Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

JUNE GIBBS BROWN 

Inspector General 

JULY 2000 

OEI-05-99-00070 

MEDICAID 

Proactive Safeguards 
OFFICE OF INSPECTOR GENERAL 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, is to 

protect the integrity of the Department of Health and Human Services programs as well as the 

health and welfare of beneficiaries served by them. This statutory mission is carried out through a 

nationwide program of audits, investigations, inspections, sanctions, and fraud alerts. The 

Inspector General informs the Secretary of program and management problems and recommends 

legislative, regulatory, and operational approaches to correct them. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) is one of several components of the Office of 

Inspector General. It conducts short-term management and program evaluations (called 

inspections) that focus on issues of concern to the Department, the Congress, and the public. The 

inspection reports provide findings and recommendations on the efficiency, vulnerability, and 

effectiveness of departmental programs. 

OEI's Chicago Regional Office prepared this report under the direction of William C. Moran, 

Regional Inspector General and Natalie A. Coen, Deputy Regional Inspector General. Principal 

OEI staff included: 

REGION HEADQUARTERS 

John M. Traczyk, Project Leader Jennifer Antico, Program Specialist 

To obtain copies of this report, please call the Chicago Regional Office at 312-353-4124. 

Reports are also available on the World Wide Web at our home page address: 

http://www.hhs.gov/oig/oei/ 
<

EXECUTIVE SUMMARY 

PURPOSE 

This is the first of three reports describing Medicaid program safeguards. This report 

discusses proactive safeguards. The second report discusses claim processing safeguards 

and the third report discusses post payment safeguards. 

This report is intended to provide information about and increase awareness of Medicaid 

proactive safeguards. Proactive safeguards anticipate problems and attempt to thwart, or 

ward off, wrong doers. They occur before a patient receives services and before a claim 

for services is generated for payment. 

PROACTIVE SAFEGUARDS 

Provider/Vendor Enrollment (including revised enrollment forms, onsite visits,

background checks and fingerprinting, surety bonds and improved verification procedures)

makes it more difficult for unqualified and unscrupulous providers to gain access to

Medicaid systems.

Periodic Provider Re-enrollment helps screen out inactive providers and providers not

engaged in legitimate businesses. 

Provider Number Termination reduces the likelihood that they will be misused by

unscrupulous persons to defraud Medicaid. 

Provider, Patient and Employee Education should be the first line of defense against

Medicaid fraud and abuse. 

Prior Authorization is used by States to control problematic providers and abused

medical services.

Certificates of Medical Necessity are frequently used by States to obtain information

about the medical need for specific services, supplies and equipment.

Prime Vendor Contracts reduce the price of products and services by permitting a

private business entity to function as the primary source for specific services or products. 

OPPORTUNITIES FOR IMPROVEMENT 

Based on our prior studies and information gathered during this study, we encourage 

States to consider the following opportunities for improving program safeguards: 

< Target high risk providers for extensive application review and verification. 

Extensive reviews of all enrollment applications may not be cost effective; 

however, it appears that extensive reviews of specific providers and improved 

information verification techniques deter unscrupulous persons from obtaining a 

provider number. 

Proactive Safeguards 1 OEI-05-99-00070 
<

<

<

Expand the use of local field offices to conduct onsite visits to verify the 

legitimacy of problematic providers. Onsite visits appear helpful in establishing 

the legitimacy of high risk provider number applicants. Some States have 

increased the number of onsite visits and controlled the costs associated with 

onsite visits by using their local field offices. 

< Conduct more frequent and better education of providers concerning their 

obligation to protect their provider number(s) from unauthorized use and the 

need to notify Medicaid when their employment relationships with clinics 

and other providers terminates. Evidence suggest that many physicians do not 

adequately protect their provider numbers. Unscrupulous persons circumvent 

provider enrollment safeguards by stealing a legitimate provider’s billing number or 

purchasing the billing number of a legitimate provider. Some physicians are totally 

unaware that billing number information they have shared with former and 

potential employers has been used to defraud Medicaid. 

< Strengthen Federal and State laws to hold physicians and other Medicaid 

providers financially and criminally liable for participating in any deception 

that allows others to use their credentials and business to defraud or cause 

financial harm to a State Medicaid program. We believe that government 

programs need to address the vulnerability in their system safeguards stemming 

from physicians who permit others to use their identity to circumvent program 

safeguards or who permit the use of their professional licenses and places of 

business as a front to deceive Medicaid. 

< Identify and register all clearinghouses and third-party billers and improve 

safeguards to ensure that electronic claims are accepted only from authorized 

sites and terminals. Today’s Medicaid systems do not ensure that claims 

originating from billing agencies have been properly authorized by the physician 

under whose name claims are submitted. Most Medicaid programs cannot identify 

billing companies that submit claims nor can they determine which physicians use 

which billing companies. 

< Centralize responsibility for, and improve, employee fraud and abuse 

awareness training. With some exceptions, it appears that fraud and abuse 

awareness training may be too fragmented to be effective. 

We intend to do additional in depth studies on proactive safeguards used by States. 

AGENCY COMMENTS 

The HCFA believes that the opportunities for improvement described in this report provide 

valuable information that will be shared with the State Medicaid programs. 

Proactive Safeguards 2 OEI-05-99-00070 
TABLE OF CONTENTS 

PAGE 

EXECUTIVE SUMMARY

INTRODUCTION ..................................................... 4

PROACTIVE SAFEGUARDS ............................................ 6

Provider/Vendor Enrollment ...................................... 6

Application Forms 

Onsite Visits 

Background Checks & Fingerprinting 

Surety Bonds 

Third Party Verification .......................................... 9

Periodic Provider Re-enrollment .................................. 9

Provider Number Termination ................................... 10

Provider, Patient & Employee Education ........................... 11

Prior Authorization ............................................. 12

Second Opinion ............................................... 14

Certificates of Medical Necessity ................................. 15

Prime Vendor Contracts ........................................ 15

OPPORTUNITIES FOR IMPROVEMENT ................................. 16

AGENCY COMMENTS ................................................ 18

APPENDIX A ....................................................... 19

Proactive Safeguards 3 OEI-05-99-00070 
INTRODUCTION 

PURPOSE 

To provide information about and increase awareness of Medicaid Proactive safeguards. 

BACKGROUND 

Medicaid is a health insurance program for certain low income and needy people. Within 

Federal limits, each State decides eligibility, benefit coverage, administrative practices, 

reimbursement and operational resource requirements. About 70 cents of every Medicaid 

dollar goes to institutional providers (hospitals, nursing homes). Thirty cents pays for 

non-institutional services (physician services, laboratory and radiology). Federal law 

requires States to pay for services provided by certain institutional providers and noninstitutional providers. States may elect to offer additional services such as dental care, 

podiatric care and prescription drugs just to name a few. 

The Health Care Financing Administration (HCFA) is responsible for administering 

Federal matching funds to the States and for legislation and regulations affecting Title 

XIX (commonly referred to as the Medicaid program). The HCFA also provides 

guidelines, technical assistance and periodic assessments of State programs. More than 36 

million recipients are enrolled in Medicaid. In 1991, 90 percent of these recipients were 

enrolled in fee-for-service (FFS) programs. By 1998, the number of recipients in FFS had 

decreased to 46 percent and enrollment in managed care plans increased to nearly 54 

percent. Nearly $169 billion was spent by the Federal Government and the States on 

Medicaid benefits in Fiscal Year 1998. 

States are required by legislation to make every effort to eliminate waste and illegitimate 

program expenditures. States are also required to develop payment safeguards designed 

to protect their Medicaid funds from unscrupulous and fraudulent providers. Most States 

also have a Medicaid Fraud Control Unit to investigate allegations of fraud and abuse. 

Proactive Safeguards 4 OEI-05-99-00070 
METHODOLOGY 

We visited or interviewed over the telephone agency(ies) responsible for administering the 

Medicaid program in the following eight States: 

California Florida Illinois 

Louisiana Maryland Oregon 

Pennsylvania Texas 

These States were selected for site visits because they account for nearly half of all 

Medicaid expenditures. They were also chosen for their geographic location. Our site 

visits were conducted during the spring of 1999. During our visits, we discussed program 

safeguards used by the State’s Medicaid program. We spoke to State Agency officials 

and, when appropriate, to State subcontractors. 

We did not discuss payment safeguards used by managed care organizations and State 

pharmacy programs. Our discussions focused on Medicaid fee-for-service program 

safeguards. We have not attempted to assess the effectiveness of each safeguard. 

The primary purpose of this report was to compile a catalog of program safeguards used 

by eight State Medicaid programs. Every effort was made to prepare a comprehensive 

and complete list. Undoubtably, there will be some disagreement as to what constitutes a 

program safeguard. Moreover, States, their subcontractors and others may have 

information about other safeguard measures not mentioned in this report. 

This is the first of three reports on Medicaid safeguards. This report discusses proactive 

safeguards. Proactive safeguards are those measures taken to prevent fraud, abuse and 

waste before a claim is ever submitted for payment. The second report discusses claim 

processing safeguards and the final report discusses post payment safeguards. 

Proactive Safeguards 5 OEI-05-99-00070 
PROACTIVE SAFEGUARDS 

Proactive safeguards are those preventive measures used by States to reduce their 

Medicaid program’s exposure to fraud and abuse. These measures anticipate problems 

and attempt to thwart, or ward off, wrong doers. They occur before a patient receives 

services and before a claim for services is generated for payment. This report describes 

the proactive safeguards we identified in the eight States we visited. 

Provider/Vendor Enrollment 

Provider enrollment is the first line of defense in the fight against fraud and abuse. 

Keeping unqualified and unscrupulous providers from gaining access to Medicaid systems 

not only protects patients but also lowers administrative costs and protects program 

assets. 

Medicaid State Agencies, or their subcontractors, assign provider numbers to qualified 

physicians and other suppliers who furnish services and supplies to Medicaid patients. 

These numbers are required for claims processing, for accounting purposes and for 

administrative functions. To obtain a provider number, every physician, hospital and 

medical supplier must complete an enrollment application. 

Application Forms 

Florida, Oregon and Texas said that they had developed new enrollment application forms. 

These new applications are designed to solicit additional information to aid the States in 

determining whether an applicant for a provider number is qualified to provide services to 

patients and a legitimate business entity. 

The applications used by States vary in length and complexity. All solicit information 

about applicants, their tax payer identification (Employer Identification Number or Social 

Security Number), the nature of their business, the location of their business and licensing 

information. Additional information is often requested from providers that States believe 

pose the greatest risk to their Medicaid program. Most of the States require copies of 

business and professional licenses and taxpayer identification . Some ask for proof of 

insurance, copies of drivers licenses, proof of vehicle registration, proof of training or 

professional association certification. 

Most provider enrollment applications are subjected to desk reviews. All of our States 

verify business and professional licenses of applicants by contacting the license issuing 

agency. States also look for applicants who may have been excluded from participating in 

Medicare or any State Medicaid program. In Illinois, Florida, Oregon and Texas, 

applications that appear to contain discrepancies or false information are referred to 

program integrity or the Medicaid Fraud Control Unit for investigation. 

Proactive Safeguards 6 OEI-05-99-00070 
Onsite Visits 

Florida and Louisiana routinely conduct onsite visits to determine whether applicants for 

provider numbers are, in fact, operating a legitimate business. California and Illinois limit 

onsite visits to new providers who they believe pose the greatest risk to their Medicaid 

program. These States do not visit hospitals, nursing homes and other facilities that must 

pass routine Federal or State onsite inspections. They focus their efforts on durable 

medical equipment companies, diagnostic service providers and other high risk provider 

groups. 

Information received from the States of Florida and Texas demonstrate the sentinel effect 

of onsite visits. In 1 month, Florida received about 85 new provider applications from 

Dade county. Onsite visits revealed that none of these applications were legitimate, and 

all were denied. In Texas, the Medicaid State Agency made visits to the business 

location(s) of new providers during a time period specified by legislation. The number of 

new provider applicants during the study period declined by more than 50 percent. After 

the study period ended, the number of applications returned to pre-study levels. Onsite 

visits, to providers who applied during the study period, revealed that all were legitimate 

businesses. The Texas State Agency believes that bogus businesses knew they would be 

visited and delayed seeking a provider number until the test period ended. 

Some States use local welfare field offices to conduct onsite visits. Florida and Louisiana 

use local field offices and out stationed Medicaid staff to ensure that every new provider is 

visited before a provider number is issued. The Medicaid State Agency provides guidance 

on how to conduct each onsite visit but the actual visits are conducted by existing field 

office staff. 

California, Illinois, Maryland, Oregon and Texas do not conduct routine visits to new 

providers. They claim that such visits are not cost effective and that they have insufficient 

staff to undertake this endeavor. Moreover, lawsuits in California have put pressure on 

that State to stop delaying and expedite the issuance of Medicaid provider numbers. 

Background Checks And Fingerprinting 

The Florida Medicaid program conducts background investigations and fingerprints nearly 

all applicants requesting a new provider number. Florida also conducts background 

investigations and fingerprints providers re-enrolling in their Medicaid program. Florida 

uses fingerprints to verify the identity of applicants desiring to obtain a Medicaid provider 

number. Of the 60,000 providers in the Florida Medicaid program, 52,000 have 

undergone a background investigation and been fingerprinted. Of 52,000 background 

checks completed, nearly 1,600 providers were found to have a criminal record. 

Proactive Safeguards 7 OEI-05-99-00070 
Florida law allows the State Agency to deny enrollment in their Medicaid program to any 

provider1

: 

< convicted of character-related felonies; 

< found to have made false representations or omitted any material fact; 

< excluded, suspended, terminated or involuntary withdrew from any State 

Medicaid program or the Medicare program; 

< convicted of obstructing or interfering in the conduct of a criminal 

investigation; 

< found by licensing, certifying or professional standards board or agency to 

have violated the standards or conditions relating to licensure, certification 

or quality of care; 

< Failing to pay fines or overpayments assessed by the Medicaid program. 

Florida works with the State’s Department of Law Enforcement to conduct background 

checks and fingerprint re-enrolling and newly enrolling providers. All persons with 5 or 

more percent ownership in a business applying for a Medicaid provider number are 

required to be fingerprinted. In high risk counties (Dade and Broward), all re-enrolling 

and newly enrolling providers must be fingerprinted. Non-physician applicants must 

identify their referring physicians. These referring physicians must have a completed 

background investigation, have been fingerprinted and be currently enrolled in the Florida 

Medicaid program. The cost of screening applicants and re-enrolling providers is $15 per 

person. This cost is paid by the applicant. The California Medi-Cal program is also 

considering conducting background checks and fingerprinting new and re-enrolling 

Medicaid providers. 

Surety Bonds 

States are using surety bonds to address vulnerabilities in their Medicaid program. Surety 

bonds provide a financial incentive designed to discourage unscrupulous providers from 

enrolling in a State’s Medicaid program. They help to ensure that providers have the 

capacity to provide services and they provide financial protection against provider fraud. 

Florida and Louisiana can require high risk providers to post a surety bond. In Florida, a 

$50,000 surety bond is required of all new durable medical equipment providers, private 

transportation companies, non-physician owned clinics, independent laboratories and 

home health agencies. A surety bond is also required of all providers doing business in 

Dade and Broward counties, and of all new providers in the remainder of the State. 

In Louisiana providers whose behavior is unacceptable can be required to re-enroll and to 

post a bond. Louisiana “sanction bonds” and Florida’s surety bonds are intended to 

protect their Medicaid programs from potential financial losses. Bonding also adds 

1 Or any officer, agent, managing employee, affiliated person, partner or shareholder having 

ownership interest of 5 percent or more. 

Proactive Safeguards 8 OEI-05-99-00070 
another level of provider scrutiny. Most bonding companies conduct their own 

investigations to verify applicant information before agreeing to bond an individual or 

company. 

Third Party Verification 

All of the States we visited verify professional licenses of applicants with the appropriate 

State licencing board(s). Some States verify business licenses by contacting State, county 

and city business licensing departments. Some (CA & TX) verify vehicle registration or 

applicant drivers licenses. California solicits the names of manufacturers and suppliers 

having a business relationship with an applicant for a Medicaid provider number. The 

provider’s manufacturers and suppliers are then contacted to verify application 

information. The Florida State Agency compares information provided to the bonding 

company with information supplied to them during provider enrollment. 

Periodic Provider Re-enrollment 

Florida, Illinois, Louisiana and Texas have taken steps to re-enroll some or all of their 

Medicaid providers. However, the actual process for doing so is fragmented among the 

various State Agencies. In some States, the department responsible for mental health 

workers and facilities would handle worker and facility enrollment or re-enrollment. 

Pharmacies would be handled by another State Agency and so forth. 

Some States believe that provider re-enrollment is resource intensive, too costly and of 

questionable cost benefit. The last time Oregon re-enrolled providers was in 1982. 

California and Pennsylvania have never re-enrolled any of their providers. States like the 

idea of periodic re-enrollment but claim they lack staff, resources and legislative support 

for such an undertaking. 

Florida has re-enrolled all if its Medicaid providers. When Florida Medicaid asked all of 

its Medicaid providers to update their provider applications, numerous letters were 

returned as undeliverable. Florida’s re-enrollment project reduced the number of durable 

medical equipment providers from 4,385 to 1,500. The number of home health and 

transportation providers fell by nearly half after re-enrollment. Overall, Florida has 

reduced the number of Medicaid provider numbers from nearly 83,000 in 1995, to 

approximately 60,000 in 1999. Florida plans to re-enroll one-third of its providers every 3 

years. 

Illinois has begun re-enrolling the providers in their Medicaid program. Unlike Florida, 

which asked all providers to re-enroll, Illinois has decided to re-enroll providers by 

speciality. The first specialist to be re-enrolled in the Illinois Medicaid program were 

dentists. Prior to re-enrollment there were more than 3,000 provider numbers assigned to 

dentists. After re-enrollment, the number of providers fell to about 700. 

Proactive Safeguards 9 OEI-05-99-00070 
Louisiana re-enrolled all non-emergency medical transportation (NEMT) providers when 

they redesigned their program. They have also re-enrolled chiropractors, mental health 

providers, rehabilitation providers and case management providers. Like Illinois, 

Louisiana experienced a significant drop in the number of providers. 

Efforts in Texas to re-enroll Medicaid providers are currently underway. All Texas 

providers were required to re-enroll by September 1, 1999 or lose their eligibility to bill 

that State’s Medicaid program. The Texas effort is aimed at ensuring that all the 

providers in their system are legitimate businesses. 

Provider Number Termination 

Experts and law enforcement officials believe that poor controls over provider numbers 

that have been issued may be a vulnerability in Medicaid program safeguards. Information 

by States indicates that there are people who defrauded Medicaid using inactive provider 

numbers. States also told us about people who obtained multiple provider numbers and 

then used them to avoid Medicaid payment safeguards and to defraud Medicaid. One 

State mention how clinics and other providers have used the provider numbers of retired 

or former employees to defraud Medicaid. 

Florida has uncovered clinics that obtained improper Medicaid payments using the unterminated provider numbers of physicians who were no longer affiliated with the clinic or 

who had retired from active practice. Florida sent letters to physicians asking them to 

verify the clinics at which they had worked and their dates of employment. The physician 

responses showed that some clinics continued to use a physician’s provider number(s) 

after the physician had left the clinic. Overall, more than 100 clinics and physicians were 

terminated from the Florida Medicaid program for irregular billing practices. 

Florida, Louisiana and Texas have found physicians who sold their provider numbers to 

persons who then used them to defraud Medicaid. All of these States plan to take action 

against physicians who participated in schemes to defraud Medicaid. Florida has referred 

nearly 150 physicians to the State Medicaid Fraud Control Unit for investigation and 

possible referral to the Justice Department for criminal, civil and administrative 

prosecution. The State of Florida contends that these physicians established bogus 

relationships with clinics and other health care businesses that enabled others to defraud 

the State Medicaid program. 

All of the States we visited have provider number termination policies. However, some 

States appear reluctant to remove unused provider numbers from their system. In some 

States, removing a provider number is a lengthy process. All of the States we visited 

claim they can identify providers with no claims activity over a specified period of time. 

All move their inactive provider numbers to a suspense file for a specified period of time. 

Proactive Safeguards 10 OEI-05-99-00070 
If the provider submits a single claim after their number is moved to the suspense file, the 

number will be re-activated without the need for a new provider enrollment application. 

In most cases, the actual removal of a provider number from Medicaid systems occurs 

after 3 years of no claim activity; however, in some States the actual removal of a provider 

number can take 5 years or more. Providers whose numbers have been terminated must 

complete a new provider application and get a new number. 

Provider, Patient and Employee Education 

Health care experts believe that teaching providers, patients and Medicaid employees 

about fraud and abuse can have a sentinel effect on provider behavior. Provider, patient 

and employee education increases awareness as to what is not acceptable billing. It also 

increases the likelihood that potentially fraudulent and abusive practices will be reported 

for in-depth investigation. 

Provider Education 

The eight States we visited furnish provider handbooks to all of their Medicaid providers. 

Handbooks help providers understand the laws, regulations and policies that govern their 

claims and claim payment. They provide information about what is, or is not, covered and 

how to bill correctly. Providers are notified of policy changes by letter, on remittance 

advices, in bulletins and at sites on the Internet. 

States also conduct training at medical conferences, health fairs and other professional 

settings. Medicaid staff often make presentations on topics of interest to providers and 

respond to provider questions about coverage, payment and other programmatic issues. 

States also make visits to provider offices to help them correct problems with their billing 

or to explain coverage and payment policies. Onsite visits are also used to warn providers 

about unacceptable billing practices found during claims processing or post payment 

reviews. This study did not determine the quality and quantity of Medicaid provider 

education efforts. Little is known as to how much emphasis Medicaid places on provider 

awareness of fraud and abuse and the consequences of engaging in such activity. 

Patient Education 

State efforts to increase Medicaid patient awareness of fraud and abuse vary from State to 

State. One State, that we visited, felt that patients were not a good source for identifying 

potentially fraudulent and abusive providers. Other States felt they had achieved some 

degree of success in combating fraud and abuse with their patient education programs. 

Despite mixed feelings as to the effectiveness of their patient education programs, all eight 

States in our sample routinely participate in health fairs and other venues that target 

patients. 

Proactive Safeguards 11 OEI-05-99-00070 
Employee Education 

Six of the eight States told us that they had conducted training to help their employees 

spot and report possible fraud and abuse. One of these States told us that they had 

conducted training of employees in the claims processing division. They assume that other 

Medicaid operational and policy divisions (i.e., Mental Health Department, Pharmacy 

Program) have also conducted training to increase employee awareness of potential fraud 

and abuse situations. In Florida, Louisiana and Texas the State Medicaid Agency has 

centralized responsibility for all fraud and abuse training given to all employees involved 

in administering their Medicaid program. The Florida State Agency has also developed an 

employee handbook to help their employees spot potential fraud and abuse. In these 

States, employee training about fraud an abuse is centralized. 

One State felt that an organized educational effort was not needed because their 

employees knew how to spot fraud and abuse and that they would refer any questionable 

conduct to their supervisor. Eventually, the problem would find its way to the State’s 

program integrity unit. 

Prior Authorization 

All of the States we visited have identified medical services that require prior 

authorization. All of the States we visited use prior authorization to control problematic 

providers and abused medical services. Prior authorization protect patients from 

unnecessary services and procedures. The States believe that prior authorization has a 

deterrent effective. 

Most States that we visited, require providers to obtain prior authorization for acute 

hospital admissions and psychiatric hospital admissions. Responsibility for authorizing 

most services is centralized in the 

State Medicaid Agency or their 

contractor(s). In Louisiana, Louisiana 

State University, School of Dentistry 

is responsible for the prior 

authorization of dental services for 

that States’s Medicaid program. In 

Illinois, the State Medicaid program 

contracts with a private dental insurer 

for prior authorization services. An 

outside agency handles hospital 

admissions, transportation, home 

health and some ancillary services in 

Oregon. 

Acute and Psychiatric Hospital Admissions 

Ambulatory Surgical Center Services 

Dental services 

Home Health Services 

Hospital Outpatient Services 

Incontinent Supplies 

Mental Health Services 

Non-Emergency Medical Transportation 

Rehabilitation & Therapy Services 

Same Day Services 

Transplants 

Services Requiring Prior Authorization 

Proactive Safeguards 12 OEI-05-99-00070 
Some Medicaid services are authorized by local field office personnel, who use State 

guidelines when deciding whether or not to approve medical services. Local office 

medical workers have responsibility for authorizing most non-emergency medical 

transportation services provided to aged and disabled persons and to persons receiving 

general assistance. Some local field offices also authorize some other medical services 

such as personal care attendants. 

Seven States in our sample have increased their use of prior authorization. California uses 

prior authorization to control utilization of incontinent supplies and other abused services 

and supplies. California has not measured the effect of its prior authorization program but 

estimates that without the sentinel effect of prior authorization their payments for services 

would be about 20 percent greater than current expenditure levels. 

Louisiana claims that prior authorization of mental hospital and acute hospital admissions 

has saved that State more than $100 million. The State reviews diagnostic information, 

anticipated services and clinical indicators of severity of illness when deciding whether to 

approve or deny a hospital admission. This same information is used to determine the 

number of inpatient days the State Medicaid program will authorize and pay. Before prior 

authorization, Louisiana’s spending on inpatient mental health services had risen from $5 

million to $36 million annually. After the State re-engineered their policies and coverage 

guidelines and added prior authorization requirements, payments fell. Today, Louisiana 

payments for inpatient mental health services have been reduced to about $10 million per 

year. 

Prior authorization of and changes to Louisiana’s non-emergency transportation benefit 

has resulted in annual payment levels falling from $60 million per year to $8 million yearly. 

When Texas instituted prior authorization for transportation services, they saw a 

tremendous drop in the number of non-emergency medical transportation claims and 

payments. Annual payments, for transporting dialysis and cancer patients to and from 

therapy, declined from $4 million to $2 million. 

All of the States acknowledge that prior authorization has an unmeasurable deterrent 

effect. What States can measure is the number of prior authorization requests that are 

denied. While this number is small (on average, less than 5 percent), the savings from 

services denied are significant. In 1998, Pennsylvania Medicaid received more than 

174,000 prior authorization requests. About 5,200 or 3 percent of the 174,000 prior 

authorization requests were denied. These denials saved the Pennsylvania Medicaid 

program more than $25 million in 1998. Pennsylvania has seen no increase or decrease in 

their Medicaid program expenditures over the last 3 years. The State attributes this to 

their prior authorization and pre-certification policies. 

Oregon questions whether prior authorization is an effective tool or just “rubber 

stamping.” Providers are usually given Medicaid guidelines and other information that 

describes the specific criteria that must be met to obtain prior authorization. This 

information may help ensure approval of medical services. While this may be true, other 

States report that they address this vulnerability during their post payment reviews. If the 

Proactive Safeguards 13 OEI-05-99-00070 
patient medical records do not support the level of service authorized by the State, the 

provider will be asked to refund any overpayment. 

Oregon has reduced the number of services requiring prior authorization. The Oregon 

Medicaid program found that prior authorization of some services was not cost effective 

and merely made providers jump through hoops to get authorization. Oregon has 

removed some medical services, some supplies and small payment items from prior 

authorization. Oregon found that it was not cost effective to prior authorize small 

payment items. While Oregon has cut the number of services requiring prior authorization 

they have also developed stricter criteria for approving services and supplies still requiring 

prior authorization. 

Second Opinion 

Scientific evidence exists that suggests that some medical procedures and drugs are over 

used by the medical community. Despite this, most State Medicaid programs do not 

require patients to have a second opinion before undergoing over used and potentially 

medically unnecessary medical procedures. 

Pennsylvania recently terminated their second opinion program because they felt it had 

outlived its usefulness as more and more patients were enrolled in managed care. 

Pennsylvania believes that it is up to managed care organizations to decide whether or not 

they want a second opinion program. 

Nearly all of the States in our sample have abandoned mandatory second opinion 

safeguards because they found them ineffective and costly to administer. State second 

opinion programs allowed the patient’s physician to suggest other providers that the 

patient might contact for a second opinion. Patients were also permitted to choose, on 

their own, a physician for a second opinion. Several States mentioned that they still pay 

for a second medical opinion if requested by the patient. 

Illinois, California and some private 

sector insurance plans have experienced 

success with their second opinion 

programs. In Illinois and California, 

patients about to receive certain dental 

services are re-examined by dentists 

affiliated with the State’s dental 

contractor. Both claim that their dental 

second opinion program has saved 

money and prevented patients from 

undergoing unnecessary procedures. 

These States believe that the 

effectiveness of their second 

Partial List of Overused Services 

Bunionectomy Carotid endarterectomy 

Cataract surgery, Coronary artery bypass 

except congenital Coronary angioplasty 

Hemorrhoidectomy Hip replacement 

Hysterectomy Knee surgery 

Mastectomy Myringotomy with tubes 

Prostatectomy Spinal and vertebral 

surgery 

Submucosa resection Tonsillectomy with or 

Varicose vein stripping without adenoidectomy 

Proactive Safeguards 14 OEI-05-99-00070 
opinion program is due to their contracts with independent, unbiased physicians who have 

been hired to provide the second opinion. 

Certificates of Medical Necessity 

All of the States we visited require that physicians certify the medical need for specific 

services, supplies and equipment. Certificates of medical necessity (CMNs) are 

attestations by physicians stating that they have ordered the services or supplies and that 

the services and supplies ordered are medically necessary for the care and treatment of the 

patient. The CMN is submitted to Medicaid along with the claim for reimbursement. 

Processing of claims for services and supplies requiring CMNs is usually interrupted until 

the CMNs and claims are manually reviewed. Additional information is obtained from 

providers whose CMNs are incomplete or contain discrepancies that prevent further 

processing. 

Prime Vendor Contracts 

Florida, Maryland, Oregon and Texas use prime vendors to provide specific services to 

patients. Illinois is also considering using prime vendor contracts. Prime Vendor 

contracts permit a designated private business to function as the primary source for 

specific services or products produced or provided by other suppliers. The prime vendor 

is responsible for delivery of specific products and services to Medicaid patients. 

New York has passed legislation requiring the State Medicaid program to seek 

competitive bids for various durable medical equipment (DME) services. New York has 

issued Requests for Proposals (RFPs) for diapers and is developing another for diabetic 

supplies and high-compression stockings. 

Maryland uses prime vendors to provider non-emergency transportation services (NEMT). 

Local welfare offices put out requests for proposals (RFPs) and obtain bids. One, or 

more bidders, are then awarded contracts to provide all NEMT services within a particular 

geographic area. All authorized NEMT services are provided by the entity holding the 

contract. 

Oregon uses brokers to manage Medicaid patient transportation needs in the Tri-county 

area that includes Portland. The State Medicaid program pays brokers a fixed rate. The 

broker arranges the transportation services a patient needs and pays the provider that 

actually transported the patient. The difference between the State Medicaid payment and 

the broker’s expenses is the broker’s profit or loss. 

In Texas, problems identified in the State Controller’s study of Medicaid payment errors 

lead to that States limiting the number of NEMT providers. Only services authorized and 

provided by contracted providers or service companies are payable under the Texas 

Medicaid program. Illinois is considering a similar plan. 

Proactive Safeguards 15 OEI-05-99-00070 
OPPORTUNITIES 

IMPROVEMENT 

FOR 

Each of the States we visited has taken a different approach to keep unqualified and 

unscrupulous persons from gaining access to their Medicaid systems. Every State should 

have aggressive proactive safeguards. Based on our prior studies and information 

gathered during this study, we would encourage States to consider the following 

opportunities for improvement: 

Target high risk providers for extensive application review and verification. 

Today’s provider enrollment applications solicit more information than a decade ago. 

Verifying information provided on them can be improved by prioritizing applicants based 

on risk. Applicants considered high risk would undergo more extensive application 

development to verify information. 

Some States have reduced their vulnerability to fraud and abuse by improving the way that 

they verify information provided by applicants. As some States have discovered, reliance 

on application information may be a vulnerability in their provider enrollment process. 

Application information submitted by some providers has been found to be false. 

States could improve their third party verification by independently locating and 

contacting an applicant’s manufacturers, suppliers, supervising physician and other 

references. Our experience has shown that relying solely on applicant supplied 

information (i.e., names, telephone numbers, etc.) is a vulnerability.2 Independently 

verifying reference names, addresses and telephone numbers would help ensure that the 

references provided by an applicant are, in themselves, legitimate businesses or persons. 

Expand the use of local field offices to conduct onsite visits to verify the legitimacy of 

problematic providers. 

Onsite visits appear helpful in establishing the legitimacy of some provider number 

applicants. Information from States that make onsite visits demonstrates that onsite visits 

are an effective proactive safeguard. Onsite visits appear to deter unscrupulous persons 

from obtaining a provider number. 

Conduct more frequent and better education of providers concerning their obligation 

to protect their provider number(s) from unauthorized use and the need to notify 

2 Additional information about provider enrollment and application vulnerabilities can be found in 

Independent Physiological Laboratories: Vulnerabilities Confronting Medicare (OEI-05-97-00240) and 

Independent Physiological Laboratories: Carrier Perspectives (OEI-05-97-00241). 

Proactive Safeguards 16 OEI-05-99-00070 
Medicaid when their employment relationships with clinics and other providers 

terminates. 

Evidence suggest that many physicians do not adequately protect their provider numbers. 

Some States acknowledge that unscrupulous persons have circumvented their provider 

enrollment safeguards by: 

< stealing a legitimate provider’s billing number, 

< purchasing the billing number of a legitimate provider, and, 

< establishing themselves as a billing company. 

According to Florida and Texas, some physicians are totally unaware that billing number 

information they have shared with former and potential employers has been used to 

defraud Medicaid. Other physicians knowingly sell their provider numbers to non 

physician providers. These physicians, many of whom are retired, accept payments for the 

use of their credentials. In an effort to stop misuse of physician provider numbers, the 

State of Florida visits all physicians who meet certain criteria that suggest the physician 

may be no longer be in active medical practice. Better provider number termination 

policies and periodic contacts with physicians to verify that provider information is current 

would improve safeguards.3 

Strengthen Federal and State laws to hold physicians and other Medicaid providers 

financially and criminally liable for reckless conduct for participating in any deception 

that allows others to use their credentials and business to defraud or cause financial 

harm to Medicaid program. 

Medicaid funds obtained through fraud and deception are often paid to a third party. Our 

past studies, and this study, have shown that third parties obtain the assistance of 

physicians and other providers to facilitate the perpetration of fraud against government 

programs.4 We believe that government programs need to address this vulnerability in 

their system safeguards stemming from physicians who permit others to use their identity 

to circumvent program safeguards or who permit the use of their professional licenses and 

places of business as a front to deceive Medicaid. Physicians found to be in reckless 

disregard of such a law should face criminal, civil and administrative actions. 

Identify and register all clearinghouses and third-party billers and improve safeguards 

to ensure that electronic claims are accepted only from authorized sites and terminals. 

Unscrupulous persons can circumvent enrollment safeguards by operating a billing service 

and offering trial periods and other incentives to obtain a physician’s billing 

3 Additional information about provider enrollment and application vulnerabilities can be found in 

Independent Physiological Laboratories: Vulnerabilities Confronting Medicare (OEI-05-97-00240), 

Independent Physiological Laboratories: Carrier Perspectives (OEI-05-97-00241) and Medical Billing 

Software and Processes Used to Prepare Claims (OEI-05-99-00100). 

4 Ibid. 

Proactive Safeguards 17 OEI-05-99-00070 
number. Once a legitimate provider number is known, a billing agency can misuse it. 

Today’s Medicaid systems do not ensure that claims originating from billing agencies have 

been properly authorized by the physician under whose name claims are submitted. Most 

Medicaid programs cannot identify billing companies that submit claims nor can they 

determine which physicians use which billing companies.5 

Centralize responsibility for, and improve, employee fraud and abuse awareness 

training. 

With some exceptions, it appears that Medicaid staff (and subcontracted staff) training 

about fraud and abuse may be too fragmented to be effective. Staff training about fraud 

and abuse is often left to the different State components (pharmacy, long-term care, 

dental, etc.) and not the responsibility of any single centralized agency.6 

All of the States we visited have an internal unit to conduct reviews and research 

allegations of wrong doing. These units provide an opportunity for improving staff 

awareness about fraud and abuse. States should consider using these units to improve 

employee awareness of their responsibility to help identify and combat fraud and abuse. 

Moreover, improving the visibility of these units can provide States with an opportunity to 

streamline and clarify fraud and abuse reporting processes and help reduce the likelihood 

that allegations of fraud and abuse would be inappropriately handled. 

Patient advocates, case managers, second medical/dental opinions and certificates of 

medical necessity also provide additional opportunities for improving Medicaid 

safeguards. States with patient advocates help patients make informed medical decisions, 

provide treatment and care alternatives and reduce the number of medically unnecessary 

procedures. States that subcontract with specialists to provide second opinions appear to 

have been successful in curbing abuse of certain procedures. An opportunity exists to 

improve State second opinion programs. Second opinions from independent parties help 

control questionable medical procedures. They can also be used as a deterrent to prevent 

overutilization of services requiring a certificate of medical necessity. Random second 

opinions may provide an opportunity for improving safeguards to protect Medicaid 

programs against forged and inaccurate certificates of medical necessity. 

AGENCY COMMENTS 

We received comments on this report from HCFA. The HCFA believes that the opportunities for 

improvement described in this report provide valuable information that will be shared with the 

State Medicaid programs. The full text of HCFA’s comments can be found in Appendix A. 

5 Additional information about billing companies and system vulnerabilities can be found in 

Medical Billing Software and Processes Used to Prepare Claims. OEI-05-99-00100. 

6 Additional information about fragmented responsibilities for the handling fraud and abuse issues 

can be found in Carrier Fraud Units. OEI-05-94-00470. 

Proactive Safeguards 18 OEI-05-99-00070 
APPENDIX A 

HCFA Comments on this Report 

Proactive Safeguards 19 OEI-05-99-00070 
Proactive Safeguards 20 OEI-05-99-00070 
Proactive Safeguards 21 OEI-05-99-00070