PRESCRIPTION 

OPIOIDS

Medicare Needs to 

Expand Oversight 

Efforts to Reduce the 

Risk of Harm

Report to Congressional Requesters

October 2017

GAO-18-15

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-15, a report to 

congressional requesters

October 2017

PRESCRIPTION OPIOIDS

Medicare Needs to Expand Oversight Efforts to 

Reduce the Risk of Harm

What GAO Found

The Centers for Medicare & Medicaid Services (CMS) provides guidance on the

monitoring of Medicare beneficiaries who receive opioid prescriptions to plan 

sponsors—private organizations that implement the Medicare drug benefit, Part 

D—but lacks information on most beneficiaries at risk of harm. 

• CMS provides plan sponsors guidance on how they should monitor 

opioid overutilization among Medicare Part D beneficiaries and requires 

them to implement drug utilization review systems that use criteria similar 

to CMS’s. CMS’s criteria focus on beneficiaries who (1) receive 

prescriptions of high doses of opioids, (2) receive prescriptions from four 

or more providers, and (3) fill the prescriptions at four or more 

pharmacies. According to CMS officials, this approach allows plan 

sponsors to focus their actions on those beneficiaries it determined to 

have the highest risk of harm from opioid use.

• CMS’s criteria, including recent revisions, do not provide sufficient

information about the larger population of potentially at-risk beneficiaries. 

CMS estimates that while 33,223 beneficiaries would have met the

revised criteria in 2015, 727,016 would have received high doses of 

opioids regardless of the number of providers or pharmacies. In 2016, 

CMS began to collect information on some of these beneficiaries using a 

higher dosage threshold for opioid use. This approach misses some who 

could be at risk of harm, based on Centers for Disease Control and 

Prevention guidelines. As a result, CMS is limited in its ability to assess

progress toward meeting the broader goals of its Opioid Misuse Strategy, 

which includes activities to reduce the risk of harm from opioid use. 

CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and Those Who Would 

Have Met Revised Overutilization Monitoring Criteria

CMS oversees the prescribing of drugs at high risk of abuse through a variety of 

projects, but does not analyze data specifically on opioids. According to CMS 

officials, CMS and plan sponsors identify providers who prescribe large amounts 

of drugs with a high risk of abuse, and those suspected of fraud or abuse may be 

referred to law enforcement. However, GAO found that CMS does not identify

providers who may be inappropriately prescribing large amounts of opioids

separately from other drugs, and does not require plan sponsors to report 

actions they take when they identify such providers. As a result, CMS is lacking

information that it could use to assess how opioid prescribing patterns are 

changing over time, and whether its efforts to reduce harm are effective.

View GAO-18-15. For more information, 

contact Elizabeth H. Curda at (202) 512-7114

or curdae@gao.gov.

Why GAO Did This Study

Misuse of prescription opioids can lead

to overdose and death. In 2016, over 

14 million Medicare Part D 

beneficiaries received opioid 

prescriptions, and spending for opioids 

was almost $4.1 billion. GAO and 

others have reported on inappropriate 

activities and risks associated with 

these prescriptions, such as receiving 

multiple opioid prescriptions from 

different providers.

GAO was asked to describe what is 

known about CMS’s oversight of 

Medicare Part D opioid use and 

prescribing. This report examines (1) 

CMS oversight of beneficiaries who 

receive opioid prescriptions under Part 

D, and (2) CMS oversight of providers 

who prescribe opioids to Medicare Part 

D beneficiaries. GAO reviewed CMS 

opioid utilization and prescriber data,

CMS guidance for plan sponsors, and 

CMS’s strategy to prevent opioid 

misuse. GAO also interviewed CMS 

officials, the six largest Part D plan 

sponsors, and 12 national associations

selected to represent insurance plans, 

pharmacy benefit managers, 

physicians, patients, and regulatory 

and law enforcement authorities.

What GAO Recommends

GAO recommends that CMS (1) gather 

information on the full number of at-risk 

beneficiaries receiving high doses of 

opioids, (2) identify providers who

prescribe high amounts of opioids, and 

(3) require plan sponsors to report to 

CMS on actions related to providers 

who inappropriately prescribe opioids.

HHS concurred with the first two 

recommendations, but not with the 

third. GAO continues to believe the 

recommendation is valid, as discussed 

in the report.
Page i GAO-18-15 Prescription Opioids

Letter 1

Background 5

CMS Delegates Monitoring of Beneficiaries who Receive Opioid 

Prescriptions to Plan Sponsors, but Does Not Have Sufficient 

Information on Most Beneficiaries at Risk for Harm 8

CMS Oversees Providers through its Contractor and Plan 

Sponsors, but Efforts Do Not Specifically Monitor Opioid 

Prescriptions 17

Conclusions 22

Recommendations 23

Agency Comments and Our Evaluation 24

Appendix I Comments from the Department of Health and Human Services 26

Appendix II GAO Contact and Staff Acknowledgments 30

Table

Table 1: Part D Medicare Beneficiaries Who Meet Overutilization 

Monitoring System (OMS) Criteria for High Risk Opioid 

Use, Calendar Years 2011 and 2013-2016 11

Figure

Figure 1: CMS Estimates of 2015 Part D Beneficiaries with High 

Opioid Doses and Those Who Would Have Met Revised 

Overutilization Monitoring Criteria 15

Contents
Page ii GAO-18-15 Prescription Opioids

Abbreviations

CDC Centers for Disease Control and Prevention

CMS Centers for Medicare & Medicaid Services

CPI Center for Program Integrity

DUR drug utilization review

HHS Department of Health and Human Services

HHS-OIG Department of Health and Human Services 

Office of Inspector General

MED morphine equivalent dose

mg milligrams

NBI MEDIC National Benefit Integrity Medicare Drug Integrity 

Contractor

OMS Overutilization Monitoring System

PLATO Predictive Learning Analytics Tracking Outcome

POS point-of-sale

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-18-15 Prescription Opioids

441 G St. N.W.

Washington, DC 20548

October 6, 2017

The Honorable Pat Toomey

Chairman

Subcommittee on Health Care

Committee on Finance

United States Senate

The Honorable Tim Kaine

United States Senate

Misuse of prescription opioids, which are used to treat both acute and 

chronic pain, has become a serious public health problem for the U.S. 

population, including Medicare beneficiaries. The Centers for Disease 

Control and Prevention (CDC) reported that from 1999 to 2013 the rate of 

drug poisoning deaths from prescription opioids nearly quadrupled from 

1.4 to 5.1 per 100,000 people.1 In addition, the Department of Health and 

Human Services (HHS) Office of Inspector General (HHS-OIG) reported 

that 14.4 million people (about one-third) who participate in Medicare Part 

D received at least one prescription for opioids in 2016, and that Part D 

spending for opioids in 2016 was almost $4.1 billion.2 GAO and the HHSOIG have previously reported on inappropriate activities that can be 

associated with such prescriptions, including “doctor shopping” to receive 

multiple opioid prescriptions from different providers, the diversion of 

prescription drugs for uses other than intended, and questionable 

 1

Department of Health and Human Services, Centers for Disease Control and Prevention, 

Rates of Deaths from Drug Poisoning and Drug Poisoning Involving Opioid Analgesics—

United States, 1999-2013, Morbidity and Mortality Weekly Report, vol. 64, no. 1, (Atlanta, 

Ga.: Jan. 16, 2015). 

2

Department of Health and Human Services Office of Inspector General, Opioids in 

Medicare Part D: Concerns about Extreme Use and Questionable Prescribing, OE-02-17-

00250 (July 2017). Medicare is a federal health insurance program for people age 65 and 

older, individuals under age 65 with certain disabilities, and individuals diagnosed with 

end-stage renal disease. Since 2006, Medicare Part D has offered voluntary prescription 

drug coverage through stand-alone prescription drug plans or through Medicare 

Advantage prescription drug plans, which combine medical and prescription drug benefits.

Letter
Page 2 GAO-18-15 Prescription Opioids

prescribing practices, including those in Medicare.3 Additionally, a staff 

report issued in 2016 by the Senate Permanent Subcommittee on 

Investigations outlined concerns associated with opioid abuse in both 

Medicare and private health insurance.4

In March 2015, HHS announced plans to make addressing opioid abuse 

a high priority through two broad goals: (1) decreasing opioid overdoses 

and overall overdose deaths, and (2) decreasing the prevalence of opioid 

use disorder.5 Further, in January 2017, the Centers for Medicare & 

Medicaid Services (CMS), the HHS agency that administers Medicare, 

issued its Opioid Misuse Strategy for the Medicaid and Medicare 

programs, including Part D. One of the four priority areas outlined in the 

strategy is implementing activities to reduce the risk of opioid use 

disorders, overdoses, inappropriate prescribing, and drug diversion.6 For 

this priority, the strategy includes the agency’s plans to address concerns 

about beneficiary use of opioids and the prescribing of opioids by 

providers, such as educating and providing feedback to beneficiaries and 

 3

See GAO, Prescription Drugs: State Monitoring Programs Provide Useful Tool to Reduce 

Diversion, GAO-02-634 (Washington, D.C.: May 17, 2002); GAO, Prescription Drugs: 

OxyContin Abuse and Diversion and Efforts to Address the Problem, GAO-04-110 

(Washington, D.C.: Dec. 19, 2003); GAO, Medicare Part D: Instances of Questionable 

Access to Prescription Drugs, GAO-11-699 (Washington, D.C.: Sept. 6, 2011); and GAO, 

Medicare Program Integrity: CMS Pursues Many Practices to Address Prescription Drug 

Fraud, Waste, and Abuse, GAO-15-66 (Washington, D.C.: Oct. 24, 2014). In response to 

recommendations in GAO-11-699 to CMS regarding its efforts to curb drug overutilization,

CMS began working with Part D sponsors and stakeholders to control payment for 

inappropriate overutilization of drugs. See also Department of Health and Human 

Services, Office of Inspector General, Questionable Billing and Geographic Hotspots Point 

to Potential Fraud and Abuse in Medicare Part D, OEI-02-15-00190 (June 2015); and 

Department of Health and Human Services, Office of Inspector General, High Part D 

Spending on Opioids and Substantial Growth in Compounded Drugs Raise Concerns, 

OEI-02-16-0029, (June 2016). 

4

Permanent Subcommittee on Investigations, Committee on Homeland Security and 

Governmental Affairs, United States Senate, Combatting the Opioid Epidemic: A Review 

of Anti-Abuse Efforts in Medicare and Private Health Insurance Systems (Oct. 4, 2016).

5

Department of Health and Human Services, Office of the Assistant Secretary for Planning 

and Evaluation, Opioid Abuse in the U.S. and HHS Actions to Address Opioid-Drug 

Related Overdoses and Death (March 26, 2015). Opioid use disorder is defined as a 

problematic pattern of opioid use leading to clinically significant impairment or distress as 

indicated by at least 2 of 11 criteria occurring within a 12 month period. The criteria 

include opioids that are often taken in larger amounts or over a longer period of time than 

was intended, persistent desire or unsuccessful efforts to cut down or control opioid use, 

or a strong desire or urge to use opioids.

6

Centers for Medicare & Medicaid Services, Centers for Medicare & Medicaid Services 

(CMS) Opioid Misuse Strategy 2016 (Jan.5, 2017).
Page 3 GAO-18-15 Prescription Opioids

providers concerning effective pain management and appropriate opioid 

prescribing, as well as use of evidence-based prescribing guidelines. The 

strategy also outlines attempts to identify providers with a high risk of 

fraud, waste, and abuse in prescribing opioids and other drugs. CMS 

contracts with the National Benefit Integrity Medicare Drug Integrity 

Contractor (NBI MEDIC) to monitor and analyze data to detect potential 

fraud, waste, and abuse, and to investigate such potential fraud, waste, 

and abuse in Medicare Parts C and D, among other activities.7

You asked us for information on CMS’s activities related to reducing the 

misuse and overprescribing of opioids. We examined

1. how CMS oversees beneficiaries who receive opioid prescriptions 

under Medicare Part D, and

2. how CMS oversees providers who prescribe opioids to Medicare Part 

D beneficiaries.

To examine CMS oversight of beneficiaries who receive opioid 

prescriptions under Medicare Part D, we analyzed CMS documents, such 

as CMS’s Opioid Misuse Strategy as well as letters, guidance, and other 

documents on the operation of the Part D program; and CMS data about 

the number of beneficiaries at risk of opioid overutilization. We also 

reviewed CDC guidelines for prescribing opioids. Further, we interviewed 

CMS officials involved in these efforts. This information helped us 

understand CMS procedures for identifying beneficiaries at risk of 

overuse of opioids, as well as to assess trends in such use. We also 

interviewed plan sponsors—private organizations under contract with 

CMS that provide the Part D drug benefit to Medicare beneficiaries—

about their oversight role and the compliance programs they operate to 

safeguard the Part D program from fraud, waste, and abuse. In addition, 

we interviewed other stakeholders involved in opioid use and prescribing, 

including organizations that represent providers, pharmacies, 

 7

Medicare Part C, also known as Medicare Advantage, is a private plan alternative to 

traditional Medicare, and covers all traditional Medicare services. 
Page 4 GAO-18-15 Prescription Opioids

beneficiaries, and others to further understand issues related to opioid 

use.8

To examine CMS oversight of providers who prescribe opioids to 

Medicare Part D beneficiaries, we analyzed CMS and NBI MEDIC 

documents, such as Part D program guidance, and documents sent to 

plan sponsors about opioid prescribing patterns, as well as data about 

providers who prescribe a large amount of opioids. We also interviewed 

CMS officials and officials from NBI MEDIC about monitoring opioid 

prescribing. We used this information to understand CMS’s and NBI 

MEDIC’s procedures for identifying and addressing opioid 

overprescribing. We also interviewed the same plan sponsors and 

stakeholders identified above about issues related to opioid prescribing 

and CMS’s role in addressing opioid overprescribing.

For both objectives, we compared the information we collected to CMS’s 

stated goals and relevant federal internal control standards.9 We 

assessed the reliability of CMS and NBI MEDIC data by reviewing 

documents for potential inconsistencies and discussing the 

methodologies used to gather the data with officials from both CMS and 

NBI MEDIC. We determined that these data were sufficiently reliable for 

the purposes of our objectives.

We conducted this performance audit from October 2016 to October 2017 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

 8

We interviewed officials from the largest six health care plan sponsors: Aetna, Cigna, 

CVS Heath, Express Scripts, Humana, and UnitedHealth Group. We also interviewed 12 

stakeholders that represent a range of perspectives on opioid use and prescribing 

patterns in Medicare: AARP, American Health Insurance Plans, American Society of 

Interventional Pain Physicians, Brandeis Prescription Drug Monitoring Program Training 

and Technical Assistance Center, Federation of State Medical Boards, National 

Association of Drug Diversion Investigators, National Association of Medicaid Directors, 

National Healthcare Antifraud Association, Pew Charitable Trust, Pharmaceutical Care 

Management Association, Physicians for Responsible Opioid Prescribing, and one expert 

on opioid abuse.

9

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: Sept. 10, 2014). Internal controls is a process affected by an entity’s 

oversight body, management, and other personnel that provides reasonable assurance 

that the objectives of an entity will be achieved.
Page 5 GAO-18-15 Prescription Opioids

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Opioids, such as hydrocodone, oxycodone, morphine, and methadone, 

can be prescribed to treat both acute and chronic pain. Because many 

opioids have a high potential for abuse and may lead to severe 

psychological or physical dependence, many of them are classified as 

Schedule II drugs under the Controlled Substances Act.10 The abuse of

opioids has been associated with serious consequences, including 

addiction, overdose, and death.

Medicare Part D plan sponsors are private organizations, such as health 

insurance companies and pharmacy benefit managers, contracted by 

CMS to provide outpatient drug benefit plans to Medicare beneficiaries. 

CMS provides guidance to plan sponsors that are responsible for 

establishing reasonable and appropriate drug utilization review (DUR)

programs that assist in preventing misuse of prescribed medications in 

general, including the unsafe use of opioid pain medications. In 2013, 

CMS implemented the Medicare Part D opioid overutilization policy 

intended to improve medication safety. Through the Overutilization 

Monitoring System (OMS), CMS seeks to ensure that plan sponsors 

establish reasonable and appropriate DUR programs to prevent 

overutilization of opioids. CMS uses criteria in the OMS to identify highrisk use of opioids. Plan sponsors may, but are not required to, use these 

guidelines as part of their DUR.

CMS’s Center for Program Integrity (CPI) oversees Part D program 

integrity and coordinates with other parts of CMS that monitor plan 

sponsor compliance with the Part D program. CPI has primary 

responsibility for overseeing NBI MEDIC, which is responsible for 

identifying and investigating potential Part D fraud, waste, and abuse, in 

general. NBI MEDIC handles complaints from beneficiaries and others, as 

well as requests from law enforcement; investigates providers and refers 

them to law enforcement as appropriate; and analyzes Part D program 

prescription drug event records and other data to identify patterns that 

 10Under the Controlled Substances Act, which was enacted in 1970, drugs are classified 

as controlled substances and placed into one of five schedules based on their medicinal 

value, potential for abuse, and risk of dependence. Schedule II drugs have the highest 

potential for abuse of any drugs approved for medical use. 

Background

Responsibilities of 

Medicare Part D Plan 

Sponsors, CMS, and NBI 

MEDIC
Page 6 GAO-18-15 Prescription Opioids

may indicate fraud, waste, or abuse.11 NBI MEDIC’s responsibilities are 

for all Part D drugs and are not opioid-specific.

One concern associated with prescribed opioids is their diversion—that is, 

the redirection of prescription drugs for an illegal purpose such as 

recreational use or resale. Diversion can include selling prescription drugs 

that were obtained legally, transferring a legitimately prescribed opioid to 

family or friends who may be trying to self-medicate, or pretending to be 

in pain to obtain a prescription opioid due to an addiction. It is often 

associated with “doctor shopping,” the attempt to obtain large amounts of 

opioids through multiple providers, or from multiple pharmacies. Doctor 

shopping can be used to help support an individual’s addiction or to 

obtain opioids for resale on the black market. Drug diversion can also 

include illicit prescribing, whereby providers—commonly known as “pill 

mills”—write unnecessary prescriptions or prescribe larger quantities than 

are medically necessary. Opioids are among the drugs with the highest 

potential for drug diversion.

In 2016, CDC issued guidelines with recommendations for prescribing 

opioids in outpatient settings for chronic pain, based on consultation with 

experts and a review of scientific evidence.12 CDC noted in the guidelines 

that primary care physicians have reported concerns about opioid misuse 

and addiction, and find managing patients with chronic pain a challenge, 

possibly because of insufficient training in prescribing opioids. According 

to the guidelines, most experts agreed that long-term opioid dosage of 50 

milligrams (mg) morphine equivalent dose (MED) per day or more 

generally increases overdose risk without necessarily adding benefits for 

pain control or function.13 Experts also noted that daily opioid dosages 

close to or greater than 100 mg MED per day are associated with 

significant risks. The guidelines therefore recommended that providers 

use caution when prescribing opioids at any dose, carefully reassess 

 11A prescription drug event is recorded and submitted to CMS every time a Medicare 

beneficiary fills a prescription covered under Part D. These records include drug cost and 

payment information that enables CMS to administer and monitor the Part D benefit. 

12Department of Health and Human Services, Centers for Disease Control and 

Prevention, CDC Guideline for Prescribing Opioids for Chronic Pain—United States, 2016 ̧ 

Morbidity and Mortality Weekly Report, vol. 65, no. 1, (Atlanta, Ga.: March 18, 2016). 

13CDC uses the term morphine milligram equivalents and CMS uses the term MED to 

mean the same thing. For purposes of this report, we use the term MED.

Drug Diversion

CDC Guidelines for 

Prescribing Opioids
Page 7 GAO-18-15 Prescription Opioids

evidence of individual benefits and risks when increasing the dosage to 

50 mg MED per day or more, and either avoid or carefully justify dosage 

at 90 mg MED or more. In making these recommendations, CDC noted 

that there is not a dosage threshold below which the risk of overdose is 

eliminated, but found that dosages less than 50 mg MED would reduce 

the risk for a large portion of patients. CDC also noted that providers 

should use additional caution in prescribing opioids to patients aged 65 

and older, because the drugs can accumulate in the body to toxic levels.
Page 8 GAO-18-15 Prescription Opioids

CMS provides guidance to plan sponsors on how they should monitor 

opioid overutilization problems among Part D beneficiaries. The agency 

includes this guidance in its annual letters to plan sponsors, known as call 

letters; it also provided a supplemental memo to plan sponsors in 2012.14

Among other things, these guidance documents instructed plan sponsors 

to implement a retrospective drug utilization review (DUR) system to 

monitor beneficiary utilization starting in 2013.15 As part of the DUR 

systems, CMS requires plan sponsors to have methods to identify 

beneficiaries who are potentially overusing specific drugs or groups of 

drugs, including opioids.

 14Centers for Medicare & Medicaid Services, Announcement of Calendar Year (CY) 2013 

Medicare Advantage Capitation Rates and Medicare Advantage and Part D Payment 

Policies and Final Call Letter, accessed December 21, 2016, 

https://www.cms.gov/Medicare/Health-Plans/HealthPlansGenInfo/Downloads/2013-CallLetter.pdf; and Centers for Medicare & Medicaid Services, Supplemental Guidance 

Related to Improving Drug Utilization Review Controls in Part D, accessed April 25, 2017,

https://www.cms.gov/Medicare/Prescription-DrugCoverage/PrescriptionDrugCovContra/Downloads/HPMSSupplementalGuidanceRelatedtoImprovingDURcontrols.pdf. 

15In addition to instructing plan sponsors to implement retrospective DUR systems, the 

guidance in the 2013 call letter includes information on other mechanisms to control 

overutilization. See https://www.cms.gov/Medicare/HealthPlans/HealthPlansGenInfo/Downloads/2013-Call-Letter.pdf. 

CMS Delegates 

Monitoring of 

Beneficiaries who 

Receive Opioid 

Prescriptions to Plan 

Sponsors, but Does 

Not Have Sufficient

Information on Most 

Beneficiaries at Risk 

for Harm

CMS Delegates 

Monitoring of Individual 

Beneficiaries’ Opioid 

Prescriptions to Plan 

Sponsors
Page 9 GAO-18-15 Prescription Opioids

Also in 2013, CMS created the Overutilization Monitoring System (OMS), 

which outlines criteria to identify beneficiaries with high-risk use of opioids 

and to oversee sponsors’ compliance with CMS’s opioid overutilization 

policy. Plan sponsors may use the OMS criteria for their DUR systems, 

but they have some flexibility to develop their own targeting criteria, within 

CMS guidance. The OMS considers beneficiaries to be at a high risk of 

opioid overuse when they meet all three of the following criteria: (1) 

receive a total daily MED greater than 120 mg for 90 consecutive days, 

(2) receive opioids prescriptions from four or more providers in the 

previous 12 months, and (3) receive opioids from four or more 

pharmacies in the previous 12 months.16 The criteria exclude 

beneficiaries with a cancer diagnosis and those in hospice care, for whom 

higher doses of opioids may be appropriate.

Officials from all six plan sponsors we interviewed confirmed they have a 

DUR system that specifically looks at opioids. In addition, to be consistent 

with CMS, all of the plan sponsors adopted criteria similar to the OMS, 

with some minor modifications—typically involving the number of months 

in which they measured beneficiaries’ opioid prescriptions.

Through the OMS, CMS generates quarterly reports that list beneficiaries 

who meet all of the criteria and who are identified as high-risk and then 

distributes the reports to the plan sponsors. Plan sponsors are expected 

to review the list of identified beneficiaries, determine appropriate action, 

and then respond to CMS with information on their actions within 30 days. 

According to CMS officials, the agency also expects that plan sponsors 

will share any information with CMS on beneficiaries that they identify 

through their own DUR systems. Some actions plan sponsors may take 

include

• Case management. After plan sponsors identify beneficiaries with 

patterns of inappropriate opioid use and possible coordination of care 

issues through their DUR analysis, they may conduct case 

management. Case management may include an attempt to improve 

 16These criteria are in effect through 2017. CMS announced in its April 3, 2017 call letter, 

Announcement of Calendar Year (CY) 2018 Medicare Advantage Capitation Rates and 

Medicare Advantage and Part D Payment Policies and Final Call Letter and Request for 

Information, revisions to the OMS criteria that will take effect in 2018, accessed April 4, 

2017, https://www.cms.gov/Medicare/HealthPlans/MedicareAdvtgSpecRateStats/Downloads/Announcement2018.pdf. Some of the 

beneficiaries that meet the OMS criteria may not be using the opioids themselves, but 

rather diverting them by either giving or selling them to others. 
Page 10 GAO-18-15 Prescription Opioids

coordination issues, and often involves provider outreach, whereby 

the plan sponsor will contact the providers associated with the 

beneficiary to let them know that the beneficiary is receiving high 

levels of opioids and may be at risk of harm. In addition to outreach, 

officials from two of the six plan sponsors we interviewed told us they 

focus on provider education and one plan sponsor said they may 

direct the providers to the CDC guidelines or other information to help 

reduce overutilization. Officials from two plan sponsors reported that 

they also reach out to beneficiaries to let them know they are 

receiving high levels of opioids and may be at risk of harm.

• Beneficiary-specific point-of-sale (POS) edits. When plan sponsors 

determine that a beneficiary is at risk for opioid harm, they may 

choose to implement a beneficiary-specific POS edit to prevent 

overutilization. Beneficiary-specific POS edits are restrictions that limit 

these beneficiaries to certain opioids and amounts. Pharmacists 

receive a message when a beneficiary attempts to fill a prescription

that exceeds the limit in place for that beneficiary. CMS expects plan 

sponsors to report on the POS edits they use through CMS’s 

Medicare Advantage and Prescription Drug System for information

sharing and monitoring purposes. That way, if a beneficiary changes 

plans, the new plan sponsor will receive an alert about the 

beneficiary’s record of POS edits. From February 2014 through March 

10, 2016, there were 2,693 POS edits reported in that system for 

2,520 beneficiaries.17

• Formulary-level POS edits. CMS expects plan sponsors to use 

formulary-level POS edits to prospectively prevent opioid 

overutilization. These edits alert providers who may not have been 

aware that their patients are receiving high levels of opioids from other 

doctors. CMS recommends these formulary-level edits to be used 

when a beneficiary has a cumulative opioid MED of at least 90 mg.18

• Referrals for investigation. According to the six plan sponsors we 

interviewed, the referrals can be made to NBI MEDIC or to the plan 

 17These are the most recent data available, because 2017 data will not be available until 

2018. Some beneficiaries may be subject to multiple edits that apply in different situations. 

18These edits may be soft edits, which can be overridden by the pharmacist, or hard edits, 

which require prescriber attestation through the coverage determination process. CMS 

recommends that soft edits be implemented with a threshold at levels greater than 90mg 

MED, and hard edits have a threshold at 200mg MED or more. While CMS expects plan 

sponsors to implement formulary-level edits, hard edits are not required.
Page 11 GAO-18-15 Prescription Opioids

sponsor’s own internal investigative unit, if they have one. After 

investigating a particular case, if a plan sponsor or NBI MEDIC 

determines that a beneficiary is suspected of diverting opioids, they 

may refer the case to the HHS-OIG, or a law enforcement agency, 

according to CMS, NBI MEDIC, and one plan sponsor.

• Pharmacy lock-ins. Beginning in 2019, Medicare Part D plan 

sponsors will be able to restrict certain beneficiaries identified as atrisk for prescription drug abuse to a single pharmacy for all their 

opioid prescriptions, known as a pharmacy “lock in.”19 Some plan 

sponsors explained that they use pharmacy lock-ins for their 

commercial and Medicaid lines of business, and generally found them 

to be a useful tool for controlling opioid use.

Based on CMS’s use of the OMS and the actions taken by plan sponsors, 

CMS reported a decrease in the number of beneficiaries meeting the 

OMS criteria of high-risk—which agency officials consider an indication of 

success toward its goal of decreasing opioid use disorder. From calendar 

years 2011 through 2016, there was a 61 percent decrease in the number 

of beneficiaries meeting the OMS criteria.20 (See table 1.)

Table 1: Part D Medicare Beneficiaries Who Meet Overutilization Monitoring System 

(OMS) Criteria for High Risk Opioid Use,a Calendar Years 2011 and 2013-2016b

Calendar year Number of Part D enrollees 

Number of Part D beneficiaries 

identified as high-risk under 

OMS criteria 

2011 31,483,841 29,404

2013 37,842,632 25,347

2014 39,982,962 21,838

2015 41,835,016 15,651

2016 43,569,035 11,594

Source: Centers for Medicare & Medicaid Services. | GAO-18-15

 19A Part D beneficiary who is at-risk for prescription drug abuse is identified through the 

use of applicable clinical guidelines that indicate misuse or abuse of prescription drugs. 

See Comprehensive Addiction and Recovery Act of 2016, Pub. L. No. 114-198, § 704(a), 

130 Stat. 695, 742 (2016). The act provides CMS with the authority to implement a lock-in 

program for prescribers and/or pharmacies in Medicare Part D for plan years beginning on 

or after January 1, 2019. CMS officials told us that they currently plan implementation by 

this statutory deadline.

20According to CMS officials, the agency does not have 2012 data, because it used 2011 

data as a benchmark to develop the OMS and did not officially implement the OMS until 

2013.
Page 12 GAO-18-15 Prescription Opioids

a

Not all Part D beneficiaries who receive prescriptions for opioids use the drugs, but instead may 

divert them by giving or selling them to others. The OMS criteria in effect for these years identify 

beneficiaries that receive a daily morphine equivalent dose greater than 120 mg for 90 consecutive 

days, receive opioids from four or more providers in the previous 12 months, and receive opioids from 

four or more pharmacies in the previous 12 months. The criteria exclude beneficiaries with a cancer 

diagnosis and those in hospice care.

b

CMS does not have 2012 data, because it used 2011 data as a benchmark to develop the OMS and 

did not officially implement OMS until 2013.

In addition to using the OMS as a monitoring tool to oversee plan 

sponsors’ compliance with their DUR system requirements, CMS relies 

on patient safety measures to assess how well Part D plan sponsors are 

monitoring beneficiaries and taking appropriate actions. Specifically, CMS 

tracks data on plan sponsors’ performance for 15 measures related to 

Part D patient safety that are developed and maintained by the Pharmacy 

Quality Alliance, and CMS communicates with plan sponsors about their 

performance.21 In 2016, CMS started tracking plan sponsors’ 

performance on three Pharmacy Quality Alliance-approved patient safety 

measures that are directly related to opioids, which were

1. The proportion of beneficiaries that use opioids at high dosages (more 

than 120 mg MED for 90 days or longer) in persons without cancer or 

not in hospice care.

2. The proportion of beneficiaries that use opioids from multiple 

providers (four or more providers and four or more pharmacies) in 

persons without cancer or not in hospice care.

3. The proportion of beneficiaries that use opioids at high dosage and 

from multiple providers in persons without cancer or not in hospice 

care, and that meet both of the other measures.

The three measures are similar to the OMS criteria in that they identify 

beneficiaries with high dosages of opioids (120 mg MED) from multiple 

providers and pharmacies (four or more of each). However, there are a 

number of differences between these measures and the OMS. For 

example, the OMS counts actual beneficiaries, while the patient safety 

measures report member-years, which are adjusted to account for 

 21The Pharmacy Quality Alliance is a consensus-based, multi-stakeholder membership 

organization that collaboratively promotes appropriate medication use and develops 

strategies for measuring and reporting performance information related to medications. 

The alliance developed all but one of CMS’s Part D patient safety measures, and that one 

measure is not related to opioid safety.
Page 13 GAO-18-15 Prescription Opioids

beneficiaries who are enrolled in a plan for only part of a year.22 In 

addition, these measures separately identify beneficiaries who fulfill each 

of those criteria individually. For example, data gathered on the first 

measure indicate that about 285,119 beneficiaries, counted as memberyears across all Part D plans, received high doses (more than 120 mg 

MED) of opioids for 90 days or longer during calendar year 2016. CMS 

also uses these data in different ways from how it uses OMS data. The 

OMS criteria were developed and maintained by CMS to identify patients 

at risk for harm who may warrant case management and to examine 

opioid use trends across the Part D program, including progress toward 

its goal of decreasing opioid use disorder. In contrast, CMS officials told 

us that the agency uses the patient safety measures to assess plan 

sponsor performance. The patient safety measures also serve as a tool 

for Part D sponsors to compare their performance to overall averages, 

and to track progress in improving these measures over time. CMS also 

tracks sponsors’ progress in improving the measures, according to 

agency officials. Each quarter, CMS contacts plan sponsors who have the 

lowest performance on each measure and expects them to respond about 

actions they take to improve performance. Beginning in April 2017, the 

agency began distributing to plan sponsors the beneficiary-level files for 

the patient safety measures. CMS officials said that these files provide a 

complete list of beneficiaries included in each of the measures.23

While CMS tracks the total number of beneficiaries who meet all three 

OMS criteria as part of its opioid overutilization oversight across the Part 

D program, it does not have comparable information on most 

beneficiaries who may be at risk for harm. CMS has goals to reduce the 

risk of opioid use disorders, overdoses, inappropriate prescribing, and 

drug diversion in its Opioid Misuse Strategy, but OMS does not track the 

number of beneficiaries with prescriptions for high doses of opioids unless 

those beneficiaries are also receiving them both from four or more 

providers and from four or more pharmacies; and agency officials told us 

that CMS has no plans for OMS to begin doing so. According to CDC 

guidelines, long-term use of high opioid dosages—those above a MED of 

 22According to officials, in counting member-years, for example, if a beneficiary is enrolled 

in a plan for 6 out of 12 months of the year, he or she would count as only 0.5 member 

years. 

23The list of beneficiaries based on patient safety measure data is different from that 

provided to plan sponsors under OMS. 

CMS Does Not Have 

Sufficient Information on 

Most Beneficiaries 

Potentially at Risk for 

Harm
Page 14 GAO-18-15 Prescription Opioids

90 mg per day—are associated with significant risk of harm and should 

be avoided if possible.

Based on the CDC guidelines, outreach to Part D plan sponsors, and 

CMS analyses of Part D data, CMS has revised its current OMS criteria to 

include more at-risk beneficiaries beginning in 2018. The new OMS 

criteria define a high user as having an average daily MED greater than 

90 mg for any duration, and who receives opioids from four or more 

providers and four or more pharmacies, or from six or more providers 

regardless of the number of pharmacies, for the prior 6 months.24

According to CMS officials, the revised OMS criteria, like the current 

criteria, are intended to identify the beneficiaries it determined are at the 

greatest risk of harm: those who may lack coordinated care as a result of 

using multiple pharmacies and providers. CMS officials also noted that 

the revised criteria are intended to limit the increase in the number of 

beneficiaries for whom plan sponsors are expected to take action, such 

as case management, to avoid overburdening plan sponsors with 

unreasonable workload levels.25

While the revised criteria will help identify beneficiaries who CMS 

determined are at the highest risk of opioid misuse and therefore may 

need case management by plan sponsors, they will not provide 

information on most Part D beneficiaries who may also be at risk of harm. 

In developing the revised criteria, CMS conducted a one-time analysis 

that estimated there were 727,016 beneficiaries with an average MED of 

90 mg or more, for any length of time during a 6 month measurement 

period in 2015, regardless of the number of providers or pharmacies 

used. These beneficiaries may be at risk of harm from opioids, according 

to CDC guidelines, and therefore tracking the number of these 

beneficiaries over time could help CMS to determine whether it is making 

progress toward meeting the goals specified in its Opioid Misuse 

 24According to CMS officials, the changes are partially in response to CDC’s 2016 

guidelines. The CDC guidelines noted that patients are at risk of harm above 50 mg MED 

and that providers should generally avoid increasing dosage to more than 90 mg MED of 

opioids, regardless the number of providers or pharmacies. 

25The revised OMS criteria are expected to more than double the number of beneficiaries 

that plan sponsors are expected to review, determine appropriate actions to take, and 

respond to CMS. Based on 2015 data, CMS found that 15,651 beneficiaries met the 

current OMS criteria and 33,223 beneficiaries would have met the revised criteria. CMS 

officials told us that, based on information gathered in a pilot in 2012, providers were not 

receptive to case-management in cases involving high doses of opioids with a single 

prescriber.
Page 15 GAO-18-15 Prescription Opioids

Strategy. However, CMS officials told us that the agency does not keep 

track of these beneficiaries, and does not have plans to do so as part of 

OMS. Instead, CMS uses the number of beneficiaries who meet the OMS 

criteria as an indicator of progress toward its goals. CMS estimated that 

33,223 beneficiaries would have met its revised criteria based on 2015 

data, which is a much smaller number than the estimated 727,016 

beneficiaries at risk of harm from opioids.26 (See fig. 1.)

Figure 1: CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and 

Those Who Would Have Met Revised Overutilization Monitoring Criteria

a

This number includes beneficiaries with an average opioid morphine equivalent dose of 90 

milligrams or more within a 6-month measurement period.

b

This number is an estimate of how many beneficiaries would have met CMS’s revised Overutilization 

Monitoring System (OMS) criteria. CMS calculated these totals by applying the revised OMS criteria 

to 2015 Part D data.

In 2016, CMS began to gather information from its patient safety 

measures on the number of beneficiaries who use more than 120 mg 

MED of opioids for 90 days or longer, regardless of the number of 

providers and pharmacies. However, this information does not include all 

at-risk beneficiaries, because the threshold is more lenient than indicated 

in CDC guidelines and CMS’s new criteria for OMS. Specifically, CMS’s 

one-time analysis of 2015 data indicated that 727,016 beneficiaries 

received prescriptions with an average MED of 90 mg or more for any 

length of time during a 6-month measurement period. In contrast, the 

2016 patient safety measures reports identified significantly fewer 

beneficiaries, 285,119, in its most comparable measure—member years 

for opioid prescriptions at 120 mg MED for 90 consecutive days or longer. 

 26In July 2017, the HHS-OIG conducted a separate review using an MED of 120 mg, while 

CMS’s review used an MED of 90 mg. HHS-OIG compared the number of beneficiaries 

who received an average MED of greater than 120 mg a day for at least three months 

(501,008 beneficiaries) with the number of beneficiaries considered to be “doctor 

shopping”, which the HHS-OIG defined as meeting CMS’s initial OMS criteria (22,308 

beneficiaries). 
Page 16 GAO-18-15 Prescription Opioids

According to CMS officials, CMS shared feedback with the Pharmacy 

Quality Alliance to consider updating the threshold to 90 mg MED to align 

with CDC guidelines and the revised OMS criteria. CMS officials said the 

agency will consider adopting these updates once complete. In addition, 

while CMS monitors the patient safety measure data, these data are 

relatively new. CMS officials told us that, as a result, the agency does not 

yet have enough data to report changes over time toward its goals to 

reduce the risk of opioid use disorders, overdoses, and inappropriate 

prescribing.

Neither the data gathered as part of OMS, nor patient safety measures 

gathered so far are adequate to provide CMS with the information 

necessary to track progress toward meeting its goal of reducing harm 

from opioids. While tracking a smaller number of beneficiaries in OMS is 

useful for targeting resource-intensive plan sponsor actions, keeping track 

of the larger number of beneficiaries at risk of harm from high doses of 

opioids—greater than 90 mg MED for any duration regardless of the 

number of providers and pharmacies—could provide CMS with 

information on progress toward its goals without additional monitoring by 

plan sponsors. Doing so would also be consistent with federal internal 

control standards, which require agencies to use quality information to 

achieve objectives and address risks.27 Without tracking the number of 

beneficiaries who receive potentially dangerous levels of opioids 

regardless of the number of providers or pharmacies, and then examining 

changes in that number over time, CMS lacks key information that would 

be useful to determine if it is making progress toward reducing the risk of 

opioid harm for Part D beneficiaries.

 27See GAO-14-704G.
Page 17 GAO-18-15 Prescription Opioids

CMS oversees providers who prescribe opioids to Medicare Part D 

beneficiaries through its contractor, NBI MEDIC, and the Part D plan 

sponsors.

CMS requires NBI MEDIC to identify providers who prescribe high 

amounts of drugs classified as Schedule II under the Controlled 

Substances Act, which indicates a high potential for abuse and includes 

many opioids. Using prescription drug event data, NBI MEDIC conducts a 

peer comparison of providers’ prescribing practices to identify outlier 

providers—the highest prescribers of Schedule II drugs, which include, 

but are not limited to, opioids. NBI MEDIC’s initial analyses focuses on 

providers associated with at least 100 prescription drug event records or 

at least $100,000 in total Part D payments for Schedule II drugs over the 

course of one year.28 These providers are then classified as outliers if 

they are listed as high in both the number of prescription drug records per 

prescriber and prescriptions per beneficiary by specialty within each 

state.29 NBI MEDIC reports to CMS on the providers with the highest 

number of prescriptions identified by the analysis. Beginning with the 

October 2016 report, CMS began sharing NBI MEDIC’s prescriber outlier 

 28Every time a beneficiary fills a prescription under Medicare Part D, a prescription drug 

plan sponsor must submit a summary record called the prescription drug event data to 

CMS. The PDE data are not the same as individual drug claim transactions, but are 

summary extracts using CMS-defined standard fields.

29The 30-day equivalent was used to normalize prescriptions of varying durations by 

totaling the days’ supply from the prescription drug event records and dividing it by 30.

CMS Oversees 

Providers through its 

Contractor and Plan 

Sponsors, but Efforts 

Do Not Specifically 

Monitor Opioid 

Prescriptions

CMS’s Contractor and 

Plan Sponsors Seek to 

Identify Inappropriate 

Prescribing of Drugs with 

High Potential for Abuse, 

Including Opioids

NBI MEDIC’s Data Analyses to 

Identify Outlier Providers
Page 18 GAO-18-15 Prescription Opioids

report with the plan sponsors quarterly to supplement their own 

investigations of potential fraud, waste, and abuse. According to data 

from NBI MEDIC, the number of outlier providers identified has generally 

remained stable except for an increase in 2015. NBI MEDIC and CMS 

officials said this increase occurred when a commonly used opioid, 

hydrocodone, was added to the analysis after it was reclassified as a 

Schedule II drug.

NBI MEDIC gathers data on Medicare Part C and Part D and uses its 

Predictive Learning Analytics Tracking Outcome (PLATO) system to 

conduct a number of data analysis projects. According to NBI MEDIC 

officials, these PLATO projects seek to identify potential fraud by 

examining data on provider behaviors. In addition, according to officials, 

PLATO is capable of allowing NBI MEDIC to share information on 

providers with plan sponsors. NBI MEDIC officials stated there are two 

current PLATO projects that include a focus on some opioids.

• The TRIO data project identifies providers who prescribe 

beneficiaries a combination of an opioid, a benzodiazepine, and the 

muscle relaxant Carisoprodol.30 This well-known combination of drugs 

is used to increase the effects of opioids.

• The Pill Mill data project identifies providers with abnormal 

prescribing behavior in authorizing controlled substances, including 

opioids, absent medical necessity. To identify providers potentially 

operating a pill mill, 17 risk factors are considered, including the 

number of beneficiaries for whom a provider prescribed controlled 

substances, the quantity of these medications, the number of 

beneficiaries who travel long distances to receive medications, and 

the number of beneficiaries treated for drug abuse or misuse at 

emergency rooms.

Another analysis that NBI MEDIC conducts, according to its officials, is 

the Transmucosal Immediate Release Fentanyl project, which identifies 

potential improper payments for medicines containing fentanyl, a 

prescription opioid pain reliever. NBI MEDIC looks for instances of this 

 30Benzodiazepines are drugs prescribed to treat conditions like anxiety, insomnia, and 

seizures. Examples of these drugs include alprazolam, clonazepam, and lorazepam.

NBI MEDIC’s Other Projects
Page 19 GAO-18-15 Prescription Opioids

drug being prescribed to beneficiaries who do not have cancer combined 

with breakthrough pain, the only approved use for this drug.31

NBI MEDIC officials said they conduct investigations to assist CMS in 

identifying cases of potential fraud, waste, and abuse among providers for 

Medicare Part C and Part D. The investigations are prompted by 

complaints from plan sponsors, calls to NBI MEDIC’s call center, NBI 

MEDIC’s analysis of outlier providers, or from one of its other data 

analysis projects.32 As part of its investigations, NBI MEDIC officials said 

they may access data from Medicare Part B, which includes coverage for 

doctors’ services and outpatient care, to determine whether providers’ 

diagnoses coincide with their prescriptions. Officials added that they 

investigate inappropriate prescribing by reviewing Part D prescription 

records, medical records, or PLATO data; or by conducting background 

checks, interviewing beneficiaries, or conducting site visits, among other 

activities. NBI MEDIC data indicates that the total number of its 

investigations decreased from 2013 to 2016, which, according to NBI 

MEDIC officials, occurred because it increased activities related to data 

analysis and collaboration with plan sponsors.

After identifying providers engaged in potential fraudulent overprescribing, 

NBI MEDIC officials said they may refer cases to agencies for further 

investigation and potential prosecution, such as the HHS-OIG, state and 

local law enforcement, the Federal Bureau of Investigations, or the Drug 

Enforcement Administration.33 In 2016, NBI MEDIC data showed that it 

referred a total of 119 cases to the HHS-OIG and 48 to agencies within 

the Department of Justice, including the Federal Bureau of Investigations 

and the Drug Enforcement Agency. CMS officials told us that they do not 

routinely track the results of individual cases referred by NBI MEDIC to 

 31According to the Food and Drug Administration, Transmucosal Immediate Release 

Fentanyl medicines are used to manage breakthrough pain in adults with cancer who are 

routinely taking other opioid pain medicines around-the-clock for pain. Breakthrough pain 

is pain that comes on suddenly for short periods of time and is not alleviated by a patient’s 

normal pain management plan.

32The NBI MEDIC call center is designed to receive complaints regarding any suspected 

fraud, waste, and abuse in Medicare Parts C or D.

33For cases of inappropriate prescribing, CMS can revoke a provider’s eligibility for 

Medicare Part B payments. Providers do not currently enroll in Medicare Part D, but will 

be required to do so by January 2019. After that time, CMS expects to have the ability to 

remove providers inappropriately prescribing from the Medicare Part D program. 79 Fed. 

Reg. 29844 (May 23, 2014); 80 Fed. Reg. 25958 (May 6, 2015) (enforcement delayed 

until January 1, 2019).

NBI MEDIC’s Investigations to 

Identify Fraud, Waste, and 

Abuse

NBI MEDIC’s Referrals
Page 20 GAO-18-15 Prescription Opioids

other agencies. A 2016 Senate committee report indicated that the HHSOIG declined and returned more than half of the cases referred to it from 

2013 through 2015.34 According to NBI MEDIC officials, cases may be 

rejected for reasons such as not meeting prosecutorial thresholds for 

evidence, or HHS-OIG does not having enough staff to take on the 

workload. NBI MEDIC officials told us that HHS-OIG does not always 

inform NBI MEDIC of its reasons for declining the referrals.

CMS requires all plan sponsors to adopt and implement an effective 

compliance program, which must include measures to prevent, detect, 

and correct Part C or Part D program noncompliance, as well as fraud, 

waste, and abuse. CMS communicates guidance for plan sponsor’s 

compliance programs through Chapter 9 of CMS’s Prescription Drug 

Benefit Manual and in annual letters.35 CMS’s guidance focuses broadly 

on prescription drugs, and does not specifically address opioids.

To detect fraud, waste, and abuse among providers, plan sponsors told 

us they use their own data analysis and criteria, as well as NBI MEDIC’s 

list of outlier providers. For example, plan sponsors identify providers 

suspected of fraud, waste, or abuse by looking for certain characteristics, 

such as providers who have a large number of beneficiaries traveling 

from a different zip code to receive prescriptions, or providers who 

prescribe large quantities of commonly abused drugs with no associated 

medical claims to support the prescriptions. Once the suspected 

providers are identified, plan sponsors said that they conduct their own 

investigations to determine if there is sufficient evidence of inappropriate 

prescribing.

Plan sponsors told us they may choose to take a number of actions 

based on these investigations, including choosing to refer the case to NBI 

MEDIC. Additionally, if appropriate, plan sponsors can educate providers 

about prescribing guidelines and best practices, or notify them that their 

patients may be doctor shopping, in order to improve coordination of care. 

They may also terminate a provider from their plan if they find evidence of 

fraud or abuse.

 34Permanent Subcommittee on Investigations, Committee on Homeland Security and 

Governmental Affairs, United States Senate,Combating the Opioid Epidemic.

35Chapter 9-Rev. 16, 01-11-13

Plan Sponsor Monitoring of 

Providers
Page 21 GAO-18-15 Prescription Opioids

CMS lacks the information necessary to adequately determine the 

number providers potentially overprescribing opioids, and therefore 

cannot determine the effectiveness of efforts to achieve the agency’s 

goals of reducing the risk of opioid use disorders, overdoses, 

inappropriate prescribing, and drug diversion. CMS’s oversight actions 

focus broadly on Schedule II drugs rather than specifically on opioids. For 

example, NBI MEDIC’s analyses to identify outlier providers do not 

indicate the extent to which they may be overprescribing opioids 

specifically. According to CMS officials, they direct NBI MEDIC to focus 

on Schedule II drugs, because they have a high potential for abuse, 

whether they are opioids or other drugs. However, without specifically 

identifying opioids in these analyses—or an alternate source of data—

CMS lacks data on providers who prescribe high amounts of opioids, and 

therefore cannot assess progress toward meeting its goals related to 

opioid use.

CMS also lacks key information necessary for oversight of opioid 

prescribing, because it does not require plan sponsors to report to NBI 

MEDIC or CMS cases of fraud, waste, and abuse; cases of 

overprescribing; or any actions taken against providers.36 Plan sponsors 

collect information on cases of fraud, waste, and abuse, and can choose 

to report this information to NBI MEDIC or CMS. PLATO, a voluntary 

reporting system, is one way that plan sponsors can report information to 

NBI MEDIC or CMS, and share with other plan sponsors about providers 

they investigate and about actions they take. While CMS receives some 

information from plan sponsors who voluntarily report their actions, it does 

not know the full extent to which plan sponsors have identified providers 

who have prescribed high amounts of opioids and taken action to reduce 

overprescribing. Without this information, CMS cannot determine the 

extent to which plan sponsors are taking action to reduce overprescribing, 

making it difficult to assess progress in this area. CMS officials told us 

that they receive reports on what information plan sponsors enter into 

PLATO. However, according to these officials, they do not have 

information on all actions taken by plan sponsors; therefore, CMS does 

 36According to CMS officials, the agency’s regulations currently make reporting 

inappropriate prescribing and any actions against providers voluntary for plan sponsors. 

See 42 C.F.R. § 423.504(b)(4)(vi)(G)(3).

CMS Lacks Information 

Necessary for Oversight of 

Opioid Prescribing and 

Plan Sponsors’ Monitoring 

Activities
Page 22 GAO-18-15 Prescription Opioids

not know how often plan sponsors use PLATO or what proportion of 

actions they report.37

A 2015 HHS-OIG report recommended that CMS require plan sponsors 

to report all potential fraud and abuse to CMS and/or NBI MEDIC.38 CMS 

disagreed with this recommendation, and stated that plan sponsors 

currently have several options for referring incidents, that CMS has 

worked with plan sponsors to improve organizational performance, and 

that plan sponsors regularly share information on best practices for 

prevention and detection of fraud. The HHS-OIG continues to recommend 

that CMS require reporting due to the lack of a comprehensive set of data 

needed to monitor providers’ inappropriate prescribing.

Without specifically monitoring providers’ overprescribing of opioids, CMS 

cannot determine if its efforts, or the efforts of NBI MEDIC and plan 

sponsors, are helping to contribute to its goals related to opioid use. 

Federal internal control standards require agencies to conduct monitoring 

activities and to use quality information to achieve objectives and address 

risks.39 Without adequate information on providers’ opioid prescribing 

patterns in Part D, CMS is unable to determine whether its related 

oversight efforts—including such efforts by NBI MEDIC or Part D plan 

sponsors—are effective or should be adjusted.

A large number of Medicare Part D beneficiaries use prescription opioids,

and reducing the inappropriate prescribing of these drugs is a key part of 

CMS’s strategy to decrease the risk of opioid use disorder, overdoses, 

and deaths. Despite working to identify and decrease egregious opioid 

use behavior—such as doctor shopping—among beneficiaries in 

Medicare Part D, CMS lacks the necessary information to effectively 

determine the full number of beneficiaries at risk of opioid harm. CMS 

recently expanded the number of beneficiaries for whom it expects plan 

sponsors to conduct intervention efforts, such as case management, and 

 37CMS places some limits on access to PLATO, and officials from four out of the six plan 

sponsors we interviewed told us that these limits make it challenging to use and update 

PLATO as effectively as possible. CMS officials told us that they would consider any 

requests from plan sponsors to remove these limits, but also indicated that CMS and plan 

sponsors have not communicated about this possibility.

38Department of Health and Human Services, Office of Inspector General, Ensuring the 

Integrity of Medicare Part D, OEI-03-15-00180 (Washington, D.C.: June 2015).

39See GAO-14-704G.

Conclusions
Page 23 GAO-18-15 Prescription Opioids

has begun to collect additional patient safety measure data on 

beneficiaries at risk of harm from opioids. However, these efforts have not 

yet provided CMS with sufficient data to track how many beneficiaries are 

receiving large doses of opioids, and therefore are at risk of harm. 

Without expanding and enhancing its data collection efforts to include 

information on more at-risk beneficiaries, CMS cannot fully assess 

whether it is making sufficient progress toward its goals of reducing opioid 

use disorders, overdoses, inappropriate prescribing, and drug diversion.

CMS’s efforts to oversee opioid prescribing specifically are also 

inadequate. CMS directs NBI MEDIC to focus its analyses on providers 

who prescribe any drugs with a high risk of abuse, but NBI MEDIC does 

not specifically track those providers who prescribe opioids. Absent 

opioid-specific monitoring, CMS cannot assess whether its efforts to 

reduce opioid overprescribing are effective, or if opioid prescribing 

patterns are changing over time. In addition, neither CMS nor NBI MEDIC 

can be sure they have complete information about providers potentially 

overprescribing opioids to Part D beneficiaries, because plan sponsors 

are not required to report to CMS or NBI MEDIC all potential fraud and 

abuse incidents or actions sponsors have taken against providers. As a 

result, CMS lacks information about plan sponsors’ monitoring of 

providers who overprescribe opioids, and is therefore unable to determine 

if the agency’s and plan sponsors’ efforts are successful in achieving 

CMS’s goals.

We are making the following three recommendations to CMS.

• The Administrator of CMS should gather information over time on the 

number of beneficiaries at risk of harm from opioids, including those 

who receive high opioid morphine equivalent doses regardless of the 

number of pharmacies or providers, as part of assessing progress 

over time in reaching the agency’s goals related to reducing opioid 

use. (Recommendation 1)

• The Administrator of CMS should require its contractor, NBI MEDIC, 

to identify and conduct analyses on providers who prescribe high 

amounts of opioids separately from providers who prescribe high 

amounts of any Schedule II drug. (Recommendation 2)

• The Administrator of CMS should require plan sponsors to report to 

CMS on investigations and other actions taken related to providers 

who prescribe high amounts of opioids. (Recommendation 3)

Recommendations
Page 24 GAO-18-15 Prescription Opioids

We provided a draft of this report to HHS for comment. HHS provided 

written comments, which are reprinted in appendix I, and technical 

comments, which we incorporated as appropriate. In its written 

comments, HHS described its efforts to reduce opioid overutilization in 

Medicare Part D. HHS noted that these efforts include a medication 

safety approach to improve care coordination for high-risk beneficiaries 

using opioids, quality metrics for plan sponsors, and data analysis of 

prescribing patterns to target potential fraud, waste, and abuse. For 

example, HHS noted that CMS adopted a Medicare Part D opioid 

overutilization policy in 2013 that provided specific guidance to Part D 

plans on effective drug utilization review programs to reduce 

overutilization of opioids. As described in our report, CMS’s opioid 

overutilization policy requires sponsors to implement retrospective drug 

utilization review programs to identify beneficiaries who are potentially 

overusing opioids. Among other things, sponsors may choose to 

implement beneficiary-specific edits that limit high-risk beneficiaries to 

certain opioids and amounts, and CMS expects them to use formularylevel edits to alert providers when their patients are receiving high levels 

of opioids from other doctors.

HHS also concurred with two of our three recommendations. 

• HHS concurred with our recommendation that CMS gather 

information over time on the number of beneficiaries at risk of harm 

from opioids, as part of assessing progress toward agency goals. 

HHS commented that CMS tracks beneficiaries who meet these 

criteria through the patient safety measures. However, while these 

patient safety measures are a potential source of this information, 

they currently do not include all at-risk beneficiaries, because the 

opioid use threshold they use (120 mg MED for 90 days or longer) is 

more lenient than indicated in CDC guidelines or in CMS’s revised 

OMS criteria. In addition, while CMS uses the patient safety measures 

to assess plan sponsor performance, the data are relatively new, and 

CMS has not yet used them to report progress over time toward its 

goals.

• HHS concurred with our recommendation that CMS require NBI 

MEDIC to gather separate data on providers who prescribe high 

amounts of opioids, and HHS noted that it intends to work with NBI 

MEDIC to identify trends in outlier prescribers of opioids.

• HHS did not concur with our recommendation that CMS require plan 

sponsors to report on investigations and other actions taken related to 

Agency Comments

and Our Evaluation
Page 25 GAO-18-15 Prescription Opioids

providers who prescribe high amounts of opioids. HHS noted that plan 

sponsors have the responsibility to detect and prevent fraud, waste, 

and abuse and that CMS reviews cases when it conducts audits. HHS

also stated that it seeks to balance requirements on plan sponsors

when considering new regulatory requirements. As noted in our 

report, plan sponsors conduct investigations and take actions against 

providers, and some plan sponsors report actions to CMS and NBI 

MEDIC. However, without complete reporting, such as reporting from 

all plan sponsors on the actions they take to reduce overprescribing, 

CMS is missing key information that could help assess progress in 

this area. Due to the importance of this information, we continue to 

believe that CMS should require plan sponsors to report on the 

actions they take.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of HHS and 

the Administrator of CMS. In addition, the report will be available at no 

charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact 

me at (202) 512-7114 or CurdaE@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix II.

Elizabeth H. Curda

Director, Health Care
Appendix I: Comments from the Department of 

Health and Human Services

Page 26 GAO-18-15 Prescription Opioids

Appendix I: Comments from the Department 

of Health and Human Services
Appendix I: Comments from the Department of 

Health and Human Services

Page 27 GAO-18-15 Prescription Opioids
Appendix I: Comments from the Department of 

Health and Human Services

Page 28 GAO-18-15 Prescription Opioids
Appendix I: Comments from the Department of 

Health and Human Services

Page 29 GAO-18-15 Prescription Opioids
Appendix II: GAO Contact and Staff 

Acknowledgments

Page 30 GAO-18-15 Prescription Opioids

Elizabeth H. Curda, (202) 512-7114 or CurdaE@gao.gov

In addition to the contact named above, Will Simerl (Assistant Director), 

Carolyn Feis Korman (Analyst-in-Charge), Amy Andresen, Samantha 

Pawlak, and Patricia Roy made key contributions to this report. Also 

contributing were Muriel Brown, Drew Long, and Emily Wilson.

Appendix II: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(101183)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.