Medicare Program Integrity Manual 
Chapter 2  Data Analysis 
 
Table of Contents  
(Rev. 10365; 10-02-20) 
 
Transmittals for Chapter 2 
 
2.1 - Identifying Potential Errors - Introduction  
2.2. - Data Analysis  
2.3 - Sources of Data for UPICs 
2.4  Sources of Data for MACs and UPICs  
  2.1  Identifying Potential Errors - Introduction 
(Rev. 10365; Issued: 10-02-20; Effective: 08-27-20; Implementation: 08-27-20) 
 
A.  Contractors To Which This Section Applies 
 
This section applies to MACs, UPICs, Recovery Auditors, and Supplemental Medical 
Review Contractor (SMRC). 
 
B.  General 
 
This chapter specifies resources and procedures to the MACs, UPICs, Recovery 
Auditors, and the SMRC. The contractors shall use these instructions to identify and 
verify potential errors to produce the greatest protection to the Medicare program. 
Contractors should objectively use analytical methodologies to evaluate potential errors 
and not take administrative action unless they have verified the error and determined that 
the error is a high enough priority to justify the action. They should also archive the error 
including supporting rationale for selection. (See Reliable Information in Pub. 100-08, 
Exhibits, Exhibit 4.) 
 
C.  Review of Data 
 
Data analysis is an essential first step in determining whether patterns of claims 
submissions and payments indicate potential problems. Such data analysis should include 
identification of statistical outliers in billing patterns within a well-defined group, or 
more sophisticated detection of patterns within claims or groups of claims that might 
suggest improper billing or payment. 
 
Data analysis shall be undertaken as part of general surveillance and review of submitted 
claims, or shall be conducted in response to information about specific problems 
stemming from complaints, provider or beneficiary input, fraud alerts, reports from CMS, 
other MACs, or independent government and nongovernmental agencies. 
 
2.2  Data Analysis 
(Rev. 10365; Issued: 10-02-20; Effective: 08-27-20; Implementation: 08-27-20) 
 
A.  Contractors To Which This Section Applies 
 
This section applies to MACs, UPICs, SMRC. This section does not apply to the 
Recovery Auditors. Recovery Auditors should follow the data analysis instructions listed 
in their Statement of Work. 
 
B.  General 
 
Data analysis is a tool for identifying actual or potential claim payment errors. Data 
analysis applies well-established statistical methods to claim information and other 
related data to identify potential errors and potential fraud by claim characteristics (e.g.,  diagnoses, procedures, providers, or beneficiaries) individually or at an aggregate level. 
Data analysis is an integrated, on-going component of MR and benefit integrity (BI) 
activity. 
 
The MACs and UPICs ability to make use of available data and apply innovative 
analytical methodologies is critical to the success of the MR and BI programs. They 
should use research and experience in the field to develop new approaches and 
techniques of data analysis. The MACs and UPICs should have ongoing communication 
with other government organizations (e.g., QIOs and the State Medicaid agencies) 
concerning new methods and techniques. 
 
Analysis of data should: 
 
  Identify those areas of potential errors (e.g., services which may be non-
covered or not correctly coded) that pose the greatest risk; 
 
  Establish baseline data to enable the recognition of unusual trends, changes 
in utilization over time, or schemes to inappropriately maximize 
reimbursement; 
 
  Identify where there is a need for an LCD; 
 
  Identify where there is a need for targeted education efforts; 
 
  Suggest claim review strategies that efficiently prevent or address potential 
errors (e.g., prepayment edit specifications or parameters); 
 
  Produce innovative views of utilization or billing patterns that illuminate 
potential errors; 
 
  Identify high volume or high cost services that are being widely overutilized. 
This is important because these services do not appear as an outlier and may be 
overlooked when, in fact, they pose the greatest financial risk; 
 
  Identify program areas and specific providers for possible fraud 
investigations; and 
 
  Determine if major findings identified by Recovery Auditors, CERT, and 
CMS represent significant problem areas in the MACs jurisdiction. 
 
This data analysis program shall involve an analysis of national data furnished by CMS 
as well as review of internal billing utilization and payment data to identify potential 
errors. 
 
The goals of the data analysis program are to identify provider billing practices and 
services that pose the greatest financial risk to the Medicare program.   
The MACs and UPICs shall document the processes used to implement their data 
analysis program and provide the documentation upon request. 
 
In order to implement a data analysis program, the MACs and UPICs shall: 
 
  Collect data from sources such as: 
 
  Historical data, e.g., review experience, denial data, provider billing 
o
problems, provider cost report data, provider statistical and reimbursement 
(PS&R) data, billing data, payment data, utilization data, data from other 
Federal sources (e.g., QIO, other MACs, Medicaid); and 
 
  Common Working File (CWF) 
o
 
  Referrals from internal or external sources (e.g., 1-800 Medicare Call 
Center, provider audit, beneficiary, State Senior Medicare Patrol, or other 
complaints). 
 
The shared system maintainer shall allow MACs the ability to select claims using the NPI 
or the legacy number (OSCAR or UPIN) as a criterion for medical review. 
 
C.  Resources Needed for Data Analysis 
 
The MACs and UPICs shall have available sufficient hardware, software, and personnel 
with analytical skills to meet requirements for identifying problems efficiently, and 
effectively developing and implementing corrective actions. If MACs are unable to 
employ staff with the qualifications necessary for effective data analysis, evaluation and 
reporting, they shall use other entities (e.g., universities, consultants, other contractors) 
who can provide the technical expertise needed. The following are minimum resource 
requirements for conducting data analysis, evaluation, and reporting. 
 
1.  Data Processing Hardware 
 
Adequate equipment for data analysis includes facilities to process data 
(e.g., mainframes and personal computers) and to store data (e.g., tape 
drive, disk drives, etc.). Upgrading current resources (e.g., mainframe 
computers, shared systems, etc.) or the purchase of new capabilities (e.g., 
microcomputer workstations or subcontracts for computer services) may 
provide additional processing capabilities. In addition, MACs and UPICs 
shall have secure telecommunication capabilities to interact with the CMS 
Data Center. 
 
2.  Data Processing Software 
 
The CMS provides MACs and UPICs with software to allow communication  with the CMS Data Center. At their discretion, MACs and UPICs that wish to 
develop or acquire additional software that allows for analysis of internal data 
or other data obtained from the CMS Data Center may do so. The MACs and 
UPICs should have internal software to support the analyses of data to meet 
program goals. 
 
3.  Personnel 
 
The MACs and UPICs shall have staff with appropriate training, expertise and 
skills to support the application of software and conduct systematic analyses 
and clinical evaluation of claims data. CMS strongly encourages MACs and 
UPICs to have staff with clinical expertise (e.g., registered nurses) and a mix of 
skills in programming, statistics, and data mining analysis (e.g., trending and 
profiling of providers/codes). 
 
The MACs and UPICs shall also employ a staff that has training in developing analytical 
and sampling strategies for overpayment projections. 
 
D.  Frequency of Analysis 
 
The MACs shall have a minimum of 18 months of data but are encouraged to have 36 
months. The MACs shall, at a minimum, compare the current 6-month period to the 
previous 6-month period to detect changes in providers current billing patterns and to 
identify trends in new services. Summary data or statistically representative samples can 
be used when dealing with very large volumes of data. 
 
E.  Determine Indicators to Identify Norms and Deviations 
 
The MACs and UPICs shall develop indicators that will be used to identify norms, 
abnormalities, and individual variables that describe statistically significant time-series 
trends and the most significant abnormalities or trends. Examples of indicators or 
variables are: 
 
  Standard deviations from the mean; 
 
  Percent above the mean or median; 
 
  Percent change in billing activity, payment charges, and number of 
visits/services from one period to another. 
 
  Rate of change over specified periods in time. 
 
F.  Document Data Strategy 
 
While the CMS is deliberately not prescriptive in terms of the technical details of how to 
reach data analysis goals, MACs and UPICs are expected to develop the most  sophisticated and effective methods and procedures to meet these goals and will be held 
accountable for accurate, effective reports, procedures, and quality outcomes. 
 
2.3  Sources of Data for UPICs 
(Rev. 10365; Issued: 10-02-20; Effective: 08-27-20; Implementation: 08-27-20) 
 
The term Medicare beneficiary identifier (Mbi) is a general term describing a 
beneficiary's Medicare identification number. For purposes of this manual, Medicare 
beneficiary identifier references both the Health Insurance Claim Number (HICN) and 
the Medicare Beneficiary Identifier (MBI) during the new Medicare card transition 
period and after for certain business areas that will continue to use the HICN as part of 
their processes. 
 
A.  Contractors To Which This Section Applies 
 
This section applies to UPICs. 
 
B.  General 
 
The UPICs approach for combining claims data (MAC data, Recovery Auditor data from 
the Recovery Auditor data warehouse) and other data to create a platform for conducting 
complex data analysis shall be documented in their Information Technology Systems 
Plan. By combining data from various sources, the UPIC will present an entire picture of 
a beneficiarys claim history regardless of where the claim was processed. The primary 
source of this data will be the CMS shared systems data, National Claims History (NCH), 
and Integrated Data Repository (IDR). The UPIC shall be responsible for obtaining data 
for all beneficiaries for whom the MAC(s) paid the claims. 
 
At a minimum, UPICs are required to store the most recent 36 months worth of data 
(including Part A, Part B, DME, home health & hospice) for the jurisdiction or zone defined 
in their task order. 
 
If the jurisdiction of the MAC(s) is not defined geographically, the UPIC shall obtain a 
complete beneficiary claims history for each unique beneficiary for whom the MAC(s) 
paid a claim. 
 
EXAMPLE 1: The MAC(s) jurisdiction covers Maryland but includes a hospital chain 
with facilities in Montana. The UPIC would request claims history from shared systems, 
NCH, or IDR for all claims paid by the MAC(s). 
 
EXAMPLE 2: The MAC(s) jurisdiction covers Maryland, a beneficiary lives in 
Pennsylvania, and the beneficiary saw a doctor in Maryland. The UPIC would 
request from shared systems, NCH, or IDR for all claims paid by the MAC(s). 
 
The UPICs will not be able to tap data from the Common Working File (CWF). 
  The UPICs should, at their discretion, if agreement and cooperation of the MAC(s) are 
obtained, use data directly from the claims processing system of the MAC(s), and then 
supplement the other data using NCH. 
 
In developing this plan, the UPICs shall address the above requirements and, at a 
minimum, establish read-only access to the MACs shared claims processing system(s) 
and access to the Part A, B, and D data available through the NCH for the jurisdictional 
area defined in the Task Order. The UPIC shall obtain denial data through the MACs and 
document the process for obtaining this data from the MAC(s) in the Joint Operating 
Agreement. At a minimum, the denial data shall include data for edits that were requested 
and/or recommended by the UPIC. 
 
The UPIC shall have the ability to receive, load, and manipulate CMS data. The data 
shall also be maintained in accordance with CMS and Federal privacy laws and 
regulations as described in the CMS Data Use Agreement. For planning purposes, the 
UPICs should assume that there are 30 claims per Medicare beneficiary identifier (Mbi) 
per year, on average. A claim record is about 1000 bytes. To calculate the storage space 
necessary, use the following formula: 
 
(#Mbis) X (30 claims) X (#years) X (1000) = #bytes 
 
The CMS contract officers representative (COR) and UPIC will need to complete: 
 
  A data use agreement to give permission to receive privacy protected data; 
 
  A Data request form to specify all data required by the UPIC; 
 
  A HDC application for HDC access and/or CMS systems access to get access 
to the data center and/or to specify which CMS systems the UPIC will access; 
 
  A DESY system application form. (This is provided to the UPIC 
post- award). 
 
2.4  Sources of Data for MACs and UPICs 
(Rev. 10365; Issued: 10-02-20; Effective: 08-27-20; Implementation: 08-27-20) 
 
A.  Contractors To Which This Section Applies 
 
This section applies to MACs and UPICs. The sources of data for CERT and Recovery 
Auditors are specified in their SOWs. 
 
B.  General 
 
The data sources that MACs and UPICs use will depend upon the issue(s) being 
addressed and the availability of existing data. CMS maintains numerous systems 
housing Medicare, Parts A, B, and D claims, Beneficiary Entitlement, Enrollment and  Utilization data, Provider reference information. The IDR is the enterprise resource 
designed to house and unify the data from disparate systems to enable cross-cutting 
reporting and analysis. The IDR has been created with an aim toward reducing data 
redundancy, providing flexibility to satisfy changing business needs and serve as the 
relational data warehouse for core CMS data. The IDR provides the system platform and 
database structures which enable one store of data to meet the various needs of our MAC 
and UPIC community. The repository is leveraged by multiple reporting, analytical and 
operational production applications. 
 
Systematic data analysis requires MACs and UPICs to have in place the hardware and 
software capability to profile providers in aggregate, by provider type, by common 
specialties among providers, or individually. Some of the provider information that 
should be used includes: 
 
  Types of providers; 
 
  Volume of business; 
 
  Volume (or percentage) of Medicare/Medicaid patients; 
 
  Prevalent types of services; 
 
  Location; 
 
  Relationships to other organizations; 
 
  Types of ownership; 
 
  Previous investigations by the UPIC; 
 
  Size and composition of staff; 
 
  Administrative costs; 
 
  Claims history; and 
 
  Other information needed to explain or clarify the issue(s) in question. 
 
Where possible, the selection of providers should show a representative grouping, in 
order to accurately reflect the extent of program losses. 
 
C.  Primary Source of Data 
 
Claims data is the primary source of information used to identify and target fraudulent, 
wasteful or abusive activities. Sources of claims data are: 
    IDR--MACs and UPICs should utilize the reports accessible in the 
system platform and database structures. Reports include the 
following: 
 
  Claims Summary Information report (CSI) which used to be called 
o
Health Care Information System (HCIS), 
 
  Part B Analytics System Report (PBASR), which show 
o
comparative utilization ratios by code, MAC, and specialty, 
 
  Short Term Alternatives for Therapy Services (STATS) which 
o
shows Outpatient therapy professional and provider claims data, 
 
  IDR Analysis Reports which include analysis reports and IDR volume 
o
and statistics, and 
 
  Focused Medical Review (FMR) which shows Part B claims 
o
utilization and enrollment data. 
 
The MACs and UPICs shall also use national data where available. National data for 
services billed by skilled nursing facilities (SNFs) and home health agencies (HHAs) is 
available at the CMS Data Center. When made available, contractors can access through 
CMS One Program Integrity (see below One PI) or the CMS Enterprise Portal. 
 
  CMS One Program Integrity (One PI)  Serves as a system application, tool 
and databases providing access to the CMS IDR which houses, at a 
minimum, the most current Medicare Parts A and B billing and payment 
data; 
 
  Contractor Local Claims Data  Local data should be compiled in a way to 
identify which providers or type of service in the contractors area may be 
driving any unusual utilization patterns; 
 
  CMS  Fraud  Prevention  System(FPS)--When  access  is  available,  MACs 
should  consider  periodically  reviewing  the  information  and  data  trends 
resulting from national predictive models contained in the FPS; 
 
  CMS PBASR--The Report stores data sets that contain annual timeframes, and 
Healthcare Common Procedure Coding System HCPCs/CPT codes that 
correspond to provider/supplier disciplines. Each data set displays the allowed 
services, allowed charges, and payment amounts by HCPCs/CPT codes and 
prominent modifiers. The PBAR is only accessible through the Enterprise 
Portal; and 
 
  CMS Claims Summary Information (CSI)Files contain Medicare Part A 
(i.e., Inpatient, Skilled Nursing Facility, Home Health Agency (Part A & B)  and Hospice) and Medicare Part B (i.e., Outpatient) information based on the 
type and State of the institutional provider. The data set names correspond with 
the provider type. Brief descriptions of the provider types and the selected 
reporting elements (e.g., units of service, billed charges, provider ZIP code, 
etc.) are provided. Access is through the One PI portal. 
 
D.  Secondary Sources of Data 
 
The MACs and UPICs should consider other sources of data in determining areas for 
further analysis. These include: 
 
  OIG and Government Accountability Office (GAO) reports; 
 
  Fraud Alerts; 
 
  Beneficiary, physician and provider complaints; 
 
  Appeals data from QICs, including appeals overturn rate for a particular type 
of claim; 
 
  Referrals from the QIO, other contractors, CMS components, Medicaid 
fraud control units, Office of the U.S. Attorney, or other federal programs; 
 
  Suggestions provided directly or implicit in various reports and other materials 
produced in the course of evaluation and audit activities, (e.g., contractor 
evaluations, State assessment, CMS-directed studies, contractor or State audits 
of providers); 
 
  Referrals from medical licensing boards; 
 
  Referrals from the CAC; 
 
  Peer Review Reports such as the First-look Analysis Tool for Hospital 
Outlier Monitoring (FATHOM) and Program to Evaluate Payment Patterns 
Electronic Report (PEPPER), and Comparative Billing Reports; 
 
  Information on new technologies and new or clarified benefits; 
 
  Provider cost reports; 
 
  Provider Statistical and Reimbursement (PS&R) System data; 
 
  Enrollment data; 
 
  Overpayment data; 
    Pricing, data analysis, and coding (PDAC) data; 
 
  Referrals from other internal and/or external sources (e.g., MAC audit staff, 
audit staff or, MAC quality assurance (QA) staff); 
  Medicare Learning Network  which includes MedLearn Matters articles 
and Quarterly Provider Compliance Newsletters; 
 
  IBM Cognos support for the Part D and Drug Data Processing System 
(DDPS) using the Teradata data repository; 
 
  CMS prepared data, such as a listing of distinct providers or suppliers and/or 
bills that require medical review. 
 
While the MAC, Recovery Auditor, and UPIC should investigate reports from the GAO, 
congressional committees, Office of Inspector General Office of Audit Services (OIG 
OAS), OIG OI, newspaper and magazine articles, as well as local and national television 
and radio programs, highlighting areas of possible abuse, these types of leads should not 
in source for leads on fraud, waste or abuse cases. 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  Transmittals Issued for this Chapter 
 
Rev #  Issue Date  Subject  Impl Date  CR# 
R10365PI 10/02/2020  Updates to Chapters 1, 2, 3, 4, 6, 7, 8, 10,  08/27/2020 11884 
11, and Exhibits of Publication (Pub.) 100-
08 
R10228PI 07/07/27/2020 Updates to Chapters 1, 2, 3, 4, 6, 7, 8, 10,  08/27/2020 11884 
11, and Exhibits of Publication (Pub.) 100-
08 Rescinded and replaced by Transmittal 
10365 
R876PI  04/12/2019  Update to Publication (Pub.) 100-08 to  05/13/2019 11109 
Provide Language-Only Changes for the 
New Medicare Card Project 
R658PI  06/22/2016  Medicare Program Integrity Data Analysis-- 02/01/2016 9176 
Update 
R630PI  12/31/2015  Medicare Program Integrity Data  02/01/2016 9176 
AnalysisUpdate  Rescinded and replaced 
by Transmittal 658 
R313PI  11/20/2009  Program Integrity Manual (PIM)  12/21/2009 6546 
Reorganization Chapters 1, 2, and 7 
R279PI  12/19/2008  Zone Program Integrity Contractor (ZPIC)  01/26/2009 6171 
Updates 
R231PI  01/04/2008  NPI Number for Medical Review  04/07/2008 5761 
R180PI  12/22/2006  Sources of Data for PSCs  01/22/2007 5412 
R101PI  01/28/2005  Benefit Integrity (BI) PIM Revisions  02/28/2005 3579 
R071PI  04/09/2004  Rewrite of Program Integrity Manual  05/10/2004 3030 
(except Chapter 10) to Apply to PSCs 
R047PI  07/25/2003  Data Analysis  08/08/2003 2517 
R032PI  10/25/2002  Fraud Alerts  10/25/2002 2333 
R016PIM 11/28/2001  Adds Various Program Memoranda for BI  11/28/2001 1732 
Requests for Information, Organizational 
Requirements, Unsolicited Voluntary 
Refund Checks, Anti-Kickback Statute 
Implications 
R003PIM 11/22/2000  Complete Replacement of PIM Revision 1.  NA  1292 
R001PIM 06/2000  Initial Release of Manual  NA  931 
Back to top of chapter