Background

Medicaid is the third largest social program in the federal budget and is also  one of the largest components of state budgets. Although it is one federal  program, Medicaid consists of 56 distinct state-level programs—one for  each state, District of Columbia, Puerto Rico, and each U.S. territory. Each  state has a designated Medicaid agency that administers its program under  broad federal guidelines. The federal government matches state Medicaid  spending for medical assistance according to a formula based on each  state’s per capita income. The federal share can range from 50 cents to 83  cents of each Medicaid dollar spent.
HCFA administers the Medicaid program at the federal level. In accordance  with the Medicaid statute, it sets broad guidelines for the states, but within  them, each state establishes its own eligibility standards; determines the  type, amount, duration, and scope of covered services; sets payment rates;  oversees the integrity of its program; and develops its administrative  structure. States are required to describe the nature and scope of their  program in a comprehensive written plan submitted to HCFA—with federal  funding for state Medicaid services contingent on HCFA’s approval of the  plan. HCFA is responsible for ensuring that state Medicaid programs meet  all federal requirements. In addition to Medicaid, HCFA also has  responsibility for administering Medicare, a federal health insurance  program for certain disabled persons and those 65 years and older. While  Medicaid and Medicare have different structures and governance, some  low-income beneficiaries and many providers participate in both programs.
There are also—in 47 states and the District of Columbia—separate  MFCUs that are responsible for investigating and prosecuting Medicaid  provider fraud, patient abuse, and financial fraud. In 1999, MFCUs received  authority to investigate cases involving Medicare fraud as well.  Most  MFCUs are part of the state Attorney General’s office, and most prosecute  the cases they investigate. MFCUs that have been federally certified for  more than 3 years receive 75 cents in federal funding for every dollar they  spend, up to a limit established by federal regulations.
In addition to state Medicaid agencies and MFCUs, other state and federal  agencies assist in dealing with Medicaid improper payments. Because of  their responsibilities to ensure sound fiscal management in their states,  state auditors or state inspectors general may become involved in Medicaid  payment safeguard activities through efforts such as testing payment  system controls or investigating possible causes of mispayment. At the  federal level, the Federal Bureau of Investigation (FBI) and the OIG  investigate, and U.S. Attorneys prosecute, certain Medicaid fraud cases,  such as those that involve multiple states or also involve fraud against  other health care programs. Funding for these agencies to pursue fraud and  abuse in federal health care programs is available from the Health Care  Fraud and Abuse Control Program (HCFAC). Established in 1996 by  Section 201 of the Health Insurance Portability and Accountability Act  (HIPAA), it funds, consolidates, and strengthens federal fraud control  efforts under the Department of Justice (DOJ) and HHS. This fund  provided $154.3 million in fiscal year 2000 to the OIG and DOJ. Separately,  the FBI received an additional $76 million in HIPAA-specified funding for  fiscal year 2000. Medicare has been the major focus of this effort, but  Medicaid has also benefited. In its joint report with DOJ on the HCFAC  fund, HHS reported returning nearly $45 million dollars to Medicaid as a  result of these fraud control activities for fiscal years 1997 through 1999.

	Medicaid Is at Risk for Improper Payments but the Amount Lost Is Unknown

With state and federal Medicaid payments projected to total $221.6 billion  this fiscal year, even a small percentage loss due to improper payments  represents a significant loss to taxpayers. The magnitude of improper  payments throughout Medicaid is unknown, although a few states have  attempted to determine the level by measuring the accuracy of their  program’s payments. An even more difficult portion of improper payments  to identify are those attributable to intentional fraud—recent cases in  California and other states provide examples of losses due to fraudulent  activities.

		Few States Have Measured Improper Payments

There are no reliable estimates of the extent of improper payments  throughout the Medicaid program. However, at least three states have  conducted studies to try to measure their program’s payment accuracy  rates and pinpoint where payment vulnerability occurs, with varied  success.
Illinois, in 1998, reported an estimated payment accuracy rate of 95.3 percent, with a margin of error of +/- 2.3 percentage points, of total  dollars paid. The estimate was based on a sample of individual paid  claims, for which the state reviewed medical records and interviewed  patients to verify that services were rendered and medically necessary.  As a result of this audit, the state identified key areas of weakness and  targeted several areas needing improvement. For example, because the  Illinois payment accuracy review indicated that nearly one-third of  payments to nonemergency transportation providers were in error, the  Illinois Medicaid program has taken a number of steps to improve the  accuracy of payments to this provider type.
Texas, also in 1998, reported an estimated payment accuracy rate of  89.5 percent in the acute medical care fee-for-service portion of the  program. However, in making that estimate, reviewers had trouble  locating many patients and records due to statutorily imposed time  constraints. Further work led the state, in 1999, to revise the estimate to  between 93.2 and 94 percent. In developing the estimate, the state  identified ways to reduce improper payments through expanded use of  computerized fraud detection tools, such as matching Medicaid  eligibility records with vital statistics databases to avoid payments for  deceased beneficiaries. In January 2001, Texas reported that a more  recent study estimated a payment accuracy rate of 92.8 percent in its  acute medical care fee-for-service payments.
Kansas, in 2000, reported an estimated payment accuracy rate of  76 percent with a margin of error of +/- 9 percentage points. The  estimate was based on a sample of individual paid claims, as in Illinois.  The payment accuracy study recommended increased provider and  consumer education, as well as improvements to computerized payment  systems. In addition, Kansas officials undertook focused reviews of  certain types of claims that were identified as vulnerable to abuse.
In their payment accuracy studies, these states commonly identified errors  such as   missing or insufficient documentation to show whether the claim was   claims for treatments or services that were not medically necessary;  claims that should have been coded for a lower reimbursement amount;  and  claims for treatments or services that the program did not cover.
Because payment accuracy studies can provide useful guidance toward  developing cost-effective measures to reduce losses, HCFA has sought  HCFAC funding for grants to states for such efforts. HCFA also has  established a workgroup to develop guiding principles, definitions, and  reporting protocols for payment accuracy studies. HCFA and its workgroup  of state officials are also trying to assess whether, given the many  differences among the various Medicaid programs, a common methodology  can be developed that would allow valid comparison of error rates across  states.

		Fraud and Abuse Represent a Portion of Improper Payments That Is Even More Difficult to Quantify

State payment accuracy studies may not fully identify improper payments  that might be related to fraud, due primarily to fraud’s covert nature. Losses  due to fraudulent billing and other related practices are difficult to quantify.  However, these amounts can be significant, as was demonstrated recently  in California’s program, in which millions of dollars were paid to numerous  fraudulent providers. Since July 1999, a state-federal task force targeting  questionable pharmaceutical and durable medical equipment suppliers for  improper billing has charged 115 providers, wholesalers, and suppliers in  cases involving about $58 million in fraud. At least 69 individuals have been  convicted and paid about $20 million in restitution. An additional 300  entities are being investigated for suspected fraud that could exceed  $250 million. In one case, a family-run equipment company defrauded the  program out of more than $9 million by submitting thousands of claims for  equipment and supplies that were never delivered to patients. Investigators  also found the following.  “Bump and run” schemes in which individuals bill for a few months for  services that are not rendered, stop billing before being detected, and  then start again under a new name.
Wholesalers who gave pharmacies and suppliers false invoices to  substantiate false claims.
Use of “marketers” who recruit and pay beneficiaries $100 or more to  lend their Medicaid identification cards for use in improper billing.
Use of beneficiary identification numbers stolen from a hospital to bill  for services not provided.
Use of identification from providers who had retired or moved out of the  state.
Purchase of an established business in order to fraudulently bill under  its name.
Administrative weaknesses in the California Medicaid program made these  activities easier to accomplish. For example, the program was issuing new  billing numbers to individuals with demonstrated histories of current or  past questionable billing practices. The program allowed providers to have  multiple numbers, and applicants did not have to disclose past involvement  in the program or any ongoing audits. As a result, in some cases, individuals  who had past questionable billings applied for a new provider number and  were reinstated with full billing privileges. In addition, applicants for a  billing number for a business that needed a license—such as a pharmacy— did not have to disclose that actual owners were not the licensed  individuals. This allowed unlicensed individuals to pay medical  professionals for the use of their licenses to obtain a provider number.   California has taken steps to try to close such loopholes.
In addition to single-state schemes, fraudulent activities sometimes involve  large-scale multistate schemes. One case led to a $486 million civil  settlement in early 2000—one of the largest health care settlements ever. It  followed a 5-year investigation of a dialysis firm billing Medicare and  several state Medicaid programs for intradialytic parenteral nutrition that  was not necessary or not provided in the quantity claimed. The company  had an ownership interest in a laboratory that also double-billed for  unnecessary tests and paid kickbacks to nephrologists and clinics that used  the laboratory. In another case, a national laboratory headquartered in  Michigan was ordered to pay $6.8 million in a multistate settlement for  billing Medicare and five Medicaid programs for bogus medical tests.
Improper billing schemes such as the ones discussed above are the  principal types of fraud cases developed by MFCUs, according to MFCU  directors responding to our survey. Improper billing includes “upcoding,” in  which the provider misrepresents treatment provided and bills for a more  costly procedure; “ghost” or “phantom” billing, in which a provider bills for  services never provided; and delivering more services than are either  necessary or appropriate for the patient’s diagnosis. However, other types  of fraud occur, including improper business practices—such as kickbacks  for steering services to a provider—or misrepresentation of qualifications,  such as an individual falsely claiming to be a physician.  MFCU directors  have found a wide variety of providers involved in fraud, including  physicians, dentists, pharmacies, durable medical equipment providers,  and transportation providers. Beneficiaries also engage in fraud, either by  misrepresenting assets to become eligible for the program, lending or  selling their identification numbers for another’s use, or obtaining products  such as pharmaceuticals for resale.
Fraud is not merely a financial concern—it can also pose a risk to the  physical health of beneficiaries. For example, providers have drawn blood  unnecessarily in order to better substantiate billing for tests that were not  performed, and dentists have conducted extensive unnecessary dental  work on beneficiaries in order to bill the program.

	States’ Efforts to Control Improper Payments Are Uneven

The amount of resources and effort that state Medicaid programs devote to  protecting the integrity of their programs varies. Some states have focused  their efforts on preventing improper payments by strengthening their  prepayment claims checking. States’ abilities to detect improper payments  also vary, in part because some lack sophisticated information technology  that can help them analyze and track instances of inappropriate billing.  Strong leadership in certain states is resulting in stricter laws and  restructured operations to better ensure that the Medicaid program pays  claims appropriately.

		Resources Devoted to Program Protection Efforts Are Generally Modest

Resources for addressing improper Medicaid payments are generally  modest. In our survey, 25 state Medicaid agencies reported spending one- tenth of 1 percent or less of program expenditures on these efforts. Others,  such as California, spend about one-fourth of 1 percent of program  expenditures on preventing and detecting improper payments. However,  this is not unique to Medicaid. As we recently reported, the Medicare  program devotes little more than one-fourth of 1 percent of its program  expenditures to safeguarding payments. As a result, we recommended that  the Congress increase funding for these important activities.
All states forgo some of the federal funds available to help their MFCUs  investigate and prosecute fraud. MFCUs, once federally certified and in  operation for 3 years, are eligible for 75 cents in federal funds for every  dollar they spend, up to a maximum federal contribution of the greater of  $125,000 per quarter or one-fourth of 1 percent of the state Medicaid  program’s total expenditures in the previous quarter. However, only 10  percent of MFCUs receive enough state funding to obtain even half of the  allowed federal match. States ranged from having enough state funding to  obtain less than 7 percent to having up to 86 percent of their allowed  federal match.
Many Medicaid state agency fraud control and MFCU officials reported  gaps in staff, staff training, or technology acquisition. Many state officials  said that they wanted to increase their workforce by hiring staff with  specific skills, such as auditing, computer analysis, and clinical knowledge,  and adding the technology to analyze large amounts of claims data. For  example, in our survey, only 14 of 53 state agencies reported that they have  statisticians to help collect, organize, and analyze data to spot improper  billing practices. Further, although information technology to store and  analyze large amounts of data easily has improved significantly in recent  years, some states reported using very old information technology to  assess program billing. Four state Medicaid agencies reported using  software that is at least 15 years old to assess claims before payment, and  three state Medicaid agencies reported using software at least that old to  analyze claims after payment to ensure the billings were proper.
While about half of the state agencies and a third of MFCUs reported that  their program integrity unit budgets were steady or declining in the  previous 3 years, we did learn that other states showed a more promising  trend.  In our survey, 8 state Medicaid agencies and 4 MFCUs reported that  their budgets for program integrity activities had increased significantly,  while another 15 state agencies and 27 MFCUs reported that their budgets  had increased somewhat.  As a result, they reported that they were able to  hire additional staff and increase program safeguards.  For example,  Connecticut’s increased funding allowed the state Medicaid agency to hire  additional staff to increase audits and site visits to providers. Georgia’s  state Medicaid agency also received increased funding, which allowed it to  increase staffing levels and to make a number of additional improvements,  such as opening an office to cover the southern part of the state.

		Prevention Efforts Emphasized in Certain States

Preventing improper payments can be a cost-effective way to protect  program dollars. Prevention can help avoid what is known as “pay and  chase” in which efforts must be made to detect and attempt to recover  inappropriate payments after they have been made. Such postpayment  efforts are often costly and typically recover only a small fraction of the  identified misspent funds, although they can identify parts of the program  where controls, such as on payments, may need strengthening.  States use a  variety of preventive approaches—such as prepayment computer “edits,”  manual reviews, provider education, and thoroughly checking the  credentials of individuals applying to be program providers—and the scope  and effectiveness of these activities varies among the states.

			States Use Prepayment Edits and Reviews to Help Prevent Improper Payments

All 41 of the state Medicaid agencies responding to our survey about  prepayment claims review reported that they use such reviews to varying  degrees. These include automated computer “edits” and manual reviews to  help ensure payment accuracy. Typically, their edits check the  mathematical accuracy of claims, the correct use of payment codes, and  patients’ Medicaid eligibility.  Such reviews help ensure that the services  listed on the claim are covered, medically necessary, and paid in  accordance with state and federal requirements. For example, an edit can  be used to deny a claim for obstetrical care for a male beneficiary. Some  states have thousands of such edits in their payment systems that identify  duplicate claims, invalid dates, missing codes, or claims for services that  conflict with previous care provided to the beneficiary.
Although widely used, recent experiences from several states that are  aggressively working to detect overpayments suggest that their existing  prepayment edits have not  been catching various types of improper  payments. A few states have hired a private contractor to help analyze  claims data to uncover overpayments. For example, with the aid of this  contractor, Florida learned that it was paying some pharmacies 10 times  more than it should for asthma inhalant because its edit did not stop claims  listing the amount in unit doses rather than in grams, as required. Following  this contractor’s overpayment review, Kentucky made edit changes it  estimates will prevent $2 million in improper payments.  This same  contractor assisted Washington in making edit and other policy changes  that are anticipated to save $4 million.
Investigations in other states have also identified the need for new and  revised edits. Some MFCU officials reported that they had advised their  state agencies to strengthen certain edits based on the cases they had  investigated. For example, the North Carolina MFCU suggested an edit to  its state agency to identify and bundle laboratory services that should not  have been billed separately. Also, the Louisiana MFCU reported that it had  recommended that its Medicaid agency develop an edit to prevent  duplicate payment of children’s medical screenings and physician visits and  to ensure that physicians and certified nurse practitioners working  together do not send in duplicate claims for the same services.
Manual reviews before claims are paid can further help prevent improper  payments, but they are resource-intensive, thus limiting the number of such  reviews that can be done cost effectively. Manual reviews involve a trained  specialist—such as a nurse—examining documentation submitted with a  claim and possibly requesting additional information from providers,  beneficiaries, and other related parties. Because of the cost and time  involved, manual prepayment review is often targeted to certain providers.  For example, if a provider’s claims pattern is substantially different from  his or her peers, or if there is a sudden increase in claims volume for a  given provider, or if there is substantial evidence of abuse or wrongdoing,  payment may be withheld until a reviewer determines whether the  aberrations or increases are appropriate and can be substantiated. Table 1  shows examples of prepayment reviews currently being used by some  states.
Because billing mistakes can be inadvertent, educating providers on how to  comply with program rules and file claims correctly can often prevent  errors. For example, in our survey, almost all state Medicaid agencies  reported initiating meetings with providers, usually to discuss coding and  policy changes. Seventeen state Medicaid agencies reported that their staff  met with providers to discuss safeguarding the confidentiality of provider  and beneficiary Medicaid numbers. In addition, 17 state Medicaid programs  alerted providers to prevalent fraud schemes.  State Medicaid agencies  also reported conveying information on proper billing procedures to  providers through a variety of other means, such as letters, bulletins,  Internet sites, and professional meetings.

			Provider Enrollment Screening Processes Are Often Limited

Some states use more extensive provider enrollment measures to help  prevent dishonest providers from entering the Medicaid program and to  ensure better control over provider billing numbers. While all states collect  some basic information on providers, states have considerable latitude in  how they structure their provider enrollment processes. In addition, states  are required to check if those providers who should be licensed are  licensed and whether the provider has been excluded from participating in  other federal health programs. Checking a provider’s criminal record and  business site has been found to be important by states such as Florida to  ensure that providers entering the program are legitimate. Nine of the  states responding to our survey reported having a provider enrollment  process that included all four of these checks—licensure, excluded  provider status, criminal record, and business location verification—in  their provider enrollment processes. Table 2 provides examples of these  activities.
Most Medicaid agencies reported checking whether applicants whose  practice requires licensure had a valid license and whether they had been  excluded from participating in other federal health programs.  However,  less than half of the states responding to our survey reported checking  whether applicants have criminal records. While conducting such checks  on a targeted basis might be useful in helping to protect the program, they  can be time-consuming and difficult to perform, according to states that  have attempted them. This is due in part to often inaccurate and  incomplete statewide databases containing records on criminal  convictions. Nineteen of 52 state Medicaid programs reported that they  conducted site visits to determine if an applicant had a bona fide operation.  Of those that do conduct site visits, most limit them to particular types of  providers they believe have a greater likelihood of abusing the program.  For example, Kansas Medicaid officials reported that, based on a risk  analysis, there is a greater risk that durable medical equipment suppliers  are not legitimate providers and, therefore, the Medicaid program  conducted site visits of these applicants.
Many states allow providers, once enrolled, to bill the program indefinitely  without updating information about their status. Poor control over  provider billing numbers can make Medicaid programs more vulnerable to  improper payment. In our survey, 26 states reported allowing providers to  continue to bill indefinitely while other states had an enrollment time limit,  which often varied by provider type. However, 33 states reported that they  cancel inactive billing numbers—generally for providers who have not  billed the program for more than 1 to 3 years. Such efforts can be  important, as questionable providers have been known to keep multiple  billing numbers “in reserve” in case their primary billing number is  suspended. In California, some individuals falsely billed the Medicaid  program using the numbers of retired practitioners.

		States’ Postpayment Detection Activities and Capabilities Differ

Just as states are uneven in their efforts to prevent improper payments,  they also vary in their ability to detect improperly paid claims. Because  prepayment reviews cannot catch all erroneous claims, Medicaid programs  must have systems in place to retrospectively review paid claims. While  some states are using software from the early 1980s to analyze paid claims,  other states—such as Texas and Washington—are implementing state-of- the-art systems to improve their ability to detect and investigate potential  improper payments.
Each Medicaid state agency is required to have an automated claims  processing and retrieval system that can be used to detect postpayment  errors. These automated claims processing systems, known as Medicaid  Management Information Systems (MMIS), contain a Surveillance and  Utilization Review Subsystem (SURS) that state agency officials can use to  identify providers with aberrant billing patterns. For example, these might  include providers with a large increase in Medicaid activity or with billing  patterns that are significantly different from their peers and that result in  enhanced reimbursement. Almost all states reported conducting focused  reviews or investigations when a provider’s billing was aberrant to  determine if any improper payments had been made. State Medicaid  officials told us that when their state Medicaid agency discovers that  improper payments have been made, it takes action to recover the  improper payment, and, if warranted, refers the provider to its state MFCU  for possible criminal investigation and prosecution. Providers who have  been identified as having significant billing problems generally receive  continued scrutiny if they remain in the program.
The systems used to uncover such aberrant billing—MMIS and SURS— were developed in the early 1980s when computer algorithms to identify  potentially inappropriate claims were less sophisticated and analysis  required more programming skill. Newer systems allow staff to use  desktop computers to directly query large databases of claim, provider, and  beneficiary information, without requiring the assistance of data  processing professionals. Several state officials reported that buying or  leasing these upgraded computer systems and hiring staff skilled in their  use would be their top priority if they had more funding. Other states are  already purchasing or leasing such systems, as the following examples  illustrate.
Texas is using private contractors to design, develop, install, and train  staff to use a state-of-the-art system intended to integrate detection and  investigation capabilities. It is intended to allow the state to uncover  potentially problematic payment patterns that old SURS profiling  methodologies would have missed. It also includes a “neural network”  that is intended to “learn” from the data it analyzes and adjust its  algorithms to identify previously overlooked aberrant payment patterns.  The system is further enhanced with modules designed to help develop  cases for prosecution. The first 2 years of the project cost Texas $5.8 million, but according to state Medicaid officials, Texas had already  collected $2.2 million in overpayments in the system’s first year of  operation.
Kentucky has hired a private contractor to use an advanced computer  system to analyze claims payment data. It is paying that contractor  through contingency fees based on overpayment collections related to  these efforts. Using claims data from January 1995 through June 1998,  the contractor identified $137 million in overpayments, of which the  state has collected between $4 and $5 million. That compares to  previous recovery efforts by the state that, on average, netted about  $75,000 a year.
Under its new Payment Integrity Program, Washington is using a private  contractor to design, develop, install, and train staff to analyze data on  an advanced computer system. The system improves access to data and  includes fraud and abuse identification software with prepackaged  algorithms to analyze the data and identify overpayments, as well as  develop leads that would need further investigation. It also allows  agency staff to develop algorithms and perform their own online  reviews. Since the program started in June 1999, the contractor and  state agency staff have identified overpayments totaling more than  $2.95 million.
Some states have developed detection strategies that combine the use of  advanced technology with special investigative protocols. For example,  New Jersey conducted special audits of transportation services, cross- matching data on transportation claims to beneficiary medical  appointments, and sometimes contacting providers to confirm that the  beneficiary actually arrived and was treated. Also, using billing trend  reports, New Jersey audited pharmacies with abnormally large numbers of  claims for a newly covered high-priced drug, and then audited the  pharmacies’ purchases from wholesalers, thus discovering that these  pharmacies were billing for a larger amount of this drug than had been  shipped to them.
Beneficiaries can also play a role in helping state Medicaid agencies detect  improper payments. Forty-two states reported having hotlines that  beneficiaries could use to report suspected improprieties. Fourteen states  reported alerting beneficiaries to certain types of fraudulent schemes.  Twenty-seven reported taking other types of actions. For example, some  states commented that they mail explanation-of-benefit statements to  beneficiaries to increase awareness of the services being billed in their  names, so that if beneficiaries are not receiving billed services, they will be  able to inform the state.

		Fraud Investigation and Prosecution Is a Shared Responsibility

State Medicaid agencies are primarily responsible for conducting program  integrity activities, but they share this responsibility with other agencies.  For example, they are required to refer potential fraud cases to the MFCUs  for investigation and prosecution. Cases that may involve improper billing  of Medicare or private insurers as well as Medicaid may also require  investigation by the OIG or the FBI, and may involve prosecution by DOJ.  In addition, other state agencies, such as those responsible for licensure,  can become involved in an investigative effort.
Federal regulations require Medicaid agencies and MFCUs to have an  agreement to cooperate; however, the actual level of cooperation between  state Medicaid agencies and MFCUs varies. State Medicaid agencies are  required to refer suspected fraud cases to MFCUs for investigation and  possible prosecution, provide needed records to the MFCUs, and enter into  a Memorandum of Understanding establishing procedures for sharing  information and referring cases.
In our survey, MFCUs generally reported that about one-third of the cases  that they open are referred by their state Medicaid agency. The most  common criterion reported by state agencies for referring cases to MFCUs  was a belief of an intent to commit an impropriety on the part of a provider.  The number of cases state agencies reported referring in their previous  fiscal year varied substantially. This is not surprising because Medicaid  agencies differ in size, organization, scope of services, and beneficiary  eligibility requirements. They also operate in different states, each of which  has its own legal system and business climate, differences that can affect  the number and quality of fraud referrals made by the state agency.
In addition to differences in referral patterns, the reported level of  interaction between states’ Medicaid agencies and MFCUs also varied. For  example, meetings between the two organizations to discuss pending cases  are important for preventing agency actions that could compromise a fraud  unit investigation or for alerting MFCU officials to cases the state agency is  developing. Most state Medicaid agencies reported having joint meetings at  least six times a year; however, eight states reported that they conduct such  meetings only one to three times each year.
New Jersey is a state where the Medicaid agency and MFCU have worked  together to further each agency’s efforts through close cooperation.  Medicaid agency staffers are sometimes detailed to the MFCU to continue  working cases they have developed. The state agency and MFCU hold joint  meetings monthly to discuss developing cases, case progress, and to plan  strategies for investigations, prosecutions, and administrative actions. The  MFCU tries to use search warrants and other methods to gather evidence in  suspected fraud cases so that information can be shared with the Medicaid  agency. This is in contrast to the use of another MFCU tool—grand jury  investigations—which have secrecy rules to prevent disclosure of  evidence. This level of cooperation allows the state Medicaid agency to  take immediate administrative action to stop improper payments without  disrupting criminal case development. The MFCU also works to have  defendants who are pleading guilty sign a consent order debarring or  disqualifying them from participating in Medicaid, eliminating the need  for state agency debarment or disqualification proceedings. In contrast to  New Jersey, in another state, the director of an MFCU reported to us that  MFCU investigators were denied access to state Medicaid agency meetings,  which made it more difficult for both agencies to develop potential fraud  cases.
State Medicaid and MFCU officials told us that close collaboration among  state agencies or state and federal law enforcement agencies was  particularly important for certain types of cases. In the handful of states  whose MFCUs lack authority to serve warrants or prosecute cases, MFCUs  must work with other agencies to ensure that these activities take place.  When dealing with individuals whose fraudulent or abusive activities cross  state lines, one MFCU may need to work with other states’ agencies or with  federal officials. Some cases involve efforts to defraud both Medicare and  Medicaid, which can require an MFCU to work with the OIG or FBI. Such  interagency collaboration has been fostered by the HCFAC program, which  has increased funding for federal health care law enforcement efforts.  Implementing section 407 of the Ticket to Work and Work Incentives  Improvement Act of 1999, which authorized MFCUs to address cases that  involve Medicare as well as Medicaid fraud, will also likely necessitate  enhanced cooperation between MFCUs and federal law enforcement  officials.
Nearly all MFCUs responding to our survey reported that they have  conducted joint investigations with other organizations in the last 3 years.  Most commonly, this involved conducting joint investigations with their  state agency, state licensing boards, the OIG, FBI, or a federal task force.  Cooperative efforts have led to joint prosecutions. Twenty-seven states  reported jointly prosecuting criminal cases with federal attorneys in the  previous 3 years—about half doing so at least four times.
Such cooperation can augment state officials’ activities. This was  demonstrated in California, where members of a task force created by the  FBI, the U.S. Attorney’s office, the California State Controller’s office, the  Attorney General’s office, and the state Department of Health uncovered  numerous fraud and abuse cases in the Los Angeles area. The Controller’s  staff audited suppliers and referred to the FBI those with insufficient  inventories or purchase records to substantiate claims volume. The FBI  investigated further and made referrals to the U.S. Attorney. Meanwhile,  the governor created a fraud prevention bureau within the state agency that  worked closely with on-site FBI agents to investigate provider operations.  Once a case was developed, the FBI referred it to the MFCU and U.S.  Attorney’s office for prosecution.

		Some States Have Taken Additional Steps to Enhance Medicaid Program Integrity

During our review, we found that several states—including Georgia, New  Jersey, North Carolina, and Texas—have enacted stricter rules or  restructured operations to better ensure the integrity of their Medicaid  programs. A few examples of their accomplishments follow.
Legislative changes: Some states are enacting health-care-specific  criminal and civil legislation—often modeled after federal law.  With these  statutes, prosecutors no longer must develop cases based on more generic  mail fraud, racketeering, theft, or conspiracy statutes. For example, New  Jersey enacted the Health Care Claims Fraud Act, which creates the  specific crime of health care claims fraud and provides for 10-year prison  sentences, fines of up to five times the amount gained through fraud, and  professional license revocation. Meanwhile, civil statutes—such as one  enacted in North Carolina and other states authorizing action against  providers who “knowingly” submit false Medicaid claims for payment— allow prosecutors to take advantage of less stringent evidentiary  requirements than those required by criminal statutes.
Restructuring operations: Some states are enhancing their program  safeguard operations through restructuring. Texas created an Office of  Investigations and Enforcement in 1997 within the state Medicaid agency,  giving it power to take administrative actions against providers. These  actions cannot be appealed when the Office has tangible evidence of  potential fraud, abuse, or waste. It also can impose sanctions and recover  improper payments. Meanwhile, Georgia established an MFCU in 1995 that  differs from most in that it includes auditors from the state Department of  Audits, investigators from the state Bureau of Investigation, and  prosecutors from the state Attorney General’s office. They work together  as a discreet entity under memoranda of understanding signed by the three  agencies.

	Current Federal Role Focuses on Technical Assistance

HCFA and the OIG—the agencies that are responsible for the Medicaid  program at the federal level—are taking steps to promote effective  Medicaid program integrity by providing technical help to the states to  facilitate states’ efforts. These federal agencies also conduct some  information gathering on state activities in order to guide state efforts.  Many state agency and MFCU officials reported that their agencies had  benefited greatly from federal technical assistance, guidance, and training,  and would welcome more assistance.

		HCFA Has Increased Efforts to Facilitate State Program Integrity Activities

In 1997, HCFA began a new approach as a facilitator, enabler, and catalyst  of states’ program integrity efforts. To do so, HCFA established the  National Medicaid Fraud and Abuse Initiative, led by staff from HCFA’s  southern consortium and headquarters, with designated, part-time  coordinators for the Initiative in each of HCFA’s 10 regional offices. The  strategy for the Initiative was to partner with the states and have state  representatives work with HCFA staff to set the agenda and goals for the  effort. The Initiative provides networking, information sharing, and training  opportunities for state agencies and their program integrity partners.  Participants in early Initiative meetings identified 10 major focus areas— including payment accuracy measurement, managed care, and information  technology. Workgroups are developing recommendations in each area.
The Initiative also includes the Medicaid Fraud and Abuse Control  Technical Advisory Group, consisting of HCFA and state officials, which  serves as an ongoing forum for  sharing issues, solutions, resources, and expertise among states;  advising HCFA on policies, procedures, and program development; and  making recommendations on federal policy and legislative changes.
The Initiative has resulted in several tangible products and events,  including a fraud statute Web site, managed care guidelines, seminars on  innovations and obstacles in safeguarding Medicaid, and a technology  conference. These efforts are described in table 3.
State Medicaid officials that we spoke with reported that Initiative  activities are helping them with their program safeguard efforts by  providing important networking, information sharing, and training  opportunities. Our survey results indicated that staff from 41 state  Medicaid agencies attended Initiative-sponsored training last year, and  more than 40 percent of state agencies had staff serve on Initiative panels.  In fact, nearly 75 percent of state Medicaid agency survey respondents  would like more of the types of assistance HCFA has been providing,  including additional  training;  technical assistance on use of technology;  guidance on managed care fraud detection and prevention; and  information on innovative practices in other states.
According to HCFA and some state officials, this approach has been more  effective than previous efforts to guide state activities. Prior to 1997, HCFA  reviewed information systems—including state SURS unit activities— through formal “systems performance reviews” of program controls. These  controls included those related to payment and program safeguard  activities. HCFA could impose penalties on states that failed these reviews,  and some HCFA and state officials told us that states found the reviews  burdensome. Section 4753 of the Balanced Budget Act of 1997 repealed  HCFA’s authority to conduct such reviews. State and federal officials agree  that federal attention to state program protection efforts declined after  these mandatory reviews were eliminated. HCFA officials told us that staff  in HCFA’s regional offices continued to provide some oversight of state  efforts, but not in a coordinated way.
However, without a regular review of state activities to address improper  payments, HCFA staff had little information with which to guide states  where more effective efforts were needed. To get a more comprehensive  and systematic view of state antifraud efforts, the regional Initiative  coordinators conducted structured site reviews of certain program  safeguards in eight states in fiscal year 2000. These reviews examined how  state Medicaid agencies identify and address potential fraud or abuse,  whether state agencies are complying with appropriate laws and  regulations—such as how they check to ensure that only qualified  providers participate in the program—and potential areas for  improvement. Reviews in another eight states are being conducted in fiscal  year 2001. However, these reviews, as with all of HCFA’s Initiative  endeavors, focus only on state efforts to address potential fraud and abuse;  they do not address all of the ways states may be trying to prevent or detect  improper payments, and whether these efforts could be improved.

		OIG Reviews MFCUs’ Reported Activities and Provides Training Opportunities

The OIG initially certifies, and each year recertifies, that MFCUs are  complying with federal requirements and are eligible for federal funding.  The OIG determines whether an MCFU should be recertified primarily  based on reports the MFCUs submit on their activities. The OIG assesses  these reports to determine whether each unit has used federal funds  effectively and has met a set of 12 performance standards. These standards,  which the OIG developed in conjunction with the National Association of  Medicaid Fraud Control Units, cover areas such as staffing, training, types  of cases (whether they constitute potential fraud or physical abuse of  beneficiaries), case flow, and monitoring of case outcomes. For example, in  the area of staffing, the OIG checks whether an MFCU has the minimum  number of staff required. This includes at least one attorney experienced in  investigating criminal cases or civil fraud, one experienced auditor capable  of supervising financial records reviews and assisting in fraud  investigations, and one senior investigator with substantial experience in  conducting and supervising criminal investigations.
The OIG may also conduct site visits to observe MFCU operations or  provide guidance. Eight MFCUs received such visits in fiscal year 1999. OIG  officials said they rarely decertified MFCUs. If decertified, an MFCU can  reapply for federal certification when officials believe it will meet the  required standards. Such is the case with the District of Columbia’s MFCU,  which was decertified in 1983 for “lack of productivity.”   It was recertified  in 2000.
The MFCUs generally reported being satisfied with OIG oversight and  guidance, but indicated several areas where the OIG could provide more  assistance—especially by providing more training. More than 45 percent of  MFCUs reported that their staff attended OIG-sponsored training in the  past fiscal year. MFCUs also would like the OIG to do the following.
MFCU officials wanted the OIG to provide more training and assistance  in their new authority to address cases that involve both Medicare and  Medicaid fraud. Survey respondents were particularly interested in  learning more about Medicare program rules, how Medicare claims  processing contractors operate, and recent Medicare fraud schemes.  They also wanted help in working with HCFA and Medicare claims  processing contractors to get timely, online access to Medicare claims  data. The OIG has begun to provide training on Medicare related issues.
MFCUs would like the OIG to increase the number of OIG staff in  regions and local areas to increase their participation in joint  investigations.

	Concluding Observations

Medicaid remains vulnerable to payment error and, while most states are  taking steps to address their programs’ vulnerabilities, their efforts are  uneven. Some states have worked diligently to prevent or detect improper  payments, while others have not been as proactive. The federal government  has provided technical assistance and a forum for information exchange  for the states, as well as some guidance. Given that states are responsible  for administering Medicaid and investigating and prosecuting any  fraudulent activities, states must set their own course to ensure the  integrity of their Medicaid programs. But the federal government has a  responsibility to actively partner with states to ensure that they succeed. In  recent years, HCFA and other federal investigative organizations have  played a more active role as partners in this endeavor.

	Agency Comments and Our Evaluation

We provided draft copies of this report to HHS for comment. HHS officials  provided written comments (see appendix III). We also provided excerpts  from the draft report that dealt with state activities to states that we had  visited. The reviewing officials suggested some technical corrections,  which we incorporated into the report where appropriate.
In its written comments, HHS provided information on the Department’s  most recent efforts to prevent improper payments and to combat fraud and  abuse in the Medicaid program. Among other activities, these efforts  include a resource guide for states, a summary report of the joint HHS-DOJ  technology conference, and a data exchange project between Medicaid and  Medicare.  HHS highlighted efforts to review program integrity activities in  states and indicated that it intends to broaden the scope of the review in  future fiscal years. Both the OIG and HCFA have developed training for  state officials, including training for MFCU officials on Medicare. Finally,  HHS reported that it has established a Web site at  www.hcfa.gov/medicaid/fraud  to provide states with additional technical  assistance and guidance in their efforts to prevent and detect improper  payments and to address fraud and abuse.
As agreed with your office, unless you announce this report’s contents  earlier, we plan no further distribution until 30 days after the issue date. We  will then send copies to the Honorable Tommy G. Thompson, Secretary of  HHS; the Honorable Thomas Scully, Administrator of HCFA; Mr. Michael  Mangano, Acting Inspector General; and other interested parties. We will  make copies available to others upon request.  If you or your staff have any  questions about this report, please call me at (312) 220-7600 or Sheila K.
Avruch at (202) 512-7277. Other major contributors to this report were  Barrett Bader, Bonnie Brown, Joel Grossman, and Elsie Picyk.

Scope and Methodology

As we developed our work on this report, we focused on the risk of  improper Medicaid fee-for-service payments, states’ efforts to address  improper payments—including efforts to investigate and prosecute fraud— and the  guidance and oversight the states are receiving from federal  oversight agencies. To do this work, we used information from our surveys,  state visits, interviews, and analyses of agency program integrity  documents and literature.
To address the risk of improper fee-for-service payments, we reviewed  studies that Illinois, Kansas, and Texas have conducted to measure  payment accuracy in their Medicaid programs, and we interviewed state  officials on the studies’ methodologies, findings, and limitations. To gain  information on the types of improper billing schemes and other types of  fraud cases, we interviewed state officials and reviewed state and HCFA  documents. We also used results from our state survey, described below.
To find out about state activities and federal oversight from the states’  perspective, we analyzed the results of surveys we sent to the 56 state  Medicaid agencies and the 47 federally certified MFCUs then in existence.  Fifty-three of the 56 state Medicaid agencies and 46 of the 47 MFCUs  responded to our surveys. An additional MFCU in the District of Columbia,  which had been decertified in 1983, was recertified in March 2000 after we  sent out our survey. To facilitate their answering our questionnaire, we  asked respondents, in several questions on the surveys, to base their  answers on data from their most recently completed fiscal years, whether  state or federal. (See appendix II for copies of our questionnaires and  results.)
To supplement the survey analyses, we visited state Medicaid programs and  MFCUs in four states: Georgia, New Jersey, Texas, and Washington. We  chose these states to provide regional diversity, and because they were  among the ones considered by federal officials to be particularly active in  efforts to identify and respond to improper payment practices—either  through the use of new technology or by other means. Also, by telephone,  we interviewed Medicaid, MFCU, and state government officials in other  states that have taken steps to strengthen their Medicaid program integrity  efforts.
To better understand efforts to control improper payments at the national  level, we interviewed officials at HCFA’s Central Office and leaders of the  agency’s National Medicaid Fraud and Abuse Initiative in HCFA’s Atlanta  and Dallas regional offices, as well as officials at the OIG. To gain a more  broad-based perspective on other joint agency investigations and  prosecutions, we interviewed representatives of the FBI, the U.S. Attorneys  office, and the Civil and Criminal Divisions of DOJ. In addition, we  participated in several meetings on control of improper payments,  including fraud, which were sponsored by HCFA and others. Finally, we  interviewed representatives of provider and supplier groups and  technology companies that have developed software that is useful in the  detection of improper payments. In addition, we reviewed literature on  health care fraud and abuse, including studies by the OIG, HCFA, and  others.
We performed our work from September 1999 through April 2001 in  accordance with generally accepted government auditing standards.

Aggregated Results From State Medicaid Agency and MFCU Questionnaires

Related GAO Products

Major Management Challenges and Program Risks: Department of Health  and Human Services (GAO-01-247, Jan., 2001).
National Practitioner Data Bank: Major Improvements Are Needed to  Enhance Data Bank’s Reliability (GAO-01-130, Nov. 17, 2000).
Medicaid: State Financing Schemes Again Drive Up Federal Payments  (GAO/T-HEHS-00-193, Sept. 6, 2000).
Financial Management: Improper Payments Reported in Fiscal Year  1999 Financial Statements (GAO/AIMD-00-261-R, July 27, 2000).
Medicaid: HCFA and States Could Work Together to Better Ensure the  Integrity of Providers (GAO/T-HEHS-00-159, July 18, 2000).
Medicaid In Schools: Improper Payments Demand Improvements in  HCFA Oversight (GAO/HEHS/OSI-00-69, Apr. 5, 2000).
Medicaid: Federal and State Leadership Needed to Control Fraud and  Abuse (GAO/T-HEHS-00-30, Nov. 9, 1999).
Financial Management: Increased Attention Needed to Prevent Billions  in Improper Payments (GAO/AIMD-00-10, Oct. 29, 1999).

	Ordering Information

The first copy of each GAO report is free. Additional copies of  reports are $2 each. A check or money order should be made out to  the Superintendent of Documents. VISA and MasterCard credit  cards are accepted, also.
Orders for 100 or more copies to be mailed to a single address are  discounted 25 percent.
Orders by mail: U.S. General Accounting Office P.O. Box 37050 Washington, DC  20013 Orders by visiting: Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders by phone: (202) 512-6000 fax: (202) 512-6061 TDD (202) 512-2537 Each day, GAO issues a list of newly available reports and  testimony. To receive facsimile copies of the daily list or any list  from the past 30 days, please call (202) 512-6000 using a touchtone  phone. A recorded menu will provide information on how to obtain  these lists.

	To Report Fraud, Waste, or Abuse in Federal Programs

Web site: http://www.gao.gov/fraudnet/fraudnet.htm  e-mail: fraudnet@gao.gov  1-800-424-5454 (automated answering system)

Summary:
What GAO Found

State Medicaid programs make a wide variety of payments to individuals, institutions, and managed health care plans for services provided to beneficiaries whose eligibility status may fluctuate because of changes in income. Because of the size and the nature of the program, Medicaid is potentially at risk for billions of dollars in improper payments. The exact amount is unknown because few states measure the overall accuracy of their payments. Some improper Medicaid payments by states are the result of fraud by billers or program participants, but such improper payments are hard to measure because of the covert nature of fraud. Efforts by state Medicaid programs to address improper payments are modestly and unevenly funded. Half of the states spend no more than 1/10th of one percent of program expenditures to safeguard program payments. States also differ in how they help prevent improper payments as well as the degree to which they coordinate their investigations and prosecutions of fraud. Federal guidance to the states relies largely on technical assistance. The Health Care Financing Administration has recently taken a more active role to facilitate states' efforts and provide a national forum to share information.