Department of Health and Human Services

OFFICE OF

INSPECTOR GENERAL

ENHANCED ENROLLMENT 

SCREENING OF MEDICARE 

PROVIDERS: EARLY 

IMPLEMENTATION RESULTS

Daniel R. Levinson

Inspector General 

April 2016

OEI-03-13-00050
EXECUTIVE SUMMARY— ENHANCED ENROLLMENT SCREENING OF MEDICARE 

PROVIDERS: EARLY IMPLEMENTATION RESULTS 

OEI-03-13-00050 

WHY WE DID THIS STUDY 

To bill for services they provide to beneficiaries, providers must enroll in Medicare and periodically 

revalidate this enrollment. Effective enrollment screening is an important tool in preventing 

Medicare fraud. The Centers for Medicare & Medicaid Services (CMS) has sought to enhance the 

enrollment screening process with new antifraud tools such as placing providers in risk categories, 

increasing site visits, requiring fingerprinting, implementing an Automated Provider Screening 

system, and denying enrollment to providers whose owners have unresolved overpayments. This 

study examines CMS’s early implementation of new screening tools intended to prevent illegitimate

providers from enrolling in Medicare. 

HOW WE DID THIS STUDY 

We obtained data from CMS on enrollment and revalidation applications submitted for the 1-year 

period before the implementation of enhanced screening procedures (i.e., March 25, 2010, through 

March 24, 2011) and the 1-year period after the implementation of enhanced screening procedures 

(i.e., March 25, 2012, through March 24, 2013). For the latter period, we reviewed detailed results of 

16,022 site visits conducted by CMS’s National Site Visit Contractor (NSVC). In addition, we 

examined CMS and its contractors’ policies and procedures for enrollment, and we surveyed or 

interviewed CMS and contractor staff involved in the enrollment process. 

WHAT WE FOUND 

After CMS implemented risk screening and site visit enhancements to strengthen the provider 

enrollment process, we found that providers submitted fewer enrollment applications to CMS in the 

postimplementation period. There was also an increase in the rate of applications that CMS returned 

to providers and a higher rate of approvals (lower rate of denials) among CMS’s enrollment 

determinations. Given the variation in outcome statistics, it is not possible to determine conclusively 

whether the enhancements prevented a greater percentage of ineligible providers from entering 

Medicare. However, CMS’s additional efforts to revalidate all existing enrollments yielded 

substantial revocations and deactivations of existing providers’ billing privileges. The revalidation 

process resulted in a much higher percentage of providers being deactivated than revoked. 

Additionally, we found that CMS’s implementation of enhanced enrollment screening needs 

strengthening. Our review found gaps in contractors’ verification of key information on enrollment 

applications that could leave Medicare vulnerable to illegitimate providers. In addition, contractors 

were inconsistent in applying site visit procedures and using site visit results for enrollment 

decisions. Finally, CMS’s enrollment data system does not contain the information needed for 

effective oversight and evaluation of the enhancements to the enrollment screening process. 

WHAT WE RECOMMEND 

We recommend that CMS (1) monitor contractors to determine whether they are verifying 

information on enrollment and revalidation applications as required; (2) validate that contractors are 

appropriately considering site visit results when making enrollment decisions; (3) revise and clarify 

site visit forms so that they can be more easily used by inspectors to determine whether a facility is 

operational; (4) require the NSVC to improve quality-assurance oversight and training of site visit 

inspectors; and (5) ensure that CMS’s enrollment data system contains the complete and accurate 

data needed to execute and evaluate CMS’s enrollment-screening enhancements. CMS concurred 

with all five of our recommendations.
TABLE OF CONTENTS

Objectives ....................................................................................................1

Background..................................................................................................1

Methodology................................................................................................6

Findings........................................................................................................8

Providers submitted fewer enrollment applications after CMS 

implemented risk-screening and site visit enhancements................8

CMS’s effort to revalidate all existing enrollments yielded

substantial revocations and deactivations......................................10

Key provider information is not verified during the enrollment or 

revalidation processes....................................................................11

Contractors were inconsistent in applying site visit procedures 

and using site visit results for enrollment decisions ......................12

CMS relies on an enrollment data system, PECOS, that does not 

contain all the information needed for effective oversight ............15

Conclusion and Recommendations............................................................18

Agency Comments and Office of Inspector General Response.....21

Appendixes ................................................................................................22

A: General Site Visit Form ...........................................................22

B: Number of Contractors That Verify Identification Numbers 

Submitted by Providers on Enrollment and Revalidation 

Applications...................................................................................23

C: Agency Comments...................................................................25

Acknowledgments......................................................................................28
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 1

OBJECTIVES

1. To examine how CMS and its contractors implemented enhanced 

screening procedures for enrolling and revalidating Medicare providers 

and suppliers.

2. To review the early results of enhanced screening procedures on the 

enrollment and revalidation of Medicare providers and suppliers.

BACKGROUND

Providers and suppliers must enroll in the Medicare program and 

periodically revalidate their enrollment to be eligible to bill Medicare. 

CMS has stated that “provider enrollment is the gateway to Medicare.”1 If 

this gateway is not adequately safeguarded, Medicare is at increased risk of 

enrolling providers and suppliers with intent to defraud the program. 

Effective enrollment screening is an important tool in preventing Medicare 

fraud. 

Since 1997, the Office of Inspector General (OIG) has identified numerous 

vulnerabilities regarding provider and supplier enrollment and has made 

recommendations for improvement. In an effort to combat fraud, waste, 

and abuse resulting from vulnerabilities in the enrollment process, CMS 

has sought to enhance enrollment screening with a set of new tools. These 

tools include new antifraud authorities provided by the Patient Protection 

and Affordable Care Act (ACA), an Automated Provider Screening (APS) 

system, and the ability to deny enrollment to providers and suppliers with

unresolved overpayments.2, 3 

Enrollment and Revalidation Applications

Providers and suppliers submit paper or electronic applications to Medicare 

Administrative Contractors (MACs) or to the National Supplier 

Clearinghouse (NSC) when newly enrolling in Medicare, changing their 

information, and reactivating or revalidating their enrollment.4 CMS 

contracts with MACs and the NSC to review these applications and 

determine whether providers are eligible to bill Medicare. In accordance 

1

 CMS, CMS Proposes New Safeguards and Incentives to Reduce Medicare Fraud, 

April 24, 2013.

2

 P.L. No. 111-148 (Mar. 23, 2010), as amended by the Health Care and Education 

Reconciliation Act of 2010, P.L. No. 111-152 (Mar. 30, 2010). 

3

 A Medicare overpayment is a payment that a provider or supplier received in excess of 

amounts properly payable under Medicare statutes and regulations. 

4

 The NSC processes applications for suppliers of durable medical equipment, prosthetics, 

orthotics, and supplies (DMEPOS). MACs process all other applications. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 2

with the Medicare Program Integrity Manual, MACs and the NSC must,

unless otherwise specified, verify and validate all information furnished by 

providers on CMS-855 application forms. 

There are five CMS-855 enrollment application forms for the following 

broad categories of providers: 5 

 institutional providers (CMS-855A);

 clinics, group practices, and certain other suppliers (CMS-855B);

 physicians and nonphysician practitioners (CMS-855I); 

 suppliers of Durable Medical Equipment, Prosthetics, Orthotics, 

and Supplies (DMEPOS) (CMS-855S); and

 ordering and referring providers (CMS-855O).

Applications submitted to newly enroll, change information, or reactivate 

enrollment—hereinafter, “enrollment applications”—may be: 

 approved, i.e., determined to be eligible to bill Medicare or

 denied, i.e., determined to be ineligible to bill Medicare. 

In other instances, MACs or the NSC may return an enrollment application to

a provider if that provider furnished incomplete information during the 

application process. Providers can also withdraw their applications at any 

time during the process.

After providers’ initial enrollment, CMS requires them to revalidate their 

enrollment after a certain number of years. DMEPOS suppliers are 

required to revalidate their enrollment every 3 years. All other providers 

are required to revalidate every 5 years. Revalidation applications may be 

 approved, 

 revoked, i.e., billing privileges are terminated, or 

 deactivated, i.e., billing privileges are stopped but can be restored 

upon submission of updated information.

The Provider Enrollment, Chain, and Ownership System (PECOS) is 

CMS’s repository for provider enrollment information. 

Enhancements to the Enrollment-Screening Process

The ACA provided CMS with the authority for enhancements to the 

enrollment-screening process, including, placing providers into risk 

screening categories, expanding site visit requirements, using fingerprints 

5

 In this report we use the term “providers” to encompass both providers and suppliers.
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 3

to conduct national background checks and criminal history record checks, 

and expanding revalidation efforts.6

 

In addition, CMS’s APS system aims to automate and standardize the 

process by which MACs and the NSC verify application information. 

CMS also issued guidance to MACs and the NSC on denying enrollment to 

providers with unresolved overpayments.7 

Risk screening. On March 25, 2011, CMS began assigning providers to 

one of three risk categories: limited, moderate, or high risk. Providers 

assigned to higher risk categories are subject to a more extensive review. 

Federal regulations outline which provider types are assigned to each risk 

category: 

 High risk: newly enrolling home health agencies (HHAs) and 

newly enrolling DMEPOS suppliers;

 Moderate risk: ambulance service suppliers, community mental 

health centers, comprehensive outpatient rehabilitation facilities, 

hospice organizations, independent clinical laboratories, 

independent diagnostic testing facilities (IDTFs), physical therapists 

enrolling as individuals or group practices, portable x-ray suppliers, 

revalidating HHAs, and revalidating DMEPOS suppliers; and

 Limited risk: all other provider types. 8 

Providers initially designated as limited or moderate risk may be 

redesignated as high risk if they meet certain criteria, such as having been 

convicted of certain crimes within the previous 10 years. 

Site visits. The ACA provided CMS with the authority to expand the provider 

types subject to site visits.9 Prior to the ACA, IDTFs and DMEPOS suppliers

were subject to site visits as part of the enrollment process.10 In accordance with 

Federal regulations, all providers designated as moderate or high risk must 

undergo a site visit when newly enrolling, adding or changing a practice 

location, undergoing a change of ownership that results in a new tax 

identification number, reactivating, or revalidating enrollment. 

6

 ACA § 6401.

7

 CMS, Transmittal 479, Change Request 8039. CMS Manual System, Pub. No. 100-08, 

“Enrollment Denials When an Existing or Delinquent Overpayment Exists.”

8

 42 CFR § 424.518

9

 ACA § 6401(a), codified at 42 USC § 1395cc(j)(2)(B)(ii)(III). 

10 Prior to the ACA, certain DMEPOS suppliers did not receive site visits, including chains 

with 25 or more locations, physicians, hospitals, skilled nursing facilities, ambulatory 

surgical centers, physical therapists, occupational therapists, and managed care 

organizations. After the ACA, all DMEPOS suppliers are subject to site visits. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 4

The NSC performs site visits of DMEPOS suppliers. For all other providers, 

CMS implemented a site visit process using a National Site Visit Contractor 

(NSVC). MSM Security Services, Inc. serves as the NSVC. The NSVC began 

performing site visits in late January 2012 and was fully operational on 

March 15, 2012.11 The NSVC and the NSC use three standard forms to conduct 

site visits depending on the type of provider visited. The NSVC uses a 

specialized form for IDTFs and the NSC uses a specialized form for most 

DMEPOS suppliers. For all other providers and certain DMEPOS suppliers, the 

NSVC and the NSC use a more general site visit form.

12

 

MACs and the NSC are responsible for reviewing the results of site visits prior 

to making final decisions regarding applications. For applications screened with 

the general site visit form, the site visit determines whether 

 the facility is open,

 personnel are at the facility,

 customers are at the facility (if applicable to that provider or supplier 

type), and

 the facility appears to be operational.13

The general site visit form contains six closed-ended (i.e., “Yes/No”) 

questions and a section for additional comments from site visit inspectors.14 

Four of the questions each directly corresponds with one of the four 

standards noted above. Appendix A contains the general site visit form. The 

IDTF site visit form used during our review period contained 22 

closed-ended questions addressing the IDTF standards in 42 CFR § 410.33 

and additional questions asking for specific information or explanations of 

responses. The site visit form for DMEPOS suppliers contains 44

closed-ended questions addressing the DMEPOS supplier standards in 42 

CFR § 424.57. The DMEPOS supplier site visit form has additional 

questions asking for specific information or explanations of responses. 

11 Prior to the ACA, MACs conducted site visits of IDTFs. After the ACA, MACs 

conducted site visits for non-DMEPOS providers until the NSVC was fully operational. 

12 The general site visit form is used during enrollment and revalidation of the following 

DMEPOS suppliers: chains with 25 or more locations; hospitals; skilled nursing facilities; 

professionals (excluding chiropractors); ambulatory surgical centers; physical and 

occupational therapists; and managed care organizations. The form also may be used for 

all DMEPOS suppliers to conduct site visits not associated with enrollment or 

revalidation, including site visits in response to complaints. 

13 CMS, Medicare Program Integrity Manual, Pub. No. 100-08 (Rev. 636, 02-04-16), 

ch. 15, § 19.2.2.B. 

14 Two questions on the general site visit form are applicable only to DMEPOS suppliers. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 5

Fingerprinting. The ACA also gave CMS the authority to conduct 

fingerprinting for national background checks and criminal history record 

checks.15 According to CMS, fingerprinting would be reserved for owners of 

providers in the high-risk category. Although fingerprint-based background 

checks were included in the 2011 regulation establishing the enhanced 

enrollment screening procedures, CMS did not award a contract to manage 

this process until 2014, when it selected Accurate Biometrics, Inc. to serve as 

the Fingerprint-Based Background Check Contractor. 

Revalidation. Prior to the ACA, CMS required DMEPOS suppliers to revalidate 

their enrollment every 3 years, and other providers were required to revalidate 

every 5 years. The ACA provided CMS with the authority to conduct 

“off-cycle” revalidations and revalidate the enrollment of all existing providers 

under the new ACA screening requirements.16 This off-cycle revalidation effort 

applies to providers who were enrolled prior to March 25, 2011. CMS began 

the revalidation process in September 2011. 

APS system. In 2011 CMS contracted with Turning Point Solutions to 

develop the APS system. The APS system verifies certain application 

information against government records and private vendor data. When 

information does not match or criteria are unmet—for example, if the 

provider’s license has expired—the APS system will flag that application 

information for MACs and NSC to verify.

Overpayment screening. In 2008 CMS modified regulations to allow 

MACs and the NSC to deny enrollment applications if a physician, 

nonphysician practitioner, or a provider’s current owner has an unresolved 

overpayment. 17, 18 In August 2013 CMS issued guidance to MACs and the 

NSC on denying enrollment applications for providers with unresolved 

overpayments.19 After this guidance was issued, CMS placed the 

implementation of the guidance on hold. In December 2014 CMS issued a 

final rule, effective February 3, 2015, that clarifies when a provider can be 

15 ACA § 6401(a), codified at 42 USC § 1395cc(j)(2)(B)(ii)(II). 

16 ACA § 6401(a), codified at 42 USC § 1395cc(j)(2). 

17 73 Fed. Reg. 69726, 69940 (Nov. 19, 2008). 

18 42 CFR § 424.530(a)(6). 

19 CMS, Transmittal 479, Change Request 8039, CMS Manual System, Pub. No. 100-08, 

“Enrollment Denials When an Existing or Delinquent Overpayment Exists (Aug. 1, 

2013).”
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 6

denied enrollment due to unresolved Medicare debts (including 

overpayments). 20

METHODOLOGY

Data Collection and Analysis

CMS data. We met with CMS staff and collected data regarding enrollment 

and revalidation applications received and processed by MACs and the NSC 

1 year before the implementation of enhanced screening procedures (i.e., 

March 25, 2010, through March 24, 2011) and 1 year after the 

implementation of enhanced screening procedures (i.e., March 25, 2012, 

through March 24, 2013).21, 22 Our analysis compared trends in application 

outcomes across years. 

MAC and NSC procedure data. From the NSC and the 12 MAC 

jurisdictions that process applications, we obtained and reviewed written 

policies and survey responses regarding enrollment and revalidation 

procedures. We requested additional information from one MAC regarding 

its review of site visit results and associated application determinations for 

certain providers it enrolled or revalidated. We also interviewed staff at one 

MAC to learn more about their procedures for processing enrollment and 

revalidation applications. 

NSVC procedure data. From NSVC we obtained and reviewed written 

policies, training materials, and interview responses regarding site visit 

procedures. To collect information about site visit inspectors’ experiences in 

conducting site visits, we surveyed a simple random sample of 200 of the 

866 NSVC inspectors authorized to perform site visits as of 

September 2013.

23

 We received and reviewed completed surveys from 133 

inspectors. Because of a survey response rate of 67 percent, we did not 

project the survey responses of the 133 inspectors to the entire population of 

866 inspectors. 

20 79 Fed. Reg. 72499 (Dec. 5, 2014). CMS amended the regulation to allow MACs and 

NSC to deny enrollment applications for any unresolved debt, be it an overpayment or 

some other type of financial obligation to Medicare. The final rule allows for the denial of 

enrollment if the provider or owner has an unresolved debt or had debt when the 

provider’s enrollment was terminated or revoked and (1) the owner left the provider that 

had the debt 1 year before or after the provider’s termination or revocation, (2) the debt 

has not been fully repaid, and (3) CMS determines that the debt poses an undue risk of 

fraud, waste, or abuse. 

21 The time period March 25, 2010, through March 24, 2011, is hereinafter referred to as 

the “preimplementation period.” The time period March 25, 2012, through March 24, 

2013, is hereinafter referred to as the “postimplementation period.”

22 We did not collect data regarding CMS-855O enrollment applications because this type 

of application did not exist during the preimplementation time period. 

23 We did not include NSVC inspectors located in U.S. territories in our review. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 7

NSVC site visit results data. We obtained from CMS detailed results of 

16,022 site visits conducted by NSVC during the postimplementaiton period 

for applications received and processed by MACs within that period. Of 

these, 1,914 site visits were conducted for IDTFs and 14,108 were 

conducted for non-IDTF providers. Our analysis compared the results of 

each site visit to the enrollment decision with a date that directly followed

the date of the site visit. 

APS procedure data. From the APS contractor, we obtained and reviewed 

written policies and interview responses regarding the APS system. 

Limitations

We were not able to review the procedures or address the impact of the 

Fingerprint-Based Background Check Contractor because it was not 

operational when we conducted this study. We did not validate the data 

that CMS provided from its data systems. 

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency.
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 8

FINDINGS

Providers submitted fewer enrollment applications 

after CMS implemented risk-screening and site visit 

enhancements

In March 2011 CMS began assigning providers to risk-screening categories 

and conducting site visits for those in the moderate- and high-risk 

categories. Providers submitted fewer enrollment applications in the year 

after CMS had implemented these enhancements. During the 

preimplementation period, providers submitted 546,916 enrollment 

applications, as shown in Table 1. In the year after implementation of 

enhancements, providers submitted 12 percent (67,801) fewer enrollment 

applications. This reduction may be evidence of a “deterrent effect” 

resulting from the enhanced enrollment screening process. 

It was not possible to determine conclusively whether the new 

Medicare enrollment enhancements prevented a greater 

percentage of ineligible providers from entering the program 

CMS’s approval of submitted enrollment applications decreased slightly—

from 91 percent to 88 percent—after implementation of the new 

enhancements. At the same time, CMS’s denial of enrollment applications 

decreased, from 2.5 percent to less than 1 percent. Table 1 provides the 

numbers of approved and denied enrollment applications made before and 

after the implementation of enhanced enrollment screening procedures.

One might expect an inverse relationship to exist between approval and 

denial percentages—if approval rates decrease, denial rates increase. But 

this is not the case when one factors in the incomplete applications that 

were returned to providers. The percentage of applications returned to 

providers because of incomplete information increased from 6 percent to 11 

percent. Thus, a smaller overall percentage of submitted applications were 

deemed ready for enrollment determinations in the postimplementation 

period.
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 9

Table 1: Enrollment Results Before and After the Implementation of New Enhancements 

Preimplementation Period

(March 25, 2010, through 

March 24, 2011)

Postimplementation Period

(March 25, 2012, through 

March 24, 2013)

Number of Enrollment Applications 

Submitted 546,916 479,115

Number Approved 

Percentage Approved

500,076 423,355

91.4% 88.4%

Number Denied 

Percentage Denied 

13,600 3,411

2.5% 0.7%

Number Returned 

Percentage Returned 

32,857 51,819

6.0% 10.8%

Number Withdrawn 

Percentage Withdrawn

383 530

0.1% 0.1%

Source: OIG analysis of data compiled by CMS from PECOS, MACs, and the NSC, 2014.

When we considered only those applications for which enrollment 

determinations were made, the approval rate increased from 97 percent to 

99 percent. For the applications with determinations, the percentage of 

denials decreased from 2.6 percent to 0.8 percent, as shown in Table 2. The 

latter denial rate is similar to the 0.7 denial percentage seen across all 

enrollment applications submitted during the postimplementation period. 

Table 2: Medicare Provider Enrollment Determination Results Before and After the 

Implementation of New Enhancements

Preimplmentation Period

(March 25, 2010, through 

March 24, 2011)

Postimplementation Period

(March 25, 2012, through 

March 24, 2013)

Number of Enrollment Applications 

Submitted 546,916 479,115

Number of Enrollment Applications with 

Determinations

Percentage of Enrollment Applications 

with Determinations

513,676

93.9%

426,766

89.1%

Number Approved 

Percentage Approved 

500,076 423,355

97.4% 99.2%

Number Denied 

Percentage Denied

13,600 3,411

2.6% 0.8%

Source: OIG analysis of data compiled by CMS from PECOS, MACs, and the NSC, 2014.

Given the multiple types of variation across the two time periods—fewer 

applications submitted, a greater rate of applications returned, a higher rate 

of approvals (and lower rate of denials) among applications with 

determinations in the postimplementation period—it is not possible to 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 10

determine whether the new Medicare enrollment enhancements prevented a 

greater percentage of ineligible providers from entering Medicare. 

CMS’s effort to revalidate all existing enrollments 

yielded substantial revocations and deactivations

The ACA established a requirement for all providers to revalidate their 

enrollment information under the new enrollment screening enhancements. 

This off-cycle revalidation effort applies to all providers enrolled prior to 

March 25, 2011. All revalidation notices were mailed to providers by 

March 23, 2015. 

During the revalidation process, a provider’s enrollment can be approved, 

revoked, or deactivated. Providers who are revalidating their enrollment 

may have it revoked for a number of reasons, including noncompliance 

with Medicare standards. Providers’ enrollment can be deactivated when 

they do not respond timely to a revalidation request. 

As outlined in Table 3, the number of revocations and deactivations of 

submitted revalidation applications substantially increased after CMS 

implemented the revalidation effort using risk category and site visit 

enhancements. However, MACs revoked and deactivated a greater 

percentage of limited-risk providers than higher risk providers, even though 

these limited-risk providers were not subject to all of the new screening 

enhancements. 

Table 3: Medicare Provider Revalidation Determinations Before and After 

Implementation of CMS’s Revalidation Effort and New Enhancements 

Number of 

Revalidation 

Determinations

Number of 

Approvals/

Approval Rate

Number of 

Revocations/

Revocation Rate

Number of 

Deactivations/

Deactivation Rate

Preimplementation Period

(March 25, 2010, through March 24, 2011)

Total 51,673 51,574

99.8%

62

0.1%

37

0.1%

 NSC: Moderate- and 

High-Risk Providers

289 285

98.6%

0

0%

4

1.4%

 MACs: Moderate- and 

High-Risk Providers

1,849 1,841

99.6%

4

0.2%

4

0.2%

 MACs: Limited-Risk 

Providers

49,535 49,448

99.8%

58

0.1%

29

0.1%

Postimplementation Period

(March 25, 2012, through March 24, 2013)

Total 177,932 145,234 

81.6%

5,414

3.0%

27,284

15.3%

 NSC: Moderate- and 

High-Risk Providers

15,589 15,221

97.6%

52

0.3%

316

2.0%

 MACs: Moderate- and 

High-Risk Providers

13,775 11,509

83.5%

51

0.4%

2,215

16.1%

 MACs: Limited-Risk 

Providers

148,568 118,504

79.8%

5,311

3.6%

24,753

16.7%

Source: OIG analysis of data compiled by CMS from PECOS, MACs, and the NSC, 2014. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 11

Key provider information is not verified during the 

enrollment or revalidation processes

Providers seeking to enroll or revalidate their enrollment in Medicare must 

submit important application information to CMS. However, key 

information—i.e., identification numbers, supporting documents, and 

criminal convictions—is not always verified by MACs and the NSC as 

required by CMS policy. Even when the APS system is fully implemented, 

some key enrollment information will not be verified.24 These gaps in 

CMS’s verification of information submitted by providers on enrollment 

applications leave Medicare vulnerable to providers that submit false 

information. 

CMS’s contractors did not verify key enrollment information 

CMS has relied on MACs and NSC to verify whether information on 

enrollment and revalidation applications is correct. Although the Medicare 

Program Integrity Manual directs MACs and the NSC to verify all 

application information, none reported doing so.25, 26 Even when 

contractors did verify key information, they did not always use an outside 

source to do so.27 

Identification numbers. Providers must submit—depending on the provider 

type—Social Security numbers, National Provider Identifiers (NPIs), Drug 

Enforcement Agency (DEA) numbers, Tax Identification Numbers (TINs), 

and/or Employer Identification Numbers (EINs) on the application forms 

that MACs process. None of the MACs reported verifying all the 

identification numbers that providers supply on their individual enrollment 

and revalidation applications. Nor did the NSC always verify DMEPOS 

suppliers’ tax identification numbers or EINs with an outside source. 

24 CMS began piloting APS system procedures with a subset of MACs in April 2013, but 

as of December 2015, CMS had not used the APS system to routinely screen applications. 

25 Section 15.1.3 of the Medicare Program Integrity Manual states: “Unless stated 

otherwise in this chapter or in another CMS directive, verify and validate all information 

collected on the enrollment application.”

26 Section 15.7.3.B of the Medicare Program Integrity Manual states: “Once the 

contractor has completed its review of the CMS-855 (e.g., approved/denied application, 

approved change request), it shall provide a written statement asserting that it has (1) 

verified all data elements on the application, and (2) reviewed all applicable names on the 

CMS-855 against the MED [Medicare Exclusion Database] and the System for Access 

Management (SAM). 

27 We define an “outside source” as any source that is external to CMS. We did not 

consider MACs’ and the NSC’s internal review of provider-submitted documents to 

constitute verification with an outside source. For certain types of provider information, 

CMS policy does not require verification with what OIG considers an outside source. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 12

Appendix B outlines the number of contractors that verified identification 

numbers.

Supporting documentation. Applicants must submit certain documentation 

with their applications, including copies of licenses, certifications, and 

registrations required by States for certain health care providers; Internal 

Revenue Service documentation; lease agreements; educational degrees; 

and bank statements. Only the license, certification, and registration 

documentation is verified with an outside source by all MACs and the 

NSC.28

Criminal convictions. Applicants must report information regarding final 

adverse legal actions, such as convictions and exclusions from participation 

in Federal health care programs. All contractors used OIG or General 

Services Administration (GSA) data to verify whether applicants omitted 

exclusions. The majority of MACs stated that they also use OIG or GSA 

data—in addition to State licensure Web sites—to verify whether applicants 

omitted any criminal convictions. However, these outside sources are not 

comprehensive sources of criminal conviction information. In addition, the 

NSC does not verify whether applicants omitted information on criminal 

convictions. 

APS will not verify some key application information even after 

the system is fully implemented 

APS will not fully address enrollment vulnerabilities because some key 

application information will still not be verified even after the system is 

fully implemented. This information includes: 

 TINs of individuals and organizations who have 

ownership/managing control of the applicant; 

 TINs or EINs of other individual or organizational principals 

associated with the applicant, such as an applicant’s billing agency 

or supervising physician; 

 DEA numbers of applicants; and

 supporting documentation.

Contractors were inconsistent in applying site visit 

procedures and using site visit results for enrollment 

decisions 

After the enhancements to the enrollment screening process were 

introduced, less than 2 percent of the 16,022 site visits conducted by the 

28 Three of these MACs verify against an outside source only for Part B providers. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 13

NSVC resulted in denials or revocations of providers’ enrollment. For 

another 2 percent of site visits, MACs approved providers for enrollment 

even though site visit results indicated noncompliance with each of CMS’s 

standards. 

We found some examples in which NSVC inspectors’ observational 

comments on the site visit forms contradicted their answers to questions on 

the forms. In addition, there were inconsistencies in how NSVC inspectors 

determined whether a facility was operational. Vulnerabilities related to 

the implementation of site visits can compromise the effectiveness of 

screening providers for entry into Medicare. 

MACs approved hundreds of providers to enroll in Medicare 

despite site visit results indicating noncompliance 

MACs approved 362 of the 651 provider enrollment and revalidation 

applications for which NSVC inspectors reported that the provider’s 

facility did not meet any of the enrollment standards on the site visit form.29 

If these providers had not been approved, there would have been more than 

twice as many denials and revocations from site visits during the 

postimplementation period. 

For these 362 site visits, some NSVC inspectors provided additional 

comments, such as “facility does not exist,” “building has been vacated,” 

“suite appeared closed and abandoned,” “calling the telephone number 

resulted in response that the line was disconnected with no forwarding 

number,” and “facility is closed with a padlock on the door.” 

These comments and the inconsistencies between site visit results and 

enrollment determinations raise questions about whether MACs always 

consider site visit results when making enrollment and revalidation 

decisions and whether valid and accurate address information is being used 

for site visits. We followed up with one MAC to determine under what 

circumstances it would approve enrollment applications with unfavorable 

site visit results. Of the nine cases we sent to the MAC for review, the 

MAC reported that in six cases it had not reviewed the site visit results, in 

two cases it had not thoroughly reviewed the site visit results or should 

have conducted more research on the facility location, and in one case it 

may have provided an incorrect location for the site visit. The MAC 

reported that it had recognized the need to change its standard operating 

procedures. To ensure that providers are meeting enrollment requirements, 

the MAC now routes certain types of provider applications to a designated 

group of analysts for review.

29 We provided CMS the site visit information for these 362 providers. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 14

NSVC inspectors’ observational comments about a facility 

sometimes contradicted their responses to questions on the 

site visit form

NSVC inspectors can enter additional observations and comments about 

the facility at the end of the general site visit form. We found several 

examples of site visit results for which NSVC inspectors’ comments 

contradicted their responses to closed-ended (“Yes/No”) questions. For 

example, an inspector answered “Yes” to indicate that a facility was open, 

yet the inspector’s additional comments indicated that the facility was 

closed. In other cases, inspectors answered “Yes” to a question about 

whether customers were seen at the facility, yet the inspectors’ additional 

comments indicated that they saw no customers. MACs approved the 

enrolling and revalidating providers associated with these instances. Such 

discrepancies raise questions about (1) potential issues with NSVC 

oversight of quality assurance or training of its inspectors and (2) whether 

MACs are reviewing inspectors’ additional comments when making 

enrollment and revalidation decisions.30 

NSVC inspectors were not consistent in how they determined 

whether a facility was operational 

One of the questions on the general site visit form asks NSVC inspectors, 

“Does the facility appear to be operational?” This is an important criterion 

that site visits are meant to determine. The form clarifies: 

Operational means the provider or supplier has a qualified physical 

practice location, is open to the public for the purpose of providing health 

care related services, is prepared to submit valid Medicare claims, and is 

properly staffed, equipped, and stocked (as applicable, based on the type 

of facility or organization, provider or supplier specialty, or the services 

or items being rendered) to furnish these items or services.31, 32

One of the roles of an NSVC inspector is to determine whether a facility is 

operational. However, 50 of the 133 inspectors that responded to our 

survey reported that they did not receive training regarding how to 

determine whether a facility is operational. The difficulties surrounding the 

determination of a facility’s operational status may be due to the definition 

of “operational,” as stated above, which does not provide sufficient detail 

30 According to NSVC staff, the results of all site visits are reviewed by a member of the 

NSVC review team before being submitted to CMS. 

31 CMS, Site Verification Survey Form. 

32 NSVC training materials instruct inspectors to disregard the reference to “valid 

Medicare claims.” In addition, according to NSVC staff, CMS allows inspectors to 

disregard the parts of the definition referring to being prepared to submit valid Medicare 

claims and being properly stocked because they relate to DMEPOS facilities and not the 

type of facilities that NSVC inspectors visit. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 15

for inspectors to follow when determining whether the facility is 

operational. For example, some surveyed inspectors reported finding it 

particularly challenging to determine whether ambulance companies and 

providers that can be located in private residences, such as HHAs, were 

operational because these facilities may not be continuously staffed during 

normal business hours. 

Approximately half of responding inspectors reported that they determine 

whether a facility appears “operational” solely on how they answered other 

questions on the general site visit form. The remaining inspectors reported 

that they do not rely solely on how they answered other questions. When 

we asked inspectors how they determine whether a facility is operational, 

their responses varied. Methods included, but were not limited to,

 assessing the condition of the facility’s building, 

 calling the facility’s telephone number, and 

 observing other criteria such as whether or not lights were on, the 

facility had office furniture and supplies, the door was unlocked, 

and equipment was present. 

CMS relies on an enrollment data system, PECOS, that 

does not contain all the information needed for 

effective oversight 

CMS relies on PECOS as its centralized repository for all provider 

enrollment information. However, PECOS data related to oversight of 

enrollment screening enhancements were often incomplete and therefore 

could not be used to evaluate the impact of certain enhancements 

implemented by CMS.

PECOS lacked key data to evaluate the outcomes of the new 

enhancements

Data pertinent to tracking provider enrollment trends associated with the 

recent screening enhancements were not consistently maintained in 

PECOS. These data included

 denials and returns of enrollment applications;

 risk category designations (e.g., limited, moderate, or high risk) for 

each enrolling and revalidating provider; and 

 reasons providers submitted enrollment applications.

Denials and returns. PECOS did not contain information on all denials and 

returns that occurred during the time periods before and after the 

enhancements were implemented. According to CMS staff, the records for 

some denials and returns reside outside of PECOS in MACs’ local systems. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 16

To provide complete counts of denials and returns, CMS requested 

supplementary data from MACs. 

However, after receiving the data from the MACs, CMS was still unable to 

provide us with complete information on denials, returns, and withdrawals 

of enrollment applications by provider type because two MACs were 

unable to provide data by provider type. Because of this lack of data, we 

were unable to compare trends in enrollment application determinations 

across provider types. This prohibited us from evaluating the impact of 

enhanced screening on the enrollment of higher risk providers. This lack of 

data also limits CMS’s ability to evaluate and oversee the effectiveness of 

its enhanced screening procedures. 

Risk category designations. PECOS did not contain the risk category 

designations for 10 percent of enrolling and revalidating providers’

applications submitted during the postimplementation period. According to 

CMS staff, PECOS was not updated to include risk category data at the 

time of the risk category enhancements. In addition, CMS staff 

acknowledged that MACs do not always enter risk category information 

into PECOS. 

Reasons providers submitted enrollment applications. PECOS did not 

contain the reason for submission, e.g., new enrollment or change of 

information, for 11 percent of the nearly half-million enrollment 

applications (54,903 of 479,115) submitted during the postimplementation 

period. According to CMS staff, CMS would need to go back to the MACs 

to obtain submission reasons for these applications because the information 

resides outside of PECOS in MACs’ local systems. CMS staff indicated 

that to obtain this data, it would have to issue a technical direction letter to 

the MACs and that it would be a “significant amount of work to get that 

information.” In addition to the applications for which CMS could not 

provide a submission reason, there were 91,519 enrollment applications for 

which “other” was the reason for submission in PECOS. 

The lack of complete data regarding submission reasons in PECOS is 

problematic because for some provider categories, the reason for the 

application affects the level of review. Only higher risk providers that are 

submitting an application for reasons of new enrollment, revalidation, 

addition or change of practice location, certain changes of ownership, or 

reactivation of enrollment are required to have a site visit. Therefore, 

knowing the reason a provider submitted an enrollment application is 

necessary to know whether the application required a site visit and whether 

all required site visits were performed. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 17

CMS cannot readily use PECOS to link enrollment outcomes to 

site visit results 

According to CMS staff, the data housed in PECOS cannot be easily used 

to connect the results from site visits to MACs’ enrollment decisions. To 

determine a direct link between a site visit result and the enrollment 

decision associated with that specific site visit would require a 

labor-intensive manual review on the part of CMS and its contractors. In 

this respect, CMS’s current enrollment data system presents challenges for 

overseeing implementation of the enhancements to the site visit component 

of the screening process.

In addition, there was a discrepancy between the number of site visits that 

CMS reported the NSVC as having conducted (17,024 site visits in

PECOS) and the number of site visits for which CMS provided complete 

and valid results from NSVC (16,022 site visits obtained from the NSVC). 

According to CMS staff, the difference in numbers can be attributed to 

errors in how site visits are tracked in PECOS, possible typographical 

errors, or other data anomalies.

PECOS may not contain accurate enrollment data on DMEPOS 

suppliers for the preimplementation period 

Prior to October 2010 the NSC stored DMEPOS suppliers’ enrollment 

information in the Provider Information Management System (PIMS). In 

October 2010 the NSC converted this information from PIMS to PECOS. 

According to CMS staff, some errors may have occurred during this 

transfer. To provide data for the year before implementation of 

enhancements, CMS combined data from PECOS and PIMS and stated that 

the data may contain an error rate of at least 10 percent. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 18

CONCLUSION AND RECOMMENDATIONS

OIG has performed extensive work focusing on provider enrollment and 

found significant vulnerabilities in this area and made recommendations for 

improvement. CMS has implemented new provider-screening tools that are 

intended to reduce vulnerabilities in the provider enrollment process and 

thus reduce the number of illegitimate providers enrolling in Medicare. 

Discouraging illegitimate providers from seeking to gain entry into 

Medicare may have contributed to the decline of enrollment applications 

after the implementation of the enhancements. 

It is not possible to determine conclusively from the results of enrollment 

decisions whether or not the new enhancements to the Medicare enrollment 

process prevented a greater percentage of ineligible providers from entering 

the program. However, CMS’s efforts to revalidate all existing enrollments 

yielded substantial revocations and deactivations of providers’ billing 

privileges. As a result of its revalidation and screening efforts, CMS 

reported that as of May 2015 the billing privileges of more than 470,000 

providers had been deactivated and those of almost 28,000 had been 

revoked. 

However, the gaps in CMS’s verification of information submitted by 

providers on enrollment applications leaves Medicare vulnerable to 

providers that submit false information. Additionally, CMS should 

improve the implementation of enhancements such as site visits to ensure 

that providers are being effectively screened for entry into Medicare. 

Effective oversight of enrollment data is key to ensuring that contractors 

are performing their activities appropriately and that enhancements are 

producing intended results. At the time of our review, shortcomings in 

PECOS rendered CMS unable to leverage existing data to determine how 

the enhancements were affecting provider enrollment. 

Preventing dishonest providers from enrolling in Medicare is the first step 

in ensuring the integrity of the program. Therefore, to strengthen the 

provider enrollment-screening process, we recommend that CMS: 

Monitor MACs and the NSC to determine whether they are 

verifying information on enrollment and revalidation 

applications as required 

According to the Medicare Program Integrity Manual, contractors must, 

unless otherwise specified, verify and validate all information collected on 

the enrollment application. CMS should confirm that all the information 

on an enrollment or revalidation application is verified as required. 

Verifying this information is an important safeguard to prevent 

unscrupulous providers from enrolling in Medicare.
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 19

Validate that MACs are appropriately considering site visit 

results when making enrollment decisions

Site visits are used to determine whether providers actually exist at the 

physical locations on file with CMS. As a means to reduce inappropriate 

Medicare payments, OIG has recommended and supported the use of site 

visits to deny enrollment to providers who do not maintain operational

facilities. However, this tool is rendered ineffective if MACs approve 

enrollment and revalidation applications when site visits show that 

providers are failing to meet CMS’s standards. CMS should determine 

why these approvals occur and address any identified problems with its

contractors. CMS should also instruct MACs to review their standard 

operating procedures to ensure they are reviewing and appropriately using 

the results of site visits for enrollment decisions.

Revise and clarify site visit forms so that they can be more 

easily used by inspectors to determine whether a facility is 

operational

The general site visit form is used by inspectors to indicate whether or not a 

facility is operational and, in turn, by MACs to determine whether the 

provider meets the operational criteria for enrollment. CMS should issue 

more specific guidance to the NSVC as to what it means for a facility to be 

considered operational. This includes guidance as to what CMS expects 

inspectors to observe during a site visit for them to consider a facility 

“operational.” In addition, CMS may consider whether customized site 

visit forms for certain provider types or more in-depth questions on the 

general site visit form are needed to minimize confusion and 

inconsistencies.

Require the NSVC to improve quality assurance oversight and 

training of site visit inspectors 

Although the NSVC has quality assurance processes and trains its site visit 

inspectors, we identified instances in which inspectors reported 

contradictory information in their site visit results and inconsistencies in 

how inspectors determined whether a facility appeared operational. To 

ensure that NSVC inspectors provide the MACs with consistent and valid 

site visit assessments, CMS should require that the NSVC improve its 

quality assurance oversight of inspectors and provide more specific training 

to inspectors as to how to determine whether a site is operational. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 20

Ensure that PECOS contains the complete and accurate data 

needed to execute and evaluate CMS’s enrollment-screening 

enhancements

PECOS is CMS’s national data repository for Medicare enrollment 

information about providers. The information housed in PECOS can aid 

CMS in tracking enrollment and revalidation trends as well as determine 

whether contractors are abiding by program requirements. For CMS to 

accomplish this, however, the data maintained in PECOS must be complete 

and accurate. CMS should ensure that PECOS includes fields that relate to 

the enhancements implemented for the provider enrollment process and 

that MACs and the NSC enter all required data. 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 21

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE

CMS concurred with all five of our recommendations. In its comments, 

CMS highlighted its most recent efforts as it continues to improve upon the 

new enrollment enhancements. For example, CMS notes that it is 

expanding the use of site visits and has made improvements to the NSVC 

training process since the time of our review. CMS also described the ways 

in which it has already made progress on our recommendations. Some of 

this progress includes working with the MACs and NSC to ensure they are 

verifying all information on enrollment and revalidation applications, 

analyzing data provided by OIG on site visit results that were inconsistent 

with enrollment decisions, revising the general site visit form, and 

improving the accuracy and completeness of data stored in PECOS. We 

look forward to receiving updates from CMS on its progress toward these 

recommendations through the actions it described. Appendix C contains 

the full text of CMS’s comments.
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 22

APPENDIX A

Figure A-1: General Site Visit Form
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 23

APPENDIX B

Table B-1 provides information on whether the 12 MACs and the NSC reported verifying 

the identification numbers that providers submitted on enrollment and revalidation 

applications. In addition, Table B-1 shows the number of contractors that verified these 

identification numbers using a source external to CMS. We did not consider MACs’ and 

the NSC’s internal review of provider-submitted documents to constitute verification with 

an outside source. 

Table B-1: Number of Contractors That Verify Identification Numbers Submitted 

by Providers on Enrollment and Revalidation Applications 

Type of 

Identification 

Number

Application 

Form(s) Entity

MACs NSC

Number 

That 

Verify

Number 

That 

Verify 

With

Outside 

Source1

Verifies

Verifies 

With

Outside 

Source1

Yes = 1, No = 0

Social 

Security 

Number

All CMS-855 

forms

Individual with ownership/managing control 11 11 1 1

Billing agent 7 7 0 0

CMS-855S Sole proprietor N/A N/A 1 1

CMS-855I All applicants 11 11 N/A N/A

CMS-855A Chain home office administrator 6 6 N/A N/A

CMS-855B

IDTF supervising physician 11 11 N/A N/A

IDTF interpreting physician 11 11 N/A N/A

IDTF technician 11 11 N/A N/A

National 

Provider 

Identifier

All CMS-855 

forms

Each practice location, business, and/or 

group affiliation of all applicants 9 7 1 1

CMS-855S Billing agent/agency N/A N/A 0 0

CMS-855I

Physician assistant’s employer when 

establishing employment 11 11 N/A N/A

Physician assistant’s employer when 

physician assistant is terminating employment 10 10 N/A N/A

Physician assistant when employer is 

terminating employment 9 9 N/A N/A

CMS-855A

Old owner in changes of ownership 10 9 N/A N/A

Acquiring provider 10 10 N/A N/A

Provider being acquired 9 9 N/A N/A

Consolidating provider 7 7 N/A N/A

Individual with ownership/managing control 9 9 N/A N/A

CMS-855B

IDTF supervising physician 11 11 N/A N/A

IDTF interpreting physician 11 11 N/A N/A

CMS-855A, 

CMS-855B, 

CMS-855S

Organization with ownership/managing 

control 8 8 0 0

continued on next page
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 24

Table B-1: Number of Contractors That Verify Identification Numbers Submitted 

by Providers on Enrollment and Revalidation Applications (Continued)

Type of 

Identification 

Number

Application 

Form(s) Entity

MACs NSC

Number 

That 

Verify

Number 

That 

Verify 

With 

Outside 

Source1

Verifies

Verifies 

With 

Outside 

Source1

Yes = 1, No = 0

National 

Provider 

Identifier 

(continued)

CMS-855B, 

CMS-855I, 

CMS-855S

Individual with ownership/managing control 11 11 0 0

Drug 

Enforcement 

Agency 

Number

CMS-855I All applicants, if applicable 0 0 N/A N/A

Tax 

Identification 

Number

All CMS-855 

forms Billing agent/agency 4 2 0 0

CMS-855S

Applicant N/A N/A 1 0

Prior tax identification number for business 

entity N/A N/A 0 0

Organization with ownership/managing 

control N/A N/A 0 0

Surety bond company N/A N/A 0 0

CMS-855I Business entity 8 0 N/A N/A

CMS-855A

Chain home office 5 0 N/A N/A

New provider in consolidations 4 0 N/A N/A

Nursing registry 4 2 N/A N/A

CMS-855A, 

CMS-855B

All applicants 5 0 N/A N/A

Organization with ownership/managing 

control 7 0 N/A N/A

Employer 

Identification 

Number

CMS-855S

Sole proprietor N/A N/A 1 0

Prior employer identification number of sole 

proprietor N/A N/A 0 0

CMS-855I

Sole proprietor 8 0 N/A N/A

Physician assistant’s employer when 

establishing employment 11 0 N/A N/A

Physician assistant’s employer when 

physician assistant is terminating employment 10 0 N/A N/A

Source: OIG analysis of data submitted by 12 MACs and the NSC, 2014. 

1 This is the number of contractors that verify the identification number using information from a source that is external to CMS. We did not consider 

MACs’ and the NSC’s internal review of provider-submitted documents to constitute verification with an outside source. For certain types of provider 

information, CMS policy does not require verification with what OIG considers an outside source. 
APPENDIX C

Agency Comments

"."."""""-",,-

( DEPAKfMllNT OF HEALlH & HUMAN SERV IC_E_S ~_Ce_n_le_rB_f_or_M_e_dl_Ca_r6_&_M_6_d_IC_81_d_se_rv_lc_es

S~ 200 Independenoe Avenue SW

Washington, DC 20201

DATE: FEB 9 2015

TO: Daniel R. Levinson

Inspector General

FROM: Andrew M. Slavitt

Acting Administrator

SUBJECT: Office ofInspector General (010) Draft Report: "Enhanced Enrollment Screening

of Medicare Providers: Early Implementation Results" (OEI-03-13-00050)

The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and

comment on the Office of Inspector General's (01G) draft report. CMS is strongly committed to

program integrity efforts in Medicare and has a number of ongoing activities to enhance and

safeguard the provider enrollment and revalidation process.

In February 2011, eMS finalized regulations to implement categorical risk-based screening of

newly enrolling Medicare providers and suppliers and revalidate all current Medicare providers

and suppliers under new requirements established by the Affordable Care Act. Limited risk

providers and suppliers undergo verification of licensure, verification of compliance with federal

regulations and state requirements, and undergo various database checks. Moderate and high risk

providers and suppliers undergo additional screening, including unannounced site visits.

Additionally, individuals with a five percent or greater direct or indirect ownership interest in a

high risk provider or supplier must consent to criminal background checks including

fingerprinting. All providers and suppliers are subject to revalidation where they are required to

resubmit and recertify the accuracy oftheir enrollment information to maintain their Medicare

billing privileges. Durable Medical Equipment, Prosthetics.Orthotics, and Supplies (DMEPOS)

suppliers revalidate every 3 years and all other providers and suppliers every 5 years.

Since these regulations were issued, more than one million providers and suppliers have been

subject to the new screening requirements. Since 2011, CMS has taken actions to deactivate

billing privileges for more than 543,000 providers and suppliers as a result of revalidation and

other screening efforts and more than 34,000 providers and supplier enrollments have been

revoked. In addition, CMS has performed nearly 250,000 site visits on Medicare providers and

suppliers. CMS uses site visits to verify that a provider's or supplier's practice location meets

requirements and helps prevent questionable providers and suppliers from enrolling or

maintaining enrollment in the Medicare program. All Medicare providers and suppliers already

enrolled prior to the new screening requirements becoming effeetive were sent revalidation

notices by March 23. 2015.

eMS is also working to expand its use of site visits. CMS will be increasing the number of site

visits that its contractor performs, initially targeting those providers and suppliers that receive

Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 25

APPENDIXC 

Agency Comments 

_.i-"f$.1tVlQ:s.f<i, C.__ ~~·	 DEPARTMENT OF HEALTH & HUMAN SERV_IC_E_s __ _______c_e_n1_er_s_1o_r_Me_d_ic_ar_e_&_M_e_dic_a_id_s_erv_i_ces 

:S.~ 200 Independence Avenue SW 

Washington, DC 20201 

FEB -~ 9 2016 DATE: 

TO: 	 Daniel R. Levinson 


Inspector General 


FROM: Andrew M. Slavitt 

Acting Administrator 

/S/

SUBJECT~ Ot1ice oflnspector General (OIG) Draft Report: ''Enhanced Enrollment Screening 

of Medicare Providers: Early Implementation Results" (OEI-03-13-00050) 

The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 

comment on the Office oflnspector General's (OIG) draft report. CMS is strongly committed to 

program integrity eff01is in Medicare and has a number of ongoing activities to enhance and 

safeguard the provider enrollment and revalidation process. 

In February 2011, CMS finalized regulations to implement categorical risk-based screening of 

newly enrolling Medicare providers and suppliers and revalidate all current Medicare providel's 

and suppliers undel' new requirements established by the Affordable Ca.re Act. Limited risk 

providers and suppliers undergo verification ofIicensure, verification of compliance with federal 

regulations and state requirements, and undergo various database checks. Moderate and high risk 

providers and suppliers undergo additional screening, including tmannotmced site visits. 

Additionally, individuals with a five percent or greater direct or indirect ownership interest in a 

high risk provider or supplier must consent to criminal background checks including 

fingerprinting. All providers and suppliers are subject to revalidation where they are required to 

resubmit and recetiify the accuracy oftheir enrollment information to maintain their Medicare 

billing privileges. Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS) 

suppliers revalidate every 3 years and all other providers and suppliers every 5 years. 

Since these regulations were issued, more than one million providers and suppliers have been 

subject to the new screening requirements. Since 2011, CMS has taken actions to deactivate 

billing privileges for more than 543,000 providers and suppliers as a result of revalidation and 

other screening effo1is and more than 34,000 providers and supplier enrollments have been 

revoked. In addition, CMS has perfonned nearly 250,000 site visits on Medicare providers and 

suppliers. CMS uses site visits to verify· that a provider's or supplier's practice location meets 

requirements and helps prevent questionable providers and suppliers from enrolling or 

maintaining enrollment in the Medicare program. All Medicare providers and suppliers already 

enrolled prior to the new screening requirements becoming effective were sent revalidation 

notices by March 23, 2015. 

CMS is also working to expand its use of site visits. CMS will be increasing the number ofsite 

visits that its contractor performs, initially targeting those providers and suppliers that receive 

Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEl-03-13-00050) 25 
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 26
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 27
Enhanced Enrollment Screening of Medicare Providers: Early Implementation Results (OEI-03-13-00050) 28

ACKNOWLEDGMENTS

This report was prepared under the direction of Linda Ragone, Regional 

Inspector General for Evaluation and Inspections in the Philadelphia 

regional office.

Tanaz Dutia served as the team leader for this study. Other Office of 

Evaluation and Inspections staff from the Philadelphia regional office who 

conducted the study include Robert A. Vito, Joanna Bisgaier, and 

Nancy J. Molyneaux. Central office staff who provided support include 

Evan Godfrey, Althea Hosein, Joanne Legomsky, Scott Manley, and 

Christine Moritz.
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of individuals served by those programs. 

This statutory mission is carried out through a nationwide network of audits, investigations, 

and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and individuals. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.