  14

Certificates of Medical Necessity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  15

Prime Vendor Contracts  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  15

OPPORTUNITIES FOR IMPROVEMENT  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  16

AGENCY COMMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  18

APPENDIX A  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .  19

3 
Proactive Safeguards  OEI-05-99-00070  I N T R O D U C T I O N  
PURPOSE 
To provide information about and increase awareness of Medicaid Proactive safeguards. 
BACKGROUND 
Medicaid is a health insurance program for certain low income and needy people.  Within 
Federal limits, each State decides eligibility, benefit coverage, administrative practices, 
reimbursement and operational resource requirements.  About 70 cents of every Medicaid 
dollar goes to institutional providers (hospitals, nursing homes).  Thirty cents pays for 
non-institutional services (physician services, laboratory and radiology).  Federal law 
requires States to pay for services provided by certain institutional providers and non-
institutional providers.  States may elect to offer additional services such as dental care, 
podiatric care and prescription drugs just to name a few. 
The Health Care Financing Administration (HCFA) is responsible for administering 
Federal matching funds to the States and for legislation and regulations affecting Title 
XIX (commonly referred to as the Medicaid program).  The HCFA also provides 
guidelines, technical assistance and periodic assessments of State programs.  More than 36 
million recipients are enrolled in Medicaid.  In 1991, 90 percent of these recipients were 
enrolled in fee-for-service (FFS) programs.  By 1998, the number of recipients in FFS had 
decreased to 46 percent and enrollment in managed care plans increased to nearly 54 
percent.  Nearly $169 billion was spent by the Federal Government and the States on 
Medicaid benefits in Fiscal Year 1998. 
States are required by legislation to make every effort to eliminate waste and illegitimate 
program expenditures.  States are also required to develop payment safeguards designed 
to protect their Medicaid funds from unscrupulous and fraudulent providers.  Most States 
also have a Medicaid Fraud Control Unit to investigate allegations of fraud and abuse. 
4 
Proactive Safeguards  OEI-05-99-00070  METHODOLOGY 
We visited or interviewed over the telephone agency(ies) responsible for administering the 
Medicaid program in the following eight States: 
California  Florida  Illinois 
Louisiana  Maryland  Oregon 
Pennsylvania  Texas 
These States were selected for site visits because they account for  nearly half of all 
Medicaid expenditures.  They were also chosen for their geographic location.  Our site 
visits were conducted during the spring of 1999.  During our visits, we discussed program 
safeguards used by the States Medicaid program.  We spoke to State Agency officials 
and, when appropriate, to State subcontractors. 
We did not discuss payment safeguards used by managed care organizations and State 
pharmacy programs.  Our discussions focused on Medicaid fee-for-service program 
safeguards.  We have not attempted to assess the effectiveness of each safeguard. 
The primary purpose of this report was to compile a catalog of program safeguards used 
by eight State Medicaid programs.  Every effort was made to prepare a comprehensive 
and complete list.  Undoubtably, there will be some disagreement as to what constitutes a 
program safeguard.  Moreover,  States, their subcontractors and others may have 
information about other safeguard measures not mentioned in this report. 
This is the first of three reports on Medicaid safeguards.  This report discusses proactive 
safeguards.  Proactive safeguards are those measures taken to prevent fraud, abuse and 
waste before a claim is ever submitted for payment.  The second report discusses claim 
processing safeguards and the final report discusses post payment safeguards. 
5 
Proactive Safeguards  OEI-05-99-00070  P R O A C T I V E   S A F E G U A R D S  
Proactive safeguards are those preventive measures used by States to reduce their 
Medicaid programs exposure to fraud and abuse.  These measures anticipate problems 
and attempt to thwart, or ward off, wrong doers.  They occur before a patient receives 
services and before a claim for services is generated for payment.  This report describes 
the proactive safeguards we identified in the eight States we visited. 
Provider/Vendor Enrollment 
Provider enrollment is the first line of defense in the fight against fraud and abuse. 
Keeping  unqualified and unscrupulous providers from gaining access to Medicaid systems 
not only protects patients but also lowers administrative costs and protects program 
assets. 
Medicaid State Agencies, or their subcontractors,  assign provider numbers to qualified 
physicians and other suppliers who furnish services and supplies to Medicaid patients. 
These numbers are required for claims processing, for accounting purposes and for 
administrative functions.  To obtain a provider number, every physician, hospital and 
medical supplier must complete an enrollment application. 
Application Forms 
Florida, Oregon and Texas said that they had developed new enrollment application forms. 
These new applications are designed to solicit additional information to aid the States in 
determining whether an applicant for a provider number is qualified to provide services to 
patients and a legitimate business entity. 
The applications used by States vary in length and complexity.  All solicit information 
about applicants, their tax payer identification (Employer Identification Number or Social 
Security Number), the nature of their business, the location of their business and licensing 
information.  Additional information is often requested from providers that States believe 
pose the greatest risk to their Medicaid program.  Most of the States require copies of 
business and professional licenses and taxpayer identification .  Some ask for proof of 
insurance, copies of drivers licenses, proof of vehicle registration, proof of training or 
professional association certification. 
Most provider enrollment applications are subjected to desk reviews.  All of our States 
verify business and professional licenses of applicants by contacting the license issuing 
agency.  States also look for applicants who may have been excluded from participating in 
Medicare or any State Medicaid program.  In Illinois, Florida, Oregon and Texas, 
applications that appear to contain discrepancies or false information are referred to 
program integrity or the Medicaid Fraud Control Unit for investigation. 
6 
Proactive Safeguards  OEI-05-99-00070  Onsite Visits 
Florida and Louisiana routinely conduct onsite visits to determine whether applicants for 
provider numbers are, in fact, operating a legitimate business.  California and Illinois limit 
onsite visits to new providers who they believe pose the greatest risk to their Medicaid 
program.  These States do not visit hospitals, nursing homes and other facilities that must 
pass routine Federal or State onsite inspections.  They focus their efforts on durable 
medical equipment companies, diagnostic service providers and other high risk provider 
groups. 
Information received from the States of Florida and Texas demonstrate the sentinel effect 
of onsite visits.  In 1 month, Florida received about 85 new provider applications from 
Dade county.  Onsite visits revealed that none of these applications were legitimate, and 
all were denied.  In Texas, the Medicaid State Agency made visits to the business 
location(s) of new providers during a time period specified by legislation.  The number of 
new provider applicants during the study period declined by more than 50 percent.  After 
the study period ended, the number of applications returned to pre-study levels.  Onsite 
visits, to providers who applied during the study period, revealed that all were legitimate 
businesses.  The Texas State Agency believes that bogus businesses knew they would be 
visited and delayed seeking a provider number until the test period ended. 
Some States use local welfare field offices to conduct onsite visits.  Florida and Louisiana 
use local field offices and out stationed Medicaid staff to ensure that every new provider is 
visited before a provider number is issued.  The Medicaid State Agency provides guidance 
on how to conduct each onsite visit but the actual visits are conducted by existing field 
office staff. 
California, Illinois, Maryland, Oregon and Texas do not conduct routine visits to new 
providers.  They claim that such visits are not cost effective and that they have insufficient 
staff to undertake this endeavor.  Moreover, lawsuits in California have put pressure on 
that State to stop delaying and expedite the issuance of Medicaid provider numbers. 
Background Checks And Fingerprinting 
The Florida Medicaid program conducts background investigations and fingerprints nearly 
all applicants requesting a new provider number.  Florida also conducts background 
investigations and fingerprints providers re-enrolling in their Medicaid program.  Florida 
uses fingerprints to verify the identity of applicants desiring to obtain a Medicaid provider 
number.  Of the 60,000 providers in the Florida Medicaid program, 52,000 have 
undergone a background investigation and been fingerprinted.  Of 52,000 background 
checks completed, nearly 1,600 providers were found to have a criminal record. 
7 
Proactive Safeguards  OEI-05-99-00070  Florida law allows the State Agency to deny enrollment in their Medicaid program to any 
provider1: 
<  convicted of character-related felonies; 
<  found to have made false representations or omitted any material fact; 
<  excluded, suspended, terminated or involuntary withdrew from any State 
Medicaid program or the Medicare program; 
<  convicted of obstructing or interfering in the conduct of a criminal 
investigation; 
<	 found by licensing, certifying or professional standards board or agency to 
have violated the standards or conditions relating to licensure, certification 
or quality of care; 
<  Failing to pay fines or overpayments assessed by the Medicaid program. 
Florida works with the States Department of Law Enforcement to conduct background 
checks and fingerprint re-enrolling and newly enrolling providers.  All persons with 5 or 
more percent ownership in a business applying for a Medicaid provider number are 
required to be fingerprinted.  In high risk counties (Dade and Broward), all re-enrolling 
and newly enrolling providers must be fingerprinted.  Non-physician applicants must 
identify their referring physicians.  These referring physicians must have a completed 
background investigation, have been fingerprinted and be currently enrolled in the Florida 
Medicaid program.  The cost of screening applicants and re-enrolling providers is $15 per 
person.  This cost is paid by the applicant.  The California Medi-Cal program is also 
considering conducting background checks and fingerprinting new and re-enrolling 
Medicaid providers. 
Surety Bonds 
States are using surety bonds to address vulnerabilities in their Medicaid program.  Surety 
bonds provide a financial incentive designed to discourage unscrupulous providers from 
enrolling in a States Medicaid program.  They help to ensure that providers have the 
capacity to provide services and they provide financial protection against provider fraud. 
Florida and Louisiana can require high risk providers to post a surety bond.  In Florida, a 
$50,000 surety bond is required of all new durable medical equipment providers, private 
transportation companies, non-physician owned clinics, independent laboratories and 
home health agencies.  A surety bond is also required of all providers doing business in 
Dade and Broward counties, and of all new providers in the remainder of the State. 
In Louisiana providers whose behavior is unacceptable can be required to re-enroll and to 
post a bond.  Louisiana sanction bonds and Floridas surety bonds are intended to 
protect their Medicaid programs from potential financial losses.  Bonding also adds 
1  Or any officer, agent, managing employee, affiliated person, partner or shareholder having 
ownership interest of 5 percent or more. 
8 
Proactive Safeguards  OEI-05-99-00070  another level of provider scrutiny.  Most bonding companies conduct their own 
investigations to verify applicant information before agreeing to bond an individual or 
company. 
Third Party Verification 
All of the States we visited verify professional licenses of applicants with the appropriate 
State licencing board(s).  Some States verify business licenses by contacting State, county 
and city business licensing departments.  Some (CA & TX) verify vehicle registration or 
applicant drivers licenses.  California solicits the names of manufacturers and suppliers 
having a business relationship with an applicant for a Medicaid provider number.  The 
providers manufacturers and suppliers are then contacted to verify application 
information.  The Florida State Agency compares information provided to the bonding 
company with information supplied to them during provider enrollment. 
Periodic Provider Re-enrollment 
Florida, Illinois, Louisiana and Texas have taken steps to re-enroll some or all of their 
Medicaid providers.  However, the actual process for doing so is fragmented among the 
various State Agencies.  In some States, the department responsible for mental health 
workers and facilities would handle worker and facility enrollment or re-enrollment. 
Pharmacies would be handled by another State Agency and so forth. 
Some States believe that provider re-enrollment is resource intensive, too costly and of 
questionable cost benefit.  The last time Oregon re-enrolled providers was in 1982. 
California and Pennsylvania have never re-enrolled any of their providers.  States like the 
idea of periodic re-enrollment but claim they lack staff, resources and legislative support 
for such an undertaking. 
Florida has re-enrolled all if its Medicaid providers.  When Florida Medicaid asked all of 
its Medicaid providers to update their provider applications, numerous letters were 
returned as undeliverable.  Floridas re-enrollment project reduced the number of durable 
medical equipment providers from 4,385 to 1,500.  The number of home health and 
transportation providers fell by nearly half after re-enrollment.  Overall, Florida has 
reduced the number of Medicaid provider numbers from nearly 83,000 in 1995, to 
approximately 60,000 in 1999.  Florida plans to re-enroll one-third of its providers every 3 
years. 
Illinois has begun re-enrolling the providers in their Medicaid program.  Unlike Florida, 
which asked all providers to re-enroll, Illinois has decided to re-enroll providers by 
speciality.  The first specialist to be re-enrolled in the Illinois Medicaid program were 
dentists.  Prior to re-enrollment there were more than 3,000 provider numbers assigned to 
dentists.  After re-enrollment, the number of providers fell to about 700. 
9 
Proactive Safeguards  OEI-05-99-00070  Louisiana re-enrolled all non-emergency medical transportation (NEMT) providers when 
they redesigned their program.  They have also re-enrolled chiropractors, mental health 
providers, rehabilitation providers and case management providers.  Like Illinois, 
Louisiana experienced a significant drop in the number of providers. 
Efforts in Texas to re-enroll Medicaid providers are currently underway.  All Texas 
providers were required to re-enroll by September 1, 1999 or lose their eligibility to bill 
that States Medicaid program.  The Texas effort is aimed at ensuring that all the 
providers in their system are legitimate businesses. 
Provider Number Termination 
Experts and law enforcement officials believe that poor controls over provider numbers 
that have been issued may be a vulnerability in Medicaid program safeguards.  Information 
by States indicates that there are people who defrauded Medicaid using inactive provider 
numbers.  States also told us about people who obtained multiple provider numbers and 
then used them to avoid Medicaid payment safeguards and to defraud Medicaid.  One 
State mention how clinics and other providers have used the provider numbers of retired 
or former employees to defraud Medicaid. 
Florida has uncovered clinics that obtained improper Medicaid payments using the un
terminated provider numbers of physicians who were no longer affiliated with the clinic or 
who had retired from active practice.  Florida sent letters to physicians asking them to 
verify the clinics at which they had worked and their dates of employment.  The physician 
responses showed that some clinics continued to use a physicians provider number(s) 
after the physician had left the clinic.  Overall, more than 100 clinics and physicians were 
terminated from the Florida Medicaid program for irregular billing practices. 
Florida, Louisiana and Texas have found physicians who sold their provider numbers to 
persons who then used them to defraud Medicaid.  All of these States plan to take action 
against physicians who participated in schemes to defraud Medicaid.  Florida has referred 
nearly 150 physicians to the State Medicaid Fraud Control Unit for investigation and 
possible referral to the Justice Department for criminal, civil and administrative 
prosecution.  The State of Florida contends that these physicians established bogus 
relationships with clinics and other health care businesses that enabled others to defraud 
the State Medicaid program. 
All of the States we visited have provider number termination policies.  However, some 
States appear reluctant to remove unused provider numbers from their system.  In some 
States, removing a provider number is a lengthy process.  All of the States we visited 
claim they can identify providers with no claims activity over a specified period of time. 
All move their inactive provider numbers to a suspense file for a specified period of time. 
10 
Proactive Safeguards  OEI-05-99-00070  If the provider submits a single claim after their number is moved to the suspense file, the 
number will be re-activated without the need for a new provider enrollment application. 
In most cases, the actual removal of a provider number from Medicaid systems occurs 
after 3 years of no claim activity; however, in some States the actual removal of a provider 
number can take 5 years or more.  Providers whose numbers have been terminated must 
complete a new provider application and get a new number. 
Provider, Patient and Employee Education 
Health care experts believe that teaching providers, patients and Medicaid employees 
about fraud and abuse can have a sentinel effect on provider behavior.  Provider, patient 
and employee education increases awareness as to what is not acceptable billing.  It also 
increases the likelihood that potentially fraudulent and abusive practices will be reported 
for in-depth investigation. 
Provider Education 
The eight States we visited furnish provider handbooks to all of their Medicaid providers. 
Handbooks help providers understand the laws, regulations and policies that govern their 
claims and claim payment.  They provide information about what is, or is not, covered and 
how to bill correctly.  Providers are notified of policy changes by letter, on remittance 
advices, in bulletins and at sites on the Internet. 
States also conduct training at medical conferences, health fairs and other professional 
settings.  Medicaid staff often make presentations on topics of interest to providers and 
respond to provider questions about coverage, payment and other programmatic issues. 
States also make visits to provider offices to help them correct problems with their billing 
or to explain coverage and payment policies.  Onsite visits are also used to warn providers 
about unacceptable billing practices found during claims processing or post payment 
reviews.  This study did not determine the quality and quantity of Medicaid provider 
education efforts.  Little is known as to how much emphasis Medicaid places on provider 
awareness of fraud and abuse and the consequences of engaging in such activity. 
Patient Education 
State efforts to increase Medicaid patient awareness of fraud and abuse vary from State to 
State.  One State, that we visited, felt that patients were not a good source for identifying 
potentially fraudulent and abusive providers.  Other States felt they had achieved some 
degree of success in combating fraud and abuse with their patient education programs. 
Despite mixed feelings as to the effectiveness of their patient education programs, all eight 
States in our sample routinely participate in health fairs and other venues that target 
patients. 
11 
Proactive Safeguards  OEI-05-99-00070  Employee Education 
Six of the eight States told us that they had conducted training to help their employees 
spot and report possible fraud and abuse.  One of these States told us that they had 
conducted training of employees in the claims processing division.  They assume that other 
Medicaid operational and policy divisions (i.e., Mental Health Department, Pharmacy 
Program) have also conducted training to increase employee awareness of potential fraud 
and abuse situations.  In Florida, Louisiana and Texas the State Medicaid Agency has 
centralized responsibility for all fraud and abuse training given to all employees involved 
in administering their Medicaid program.  The Florida State Agency has also developed an 
employee handbook to help their employees spot potential fraud and abuse.  In these 
States, employee training about fraud an abuse is centralized. 
One State felt that an organized educational effort was not needed because their 
employees knew how to spot fraud and abuse and that they would refer any questionable 
conduct to their supervisor.  Eventually, the problem would find its way to the States 
program integrity unit. 
Prior Authorization 
All of the States we visited have identified medical services that require prior 
authorization.  All of the States we visited use prior authorization to control problematic 
providers and abused medical services.  Prior authorization protect patients from 
unnecessary services and procedures.  The States believe that prior authorization has a 
deterrent effective. 
Most States that we visited, require providers to obtain prior authorization for acute 
hospital admissions and psychiatric hospital admissions.  Responsibility for authorizing 
most services is centralized in the 
State Medicaid Agency or their 
Services Requiring Prior Authorization 
contractor(s).  In Louisiana, Louisiana 
State University, School of Dentistry 
Acute and Psychiatric Hospital Admissions 
is responsible for the prior 
Ambulatory Surgical Center Services 
authorization of dental services for 
Dental services 
that Statess Medicaid program.  In  Home Health Services 
Illinois, the State Medicaid program  Hospital Outpatient Services 
contracts with a private dental insurer  Incontinent Supplies 
Mental Health Services 
for prior authorization services.  An 
Non-Emergency Medical Transportation 
outside agency handles hospital 
Rehabilitation & Therapy Services 
admissions, transportation, home  Same Day Services 
health and some ancillary services in  Transplants 
Oregon. 
12 
Proactive Safeguards  OEI-05-99-00070  Some Medicaid services are authorized by local field office personnel, who use State 
guidelines when deciding whether or not to approve medical services.  Local office 
medical workers have responsibility for authorizing most non-emergency medical 
transportation services provided to aged and disabled persons and to persons receiving 
general assistance.  Some local field offices also authorize some other medical services 
such as personal care attendants. 
Seven States in our sample have increased their use of prior authorization.  California uses 
prior authorization to control utilization of incontinent supplies and other abused services 
and supplies.  California has not measured the effect of its prior authorization program but 
estimates that without the sentinel effect of prior authorization their payments for services 
would be about 20 percent greater than current expenditure levels. 
Louisiana claims that prior authorization of mental hospital and acute hospital admissions 
has saved that State more than $100 million.  The State reviews diagnostic information, 
anticipated services and clinical indicators of severity of illness when deciding whether to 
approve or deny a hospital admission.  This same information is used to determine the 
number of inpatient days the State Medicaid program will authorize and pay.  Before prior 
authorization, Louisianas spending on inpatient mental health services had risen from $5 
million to $36 million annually.  After the State re-engineered their policies and coverage 
guidelines and added prior authorization requirements, payments fell.  Today, Louisiana 
payments for inpatient mental health services have been reduced to about $10 million per 
year. 
Prior authorization of and changes to Louisianas non-emergency transportation benefit 
has resulted in annual payment levels falling from $60 million per year to $8 million yearly. 
When Texas instituted prior authorization for transportation services, they saw a 
tremendous drop in the number of non-emergency medical transportation claims and 
payments.  Annual payments, for transporting dialysis and cancer patients to and from 
therapy, declined from $4 million to $2 million. 
All of the States acknowledge that prior authorization has an unmeasurable deterrent 
effect.  What States can measure is the number of prior authorization requests that are 
denied.  While this number is small (on average, less than 5 percent), the savings from 
services denied are significant.  In 1998, Pennsylvania Medicaid received more than 
174,000 prior authorization requests.  About 5,200 or 3 percent of the 174,000 prior 
authorization requests were denied.  These denials saved the Pennsylvania Medicaid 
program more than $25 million in 1998.  Pennsylvania has seen no increase or decrease in 
their Medicaid program expenditures over the last 3 years.  The State attributes this to 
their prior authorization and pre-certification policies. 
Oregon questions whether prior authorization is an effective tool or just rubber 
stamping.  Providers are usually given Medicaid guidelines and other information that 
describes the specific criteria that must be met to obtain prior authorization.  This 
information may help ensure approval of medical services.  While this may be true, other 
States report that they address this vulnerability during their post payment reviews.  If the 
13 
Proactive Safeguards  OEI-05-99-00070  patient medical records do not support the level of service authorized by the State, the 
provider will be asked to refund any overpayment. 
Oregon has reduced the number of services requiring prior authorization.  The Oregon 
Medicaid program found that prior authorization of some services was not cost effective 
and merely made providers jump through hoops to get authorization.  Oregon has 
removed some medical services, some supplies and small payment items from prior 
authorization.  Oregon found that it was not cost effective to prior authorize small 
payment items.  While Oregon has cut the number of services requiring prior authorization 
they have also developed stricter criteria for approving services and supplies still requiring 
prior authorization. 
Second Opinion 
Scientific evidence exists that suggests that some medical procedures and drugs are over 
used by the medical community.  Despite this, most State Medicaid programs do not 
require patients to have a second opinion before undergoing over used and potentially 
medically unnecessary medical procedures. 
Pennsylvania recently terminated their second opinion program because they felt it had 
outlived its usefulness as more and more patients were enrolled in managed care. 
Pennsylvania believes that it is up to managed care organizations to decide whether or not 
they want a second opinion program. 
Nearly all of the States in our sample have abandoned mandatory second opinion 
safeguards because they found them ineffective and costly to administer.  State second 
opinion programs allowed the patients physician to suggest other providers that the 
patient might contact for a second opinion.  Patients were also permitted to choose, on 
their own, a physician for a second opinion.  Several States mentioned that they still pay 
for a second medical opinion if requested by the patient. 
Illinois, California and some private 
sector insurance plans have experienced 
Partial List of Overused Services 
success with their second opinion 
programs.  In Illinois and California, 
Bunionectomy  Carotid endarterectomy 
patients about to receive certain dental 
Cataract surgery,  Coronary artery bypass 
services are re-examined by dentists 
except congenital  Coronary angioplasty 
affiliated with the States dental  Hemorrhoidectomy  Hip replacement 
contractor.  Both claim that their dental  Hysterectomy  Knee surgery 
Mastectomy  Myringotomy with tubes 
second opinion program has saved 
Prostatectomy  Spinal and vertebral 
money and prevented patients from 
surgery 
undergoing unnecessary procedures. 
Submucosa resection  Tonsillectomy with or 
These States believe that the  Varicose vein stripping  without adenoidectomy 
effectiveness of their second 
14 
Proactive Safeguards  OEI-05-99-00070  opinion program is due to their contracts with independent, unbiased physicians who have 
been hired to provide the second opinion. 
Certificates of Medical Necessity 
All of the States we visited require that physicians certify the medical need for specific 
services, supplies and equipment.  Certificates of medical necessity (CMNs) are 
attestations by physicians stating that they have ordered the services or supplies and that 
the services and supplies ordered are medically necessary for the care and treatment of the 
patient.  The CMN is submitted to Medicaid along with the claim for reimbursement. 
Processing of claims for services and supplies requiring CMNs is usually interrupted until 
the CMNs and claims are manually reviewed.  Additional information is obtained from 
providers whose CMNs are incomplete or contain discrepancies that prevent further 
processing. 
Prime Vendor Contracts 
Florida, Maryland, Oregon and Texas use prime vendors to provide specific services to 
patients.  Illinois is also considering using prime vendor contracts.  Prime Vendor 
contracts permit a designated private business to function as the primary source for 
specific services or products produced or provided by other suppliers.  The prime vendor 
is responsible for delivery of specific products and services to Medicaid patients. 
New York has passed legislation requiring the State Medicaid program to seek 
competitive bids for various durable medical equipment (DME) services.  New York has 
issued Requests for Proposals (RFPs) for diapers and is developing another for diabetic 
supplies and high-compression stockings. 
Maryland uses prime vendors to provider non-emergency transportation services (NEMT). 
Local welfare offices put out requests for proposals (RFPs) and obtain bids.  One, or 
more bidders, are then awarded contracts to provide all NEMT services within a particular 
geographic area.  All authorized NEMT services are provided by the entity holding the 
contract. 
Oregon uses brokers to manage Medicaid patient transportation needs in the Tri-county 
area that includes Portland.  The State Medicaid program pays brokers a fixed rate.  The 
broker arranges the transportation services a patient needs and pays the provider that 
actually transported the patient.  The difference between the State Medicaid payment and 
the brokers expenses is the brokers profit or loss. 
In Texas, problems identified in the State Controllers study of Medicaid payment errors 
lead to that States limiting the number of NEMT providers.  Only services authorized and 
provided by contracted providers or service companies are payable under the Texas 
Medicaid program.  Illinois is considering a similar plan. 
15 
Proactive Safeguards  OEI-05-99-00070  O P P O R T U N I T I E S   F O R  
I M P R O V E M E N T  
Each of the States we visited has taken a different approach to keep unqualified and 
unscrupulous persons from gaining access to their Medicaid systems.  Every State should 
have aggressive proactive safeguards.  Based on our prior studies and information 
gathered during this study, we would encourage States to consider the following 
opportunities for improvement: 
Target high risk providers for extensive application review and verification. 
Todays provider enrollment applications solicit more information than a decade ago. 
Verifying information provided on them can be improved by prioritizing applicants based 
on risk.  Applicants considered high risk would undergo more extensive application 
development to verify information. 
Some States have reduced their vulnerability to fraud and abuse by improving the way that 
they verify information provided by applicants.  As some States have discovered, reliance 
on application information may be a vulnerability in their provider enrollment process. 
Application information submitted by some providers has been found to be false. 
States could improve their third party verification by independently locating and 
contacting an applicants manufacturers, suppliers, supervising physician and other 
references.  Our experience has shown that relying solely on applicant supplied 
information (i.e., names, telephone numbers, etc.) is a vulnerability.2  Independently 
verifying  reference names, addresses and telephone numbers would help ensure that the 
references provided by an applicant are, in themselves, legitimate businesses or persons. 
Expand the use of local field offices to conduct onsite visits to verify the legitimacy of 
problematic providers. 
Onsite visits appear helpful in establishing the legitimacy of some provider number 
applicants.  Information from States that make onsite visits demonstrates that onsite visits 
are an effective proactive safeguard.  Onsite visits appear to deter unscrupulous persons 
from obtaining a provider number. 
Conduct more frequent and better education of providers concerning their obligation 
to protect their provider number(s) from unauthorized use and the need to notify 
2  Additional information about provider enrollment and application vulnerabilities can be found in 
Independent Physiological Laboratories: Vulnerabilities Confronting Medicare (OEI-05-97-00240) and 
Independent Physiological Laboratories: Carrier Perspectives (OEI-05-97-00241). 
16 
Proactive Safeguards  OEI-05-99-00070  Medicaid when their employment relationships with clinics and other providers 
terminates. 
Evidence suggest that many physicians do not adequately protect their provider numbers. 
Some States acknowledge that unscrupulous persons have circumvented their provider 
enrollment safeguards by: 
<  stealing a legitimate providers billing number, 
<  purchasing the billing number of a legitimate provider, and, 
<  establishing themselves as a billing company. 
According to Florida and Texas, some physicians are totally unaware that billing number 
information they have shared with former and potential employers has been used to 
defraud Medicaid.  Other physicians knowingly sell their provider numbers to non 
physician providers.  These physicians, many of whom are retired, accept payments for the 
use of their credentials.  In an effort to stop misuse of physician provider numbers, the 
State of Florida visits all physicians who meet certain criteria that suggest the physician 
may be no longer be in active medical practice.  Better provider number termination 
policies and periodic contacts with physicians to verify that provider information is current 
would improve safeguards.3 
Strengthen Federal and State laws to hold physicians and other Medicaid providers 
financially and criminally liable for reckless conduct for participating in any deception 
that allows others to use their credentials and business to defraud or cause financial 
harm to Medicaid program. 
Medicaid funds obtained through fraud and deception are often paid to a third party.  Our 
past studies, and this study, have shown that third parties obtain the assistance of 
physicians and other providers to facilitate the perpetration of fraud against government 
programs.4  We believe that government programs need to address this vulnerability in 
their system safeguards stemming from physicians who permit others to use their identity 
to circumvent program safeguards or who permit the use of their professional licenses and 
places of business as a front to deceive Medicaid.  Physicians found to be in reckless 
disregard of such a law should face criminal, civil and administrative actions. 
Identify and register all clearinghouses and third-party billers and improve safeguards 
to ensure that electronic claims are accepted only from authorized sites and terminals. 
Unscrupulous persons can circumvent enrollment safeguards by operating a billing service 
and offering trial periods and other incentives to obtain a physicians billing 
3  Additional information about provider enrollment and application vulnerabilities can be found in 
Independent Physiological Laboratories: Vulnerabilities Confronting Medicare (OEI-05-97-00240), 
Independent Physiological Laboratories: Carrier Perspectives (OEI-05-97-00241) and Medical Billing 
Software and Processes Used to Prepare Claims (OEI-05-99-00100). 
4  Ibid. 
17 
Proactive Safeguards  OEI-05-99-00070  number.  Once a legitimate provider number is known, a billing agency can misuse it. 
Todays Medicaid systems do not ensure that claims originating from billing agencies have 
been properly authorized by the physician under whose name claims are submitted.  Most 
Medicaid programs cannot identify billing companies that submit claims nor can they 
determine which physicians use which billing companies.5 
Centralize responsibility for, and improve, employee fraud and abuse awareness 
training. 
With some exceptions, it appears that Medicaid staff (and subcontracted staff) training 
about fraud and abuse may be too fragmented to be effective.  Staff training about fraud 
and abuse is often left to the different State components (pharmacy, long-term care, 
dental, etc.) and not the responsibility of any single centralized agency.6 
All of the States we visited have an internal unit to conduct reviews and research 
allegations of wrong doing.  These units provide an opportunity for improving staff 
awareness about fraud and abuse.  States should consider using these units to improve 
employee awareness of their responsibility to help identify and combat fraud and abuse. 
Moreover, improving the visibility of these units can provide States with an opportunity to 
streamline and clarify fraud and abuse reporting processes and help reduce the likelihood 
that allegations of fraud and abuse would be inappropriately handled. 
Patient advocates, case managers, second medical/dental opinions and certificates of 
medical necessity also provide additional opportunities for improving Medicaid 
safeguards.  States with patient advocates help patients make informed medical decisions, 
provide treatment and care alternatives and reduce the number of medically unnecessary 
procedures.  States that subcontract with specialists to provide second opinions appear to 
have been successful in curbing abuse of certain procedures.  An opportunity exists to 
improve State second opinion programs.  Second opinions from independent parties help 
control questionable medical procedures.  They can also be used as a deterrent to prevent 
overutilization of services requiring a certificate of medical necessity.  Random second 
opinions may provide an opportunity for improving safeguards to protect Medicaid 
programs against forged and inaccurate certificates of  medical necessity. 
AGENCY COMMENTS 
We received comments on this report from HCFA.  The HCFA believes that the opportunities for 
improvement described in this report provide valuable information that will be shared with the 
State Medicaid programs.  The full text of HCFAs comments can be found in Appendix A. 
5  Additional information about billing companies and system vulnerabilities can be found in 
Medical Billing Software and Processes Used to Prepare Claims. OEI-05-99-00100. 
6  Additional information about fragmented responsibilities for the handling fraud and abuse issues 
can be found in Carrier Fraud Units. OEI-05-94-00470. 
18 
Proactive Safeguards  OEI-05-99-00070  A P P E N D I X   A 
HCFA Comments on this Report 

19 
Proactive Safeguards  OEI-05-99-00070  20 
Proactive Safeguards  OEI-05-99-00070  21 
Proactive Safeguards  OEI-05-99-00070