Background

Since 1996, Congress has taken important steps to increase Medicare  program integrity funding and oversight, including the establishment of  the Medicare Integrity Program. Table 1 summarizes several key  congressional actions.

	CMS Has Taken Action to Improve Medicare Program Integrity, but More Can Be Done

CMS has made progress in strengthening provider enrollment provisions,  but needs to do more to identify and prevent potentially fraudulent  providers from participating in Medicare. Additional improvements to  prepayment and postpayment claims review would help prevent and  recover improper payments. Addressing payment vulnerabilities already  identified could further help prevent or reduce fraud.

		CMS Has Strengthened Provider Enrollment Provisions since PPACA, but Further Actions Needed to Help Ensure Potentially Fraudulent Providers Do Not Participate in Medicare

PPACA authorized and CMS has implemented new provider enrollment  procedures that address past weaknesses identified by GAO and HHS’s  Office of Inspector General (OIG) that allowed entities intent on  committing fraud to enroll in Medicare. CMS has also implemented other  measures intended to improve existing procedures. Specifically, to  strengthen the existing screening activities conducted by CMS  contractors, the agency added screenings of categories of provider  enrollment applications by risk level, contracted with new national  enrollment screening and site visit contractors, and began imposing  moratoria on new enrollment of certain types of providers.
Screening Provider Enrollment Applications by Risk Level: CMS and  OIG issued a final rule in February 2011 to implement many of the  new screening procedures required by PPACA. CMS designated  three levels of risk—high, moderate, and limited—with different  screening procedures for categories of Medicare providers at each  level. Providers in the high-risk level are subject to the most rigorous  screening. Based in part on our work and that of OIG, CMS  designated newly enrolling home health agencies and suppliers of  durable medical equipment, prosthetics, orthotics, and supplies  (DMEPOS) as high risk, and designated other providers as lower risk  levels. Providers at all risk levels are screened to verify that they meet  specific requirements established by Medicare, such as having  current licenses or accreditation and valid Social Security numbers.  High- and moderate-risk providers are also subject to unannounced  site visits. Further, depending on the risks presented, PPACA  authorizes CMS to require fingerprint-based criminal history checks.  Last month, CMS awarded a contract that will enable the agency to  access Federal Bureau of Investigation information to help conduct  those checks of high-risk providers and suppliers. PPACA also  authorizes the posting of surety bonds for certain providers.
CMS has indicated that the agency will continue to review the criteria  for its screening levels and will publish changes if the agency decides  to update the assignment of screening levels for categories of  Medicare providers. Doing so could become important because the  Department of Justice (DOJ) and HHS reported multiple convictions,  judgments, settlements, or exclusions against types of providers not  currently at the high-risk level, including community mental health  centers and ambulance providers. CMS’s implementation of  accreditation for DMEPOS suppliers, and of a competitive bidding  program, including in geographic areas thought to have high fraud  rates, may be helping to reduce the risk of DMEPOS fraud. While  continued vigilance of DMEPOS suppliers is warranted, other types of  providers may become more problematic in the future. Specifically, in  September 2012, we found that a range of providers have been the  subjects of fraud investigations. According to 2010 data from OIG  and DOJ, over 10,000 providers that serve Medicare, Medicaid, and  Children’s Health Insurance Program beneficiaries were involved in  fraud investigations, including not only home health agencies and  DMEPOS suppliers, but also physicians, hospitals, and pharmacies.In addition, the provider type constituting the largest percentage of  subjects in criminal health care fraud investigations was medical  facilities—including medical centers, clinics, or practices—which  constituted almost a quarter of subjects in such investigations.  DMEPOS suppliers make up a little over 16 percent of subjects.
National Enrollment Screening and Site Visit Contractors: CMS  contracted with two new types of entities at the end of 2011 to  assume centralized responsibility for two functions that had been the  responsibility of multiple contractors. One of the new contractors is  conducting automated screenings to check that existing and newly  enrolling providers and suppliers have valid licensure, accreditation,  and a National Provider Identifier (NPI), and are not on the OIG list of  providers and suppliers excluded from participating in federal health  care programs. The second contractor conducts site visits of providers  to determine whether sites are legitimate and the providers meet  certain Medicare standards. implementation of the PPACA screening requirements, the agency  had revoked over 17,000 suspect providers’ ability to bill the Medicare  program.
Site visits for DMEPOS suppliers are to continue to be conducted by the contractor  responsible for their enrollment. In addition, CMS at times exercises its authority to  conduct a site visit or request its contractors to conduct a site visit for any Medicare  provider or supplier.
Moratoria on Enrollment of New Providers and Suppliers in Certain  Areas: CMS suspended enrollment of new home health providers and  ambulance suppliers in certain fraud “hot spots” and other geographic  areas. In July 2013, CMS first exercised its authority granted by  PPACA to establish temporary moratoria on enrolling new home  health agencies in Chicago and Miami, and new ambulance suppliers  in Houston. In January 2014, CMS extended its first moratoria and  added enrollment moratoria for new home health agency providers in  Fort Lauderdale, Detroit, Dallas, and Houston, and new ground  ambulance suppliers in Philadelphia. These moratoria are scheduled  to be in effect until July 2014, unless CMS extends or lifts them. CMS  officials cited areas of potential fraud risk, such as a disproportionate  number of providers and suppliers relative to beneficiaries and  extremely high utilization as rationales for suspending new  enrollments of home health providers or ground ambulance suppliers  in these areas.
We are currently examining the ability of CMS’s provider enrollment  system to prevent and detect the continued enrollment of ineligible or  potentially fraudulent providers in Medicare. Specifically, we are  assessing the process used to enroll and verify the eligibility of Medicare  providers in Medicare’s Provider Enrollment, Chain, and Ownership  System (PECOS) and the extent to which CMS’s controls are designed to  prevent and detect the continued enrollment of ineligible or potentially  fraudulent providers in PECOS.
Although CMS has taken many needed actions, we and OIG have found  that CMS has not fully implemented other enrollment screening actions  authorized by PPACA. These actions could help further reduce the  enrollment of providers and suppliers intent on defrauding the Medicare  program. They include issuing a rule to implement surety bonds for  certain providers, issuing a rule on provider and supplier disclosure  requirements, and establishing the core elements for provider and  supplier compliance programs.
Surety Bonds: PPACA authorized CMS to require a surety bond for  certain types of at-risk providers and suppliers. Surety bonds may  serve as a source for recoupment of erroneous payments. DMEPOS  suppliers are currently required to post a surety bond at the time of  enrollment. CMS reported in April 2014 that it had not scheduled for  publication a proposed rule to implement the PPACA surety bond  requirement for other types of at-risk providers and suppliers—such  as home health agencies and independent diagnostic testing facilities.  In light of the moratoria that CMS has placed on enrollment of home  health agencies in fraud “hot spots,” implementation of this rule could  help the agency address potential concerns for these at-risk providers  across the Medicare program.
Providers and Suppliers Disclosure: CMS has not yet scheduled a  proposed rule for publication for increased disclosures of prior actions  taken against providers and suppliers enrolling or revalidating  enrollment in Medicare, as authorized by PPACA, such as whether  the provider or supplier has been subject to a payment suspension  from a federal health care program. Agency officials had indicated that developing the additional disclosure requirements has been  complicated by provider and supplier concerns about what types of  information will be collected, what CMS will do with it, and how the  privacy and security of this information will be maintained.
Compliance Program: CMS has not established the core elements of  compliance programs for providers and suppliers, as required by  PPACA. We previously reported that agency officials indicated that  they had sought public comments on the core elements, which they  were considering, and were also studying criteria found in OIG model  plans for possible inclusion.had not yet scheduled a proposed rule for publication.

		Additional Improvements to Prepayment and Postpayment Claims Review May Better Identify or Recover Improper Payments

Medicare uses prepayment review to deny claims that should not be paid  and postpayment review to recover improperly paid claims. As claims go  through Medicare’s electronic claims payment systems, they are  subjected to prepayment controls called “edits,” most of which are fully  automated; if a claim does not meet the criteria of the edit, it is  automatically denied. Other prepayment edits are manual; they flag a  claim for individual review by trained staff who determine whether it  should be paid. Due to the volume of claims, CMS has reported that less  than 1 percent of Medicare claims are subject to manual medical record  review by trained personnel.
Increased use of prepayment edits could help prevent improper Medicare  payments. Our prior work found that, while use of prepayment edits saved  Medicare at least $1.76 billion in fiscal year 2010, the savings could have  been greater had prepayment edits been used more widely. Based on an analysis of a limited number of national policies and local coverage  determinations (LCD), we identified $14.7 million in payments in fiscal  year 2010 that appeared to be inconsistent with four national policies and  therefore improper. We also found more than $100 million in payments  that were inconsistent with three selected LCDs that could have been  identified using automated edits. Thus we concluded that more  widespread implementation of effective automated edits developed by  individual Medicare administrative contractors (MAC) in other MAC  jurisdictions could also result in savings to Medicare. CMS has taken  steps to improve the development of other types of prepayment edits that  are implemented nationwide, as we recommended. For example, the  agency has centralized the development and implementation of  automated edits based on a type of national policy called national  coverage determinations. CMS has also modified its processes for  identifying provider billing of services that are medically unlikely to  prevent circumvention of automated edits designed to identify an  unusually large quantity of services provided to the same patient.
We also evaluated the implementation of CMS’s Fraud Prevention  System (FPS), which uses predictive analytic technologies as required by  the Small Business Jobs Act of 2010 to analyze Medicare fee-for-service  (FFS) claims on a prepayment basis. FPS identifies investigative leads for  CMS’s Zone Program Integrity Contractors (ZPIC), the contractors  responsible for detecting and investigating potential fraud. Implemented in July 2011, FPS is intended to help facilitate the agency’s shift from  focusing on recovering potentially fraudulent payments after they have  been made, to detecting aberrant billing patterns as quickly as possible,  with the goal of preventing these payments from being made. However, in  October 2012, we found that, while FPS generated leads for  investigators, it was not integrated with Medicare’s payment-processing  system to allow the prevention of payments until suspect claims can be  determined to be valid. As of April 2014, CMS reported that while the FPS  functionality to deny claims before payment had been integrated with the  Medicare payment processing system in October 2013, the system did  not have the ability to suspend payment until suspect claims could be  investigated. In addition, while CMS directed the ZPICs to prioritize alerts  generated by the system, in our work examining the sources of new ZPIC  investigations in 2012, we found that FPS accounted for about 5 percent  of ZPIC investigations in that year. A CMS official reported last month  that ZPICs are now using FPS as a primary source of leads for fraud  investigations, though the official did not provide details on how much of  ZPICs’ work is initiated through the system.
Our prior work found that postpayment reviews are critical to identifying  and recouping overpayments. The use of national recovery audit  contractors (RAC) in the Medicare program is helping to identify  underpayments and overpayments on a postpayment basis. CMS  began the program in March 2009 for Medicare FFS. CMS reported  that, as of the end of 2013, RACs collected $816 million for fiscal year  2014. PPACA required the expansion of Medicare RACs to Parts C and  D. CMS has implemented a RAC for Part D, and CMS said it plans to  award a contract for a Part C RAC by the end of 2014. Moreover, in  February 2014, CMS announced a “pause” in the RAC program as the  agency makes changes to the program and starts a new procurement  process for the next round of recovery audit contracts for Medicare FFS  claims. CMS said it anticipates awarding all five of these new Medicare  FFS recovery audit contracts by the end of summer 2014.
Other contractors help CMS investigate potentially fraudulent FFS  payments, but CMS could improve its oversight of their work. CMS  contracts with ZPICs in specific geographic zones covering the nation.  We recently found that the ZPICs reported that their actions, such as  stopping payments on suspect claims, resulted in more than   $250 million in savings to Medicare in calendar year 2012. However, CMS lacks information on the timeliness of ZPICs’ actions—such as the  time it takes between identifying a suspect provider and taking actions to  stop that provider from receiving potentially fraudulent Medicare  payments—and would benefit from knowing whether ZPICs could save  more money by acting more quickly. Thus, in October 2013, we  recommended that CMS collect and evaluate information on the  timeliness of ZPICs’ investigative and administrative actions. CMS did not  comment on our recommendation. We are currently examining the  activities of the CMS contractors, including ZPICs, that conduct  postpayment claims reviews. Our work is reviewing, among other things,  whether CMS has a strategy for coordinating these contractors’  postpayment claims review activities.
CMS has taken steps to improve use of two CMS information technology  systems that could help analysts identify fraud after claims have been  paid, but further action is needed. In 2011, we found that the Integrated  Data Repository (IDR)—a central data store of Medicare and other data  needed to help CMS program integrity staff and contractors detect  improper payments of claims—did not include all the data that were  planned to be incorporated by fiscal year 2010, because of technical  obstacles and delays in funding. As of March 2014, the agency had not  addressed our recommendation to develop reliable schedules to  incorporate all types of IDR data, which could lead to additional delays in  making available all of the data that are needed to support enhanced  program integrity efforts and achieve the expected financial benefits.  However, One Program Integrity (One PI)—a web-based portal intended  to provide CMS staff and contractors with a single source of access to  data contained in IDR, as well as tools for analyzing those data—is  operational and CMS has established plans and schedules for training all  intended One PI users, as we also recommended in 2011. However, as of  March 2014, CMS had not established deadlines for program integrity  contractors to begin using One PI, as we recommended in 2011. Without  these deadlines, program integrity contractors will not be required to use  the system, and as a result, CMS may fall short in its efforts to ensure the  widespread use and to measure the benefits of One PI for program  integrity purposes.

		Addressing Identified Vulnerabilities Could Help Reduce Fraud

Having mechanisms in place to resolve vulnerabilities that could lead to  improper payments, some of which are potentially fraudulent, is critical to  effective program management, but our work has shown weaknesses in  CMS’s processes to address such vulnerabilities. Both we and OIG  have made recommendations to CMS to improve the tracking of  vulnerabilities. In our March 2010 report on the RAC demonstration  program, we found that CMS had not established an adequate process  during the demonstration or in planning for the national program to ensure  prompt resolution of vulnerabilities that could lead to improper payments  in Medicare; further, the majority of the most significant vulnerabilities  identified during the demonstration were not addressed. In December  2011, OIG found that CMS had not resolved or taken significant action to  resolve 48 of 62 vulnerabilities reported in 2009 by CMS contractors  specifically charged with addressing fraud. We and OIG recommended  that CMS have written procedures and time frames to ensure that  vulnerabilities were resolved. CMS has indicated that it is now tracking  vulnerabilities identified from several types of contractors through a single  vulnerability tracking process, and the agency has developed some  written guidance on the process. We recently examined that process and  found that, while CMS informs MACs about vulnerabilities that could be  addressed through prepayment edits, the agency does not systematically  compile and disseminate information about effective local edits to address  such vulnerabilities. Specifically, we recommended that CMS require  MACs to share information about the underlying policies and savings  related to their most effective edits, and CMS generally agreed to do so.  In addition, in 2011, CMS began requiring MACs to report on how they  had addressed certain vulnerabilities to improper payment, some of which  could be addressed through edits.
We also recently made recommendations to CMS to address the millions  of Medicare cards that display beneficiaries’ Social Security numbers,   In August  which increases beneficiaries’ vulnerability to identity theft.2012, we recommended that CMS (1) select an approach for removing  Social Security numbers from Medicare cards that best protects  beneficiaries from identity theft and minimizes burdens for providers,  beneficiaries, and CMS and (2) develop an accurate, well-documented  cost estimate for such an option. In September 2013, we further  recommended that CMS (1) initiate an information technology project for  identifying, developing, and implementing changes for the removal of  Social Security numbers and (2) incorporate such a project into other  information technology initiatives. HHS concurred with our  recommendations and agreed that removing the numbers from Medicare  cards is an appropriate step toward reducing the risk of identity theft.  However, the department also said that CMS could not proceed with  changes without agreement from other agencies, such as the Social  Security Administration, and that funding was also a consideration. Thus,  CMS has not yet taken action to address these recommendations. We  are currently examining other options for updating and securing Medicare  cards, including the potential use of electronic-card technologies.
In addition, we and others have identified concerns with CMS oversight of  fraud, waste, and abuse in Medicare’s prescription drug program, Part D,  including the contractors tasked with this work. To help address potential  vulnerabilities in that program, we are examining practices for promoting  prescription drug program integrity, and the extent to which CMS’s  oversight of Medicare Part D reflects those practices.

	Concluding Observations

Although CMS has taken some important steps to identify and prevent  fraud, the agency must continue to improve its efforts to reduce fraud,  waste, and abuse in the Medicare program. Identifying the nature, extent,  and underlying causes of improper payments, and developing adequate  corrective action processes to address vulnerabilities, are essential  prerequisites to reducing them. As CMS continues its implementation of  PPACA and Small Business Jobs Act provisions, additional evaluation  and oversight will help determine whether implementation of these  provisions has been effective in reducing improper payments. We are  investing resources in a body of work that assesses CMS’s efforts to  refine and improve its fraud detection and prevention abilities. Notably,  we are currently assessing the potential use of electronic-card  technologies, which can help reduce Medicare fraud. We are also  examining the extent to which CMS’s information system can help  prevent and detect the continued enrollment of ineligible or potentially  fraudulent providers in Medicare. Additionally, we have a study underway  examining CMS’s oversight of fraud, waste, and abuse in Medicare Part  D to determine whether the agency has adopted certain practices for  ensuring the integrity of that program. We are also examining CMS’s  oversight of some of the contractors that conduct reviews of claims after  payment. These studies are focused on additional actions for CMS that  could help the agency more systematically reduce potential fraud in the  Medicare program.
Chairman Brady, Ranking Member McDermott, and Members of the  Subcommittee, this concludes my prepared remarks. I would be pleased  to respond to any questions you may have at this time.

	GAO Contact and Staff Acknowledgments

For further information about this statement, please contact   Kathleen M. King at (202) 512-7114 or kingk@gao.gov. Contact   points for our Offices of Congressional Relations and Public Affairs   may be found on the last page of this statement. Karen Doran, Assistant  Director; Stephen Robblee; Lisa Rogers; Eden Savino; and Jennifer  Whitworth were key contributors to this statement.

Appendix I: Abbreviations

Related GAO Products

Medicare: Second Year Update for CMS’s Durable Medical Equipment  Competitive Bidding Program Round 1 Rebid. GAO-14-156. Washington,  D.C.: March 7, 2014.
Medicare Program Integrity: Contractors Reported Generating Savings,  but CMS Could Improve Its Oversight. GAO-14-111. Washington, D.C.:  October 25, 2013.
Medicare Information Technology: Centers for Medicare and Medicaid  Services Needs to Pursue a Solution for Removing Social Security  Numbers from Cards. GAO-13-761. Washington, D.C.: September 10,  2013  Health Care Fraud and Abuse Control Program: Indicators Provide  Information on Program Accomplishments, but Assessing Program  Effectiveness Is Difficult. GAO-13-746. Washington, D.C.: September 30,  2013.
Medicare Program Integrity: Increasing Consistency of Contractor  Requirements May Improve Administrative Efficiency. GAO-13-522.  Washington, D.C.: July 23, 2013.
Medicare Program Integrity: Few Payments in 2011 Exceeded Limits  under One Kind of Prepayment Control, but Reassessing Limits Could Be  Helpful. GAO-13-430. Washington, D.C.: May 9, 2013.  2013 Annual Report: Actions Needed to Reduce Fragmentation, Overlap,  and Duplication and Achieve Other Financial Benefits. GAO-13-279SP.  Washington, D.C.: April 9, 2013.
Medicare Fraud Prevention: CMS Has Implemented a Predictive  Analytics System, but Needs to Define Measures to Determine Its  Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012.
Medicare Program Integrity: Greater Prepayment Control Efforts Could  Increase Savings and Better Ensure Proper Payment. GAO-13-102.  Washington, D.C.: November 13, 2012.
Medicare: CMS Needs an Approach and a Reliable Cost Estimate for  Removing Social Security Numbers from Medicare Cards. GAO-12-831.  Washington, D.C.: August 1, 2012.
Health Care Fraud: Types of Providers Involved in Medicare, Medicaid,  and the Children’s Health Insurance Program Cases. GAO-12-820.  Washington, D.C.: September 7, 2012.
Program Integrity: Further Action Needed to Address Vulnerabilities in  Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.:  June 7, 2012.
Follow-up on 2011 Report: Status of Actions Taken to Reduce  Duplication, Overlap, and Fragmentation, Save Tax Dollars, and Enhance  Revenue. GAO-12-453SP. Washington, D.C.: February 28, 2012.
Medicare: The First Year of the Durable Medical Equipment Competitive  Bidding Program Round 1 Rebid. GAO-12-733T. Washington, D.C.:   May 9, 2012.
Medicare: Review of the First Year of CMS’s Durable Medical Equipment  Competitive Bidding Program’s Round 1 Rebid. GAO-12-693.  Washington, D.C.: May 9, 2012.
Medicare: Important Steps Have Been Taken, but More Could Be Done to  Deter Fraud. GAO-12-671T. Washington, D.C.: April 24, 2012.
Medicare Program Integrity: CMS Continues Efforts to Strengthen the  Screening of Providers and Suppliers. GAO-12-351. Washington, D.C.:  April 10, 2012.
Improper Payments: Remaining Challenges and Strategies for  Governmentwide Reduction Efforts. GAO-12-573T. Washington, D.C.:  March 28, 2012.  2012 Annual Report: Opportunities to Reduce Duplication, Overlap   and Fragmentation, Achieve Savings, and Enhance Revenue.   GAO-12-342SP. Washington, D.C.: February 28, 2012.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Expand Efforts to Support Program Integrity Initiatives.   GAO-12-292T. Washington, D.C.: December 7, 2011.
Medicare Part D: Instances of Questionable Access to Prescription  Drugs. GAO-12-104T. Washington, D.C.: October 4, 2011.
Medicare Part D: Instances of Questionable Access to Prescription  Drugs. GAO-11-699. Washington, D.C.: September 6, 2011.
Medicare Integrity Program: CMS Used Increased Funding for New  Activities but Could Improve Measurement of Program Effectiveness.  GAO-11-592. Washington, D.C.: July 29, 2011.
Improper Payments: Reported Medicare Estimates and Key Remediation  Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011.
Fraud Detection Systems: Additional Actions Needed to Support Program  Integrity Efforts at Centers for Medicare and Medicaid Services.   GAO-11-822T. Washington, D.C.: July 12, 2011.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.
Improper Payments: Recent Efforts to Address Improper Payments and  Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.
Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.
Opportunities to Reduce Potential Duplication in Government Programs,  Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington,  D.C.: March 1, 2011.
Improper Payments: Progress Made but Challenges Remain in  Estimating and Reducing Improper Payments. GAO-09-628T.  Washington, D.C.: April 22, 2009.
Medicare: Thousands of Medicare Providers Abuse the Federal Tax  System. GAO-08-618. Washington, D.C.: June 13, 2008.
Medicare: Competitive Bidding for Medical Equipment and Supplies  Could Reduce Program Payments, but Adequate Oversight Is Critical.  GAO-08-767T. Washington, D.C.: May 6, 2008.
Improper Payments: Status of Agencies’ Efforts to Address Improper  Payment and Recovery Auditing Requirements. GAO-08-438T.  Washington, D.C.: January 31, 2008.
Improper Payments: Federal Executive Branch Agencies’ Fiscal Year  2007 Improper Payment Estimate Reporting. GAO-08-377R. Washington,  D.C.: January 23, 2008.
Medicare: Improvements Needed to Address Improper Payments for  Medical Equipment and Supplies. GAO-07-59. Washington, D.C.:  January 31, 2007.
Medicare: More Effective Screening and Stronger Enrollment Standards  Needed for Medical Equipment Suppliers. GAO-05-656. Washington,  D.C.: September 22, 2005.
Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending  for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17,  2004.
Medicare: CMS Did Not Control Rising Power Wheelchair Spending.  GAO-04-716T. Washington, D.C.: April 28, 2004.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.

Summary:
Why GAO Did This Study

GAO has designated Medicare as a high-risk program, in part because the program's size and complexity make it vulnerable to fraud, waste, and abuse. In 2013, Medicare financed health care services for approximately 51 million individuals at a cost of about $604 billion. The deceptive nature of fraud makes its extent in the Medicare program difficult to measure in a reliable way, but it is clear that fraud contributes to Medicare's fiscal problems. More broadly, in fiscal year 2013, CMS estimated that improper payments—some of which may be fraudulent—were almost $50 billion.
This statement focuses on the progress made and important steps to be taken by CMS and its program integrity contractors to reduce fraud in Medicare. These contractors perform functions such as screening and enrolling providers, detecting and investigating potential fraud, and identifying improper payments and vulnerabilities that could lead to payment errors. This statement is based on relevant GAO products and recommendations issued from 2004 through 2014 using a variety of methodologies. In April 2014, GAO also received updated information from CMS on its actions related to the laws, regulations, and guidance discussed in this statement. Additionally, GAO updated information by examining public documents and relevant policies and procedures.

What GAO Found

The Centers for Medicare & Medicaid Services (CMS)—the agency within the Department of Health and Human Services (HHS) that oversees Medicare—has made progress in implementing several key strategies GAO identified in prior work as helpful in protecting Medicare from fraud; however, important actions that could help CMS and its program integrity contractors combat fraud remain incomplete.
Provider Enrollment : The Patient Protection and Affordable Care Act (PPACA) authorized, and CMS has implemented, actions to strengthen provider enrollment that address past weaknesses identified by GAO and HHS's Office of Inspector General. For example, CMS has hired contractors to determine whether providers and suppliers have valid licenses and are at legitimate locations. CMS also recently contracted for fingerprint-based criminal history checks for high-risk providers and suppliers. CMS could further strengthen provider enrollment by issuing a rule to require additional provider and supplier disclosures of information and establishing core elements for provider and supplier compliance programs, as authorized by PPACA.
Prepayment and Postpayment Claims Review : Medicare uses prepayment review to deny claims that should not be paid and postpayment review to recover improperly paid claims. GAO has found that increased use of prepayment edits could help prevent improper Medicare payments. For example, prior GAO work identified millions of dollars of payments inconsistent with selected coverage and payment policies and therefore improper. Postpayment reviews are also critical to identifying and recouping payments. GAO recommended better oversight of both the information systems analysts use to identify claims for postpayment review, in a 2011 report, and the contractors responsible for these reviews, in a 2013 report. CMS has addressed some of these recommendations.
Addressing Identified Vulnerabilities : Having mechanisms in place to resolve vulnerabilities that could lead to improper payments is critical to effective program management and could help address fraud. However, GAO work has shown weaknesses in CMS's processes to address such vulnerabilities, placing the Medicare program and its beneficiaries at risk. For example, GAO has made multiple recommendations to CMS to remove Social Security numbers from beneficiaries' Medicare cards to help prevent identity theft, and, while HHS agreed with these recommendations, the department also reported that CMS could not proceed with the changes for a variety of reasons, including funding limitations. Thus, to date, CMS has not taken action on these recommendations.
GAO has work underway addressing these key strategies, including assessing the potential use of electronic-card technologies to help reduce Medicare fraud. GAO is also examining the extent to which CMS's information system can prevent and detect the continued enrollment of ineligible or potentially fraudulent providers in Medicare. Additionally, GAO is studying CMS's oversight of program integrity efforts for prescription drugs and is examining CMS's oversight of some of the contractors that conduct reviews of claims after payment. These studies are focused on additional actions for CMS that could help the agency more systematically reduce potential fraud in the Medicare program.