MEDICARE AND 

MEDICAID

CMS Needs to Fully 

Align Its Antifraud 

Efforts with the Fraud 

Risk Framework

Report to Congressional Addressees

December 2017

GAO-18-88

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-88, a report to 

congressional addressees

December 2017

MEDICARE AND MEDICAID

CMS Needs to Fully Align Its Antifraud Efforts with 

the Fraud Risk Framework

What GAO Found

The approach that the Centers for Medicare & Medicaid Services (CMS) has 

taken for managing fraud risks across its four principal programs—Medicare, 

Medicaid, the Children’s Health Insurance Program (CHIP), and the healthinsurance marketplaces—is incorporated into its broader program-integrity 

approach. According to CMS officials, this broader program-integrity approach 

can help the agency develop control activities to address multiple sources of 

improper payments, including fraud. As the figure below shows, CMS views 

fraud as part of a spectrum of actions that may result in improper payments. 

Centers for Medicare & Medicaid Services (CMS) Description of How the Agency Addresses

the Spectrum of Fraud, Waste, and Abuse 

CMS’s efforts managing fraud risks in Medicare and Medicaid partially align with 

GAO’s 2015 A Framework for Managing Fraud Risks in Federal Programs

(Fraud Risk Framework). This framework describes leading practices in four 

components: commit, assess, design and implement, and evaluate and adapt. 

CMS has shown commitment to combating fraud in part by establishing a 

dedicated entity—the Center for Program Integrity—to lead antifraud efforts.

Furthermore, CMS is offering and requiring antifraud training for stakeholder 

groups such as providers, beneficiaries, and health-insurance plans. However, 

CMS does not require fraud-awareness training on a regular basis for 

employees, a practice that the framework identifies as a way agencies can help 

create a culture of integrity and compliance. Regarding the assess and design 

and implement components, CMS has taken steps to identify fraud risks, such as 

by designating specific provider types as high risk and developing associated 

control activities. However, it has not conducted a fraud risk assessment for 

Medicare or Medicaid, and has not designed and implemented a risk-based 

antifraud strategy. A fraud risk assessment allows managers to fully consider 

fraud risks to their programs, analyze their likelihood and impact, and prioritize 

risks. Managers can then design and implement a strategy with specific control 

activities to mitigate these fraud risks, as well as an appropriate evaluation

approach consistent with the evaluate and adapt component. By developing a 

fraud risk assessment and using that assessment to create an antifraud strategy

and evaluation approach, CMS could better ensure that it is addressing the full 

portfolio of risks and strategically targeting the most-significant fraud risks facing

Medicare and Medicaid.

View GAO-18-88. For more information, 

contact Seto Bagdoyan at (202) 512-6722 or 

bagdoyans@gao.gov.

Why GAO Did This Study

CMS, an agency within the Department 

of Health and Human Services (HHS),

provides health coverage for over 145 

million Americans through its four 

principal programs, with annual outlays 

of about $1.1 trillion. GAO has 

designated the two largest programs, 

Medicare and Medicaid, as high risk 

partly due to their vulnerability to fraud, 

waste, and abuse. In fiscal year 2016, 

improper payment estimates for these 

programs totaled about $95 billion.

GAO’s Fraud Risk Framework and the 

subsequent enactment of the Fraud 

Reduction and Data Analytics Act of 

2015 have called attention to the 

importance of federal agencies’ 

antifraud efforts. This report examines 

(1) CMS’s approach for managing 

fraud risks across its four principal 

programs, and (2) how CMS’s efforts

managing fraud risks in Medicare and 

Medicaid align with the Fraud Risk 

Framework.

GAO reviewed laws and regulations 

and HHS and CMS documents, such 

as program-integrity manuals. It also

interviewed CMS officials and a 

sample of CMS stakeholders, including

state officials and contractors. GAO 

selected states based on fraud risk and 

other factors, such as geographic 

diversity. GAO selected contractors 

based on a mix of companies and 

geographic areas served.

What GAO Recommends

GAO recommends that CMS (1) 

provide and require fraud-awareness 

training to its employees, (2) conduct 

fraud risk assessments, and (3) create 

an antifraud strategy for Medicare and 

Medicaid, including an approach for 

evaluation. HHS concurred with GAO’s 

recommendations.
Page i GAO-18-88 CMS Fraud Risk Management

Letter 1

Background 4

CMS Manages Fraud Risks as Part of Its Agency-Wide ProgramIntegrity Activities and through an Extensive Network of 

Stakeholders 13

CMS’s Efforts Managing Fraud Risks in Medicare and Medicaid 

Are Partially Aligned with the Fraud Risk Framework 22

Conclusions 48

Recommendations for Executive Action 49

Agency Comments 50

Appendix I Comments from the Department of Health and Human Services 54

Appendix II GAO Contact and Staff Acknowledgments 58

Table

Table 1: Summary of Centers for Medicare & Medicaid Services’ 

(CMS) Four Principal Programs 4

Figures

Figure 1: Federal Spending on Medicare, Medicaid, CHIP, and 

Health-Insurance Marketplaces Is Projected to Increase 6

Figure 2: The Fraud Risk Management Framework 11

Figure 3: Centers for Medicare & Medicaid Services (CMS) 

Description of How the Agency Addresses the Spectrum 

of Fraud, Waste, and Abuse 14

Figure 4: CMS Works with an Extensive Network of Stakeholders 

to Manage Fraud Risks 18

Figure 5: CMS and Stakeholder Roles and Responsibilities in 

Managing Fraud Risks for Its Four Principal Programs 20

Figure 6: Key Elements of the Fraud Risk Assessment Process 37

Contents
Page ii GAO-18-88 CMS Fraud Risk Management

Abbreviations

CBO Congressional Budget Office

CHIP Children’s Health Insurance Program

CM Center for Medicare

CMCS Center for Medicaid and CHIP Services

CMMI Center for Medicare and Medicaid

Innovation

CMS Centers for Medicare & Medicaid Services

CPI Center for Program Integrity

DOJ Department of Justice

FFS fee-for-service

FPS Fraud Prevention System

Fraud Risk Framework A Framework for Managing Fraud Risks in

Federal Programs

HCFAC Health Care Fraud and Abuse Control

HFPP Healthcare Fraud Prevention Partnership

HHS Department of Health and Human Services

MFCU Medicaid Fraud Control Unit

OIG Office of the Inspector General

OMB Office of Management and Budget

PPACA Patient Protection and Affordable Care Act

of 2010

UPIC Unified Program Integrity Contractor

ZPIC Zone Program Integrity Contractor

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-18-88 CMS Fraud Risk Management

441 G St. N.W.

Washington, DC 20548

December 5, 2017

Congressional Addressees

The Centers for Medicare & Medicaid Services (CMS)—an agency within 

the Department of Health and Human Services (HHS)—provides health 

coverage for over 145 million Americans, but its programs are susceptible 

to fraud.1 Instances of fraud in CMS programs have been regularly and 

widely reported, involving multimillion-dollar scams and false claims. For 

example, in 2015 a Michigan oncologist was sentenced for submitting $34 

million in fraudulent claims to Medicare and private insurance companies 

for administering medically unnecessary chemotherapy to 553 patients. 

Every year, the federal government investigates hundreds of fraud cases 

involving CMS programs and during fiscal year 2016 won or negotiated 

about $2.5 billion in health-care fraud judgments and settlements as a 

result of federal investigations and prosecutions.

According to the Congressional Budget Office (CBO), annual mandatory 

outlays for CMS’s four principal programs—Medicare, Medicaid, the 

Children’s Health Insurance Program (CHIP), and the health-insurance 

marketplaces2

—total about $1.1 trillion. Total outlays across these CMS 

programs are projected to nearly double in the next 10 years. Medicare 

and Medicaid are the largest CMS programs, covering approximately 129 

million individuals in fiscal year 2016, with total outlays of about $1 trillion.

In addition to their size and related expenditures, the complexities of 

these programs—such as Medicare’s four distinct program parts and the 

variation in states’ design and implementation of Medicaid—pose 

challenges to CMS oversight and present opportunities to be exploited for 

fraud.3 We have designated Medicare and Medicaid as high-risk 

programs due to their size, complexity, and vulnerability to fraud, waste, 

 1

Fraud involves obtaining something of value through willful misrepresentation. 

2

In this report, we refer to the federally facilitated marketplace and state-based 

marketplaces as the health-insurance marketplaces. 

3

Within federal requirements, states have significant flexibility to design and implement 

their Medicaid programs, resulting in over 50 distinct state-based programs. Medicaid 

programs are jointly administered by CMS and the 50 states, the District of Columbia, and 

five territories (American Samoa, the Commonwealth of the Northern Mariana Islands, 

Guam, Puerto Rico, and the U.S. Virgin Islands). In this report, we use the term “states” to 

refer to the 50 states and the District of Columbia. 

Letter
Page 2 GAO-18-88 CMS Fraud Risk Management

and abuse.4 Although the extent of fraud in Medicare and Medicaid is 

unknown, given the large size of the programs even a small percentage 

of fraud poses significant risks to the integrity of these programs.

This report addresses CMS fraud risk management efforts in light of 

GAO’s July 2015 A Framework for Managing Fraud Risks in Federal 

Programs (Fraud Risk Framework), which describes key components and 

leading practices for agencies to proactively and strategically manage 

fraud risks.5 Our objectives were to determine: (1) CMS’s approach for 

managing fraud risks across its four principal programs and (2) how 

CMS’s efforts for managing fraud risks in Medicare and Medicaid align 

with GAO’s Fraud Risk Framework. We performed our work under the 

authority of the Comptroller General to assist Congress with its oversight.

To address both objectives, we reviewed relevant laws, regulations, and 

HHS and CMS documents, such as strategic plans, reports to Congress, 

program-integrity manuals, guidance, and other documents issued from 

2011 through 2017.6 We also reviewed reports by GAO and the HHS 

Office of the Inspector General (OIG) on antifraud and program-integrity 

topics across Medicare and Medicaid.

Furthermore, for both objectives, we interviewed CMS officials from the 

Center for Program Integrity (CPI) as well as officials from other centers 

and offices within CMS. We interviewed a nongeneralizable sample of 

CMS stakeholders including states, contractors, private health-insurance 

plans, federal law-enforcement agencies, as well as industry experts.

For our sample of stakeholders, we selected four states—Florida, 

Maryland, Michigan, and Oregon—based on health-care fraud risk 

factors. We selected two states (Florida and Michigan) meeting our highrisk criteria: the presence of Medicare Fraud Strike Force Teams,7

 4

GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial Efforts 

Needed on Others, GAO-17-317 (Washington, D.C.: February 2017). 

5

GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP 

(Washington, D.C.: July 2015). 

6

We selected this period to include CMS’s 2011 strategic document describing the 

agency’s new approach to address fraud.

7

Medicare Fraud Strike Force Teams, a joint Department of Justice (DOJ) and HHS OIG 

program, consist of investigators and prosecutors who use data-analysis and traditional 

law-enforcement techniques to identify, investigate, and prosecute potentially fraudulent 

billing patterns in geographic areas with high rates of health-care fraud.
Page 3 GAO-18-88 CMS Fraud Risk Management

temporary moratoriums on certain newly enrolling providers and suppliers 

in specific geographic areas, and a high number of Medicaid fraud 

investigations. We also selected two states (Maryland and Oregon) that 

did not meet our high-risk criteria. These four states also represented a 

mix of Medicaid spending, enrollment in managed care, and geographic 

variation. For each state, we interviewed state officials from the Medicaid 

program-integrity unit, Medicaid Fraud Control Unit (MFCU), and state 

audit organization.8

In addition to the states, we interviewed national and regional CMS 

contractors. We interviewed all national contractors that we identified as 

most directly involved in CMS’s antifraud and program-integrity efforts; 

there were six such contractors. We also interviewed six regional CMS 

contractors. We identified six types of regional CMS antifraud and 

program-integrity contractors, and interviewed one of each type.9 We 

selected these contractors to achieve a mix of companies holding each 

type of regional contract (some companies hold more than one type of 

contract), and to ensure geographic diversity of the areas they serve. We 

also interviewed officials from one national and one regional private 

health-insurance plan. We chose these two plans because they are 

among larger plans that provide Medicare, Medicaid, and commercial 

services. We chose one large regional and one national health-insurance 

plan to obtain a diversity of perspectives.

In addressing our second objective, we evaluated CMS’s efforts against 

the four components of the Fraud Risk Framework: (1) commit to 

combating fraud by creating an organizational culture and structure 

conducive to fraud risk management; (2) plan regular fraud risk 

assessments and assess risks to determine a fraud risk profile; (3) design 

and implement strategy with specific control activities to mitigate 

assessed fraud risks and collaborate to help ensure effective 

implementation; and (4) evaluate outcomes using a risk-based approach 

and adapt activities to improve fraud risk management. In doing so, we 

reviewed agency documents and information obtained from interviews 

 8

MFCUs are responsible for investigating and prosecuting Medicaid fraud; HHS OIG 

provides funding and oversight for MFCUs, which generally are located in state Attorney 

General offices. State program-integrity offices refer cases to these units. All states have 

an MFCU, with the exception of North Dakota.

9

For example, regional CMS contractors include Zone Program Integrity Contractors 

(ZPIC), Unified Program Integrity Contractors (UPIC), and Medicare Administrative 

Contractors, among others. 
Page 4 GAO-18-88 CMS Fraud Risk Management

that enabled us to compare CMS’s antifraud efforts against each of these 

components. We did not evaluate the effectiveness of individual CMS 

fraud control activities and other antifraud efforts we describe in the 

report.

We conducted this performance audit from May 2016 to December 2017 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

CMS has four principal programs: Medicare, Medicaid, CHIP, and the 

health-insurance marketplaces. See table 1 for information about the four 

programs.

Table 1: Summary of Centers for Medicare & Medicaid Services’ (CMS) Four Principal Programs

Program (year 

established)

Purpose Features Number of 

beneficiaries, 

fiscal year 2016 

estimates 

(millions)

Mandatory 

federal outlays, 

fiscal year 2016 

(dollars in 

billions)

Medicare (Parts A 

and B: 1965

Part C: 1997

Part D: 2003)

Health insurance for 

persons aged 65 and 

over, certain individuals 

with disabilities, and 

individuals with end-stage 

renal disease

Federally funded with beneficiary costsharing.

Part A—hospital insurance (fee-forservice [FFS])a

Part B—outpatient care (FFS)

Part C—alternative to Parts A and B 

through private health-insurance plans, 

now also known as Medicare Advantage 

or managed careb

Part D—voluntary, outpatient prescriptiondrug coverage through stand-alone drug 

plans or Medicare Advantage drug plans 

57c 692d

Medicaid (1965) Health-insurance 

coverage for low-income 

and medically needy 

individuals

Jointly funded by the federal government 

and the states. States have significant 

flexibility to design and implement their 

programs, resulting in over 50 distinct 

state programs. States can have multiple 

delivery systems—such as FFSa and 

managed-careb arrangements—and 

states vary considerably in the extent to 

which they enroll beneficiaries in FFS 

versus managed care. 

72 368

Background
Page 5 GAO-18-88 CMS Fraud Risk Management

Program (year 

established)

Purpose Features Number of 

beneficiaries, 

fiscal year 2016 

estimates 

(millions)

Mandatory 

federal outlays, 

fiscal year 2016 

(dollars in 

billions)

Children’s Health 

Insurance Program 

(CHIP) (1997)

Health insurance for 

children whose household 

income exceeds limits for 

Medicaid eligibility

Jointly funded by the federal government 

and the states. States may choose to 

create a separate child-health program, 

expand Medicaid benefits and services to 

CHIP-eligible children, or do a 

combination of both approaches.

9 14

Health-insurance 

marketplaces (2010) 

Health-insurance 

exchanges (or 

marketplaces) for eligible 

individuals who may 

compare and select 

among qualified health 

plans

States may elect to operate their own 

marketplace, or may rely on the federally 

facilitated marketplace. Individuals who 

purchase coverage in the marketplaces 

may be eligible for financial assistance 

from the federal government to offset the 

cost of coverage. CMS and states play a 

role in overseeing the marketplaces. For 

example, CMS directly operates the 

federally facilitated marketplace and 

establishes minimum standards that all 

qualified health plans must meet to 

participate in any marketplace.

11e 42f

Source: GAO analysis of Congressional Budget Office (CBO), Department of Health and Human Services (HHS), and CMS data. | GAO-18-88

a

In FFS, providers submit claims for reimbursement after services have been rendered. Under FFS, 

Medicare (or states in Medicaid) pay providers for each service delivered (e.g., office visit, test, or 

procedure).

b

In managed care, managed-care organizations (also known as health-insurance plans) are paid a 

predetermined, fixed periodic amount per enrollee that does not vary based on number or cost of 

health-care services an enrollee uses—typically per enrollee per month. These organizations are at 

financial risk if spending on services and administration exceeds payments from Medicare (or from 

states, for Medicaid). States may have different types of managed-care arrangements in Medicaid; in 

this report, we are referring to comprehensive, risk-based managed care, the most-common type of 

managed-care arrangement.

c

Medicare projections are for calendar year 2016.

d

Data include gross spending and exclude the effects of Medicare premiums and other offsetting 

receipts.

e

Data reflect the number of individuals who paid their first month’s premiums and had active policies 

as of March 2016.

f

Data reflect spending to subsidize health insurance purchased through the marketplaces and 

spending to stabilize premiums for health insurance purchased by individuals and small employers.

As discussed earlier, Medicare and Medicaid are CMS’s largest programs 

and have been growing steadily (see fig. 1). CBO projects that, in 2026, 

under current law, Medicare spending will reach $1.3 trillion. Medicaid is 

also expected to continue to grow—program spending is projected to 

increase 66 percent to over $950 billion by fiscal year 2025, and more 

than half of the states have chosen to expand their Medicaid programs by 

covering certain low-income adults not historically eligible for Medicaid 
Page 6 GAO-18-88 CMS Fraud Risk Management

coverage, as authorized under the Patient Protection and Affordable Care 

Act of 2010 (PPACA).

Figure 1: Federal Spending on Medicare, Medicaid, CHIP, and Health-Insurance Marketplaces Is Projected to Increase

a

Spending for Medicare refers to net spending for Medicare, which accounts for offsetting receipts 

that are credited to the program. Those offsetting receipts are mostly premium payments made by 

beneficiaries to the government.

b

“Marketplace Subsidies” refers to spending to subsidize the health insurance purchased through the 

marketplaces established under the Patient Protection and Affordable Care Act and spending to 

stabilize premiums for health insurance purchased by individuals and small employers.

The two programs’ use of managed-care delivery systems to provide care 

has also increased.10 For example, the number and percentage of 

 10In managed care, managed-care organizations (also known as health-insurance plans) 

are paid a predetermined, fixed periodic amount per enrollee that does not vary based on 

number or cost of health-care services an enrollee uses—typically per enrollee per month. 

These organizations are at financial risk if spending on services and administration 

exceeds payments from Medicare (or from states, for Medicaid). States may have different 

types of managed-care arrangements in Medicaid; in this report, we are referring to 

comprehensive, risk-based managed care, the most-common type of managed-care 

arrangement. 
Page 7 GAO-18-88 CMS Fraud Risk Management

Medicare beneficiaries enrolled in Medicare Part C has grown steadily 

over the past several years, increasing from 8.7 million (20 percent of all 

Medicare beneficiaries) in calendar year 2007 to 17.5 million (32 percent 

of all Medicare beneficiaries) in calendar year 2015.11 As of July 1, 2015, 

nearly two-thirds of all Medicaid beneficiaries were enrolled in managedcare plans and about 40 percent of expenditures in fiscal year 2015 were 

for health-care services delivered through managed care.12

CMS receives appropriations to carry out antifraud activities through 

several funds including the Health Care Fraud and Abuse Control 

(HCFAC) program and the Medicaid Integrity Program. The HCFAC 

program was established under the Health Insurance Portability and 

Accountability Act of 1996 to coordinate federal, state, and local lawenforcement efforts to address health-care fraud and abuse and to 

conduct investigations and audits, among other things. In fiscal year 

2016, CMS received $560 million through the HCFAC program 

appropriations. The Medicaid Integrity Program, established by the Deficit 

Reduction Act of 2005, supports contracts to audit and identify 

overpayments in Medicaid claims, and provides technical assistance for 

states’ program-integrity efforts.13 According to CMS, it received $75 

million every year since fiscal year 2009 through the Medicaid Integrity 

Program appropriations.14 According to CMS, in fiscal year 2016, total 

program-integrity obligations to address fraud, waste, and abuse for 

Medicare and Medicaid were $1.45 billion.

 11See The Boards of Trustees, Federal Hospital Insurance and Federal Supplementary 

Medical Insurance Trust Funds, 2016 Annual Report of the Boards of Trustees of the 

Federal Hospital Insurance and Federal Supplementary Medical Insurance Trust Funds

(Washington, D.C.: 2016).

12For enrollment, see Centers for Medicare & Medicaid Services, Medicaid Managed Care 

Enrollment and Program Characteristics, advance copy (Washington, D.C.: 2016). For 

expenditures, see Centers for Medicare & Medicaid Services, Office of the Actuary, 2016 

Actuarial Report on the Financial Outlook for Medicaid (Baltimore, Md.: 2016).

13CMS also uses the HCFAC program to fund its Medicaid program-integrity activities.

14For each fiscal year since 2010, the amount appropriated has been the previous year’s 

appropriation adjusted for inflation.

CMS Funding to Address 

Fraud, Waste, and Abuse
Page 8 GAO-18-88 CMS Fraud Risk Management

As mentioned previously, we designated Medicare and Medicaid as highrisk programs starting in 1990 and 2003, respectively, because their size, 

scope, and complexity make them vulnerable to fraud, waste, and 

abuse.15 Similarly, the Office of Management and Budget (OMB) 

designated all parts of Medicare as well as Medicaid “high-priority” 

programs because these programs report $750 million or more in 

estimated improper payments in a given year. We also highlighted 

challenges associated with improper payments in Medicare and Medicaid 

in our annual report on duplication and opportunities for cost savings in 

federal programs.16

Improper payments are a significant risk to the Medicare and Medicaid 

programs and can include payments made as a result of fraud. Improper 

payments are payments that are either made in an incorrect amount 

(overpayments and underpayments) or those that should not be made at 

all.17 For example, CMS estimated in fiscal year 2016 that the Medicare 

fee-for-service (FFS) improper payment rate was 11 percent 

(approximately $41 billion) and the Medicaid improper payment rate was 

10.5 percent (approximately $36 billion).18 Improper payment 

measurement does not specifically identify or estimate improper 

payments due to fraud.

Health-care fraud can take many forms, and a single case can involve 

more than one scheme. Schemes may include fraudulent billing for 

services not provided, services provided that were not medically 

 15GAO-17-317.

16GAO, 2017 Annual Report: Additional Opportunities to Reduce Fragmentation, Overlap, 

and Duplication and Achieve Other Financial Benefits, GAO-17-491SP (Washington, D.C.: 

April 2017).

17An improper payment is defined as any payment that should not have been made or 

that was made in an incorrect amount (including overpayments and underpayments) 

under statutory, contractual, administrative, or other legally applicable requirements. It 

includes any payment to an ineligible recipient, any payment for an ineligible good or 

service, any duplicate payment, any payment for a good or service not received (except 

for such payments where authorized by law), and any payment that does not account for 

credit for applicable discounts. See 31 U.S.C. § 3321 note. OMB guidance also instructs 

agencies to report as improper payments any payment for which insufficient or no 

documentation was found.

18In fiscal year 2016, the improper payment rate for Medicare Part C was 9.99 percent 

(approximately $16 billion) and for Medicare Part D was 3.41 percent (approximately $2 

billion).

Fraud Vulnerabilities and 

Improper Payments in 

Medicare and Medicaid

Types of Health-Care 

Fraud and Fraud Risk
Page 9 GAO-18-88 CMS Fraud Risk Management

necessary, and services intentionally billed at a higher level than 

appropriate. These fraud schemes may include compensating providers, 

beneficiaries, or others for participating in the fraud scheme.19 Fraud can 

be regionally focused or can target particular service areas such as 

home-health services, or durable medical equipment such as 

wheelchairs. Fraud may also have nonfinancial effects. For example, 

patients may be subjected to harmful or unnecessary services by 

fraudulent providers. Fraud can be perpetrated by different actors, such 

as providers, beneficiaries, health-insurance plans, as well as organized 

crime.

Fraud and “fraud risk” are distinct concepts. Fraud is challenging to detect 

because of its deceptive nature. Additionally, once suspected fraud is 

identified, alleged fraud cases may be prosecuted. If the court determines 

that fraud took place, then fraudulent spending may be recovered. Fraud 

risk exists when individuals have an opportunity to engage in fraudulent 

activity, have an incentive or are under pressure to commit fraud, or are 

able to rationalize committing fraud. When fraud risks can be identified 

and mitigated, fraud may be less likely to occur.

Although the occurrence of one or more cases of health-care fraud 

indicates there is a fraud risk, a fraud risk can exist even if fraud has not 

yet been identified or occurred. Suspicious billing patterns, certain types 

of health-care providers, or complexities in program design may indicate 

a risk of fraud. Information to help identify potential fraud risks may come 

from various sources, including whistleblowers, agency officials, 

contractors, law-enforcement agencies, beneficiaries, or providers.

According to federal standards and guidance, executive-branch agency 

managers are responsible for managing fraud risks and implementing 

practices for combating those risks. Federal internal control standards call 

for agency management officials to assess the internal and external risks

their entities face as they seek to achieve their objectives. The standards 

state that as part of this overall assessment, management should 

consider the potential for fraud when identifying, analyzing, and 

 19For additional information about the types of health-care fraud schemes, see GAO, 

Health Care Fraud: Information on Most Common Schemes and Likely Effect of Smart 

Cards, GAO-16-216 (Washington, D.C.: Jan. 22, 2016). 

Fraud Risk Management 

Standards and Guidance
Page 10 GAO-18-88 CMS Fraud Risk Management

responding to risks.20 Risk management is a formal and disciplined 

practice for addressing risk and reducing it to an acceptable level.21

In July 2015, GAO issued the Fraud Risk Framework, which provides a 

comprehensive set of key components and leading practices that serve 

as a guide for agency managers to use when developing efforts to 

combat fraud in a strategic, risk-based way.22 The Fraud Risk Framework 

describes leading practices in four components: commit, assess, design 

and implement, and evaluate and adapt, as depicted in figure 2.

 20GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: September 2014). 

21MITRE, Government-wide Payment Integrity: New approaches and Solutions Needed 

(McLean, Va.: February 2016).

22GAO-15-593SP. 
Page 11 GAO-18-88 CMS Fraud Risk Management

Figure 2: The Fraud Risk Management Framework

The Fraud Reduction and Data Analytics Act of 2015, enacted in June 

2016, requires OMB to establish guidelines for federal agencies to create 

controls to identify and assess fraud risks and design and implement 

antifraud control activities. The act further requires OMB to incorporate 

the leading practices from the Fraud Risk Framework in the guidelines. In 
Page 12 GAO-18-88 CMS Fraud Risk Management

July 2016, OMB published guidance about enterprise risk management 

and internal controls in federal executive departments and agencies.23

Among other things, this guidance affirms that managers should adhere 

to the leading practices identified in the Fraud Risk Framework. Further, 

the act requires federal agencies to submit to Congress a progress report 

each year for 3 consecutive years on the implementation of the controls 

established under OMB guidelines, among other things.24

 23Office of Management and Budget, Management’s Responsibility for Enterprise Risk 

Management and Internal Control, Circular No. A-123 (Washington, D.C.: July 15, 2016).

24Pub. L. No. 114-186, § 3, 130 Stat. 546 (2016). 
Page 13 GAO-18-88 CMS Fraud Risk Management

CMS’s antifraud efforts for its four principal programs are part of the 

agency’s broader program-integrity approach to address fraud, waste, 

and abuse. CMS’s Center for Program Integrity (CPI) is the agency’s 

focal point for program integrity across the programs. According to CMS, 

its approach to program-integrity allows it to “address the whole spectrum 

of fraud, waste, and abuse.” For example, CMS describes its programintegrity activities as addressing unintentional errors resulting from 

providers being unaware of recent policy changes on one end of the 

spectrum, through somewhat more-serious patterns of abuse such as 

billing for a more-expensive service than was performed (known as 

upcoding), and finally up to serious fraudulent activities, such as billing for 

services that were not provided. CMS then aims to target its corrective 

actions to fit the risk. See figure 3 for CMS’s description of the spectrum 

of fraud, waste, and abuse that its program-integrity activities aim to 

address.

CMS Manages Fraud 

Risks as Part of Its 

Agency-Wide 

Program-Integrity 

Activities and through 

an Extensive Network 

of Stakeholders

Fraud Risk Management 

Is a Part of CMS’s Broader 

Program-Integrity 

Approach

Tradeoffs for Program-Integrity and 

Antifraud Approaches

The Fraud Risk Framework recognizes 

that agencies have flexibility in how they 

set up their antifraud activities and 

structures, and fraud risk management 

activities may be incorporated or aligned 

with other program risk management 

activities. Integrating antifraud efforts into 

a broader program-integrity approach may 

pose tradeoffs. On one hand, it offers a 

broad view of potentially aberrant 

behaviors that could inform the 

development of control activities that serve 

multiple program-integrity functions, 

including fraud risk management. On the 

other hand, without careful planning, 

integrating fraud risk management into a 

larger program-integrity approach could 

limit the amount of resources and attention 

focused specifically on fraud prevention, 

detection, and response. Additionally, 

fraud’s deceptive nature makes it harder to 

detect than other sources of improper 

payment, potentially requiring control 

activities that are specifically designed to 

prevent and detect criminal intent.

Source: GAO. | GAO-18-88
Page 14 GAO-18-88 CMS Fraud Risk Management

Figure 3: Centers for Medicare & Medicaid Services (CMS) Description of How the Agency Addresses the Spectrum of Fraud, 

Waste, and Abuse

Within its program-integrity activities, CMS has established several 

control activities that are specific to managing fraud risks, while others 

serve broader program-integrity purposes.25 According to CMS officials, 

the agency’s antifraud control activities mainly focus on providers in 

Medicare FFS. Officials told us that when CPI began operating, its 

primary focus was developing program integrity for Medicare FFS and, as 

a result, it is the most “mature” of all of CPI’s programs. CMS’s specific 

fraud control activities include, for example, the Fraud Prevention System 

(FPS), a predictive-analytics system that helps identify potentially 

fraudulent payments in Medicare FFS, and the Unified Program Integrity 

Contractors (UPIC), which detect and investigate aberrant provider 

behavior and potential fraud in Medicare and Medicaid. Other control 

activities serve broader program-integrity purposes such as to reduce 

improper payments resulting from error, waste, and abuse in addition to 

 25According to federal internal control standards, “control activities” are the policies, 

procedures, techniques, and mechanisms that enforce management’s directives to 

achieve the entity’s objectives and address related risks. In this regard, the Fraud Risk 

Framework describes examples of control activities—including predictive analytics, 

document reviews, and investigations, among other things. 
Page 15 GAO-18-88 CMS Fraud Risk Management

preventing or detecting potential fraud. For example, CMS provides 

education and outreach to Medicare providers and beneficiaries on issues 

identified through data analyses in order to reduce improper payments 

and to increase their awareness of fraud.26

HHS and CMS department- and agency-wide strategic plans guide 

CMS’s program-integrity activities—including antifraud activities.27 The 

program-integrity goals identified in the HHS strategic plan primarily focus 

on improper payments and are driven by statutory requirements.28 For 

example, the HHS strategic plan for fiscal years 2014–2018 includes 

performance goals of reducing the percentage of improper payments 

made under Medicare FFS and Medicare Parts C and D. One antifraudfocused goal in the HHS strategic plan is to increase the percentage of 

Medicare providers and suppliers identified as high risk that receive 

administrative actions, such as suspending payments to providers or 

revoking providers’ billing privileges.

HHS and CMS department- and agency-wide strategic plans also include 

an emphasis on fraud prevention and early detection—a leading practice 

in the Fraud Risk Framework—and moving away from a “pay-and-chase” 

model.29 For example, the HHS strategic plan calls for “fostering early 

detection and prevention of improper payments by focusing on preventing 

bad actors from enrolling or remaining in Medicare and Medicaid” and to 

“use public-private partnerships to prevent and detect fraud across the 

health care industry by sharing fraud-related information and data 

between the public and private sectors.” As a part of this emphasis on 

prevention, CMS developed FPS in response to the Small Business Jobs 

 26We recently reported on Medicare provider education efforts, which CMS cites as an 

important way to reduce improper payments. See GAO, Medicare Provider Education: 

Oversight of Efforts to Reduce Improper Billing Needs Improvement, GAO-17-290 

(Washington, D.C.: Mar. 10, 2017).

27Department of Health and Human Services, HHS Strategic Plan: Strategic Plan FY 

2014-2018 (Mar. 10, 2014), and Centers for Medicare & Medicaid Services, CMS 

Strategy: The Road Forward 2013-2017 (March 2013).

28OMB designated Medicare fee-for-service (FFS), Medicare Part C, Medicare Part D, 

Medicaid, and CHIP to be at high risk for improper payments. Under the Improper 

Payments Elimination and Recovery Improvement Act of 2012, CMS must establish 

annual targets and semiannual or quarterly actions for reducing improper payments.

29“Pay-and-chase” refers to the labor-intensive and time-consuming practice of trying to 

recover overpayments once they have already been made rather than preventing 

improper payments in the first place.
Page 16 GAO-18-88 CMS Fraud Risk Management

Act of 2010, which required CMS to implement predictive-analytics 

technologies. Also, the Patient Protection and Affordable Care Act of 

2010 (PPACA) included provisions to strengthen Medicare and 

Medicaid’s provider enrollment standards and procedures, among other 

program-integrity provisions.30

CMS works with an extensive and complex network of stakeholders to 

manage fraud risks in its four principal programs. In Medicaid and CHIP, 

CMS partners with and oversees the 50 states and the District of 

Columbia. Until the Deficit Reduction Act of 2005 expanded CMS’s role in 

Medicaid program integrity to provide effective federal support and 

assistance to states’ efforts to combat fraud, waste, and abuse, states 

were primarily responsible for Medicaid program integrity.31 Each state 

has its own Medicaid program-integrity unit, Medicaid Fraud Control Unit 

(MFCU), and state audit organization.32

CMS also uses numerous contractors to conduct the majority of its 

program-integrity activities. Since the enactment of Medicare in 1965, 

contractors have played an integral role in the administration of the 

program. The original Medicare program was designed so that the federal 

government contracted with health insurers or similar organizations 

experienced in handling physician and hospital claims to pay Medicare 

claims. Later, the Health Insurance Portability and Accountability Act of 

1996 required the Secretary of Health and Human Services to enter into 

contracts to promote the integrity of the Medicare program.33 According to 

CMS officials, in fiscal year 2016 contractors received 92 percent of 

CMS’s program-integrity funding. Medicare and Medicaid programintegrity contractors play a variety of roles: (1) processing and reviewing 

claims, (2) conducting site visits of providers enrolling in Medicare, (3) 

 30Pub. L. No. 111-148, § 6401–6411, 124 Stat. 119, 747–775 (Mar. 23, 2010), as 

amended by the Health Care and Education Reconciliation Act of 2010, Pub. L. No. 111-

152, 124 Stat. 1029 (Mar. 30, 2010). 

31Pub. L. No. 109-171, § 6034, 120 Stat. 4, 74–78 (2006) (codified at 42 U.S.C. § 1396u6). 

32As mentioned earlier, North Dakota does not have a MFCU. 

33Pub. L. No. 111-420, § 4241, 124 Stat. 2504, 2599 (2010) (codified at 42 U.S.C. § 

1320a-7m). In response to the Health Insurance Portability and Accountability Act of 1996, 

CMS created the Program Safeguard Contractors; currently, this role is carried out by the 

Zone Program Integrity Contractors (ZPIC) and UPICs. 

CMS Uses an Extensive 

Network of Stakeholders 

to Manage Fraud Risks 

and Plays Varying Roles in 

These Relationships
Page 17 GAO-18-88 CMS Fraud Risk Management

auditing claims and recovering overpayments, (4) performing data 

analysis, and (5) investigating aberrant claims and provider behaviors, 

among other things. States also use contractors in many of these roles for 

managing program integrity.

Additionally, multiple private health-insurance plans in Medicare Parts C 

and D and over 200 health-insurance plans in Medicaid managed care 

also carry out program-integrity activities. For the health-insurance 

marketplaces, CMS is responsible for operating the federally facilitated 

marketplace and overseeing the state-based marketplaces. CMS also 

developed the Federal Data Services Hub, which acts as a portal for 

exchanging information between state-based marketplaces, the federally 

facilitated marketplace, and state Medicaid agencies, among other 

entities, as well as other external partners, including other federal 

agencies, such as the Internal Revenue Service.34 Finally, lawenforcement groups, including the joint Department of Justice (DOJ) and 

HHS OIG Medicare Fraud Strike Force Teams, identify, investigate, and 

prosecute instances of fraud in CMS programs. See figure 4 for a 

depiction of CMS’s stakeholder network for managing fraud risks. This 

figure illustrates approximate numbers of stakeholders (through the 

concentration of dots), but not the extent of individual stakeholder roles.

 34CMS uses the Federal Services Data Hub to verify that applicant information necessary 

to support an eligibility determination is consistent with external data sources. For 

additional information, see GAO, Patient Protection and Affordable Care Act: CMS Should 

Act to Strengthen Enrollment Controls and Manage Fraud Risk, GAO-16-29 (Washington, 

D.C.: Feb. 23, 2016).
Page 18 GAO-18-88 CMS Fraud Risk Management

Figure 4: CMS Works with an Extensive Network of Stakeholders to Manage Fraud Risks

Notes: This figure illustrates approximate numbers of stakeholders (through the concentration of 

dots), but not the extent of individual stakeholder roles.
Page 19 GAO-18-88 CMS Fraud Risk Management

Beginning in 2016, CMS began consolidating the data analysis and investigations previously carried 

out in Medicare by the Zone Program Integrity Contractors and Program Safeguard Contractors, and 

in Medicaid by the Audit Medicaid Integrity Contractors, into five regional Unified Program Integrity 

Contractors (UPIC). As of September 2017, two of the five UPICs—the Midwestern and 

Northeastern—have been implemented.

a

For example, other CMS program-integrity contractors include the National Site Visit Contractor, 

Fraud Prevention System contractors, and the Supplemental Medical Review Contractor.

CMS provides oversight to, or partners with, these stakeholders to 

manage fraud risks. For oversight, CMS creates policies and guidance to 

direct stakeholders’ antifraud efforts, such as Medicare and Medicaid 

program-integrity manuals and the Medicaid Provider Enrollment 

Compendium.35 CMS also provides technical assistance to states in 

areas such as provider enrollment and data analysis. In areas where 

CMS does not have a primary role, it acts as a partner by collaborating 

and coordinating program-integrity and antifraud activities. For example, 

CMS is directly responsible for Medicare program integrity, but, in 

Medicaid and CHIP, states are the first line of program-integrity efforts. 

Similarly, CMS maintains control over Medicare FFS program integrity, 

but within Medicare managed care, it provides guidance for healthinsurance plans to carry out their own program-integrity activities.36

In the health-insurance marketplaces, CMS reviews state-based 

marketplaces’ procedures for verifying applicant eligibility for coverage. 

For example, it conducts annual reviews of the state-based marketplaces, 

which include a review of states’ fraud, waste, and abuse policies.

See figure 5 for a further description of CMS’s and various stakeholders’ 

roles and responsibilities in fraud risk management.

 35Centers for Medicare & Medicaid Services, Medicaid Provider Enrollment Compendium

(Baltimore, Md.: updated Jan. 4, 2017).

36Centers for Medicare & Medicaid Services, Prescription Drug Benefit Manual 

“Compliance Program Guidelines,” ch. 9, and Medicare Managed Care Manual 

“Compliance Program Guidelines,” ch. 21 (revised Jan. 11, 2013).
Page 20 GAO-18-88 CMS Fraud Risk Management

Figure 5: CMS and Stakeholder Roles and Responsibilities in Managing Fraud Risks for Its Four Principal Programs
Page 21 GAO-18-88 CMS Fraud Risk Management

CMS also facilitates collaboration among federal, state, and private 

entities for managing fraud risks. In 2012, CMS created the Healthcare 

Fraud Prevention Partnership (HFPP) to share information with public and 

private stakeholders and to conduct studies related to health-care fraud, 

waste, and abuse. According to CMS, as of October 2017, the HFPP 

included 89 public and private partners, including Medicare- and 

Medicaid-related federal and state agencies, law-enforcement agencies, 

private health-insurance plans (payers), and antifraud and other healthcare organizations. The HFPP has conducted studies that pool and 

analyze multiple payers’ claims data to identify providers with patterns of 

suspect billing across payers. In a recent report, participants separately 

told us that the HFPP’s studies helped them to identify and take action 

against potentially fraudulent providers and payment vulnerabilities of 

which they might not otherwise have been aware, and fostered both 

formal and informal information sharing.37

CMS’s relationships with stakeholders were varied in terms of maturity 

and extent of information sharing, according to stakeholders we 

interviewed. While some relationships between CMS and stakeholders 

have been long-standing, some are developing, and others exist on an ad 

hoc basis. For example, CMS has had a long-standing relationship with 

state Medicaid program-integrity units, by collaborating through monthly 

meetings of the Medicaid Fraud and Abuse Technical Advisory Group, 

sending fraud alerts, and offering courses through the Medicaid Integrity 

Institute. However, in our interviews with state program-integrity units, 

and as we recently reported, some state Medicaid agencies shared 

concerns about the communication, level of policy guidance, and 

technical support provided by and received from CMS for managing fraud 

risks in Medicaid.38 This concern was echoed by state audit officials, with 

 37GAO, Medicare: CMS Fraud Prevention System Uses Claims Analysis to Address 

Fraud, GAO-17-710 (Washington, D.C.: Aug. 30, 2017).

38We have previously made recommendations to CMS to improve collaboration with 

states. HHS concurred with our recommendations but, as of September 2017, has not 

implemented them. See GAO, Medicaid Program Integrity: CMS Should Build on Current 

Oversight Efforts by Further Enhancing Collaboration with States, GAO-17-277 

(Washington, D.C.: Mar. 15, 2017).
Page 22 GAO-18-88 CMS Fraud Risk Management

whom CMS recently initiated coordination to build relationships that would 

facilitate state auditing of Medicaid programs.39

CMS also has varying relationships with its law-enforcement partners. For 

example, the relationship between CMS and DOJ’s Health Care Fraud 

unit, which leads the DOJ and HHS OIG Medicare Fraud Strike Force 

Teams, has been ad hoc. According to CMS and DOJ officials, the 

interactions between the agencies have been based on specific fraud 

cases such as coordination of national takedowns when DOJ provided 

CMS with the names of providers committing fraud so that CMS could 

suspend them consistently with the timing of the enforcement efforts. 

According to CMS officials, they coordinate more with HHS OIG, working 

together on payment suspensions and revocations for OIG cases, or 

working with it to take administrative actions against large providers.

CMS’s antifraud efforts partially align with the Fraud Risk Framework. 

Consistent with the framework, CMS has demonstrated commitment to 

combating fraud by creating a dedicated entity to lead antifraud efforts. It 

has also taken steps to establish a culture conducive to fraud risk 

management, although it could expand its antifraud training to include all 

employees. CMS has taken some steps to identify fraud risks in Medicare 

and Medicaid; however, it has not conducted a fraud risk assessment or 

developed a risk-based antifraud strategy for Medicare and Medicaid as 

defined in the Fraud Risk Framework. CMS has established monitoring 

and evaluation mechanisms for its program-integrity control activities that, 

if aligned with a risk-based antifraud strategy, could enhance the 

effectiveness of fraud risk management in Medicare and Medicaid.

 39In November 2016 and May 2017, CMS and selected state audit officials held meetings 

to discuss future collaboration as well as specific areas of concern in Medicaid, such as 

oversight of Medicaid managed care. GAO facilitated the November 2016 meeting, and 

GAO officials participated in and presented prior audit results at the May 2017 meeting. 

CMS’s Efforts 

Managing Fraud 

Risks in Medicare 

and Medicaid Are 

Partially Aligned with 

the Fraud Risk 

Framework
Page 23 GAO-18-88 CMS Fraud Risk Management

The commit component of the Fraud Risk Framework calls for an agency 

to commit to combating fraud by creating an organizational culture and 

structure conducive to fraud risk management. This component includes 

establishing a dedicated entity to lead fraud risk management activities.40

Within CMS, the Center for Program Integrity (CPI) serves as the 

dedicated entity for fraud, waste, and abuse issues in Medicare and 

Medicaid, which is consistent with the Fraud Risk Framework. CPI was 

established in 2010, in response to a November 2009 Executive Order on 

reducing improper payments and eliminating waste in federal programs.41

This formalized role, according to CMS officials, elevated the status of 

program-integrity efforts, which previously were carried out by other parts 

of CMS.

As an executive-level Center—on the same level with five other 

executive-level Centers at CMS, such as the Center for Medicare and the 

Center for Medicaid and CHIP Services—CPI has a direct reporting line 

to executive-level management at CMS. The Fraud Risk Framework 

identifies a direct reporting line to senior-level managers within the 

agency as a leading practice. According to CMS officials, this elevated 

organizational status offers CPI heightened visibility across CMS, 

attention by CMS executive leadership, and involvement in executivelevel conversations.

Additionally, in 2014, CMS established a Program Integrity Board that has 

brought together senior officials across CMS Centers on a monthly basis 

to coordinate on fraud and program-integrity vulnerabilities. According to 

 40GAO-15-593SP.

41Reducing Improper Payments, Exec. Order No. 13520, 74 Fed. Reg. 226 (Nov. 20, 

2009).

CMS Has Shown 

Commitment to Combating 

Fraud by Creating an 

Organizational Structure 

and Taking Steps to 

Establish a Culture 

Conducive to Fraud Risk 

Management

CMS’s Organizational 

Structure Includes a Dedicated 

Entity for Program-Integrity and 

Antifraud Efforts 

Fraud Risk Framework Component:

Commit to combating fraud by creating an 

organizational culture and structure 

conducive to fraud risk management

Source: GAO. | GAO-18-88
Page 24 GAO-18-88 CMS Fraud Risk Management

CPI officials, the board is one of the mechanisms through which CPI 

engages other executive-level offices at CMS. CPI chairs the meetings 

and typically develops meeting agendas to solicit information from and 

disseminate information to other CMS units or stakeholders. Further, the 

board may establish small working groups, known as integrated project 

teams, to address specific vulnerabilities. For example, according to CMS 

officials, in 2016 the board established a Marketplace integrated project 

team to resolve potential fraud eligibility and enrollment issues in the 

federally facilitated marketplace using the Fraud Risk Framework.

CPI has further demonstrated commitment to addressing fraud, waste, 

and abuse through several organizational changes with the goal of 

improving coordination and communication of program-integrity activities 

across Medicare and Medicaid. Most recently, in 2014, CPI reorganized 

its structure to align functional areas across Medicare and Medicaid,

where possible. Previously, separate units within CPI administered their 

own program-integrity activities for Medicare and Medicaid programs. For 

example, CPI established a Provider Enrollment and Oversight Group, 

responsible for provider screening and enrollment functions in both 

Medicare and Medicaid. According to CMS officials, if CPI employees 

identify an issue in provider enrollment in Medicare, the same CPI 

employees also consider how this issue applies to Medicaid. According to 

CMS officials, the reorganization has helped CPI to look at vulnerabilities 

in a crosscutting way and to facilitate communication across programs.

Similarly, since 2016, CPI began shifting contracting functions from 

separate Medicare and Medicaid regional contractors that identify and 

investigate cases of potential fraud and conduct audits to five regional 

UPICs responsible for a range of program-integrity and fraud-specific 

activities in both Medicare FFS and Medicaid. According to CMS, the 

purpose of the UPICs is to coordinate provider investigations across 

Medicare and Medicaid, improve collaboration with states by providing a 

mutually beneficial service, and increase contractor accountability through 

coordinated oversight. CMS officials told us that UPIC integration is a 

cornerstone of CMS’s contract management strategy and would help to 

ensure communication and coordination across Medicare and Medicaid 

program-integrity efforts. CMS plans to award all the UPIC contracts by 

the end of 2017, ultimately phasing out the ZPICs and Medicaid Integrity 

Contractors.
Page 25 GAO-18-88 CMS Fraud Risk Management

The commit component of the Fraud Risk Framework also includes 

creating an organizational culture to combat fraud at all levels of the 

agency.

Consistent with the Fraud Risk Framework, CMS has promoted an 

antifraud culture by demonstrating a senior-level commitment to 

combating fraud through public statements, increased resource levels, 

and internal and external coordination.

In addition to HHS and CMS strategic documents discussed earlier, CMS 

and CPI leaders have testified publicly about CMS’s commitment to 

preventing fraud and protecting taxpayers and beneficiaries. For example, 

CPI’s former Director testified in May 2016 before the House Committee 

on Energy and Commerce’s Subcommittee on Oversight and 

Investigations that “CMS is deeply committed to our efforts to prevent 

waste, fraud and abuse in Medicare and Medicaid programs, protecting 

both taxpayers and the beneficiaries that we serve.”42 More recently, 

CMS’s new Administrator testified in her February 2017 confirmation 

hearing regarding her intent to prioritize efforts around preventing fraud 

and abuse.43

CPI’s budget and resources have increased over time to support its 

ongoing program-integrity mission. According to CMS, program-integrity 

obligations for Medicare and Medicaid increased from about $1.02 billion 

in fiscal year 2010 to $1.45 billion in fiscal year 2016. According to CMS 

officials, the Health Care Fraud and Abuse Control (HCFAC) account, 

one of the primary sources of CPI funding, has never received a funding 

reduction. Additionally, in 2015, CPI received additional funding based on 

a discretionary cap adjustment to HCFAC.44 Similarly, CPI staff resources 

 42Dr. Shantanu Agrawal, Deputy Administrator, and Director, Center for Program Integrity, 

Centers for Medicare & Medicaid Services, Medicare and Medicaid Program Integrity: 

Combating Improper Payments and Ineligible Providers, testimony before the House 

Committee on Energy and Commerce, Subcommittee on Oversight & Investigations, 

114th Cong., 2nd sess., May 24, 2016. As of the writing of this report, the CPI Director 

position was unfilled.

43Seema Verma, Nominee to be Administrator of the Centers for Medicare & Medicaid 

Services, Department of Health and Human Services, statement before the Senate 

Committee on Finance, 115 Cong., 1st sess., February 16, 2017. 

44The Budget Control Act of 2011 created a discretionary allocation cap adjustment for 

HCFAC funding for 10 years, from fiscal year 2012 to fiscal year 2021. The passage of the 

Consolidated and Further Continuing Appropriations Act of fiscal year 2015 was the first 

time the HCFAC cap adjustment was appropriated. 

CMS Has Taken Steps to 

Create a Culture Conducive to 

Fraud Risk Management but 

Could Enhance Antifraud 

Training for Employees 

Fraud Risk Framework Component:

Commit to combating fraud by creating an 

organizational culture and structure 

conducive to fraud risk management

Source: GAO. | GAO-18-88
Page 26 GAO-18-88 CMS Fraud Risk Management

have increased over time. According to CMS, CPI’s full-time equivalent 

positions increased from 177 in 2011 to 419 in 2017.45

Consistent with leading practices in the Fraud Risk Framework to involve 

all levels of the agency in setting an antifraud tone, CPI has also worked 

collaboratively with other CMS Centers. In addition to engaging 

executive-level officials of other CMS Centers through the Program 

Integrity Board, CPI has worked collaboratively with other Centers within 

CMS to incorporate antifraud features into new program design or policy 

development and established regular communication at the staff level. 

For example:

• Center for Medicare and Medicaid Innovation (CMMI). When 

developing the Medicare Diabetes Prevention Program, CMMI 

officials told us they worked with CPI’s Provider Enrollment and 

Oversight Group and Governance Management Group to develop 

risk-based screening procedures for entities that would enroll in 

Medicare to provide diabetes-prevention services, among other 

activities. The program was expanded nationally in 2016, and CMS 

determined that an entity may enroll in Medicare as a program 

supplier if it satisfies enrollment requirements, including that the 

supplier must pass existing high categorical risk-level screening 

requirements.46

• Center for Medicaid and CHIP Services (CMCS). CMCS officials told 

us they worked closely with CPI to issue Medicaid guidance and best 

practices to states on home and community-based services that 

incorporate program-integrity provisions.47 A senior CMCS official told 

us that, to address fraud, CMS has requested that states include 

provider information on claims to determine whether providers are 

meeting eligibility criteria.

 45Full-time equivalent allocations are as of January 1 of each year. 

4682 Fed. Reg. 52,976 (Nov. 15, 2017) (codified at 42 C.F.R. Parts 405, 410, 414, 424, 

and 425). For additional information about CMS provider-enrollment activities for 

Medicare, see GAO, Medicare: Initial Results of Revised Process to Screen Providers and 

Suppliers, and Need for Objectives and Performance Measures, GAO-17-42 (Washington, 

D.C.: Nov. 15, 2016).

47Home and community-based services provide opportunities for Medicaid beneficiaries to 

receive services in their own home or community rather than institutions or other isolated 

settings. These programs serve a variety of targeted population groups, such as people 

with cognitive, physical, or mental disabilities. 
Page 27 GAO-18-88 CMS Fraud Risk Management

• Center for Medicare (CM). In addition to building safeguards into 

programs and developing policies, CM officials told us that there are 

several standing meetings, on monthly, biweekly, and weekly bases, 

between groups within CM and CPI that discuss issues related to 

provider enrollment, FFS operations, and contractor management. A 

senior CM official also told us that there are ad hoc meetings taking 

place between CM and CPI: “We interact multiple times daily at 

different levels of the organization. Working closely is just a regular 

part of our business.”

CMS has also demonstrated its commitment to addressing fraud, waste, 

and abuse to its stakeholders. Representatives of CMS’s extensive 

stakeholder network whom we interviewed—state officials, contractors, 

and officials from public and private entities—generally recognized the 

agency’s commitment to combating fraud. In our interviews with 

stakeholders, officials observed CMS’s increased commitment over time 

to address fraud, waste, and abuse and cited examples of specific CMS 

actions. State officials, for example, told us that the Medicaid Integrity 

Institute, a training center coordinated jointly by CMS and DOJ, has been 

a helpful resource for states to build capacity to address fraud and 

program integrity.48 CMS contractors told us that CMS’s commitment to 

combating fraud is incorporated into contractual requirements, such as 

requiring (1) data analysis for potential fraud leads and (2) fraudawareness training for providers. Officials from entities that are members 

of the HFPP, specifically, a health-insurance plan and the National Health 

Care Anti-Fraud Association, added that CMS’s effort to establish the 

HFPP and its ongoing collaboration and information sharing reflect CMS’s 

commitment to combat fraud in Medicare and Medicaid.

The Fraud Risk Framework identifies training as one way of 

demonstrating an agency’s commitment to combating fraud. Training and 

education intended to increase fraud awareness among stakeholders, 

managers, and employees, serves as a preventive measure to help 

create a culture of integrity and compliance within the agency. The Fraud 

Risk Framework discusses requiring all employees to attend training upon 

hiring and on an ongoing basis thereafter.

 48The Medicaid Integrity Institute has offered fraud-related training courses such as basic 

and specialized skills and techniques in Medicaid fraud detection. We recently reported 

that the Medicaid Integrity Institute is an important training resource, but states’ demand 

for its courses frequently exceeded the institute’s capacity. See GAO-17-277. 
Page 28 GAO-18-88 CMS Fraud Risk Management

To increase awareness of fraud risks in Medicare and Medicaid, CMS 

offers and requires training for stakeholder groups such as providers, 

beneficiaries, and health-insurance plans. Specifically, through its 

National Training Program and Medicare Learning Network, CMS makes 

available training materials on combating Medicare and Medicaid fraud, 

waste, and abuse.49 These materials help to identify and report fraud, 

waste, and abuse in CMS programs and are geared toward providers, 

beneficiaries, as well as trainers and other stakeholders. Separately, 

CMS requires health-insurance plans working with CMS to provide annual 

fraud, waste, and abuse training to their employees.50

However, CMS does not offer or require similar fraud-awareness training 

for the majority of its workforce. For a relatively small portion of its overall 

workforce—specifically, contracting officer representatives who are 

responsible for certain aspects of the acquisition function—CMS requires 

completion of fraud and abuse prevention training every 2 years. 

According to CMS, 638 of its contracting officer representatives (or about 

10 percent of its overall workforce) completed such training in 2016 and 

2017. Although CMS offers fraud-awareness training to others, the 

agency does not require fraud-awareness training for new hires or on a 

regular basis for all employees because the agency has focused on 

providing process-based internal controls training for its employees.

While fraud-awareness training for contracting officer representatives is 

an important step in helping to promote fraud risk management, fraudawareness training specific to CMS programs would be beneficial for all 

employees. Such training would not only be consistent with what CMS 

offers to or requires of its stakeholders and some of its employees, but 

would also help to keep the agency’s entire workforce continuously aware 

of fraud risks and examples of known fraud schemes, such as those 

identified in successful OIG investigations. Such training would also keep 

employees informed as they administer CMS programs or develop 

agency policies and procedures. Considering the vulnerability of Medicare 

and Medicaid programs to fraud, waste, and abuse, without regular 

 49The CMS National Training Program provides support for partners and stakeholders, 

not-for-profit professionals and volunteers who work with seniors and people with 

disabilities, and others who help people make informed health-care decisions. The 

program offers an online training library with materials to conduct outreach and education 

sessions. The Medicare Learning Network provides free educational materials for healthcare professionals on CMS programs, policies, and initiatives.

50For example, 42 C.F.R. § 422.503(b)(4)(vi)(C). 
Page 29 GAO-18-88 CMS Fraud Risk Management

required training CMS cannot be assured that its workforce of over 6,000 

employees is continuously aware of risks facing its programs.

Although CMS has shown commitment to combating fraud, at times CPI’s 

efforts to combat fraud compete with other mission priorities, such as (1) 

ensuring beneficiary access to health-care services and (2) limiting 

provider burden. CPI leadership has been aware of this inherent 

challenge. For example, at a congressional hearing in May 2016, CPI’s 

Director stated that “our efforts strike an important balance: protecting 

beneficiary access to necessary health care services and reducing the 

administrative burden on legitimate providers and suppliers, while 

ensuring that taxpayer dollars are not lost to fraud, waste, and abuse.”51

Beneficiary access to care. In accordance with its mission statement, 

providing and improving beneficiaries’ access to health care is a CMS 

priority. CMS’s commitment to providing access to high-quality care and 

coverage is reflected in the agency’s mission statement and is one of its 

four strategic goals. As a result, before taking administrative actions 

against a Medicare Part A provider, such as a hospice, or providers in 

rural areas, CMS officials told us that they first look at whether there is a 

sufficient number of providers in an area by running a provider search by 

provider county and adjacent counties and considering how heavily 

populated an area is with Medicare beneficiaries. According to these 

officials, rather than taking an administrative action against a provider that 

would limit beneficiaries’ access to services, the agency may enter into a 

corrective action plan with the provider. CMS officials told us that revoking 

a provider’s enrollment in Medicare, an option available to CMS in cases 

of provider noncompliance or misconduct, is rare.52

Administrative burden on providers. According to CMS documents and 

officials, concern over placing undue burden on providers—the majority of 

whom are presumed to be honest—provides a counterforce to 

implementing program-integrity control activities. CMS’s web page 

entitled Reducing Provider Burden states: “CMS is committed to reducing 

improper payments but must be mindful of provider burden because 

 51Dr. Shantanu Agrawal, Medicare and Medicaid Program Integrity: Combating Improper 

Payments and Ineligible Providers.

5242 C.F.R. § 424.535.

Program Integrity and Mission 

Priorities

The Fraud Risk Framework acknowledges 

that managers may perceive a conflict 

between their priorities to fulfill the 

programs’ mission and taking actions to 

safeguard taxpayer dollars from improper 

use. However, the Fraud Risk Framework 

also indicates that the purpose of 

proactively managing fraud risks is to 

facilitate, not hinder, the program’s 

mission and strategic goals by ensuring 

that taxpayer dollars and government 

services serve their intended purposes.

Source: GAO. | GAO-18-88
Page 30 GAO-18-88 CMS Fraud Risk Management

medical review53 is a resource-intensive process for both the healthcare 

provider and the Medicare review contractor.”54 Two CMS contractors told 

us that they scaled back or did not pursue audits of providers’ 

documentation because of provider burden or sensitivity considerations. 

One contractor removed providers from audit samples after some 

providers opposed having to supply multiple medical records. CPI officials 

told us that they want to reduce provider burden in a logical manner. For 

example, according to CMS officials, in the Medicare FFS Recovery Audit 

Program, CMS established limits on Additional Documentation Requests, 

which are requests for medical documentation supporting a claim being 

reviewed. CMS requires such documentation adjustments so that they 

align with a providers’ claim denial rates. Providers with low denial rates 

will have lower documentation requirements, while providers with high 

denial rates will have higher documentation requirements, thus adjusting 

provider burden based on demonstrated compliance.

 53A medical review is the manual review of Medicare FFS claims and related medical 

records by trained clinicians and coders to ensure that the claims are consistent with 

Medicare coverage, payment, and coding policies. Many improper claims can be identified 

by manually reviewing associated medical records and a beneficiary’s claim history, and 

exercising clinical judgement to determine whether a service is reasonable and necessary. 

Less than 1 percent of claims undergo manual reviews. See GAO, Medicare: Claim 

Review Programs Could Be Improved with Additional Prepayment Reviews and Better 

Data, GAO-16-394 (Washington, D.C.: Apr. 13, 2016).

54See Centers for Medicare & Medicaid Services, Reducing Provider Burden, accessed 

August 15, 2017, 

http://www.cms.gov/Research-Statistics-Data-and-Systems/Monitoring-Programs/Medicar

e-FFS-Compliance-Programs/ReducingProviderBurden.html. 
Page 31 GAO-18-88 CMS Fraud Risk Management

The assess component of the Fraud Risk Framework calls for federal 

managers to plan regular fraud risk assessments and to assess risks to 

determine a fraud risk profile.55 Identifying fraud risks is one of the steps 

included in the Fraud Risk Framework for assessing risks to determine a 

fraud risk profile.

CMS has taken steps to identify some fraud risks through several control 

activities that target areas the agency has designated as higher risk within 

Medicare and Medicaid, including specific provider types, such as home 

health agencies, and specific geographic locations. As discussed earlier, 

CMS officials told us that CPI initially focused on developing control 

activities for Medicare FFS and considers these activities to be the most 

mature of all CPI efforts to address fraud risks. CMS has identified fraud 

risks in the following selected examples, which are not an exhaustive list 

of its control activities.

Data analytics to assist investigations in Medicare FFS. In 2011, CMS 

implemented FPS, a data-analytic system that screens all Medicare FFS 

claims to identify health-care providers with suspect billing patterns for 

further investigation. Medicare FFS contractors—ZPICs and UPICs—

have used FPS to identify and prioritize leads for investigations of 

potential fraud by high-risk Medicare FFS providers.56 Contractors told us 

that FPS allows them to quickly identify and triage leads. CMS’s guidance 

requires contractors to prioritize investigations with the greatest program 

 55According to the Fraud Risk Framework, a fraud risk profile documents the findings from 

a fraud risk assessment. We discuss this concept later in the report.

56We recently reported that about 20 percent of ZPIC investigations in fiscal years 2015 

and 2016 were initiated based on FPS leads. The proportion of investigations based on 

FPS is poised to increase as CMS transitions the ZPICs to the UPICs, with 45 percent of 

new investigations coming from FPS. According to ZPIC officials, this new requirement 

should allow the UPICs flexibility to focus their reviews on the FPS leads that are most 

applicable to their geographic region. See GAO-17-710.

CMS Has Taken Steps to 

Identify Program Fraud 

Risks but Has Not 

Conducted a Fraud Risk 

Assessment for Medicare 

or Medicaid

CMS Has Taken Steps to 

Identify Some Fraud Risks for 

Medicare and Medicaid

Fraud Risk Framework Component:

Plan regular fraud risk assessments and 

assess risks to determine a fraud risk 

profile

Source: GAO. | GAO-18-88
Page 32 GAO-18-88 CMS Fraud Risk Management

impact or urgency and identifies required criteria for prioritizing 

investigations, such as patient abuse or harm, multistate fraud, and high 

dollar amount of potential overpayments. One contractor we interviewed 

developed a risk-prioritization model that incorporated CMS’s required 

criteria, such as patient harm, as well as additional criteria, such as 

provider spikes in billing, into a tool that automatically creates a provider 

risk score to help the contractor focus and prioritize investigative 

resources.

Prior authorization for Medicare FFS services or supplies. CMS published 

a final rule in December 2015 that identifies a master list of durable 

medical equipment, prosthetics, orthotics, and supplies for which CMS 

can require prior authorization before suppliers submit a Medicare FFS 

claim. In this rule, CMS identified 135 items that are frequently subject to 

unnecessary utilization and stated that the agency expects the final rule 

to result in savings in the form of reduced unnecessary utilization, fraud, 

waste, and abuse. Under this program, prior authorization is a condition 

of payment for claims. CMS can choose which items on the master list to 

subject to prior authorization. For example, in March 2017, it began 

requiring prior authorization for selected power wheelchairs in four states 

and expanded the prior authorization program for these items to all states 

in July 2017.

CMS also began to test the use of prior authorization on a voluntary basis 

through a series of fixed-length demonstrations for items and services 

that have been associated with high levels of improper payments, 

including high incidences of fraud in some cases, and unnecessary 

utilization in certain geographic areas. For example, CMS began 

implementing a voluntary prior authorization demonstration in September 

2012 for other power mobility devices, such as power scooters, in seven 

states where historically there has been extensive evidence of fraud and 

improper payments.57 CMS expanded the demonstration to an additional 

12 states in October 2014, for a total of 19 states. According to the initial 

Federal Register notice, CMS planned to use the demonstration to 

develop improved methods for investigation and prosecution of fraud to 

protect federal funds from fraudulent actions and the resulting improper 

 57In the Federal Register notice announcing the power mobility demonstration, CMS cited 

Medicare Fraud Strike Force Teams’ data as part of the basis for the demonstration. CMS 

has additional prior authorization models, for example, a 3-year demonstration for 

nonemergent hyperbaric oxygen therapy, which began in March 2015.
Page 33 GAO-18-88 CMS Fraud Risk Management

payments.58 Under the demonstration, providers and suppliers are 

encouraged—but not required—to submit a request for prior authorization

for certain items before they provide the item to the beneficiary and 

submit a claim for payment.

59

Revised provider screening and enrollment processes for Medicare FFS 

and Medicaid FFS. In response to PPACA, in 2011 CMS implemented a 

revised screening process for providers and suppliers who enroll in 

Medicare and Medicaid based on identified provider risk categories.60

CMS placed all Medicare provider and supplier types into one of three 

risk categories—limited, moderate, or high—based on its assessment of 

the potential risk of fraud, waste, and abuse each provider and supplier 

type poses. For example, CMS designated prospective (newly enrolling) 

home health agencies and prospective suppliers of durable medical 

equipment, prosthetics, orthotics, and supplies in the high-risk category. 

According to the final rule and our interviews with CMS officials, CMS 

developed these risk-based categories based on its review and synthesis 

of various information sources about the fraud risks posed by each 

provider and supplier type, including (1) the agency’s experience with 

claims data used to identify potentially fraudulent billing practices, (2) 

expertise of contractors responsible for investigating and identifying 

Medicare fraud, and (3) GAO and OIG reports.61 CMS designated specific 

screening activities for each risk category, with increased requirements 

 5877 Fed. Reg. 46,439 (Aug. 3, 2012). In 2015, the Director of CPI testified that before 

implementation of this demonstration, CMS’s work found that over 80 percent of claims for 

power mobility devices did not meet Medicare coverage requirements. See Dr. Shantanu 

Agrawal, Deputy Administrator, and Director, Center for Program Integrity, Centers for 

Medicare & Medicaid Services, testimony before the House Committee on Oversight and 

Government Reform, 114th Cong., 1st sess., February 11, 2015.

59Claims submitted without a prior-authorization decision are to undergo prepayment 

review and are subject to a 25 percent reduction in payment if they are determined 

payable. 

6076 Fed. Reg. 5,862 (Feb. 2, 2011) (codified at 42 C.F.R. Parts 405, 424, 447, 455, 457, 

and 498). 

61Medicaid provider types that also exist in Medicare must be assigned to the same or 

higher risk category applicable to Medicare. For Medicaid-only providers, CMS guidance 

requires the state Medicaid agency to assign such providers to an appropriate risk level 

and recommends that the state Medicaid agency assess provider risk using similar 

considerations to those that CMS used to assess risk in Medicare provider and supplier 

types, including GAO or OIG reports, insight of law-enforcement partners, and level of 

administrative enforcement actions, among others. See CMS, Medicaid Provider 

Enrollment Compendium.
Page 34 GAO-18-88 CMS Fraud Risk Management

for moderate- and high-risk provider and supplier types. For example, 

moderate- and high-risk providers and suppliers must receive 

preenrollment site visits, and high-risk providers and suppliers also are 

subject to fingerprint-based criminal-background checks.62 As part of the 

revised screening process, beginning in September 2011, CMS also 

undertook its first program-wide effort to rescreen, or revalidate, the 

enrollment records of about 1.5 million existing Medicare FFS providers 

and suppliers, to determine whether they remain eligible to bill 

Medicare.63

Temporary provider enrollment moratoriums for certain providers and 

geographic areas for Medicare FFS and Medicaid FFS. CMS identified 

certain provider types and geographic areas as high risk for fraud and 

used its authority under PPACA to implement temporary moratoriums to 

suspend enrollment of such Medicare and Medicaid providers in those 

areas. For example, in July 2016, CMS extended temporary moratoriums 

statewide on the enrollment of new Medicare Part B nonemergency 

ambulance suppliers and Medicare home health agencies statewide in six 

states, as applicable. The statewide moratoriums also apply to 

Medicaid.64 According to the Federal Register notice, CMS imposed the 

 62Our prior work indicated that this requirement may address some of the potentially 

fraudulent or improper payments. See GAO, Medicaid: CMS Has Taken Steps, but 

Further Efforts Are Needed to Control Improper Payments, GAO-17-386T (Washington, 

D.C.: Jan. 31, 2017). In addition, CMS has implemented some modifications to its 

screening procedures since March 2011, such as increased site visits for limited-risk 

providers and continuous criminal monitoring reports. The act also allows for some 

movement of individual providers from the limited- or moderate-risk categories to the highrisk category, for reasons such as having Medicare billing privileges revoked at any time 

within the past 10 years. See GAO-17-42. Additionally, CMS officials also told us the 

agency began a special project that uses data analytics to identify high-risk Medicare FFS 

providers in Florida for additional screening. According to a 2016 report, from July 1, 2015, 

through September 30, 2016, a contractor covering Florida had conducted 9,891 site visits 

to verify providers’ and suppliers’ operational status, deactivated 422 practice locations, 

and revoked or denied 1,157 providers. 

63This program-wide revalidation effort was implemented in three phases, from September 

2011 through March 2015. CMS began the second program-wide (Medicare FFS) 

revalidation effort in March 2016. See GAO-17-42. For Medicaid, states must also 

revalidate the enrollment of all Medicaid providers at least every 5 years. 

64In addition to Medicare and Medicaid, the statewide moratoriums also apply to CHIP. 

These statewide moratoriums have been extended in 6-month increments, with the mostrecent extension announced in July 2017. 82 Fed. Reg. 35,122 (July 28, 2017) (codified at 

42 C.F.R. Part 424).
Page 35 GAO-18-88 CMS Fraud Risk Management

temporary moratoriums based on qualitative and quantitative factors 

suggesting a high risk of fraud, waste, or abuse, such as law-enforcement 

expertise with emerging fraud trends and investigations. CMS’s data 

analysis also confirmed the agency’s determination of a high risk of fraud, 

waste, and abuse for these provider and supplier types within certain 

geographic areas, according to the notice.65

Medicaid state program integrity reviews and desk reviews. CMS tailored 

state Medicaid program-integrity reviews to areas it identified as high risk 

for improper payments, such as personal care services, which may also 

be at high risk for fraud.66 In March 2017, we reported that, from fiscal 

years 2014 through 2016, CMS conducted focused reviews of state 

program-integrity efforts in 31 states, reviewing 10 or 11 states annually.67

For each state, CMS tailored its focused reviews to the state’s managed 

care plans and relevant other high-risk areas, including provider 

enrollment and screening, nonemergency medical transportation, and

personal care services. CMS and state officials we spoke with as part of 

that work told us that the tailored oversight had been beneficial and 

helped identify areas for improvement. CMS has also initiated desk 

reviews of state program-integrity efforts. According to CMS, these desk 

reviews allow the agency to provide states with customized programintegrity oversight.

Vulnerability tracking system for Medicare. CPI recently initiated an effort 

to centralize and formalize a vulnerability tracking process for Medicare, 

which could support identification of specific fraud risks, both in Medicare 

and possibly Medicaid.68 As described by CPI officials, the process aims 

 6581 Fed. Reg. 51,120 (Aug. 3, 2016) (codified at 42 C.F.R. Parts 424 and 455).

66HHS OIG testified in May 2017 that persistent vulnerabilities in personal care services 

contribute to significant fraud and place beneficiaries at risk for abuse and neglect. See 

Christi A. Grimm, Chief of Staff, Office of Inspector General, Department of Health and 

Human Services, Combating Waste, Fraud, and Abuse in Medicaid’s Personal Care 

Services Program, testimony before the House Committee on Energy and Commerce, 

Subcommittee on Oversight and Investigations, 115th Cong., 1st sess., May 2, 2017. We 

have also testified on the risks of this Medicaid benefit, including instances where services 

for which the state was billed were not provided. See GAO, Medicaid Personal Care 

Services: More Harmonized Program Requirements and Better Data Are Needed, 

GAO-17-598T (Washington, D.C.: May 2, 2017). 

67GAO-17-277.

68We did not evaluate the effectiveness of this effort as, at the time of our review, CMS’s 

work to establish a vulnerability tracking process was ongoing.
Page 36 GAO-18-88 CMS Fraud Risk Management

to collect information on fraud-related vulnerabilities from CMS 

employees, contractors, and other sources, such as GAO and HHS OIG 

reports.

The assess component of the Fraud Risk Framework calls for federal 

managers to plan regular fraud risk assessments and assess risks to 

determine a fraud risk profile. Furthermore, federal internal control 

standards call for agency management to assess the internal and 

external risks their entities face as they seek to achieve their objectives. 

The standards state that, as part of this overall assessment, management 

should consider the potential for fraud when identifying, analyzing, and 

responding to risks.69

The Fraud Risk Framework states that, in planning the fraud risk 

assessment, effective managers tailor the fraud risk assessment to the 

program by, among other things, identifying appropriate tools, methods, 

and sources for gathering information about fraud risks and involving 

relevant stakeholders in the assessment process. Fraud risk 

assessments that align with the Fraud Risk Framework involve (1) 

identifying inherent fraud risks affecting the program, (2) assessing the 

likelihood and impact of those fraud risks, (3) determining fraud risk 

tolerance, (4) examining the suitability of existing fraud controls and 

prioritizing residual fraud risks, and (5) documenting the results. (See fig. 

6.)

Although, as discussed earlier, CMS has identified some fraud risks 

posed by providers in Medicare FFS and, to a lesser degree, Medicaid 

FFS, the agency has not conducted a fraud risk assessment for either the 

Medicare or Medicaid program. Such a risk assessment would provide 

the detailed information and insights needed to create a fraud risk profile, 

which, in turn, is the basis for creating an antifraud strategy.

 69GAO-14-704G. 

CMS Has Not Conducted a 

Fraud Risk Assessment for 

Medicare or Medicaid 

Fraud Risk Framework Component:

Plan regular fraud risk assessments and 

assess risks to determine a fraud risk 

profile

Source: GAO. | GAO-18-88
Page 37 GAO-18-88 CMS Fraud Risk Management

Figure 6: Key Elements of the Fraud Risk Assessment Process

a

GAO, Standards for Internal Control in the Federal Government, GAO-14-704G (Washington, D.C.: 

Sept. 10, 2014).
Page 38 GAO-18-88 CMS Fraud Risk Management

According to CMS officials, CMS has not conducted a fraud risk 

assessment for Medicare or Medicaid because, within CPI’s broader 

approach of preventing and eliminating improper payments, its focus has 

been on addressing specific vulnerabilities among provider groups that 

have shown themselves particularly prone to fraud, waste, and abuse. 

With this approach, however, it is unlikely that CMS will be able to design 

and implement the most-appropriate control activities to respond to the 

full portfolio of fraud risks.

A fraud risk assessment consists of discrete activities that build upon 

each other. Specifically:

• Identifying inherent fraud risks affecting the program. As discussed 

earlier, CMS has taken steps to identify fraud risks. However, CMS 

has not used a process to identify inherent fraud risks from the 

universe of potential vulnerabilities facing Medicare and Medicaid 

programs, including threats from various sources. According to CPI 

officials, most of the agency’s fraud control activities are focused on 

fraud risks posed by providers. The Fraud Risk Framework discusses 

fully considering inherent fraud risks from internal and external 

sources in light of fraud risk factors such as incentives, opportunities, 

and rationalization to commit fraud. For example, according to CMS 

officials, the inherent design of the Medicare Part C program may 

pose fraud risks that are challenging to detect.70 A fraud risk 

assessment would help CMS identify all sources of fraudulent 

behaviors, beyond threats posed by providers, such as those posed 

by health-insurance plans, contractors, or employees.

• Assessing the likelihood and impact of fraud risks and determining 

fraud risk tolerance. CMS has taken steps to prioritize fraud risks in 

some areas, but it has not assessed the likelihood or impact of fraud 

risks or determined fraud risk tolerance across all parts of Medicare 

and Medicaid. Assessing the likelihood and impact of inherent fraud 

risks would involve consideration of the impact of fraud risks on 

program finances, reputation, and compliance. Without assessing the 

likelihood and impact of risks in Medicare or Medicaid or internally 

determining which fraud risks may fall under the tolerance threshold, 

 70In Medicare Part C, health-insurance plans may pose a fraud risk, as shown by recent 

legal settlement. See Freedom Health case, Department of Justice, Medicare Advantage 

Organization and Former Chief Operating Officer to Pay $32.5 Million to Settle False 

Claims Act Allegations, accessed May 31, 2017, https://www.justice.gov/opa/pr/medicareadvantage-organization-and-former-chief-operating-officer-pay-325-million-settle.
Page 39 GAO-18-88 CMS Fraud Risk Management

CMS cannot be certain that it is aware of the most-significant fraud 

risks facing these programs and what risks it is willing to tolerate 

based on the programs’ size and complexity.

• Examining the suitability of existing fraud controls and prioritizing 

residual fraud risks. CMS has not assessed existing control activities 

or prioritized residual fraud risks. According to the Fraud Risk 

Framework, managers may consider the extent to which existing 

control activities—whether focused on prevention, detection, or 

response—mitigate the likelihood and impact of inherent risks and 

whether the remaining risks exceed managers’ tolerance. This 

analysis would help CMS to prioritize residual risks and to determine 

mitigation approaches. For example, CMS has not established 

preventive fraud control activities in Medicare Part C. Using a fraud 

risk assessment for Medicare Part C and closely examining existing 

fraud control activities and residual risks, CMS could be better 

positioned to address fraud risks facing this growing program and 

develop preventive control activities. Further, without assessing 

existing fraud control activities and prioritizing residual fraud risks, 

CMS cannot be assured that its current control activities are 

addressing the most-significant risks. Such analysis would also help 

CMS determine whether additional, preferably preventive, fraud 

controls are needed to mitigate residual risks, make adjustments to 

existing control activities, and potentially scale back or remove control 

activities that are addressing tolerable fraud risks.

• Documenting the risk-assessment results in a fraud risk profile. CMS 

has not developed a fraud risk profile that documents key findings and 

conclusions of the fraud risk assessment. According to the Fraud Risk 

Framework, the risk profile can also help agencies decide how to 

allocate resources to respond to residual fraud risks. Given the large 

size and complexity of Medicare and Medicaid, a documented fraud 

risk profile could support CMS’s resource-allocation decisions as well 

as facilitate the transfer of knowledge and continuity across CMS staff 

and changing administrations.

Senior CPI officials told us that the agency plans to start a fraud risk 

assessment for Medicare and Medicaid after it completes a separate 

fraud risk assessment of the federally facilitated marketplace. This fraud 

risk assessment for the federally facilitated marketplace eligibility and 

enrollment process is being conducted in response to a recommendation 

we made in February 2016.71 In April 2017, CPI officials told us that this 

 71GAO-16-29.
Page 40 GAO-18-88 CMS Fraud Risk Management

fraud risk assessment was largely completed, although in September 

2017 CPI officials told us that the assessment was undergoing agency 

review. CPI officials told us that they have informed CM and CMCS 

officials that there will be future fraud risk assessments for Medicare and 

Medicaid; however, they could not provide estimated timelines or plans 

for conducting such assessments, such as the order or programmatic 

scope of the assessments.

Once completed, CMS could use the federally facilitated marketplace 

fraud risk assessment and apply any lessons learned when planning for 

and designing fraud risk assessments for Medicare and Medicaid. 

According to the Fraud Risk Framework, factors such as size, resources, 

maturity of the agency or program, and experience in managing risks can 

influence how the entity plans the fraud risk assessment. Additionally, 

effective managers tailor the fraud risk assessment to the program when 

planning for it. The large scale and complexity of Medicare and Medicaid 

as well as time and resources involved in conducting a fraud risk 

assessment underscore the importance of a well-planned and tailored 

approach to identifying the assessment’s programmatic scope. Planning 

and tailoring may involve decisions to conduct a fraud risk assessment for 

Medicare and Medicaid programs as a whole or divided into several 

subassessments to reflect their various component parts (e.g., Medicare 

FFS, Medicaid managed care) as well as determining the timing and 

order of assessments (e.g., concurrently or consecutively for Medicare 

and Medicaid).

CMS’s existing fraud risk identification efforts as well as communication 

channels with stakeholders could serve as a foundation for developing a 

fraud risk assessment for Medicare and Medicaid. The leading practices 

identified in the Fraud Risk Framework discuss the importance of 

identifying appropriate tools, methods, and sources for gathering 

information about fraud risks and involving relevant stakeholders in the

assessment process. CMS’s fraud risk identification efforts discussed 

earlier could provide key information about fraud risks and their likelihood 

and impact. Further, existing relationships and communication channels 

across CMS and its extensive network of stakeholders could support 

building a comprehensive understanding of known and potential fraud 

risks for the purposes of a fraud risk assessment. For example, the fraud 

vulnerabilities identified through data analysis and information sharing 

with states, health-insurance plans, law-enforcement organizations, and 

contractors through the HFPP could inform a fraud risk assessment. 

CPI’s Command Center missions—facilitated collaboration sessions that 

bring together experts from various disciplines to improve the processes 
Page 41 GAO-18-88 CMS Fraud Risk Management

for fraud prevention in Medicare and Medicaid72—could bring together 

experts to identify potential or emerging fraud vulnerabilities or to 

brainstorm approaches to mitigate residual fraud risks.

As CMS makes plans to move forward with a fraud risk assessment for 

Medicare and Medicaid, it will be important to consider the frequency with 

which the fraud risk assessment would need to be updated. While, 

according to the Fraud Risk Framework, the time intervals between 

updates can vary based on the programmatic and operating environment, 

assessing fraud risks on an ongoing basis is important to ensure that 

control activities are continuously addressing fraud risks. The constantly 

evolving fraud schemes, the size of the programs in terms of beneficiaries 

and expenditures, as well as continual changes in Medicare and Medicaid 

programs—such as development of innovative payment models and 

increasing managed-care enrollment—call for constant vigilance and 

regular updates to the fraud risk assessment.

 72According to CMS, the Command Center opened in July 2012 and provides an 

opportunity for Medicare and Medicaid policy experts, law-enforcement officials from OIG 

and the Federal Bureau of Investigation, clinicians, and CMS fraud investigators to 

collaborate before, during, and after the development of fraud leads in real time. In fiscal 

year 2015, CMS conducted 41 Command Center missions.
Page 42 GAO-18-88 CMS Fraud Risk Management

The design and implement component of the Fraud Risk Framework calls 

for federal managers to design and implement a strategy with specific 

control activities to mitigate assessed fraud risks and collaborate to help 

ensure effective implementation.

According to the Fraud Risk Framework, effective managers develop and 

document an antifraud strategy that describes the program’s approach for 

addressing the prioritized fraud risks identified during the fraud risk 

assessment, also referred to as a risk-based antifraud strategy. A riskbased antifraud strategy describes existing fraud control activities as well 

as any new fraud control activities a program may adopt to address 

residual fraud risks. In developing a strategy and antifraud control 

activities, effective managers focus on fraud prevention over detection, 

develop a plan for responding to identified instances of fraud, establish 

collaborative relationships with stakeholders, and create incentives to 

help effectively implement the strategy. Additionally, as part of a 

documented strategy, management identifies roles and responsibilities of 

those involved in fraud risk management activities; describes control 

activities as well as plans for monitoring and evaluation, creates timelines, 

and communicates the antifraud strategy to employees and stakeholders, 

among other things.

As discussed earlier, CMS has some control activities in place to identify 

fraud risk in Medicare and Medicaid, particularly in the FFS program.73

However, CMS has not developed and documented a risk-based 

antifraud strategy to guide its design and implementation of new antifraud 

activities and to better align and coordinate its existing activities to ensure 

it is targeting and mitigating the most-significant fraud risks.

 73The individual CMS fraud control activities and other antifraud efforts we describe in the 

report serve as examples of CMS activities; we did not evaluate the effectiveness of these 

efforts. 

CMS Has Not Developed 

a Risk-Based Antifraud 

Strategy for Medicare and 

Medicaid, Which Would 

Include Plans for 

Monitoring and Evaluation

CMS Has Not Developed a 

Risk-Based Antifraud Strategy

Fraud Risk Framework Component:

Design and implement a strategy with 

specific control activities to mitigate 

assessed fraud risks and collaborate to 

help ensure effective implementation

Source: GAO. | GAO-18-88
Page 43 GAO-18-88 CMS Fraud Risk Management

Antifraud strategy. CMS officials told us that CPI does not have a 

documented risk-based antifraud strategy. Although CMS has developed 

several documents that describe efforts to address fraud,74 the agency 

has not developed a risk-based antifraud strategy for Medicare and 

Medicaid because, as discussed earlier, it has not conducted a fraud risk 

assessment that would serve as a foundation for such strategy.

In 2016, CPI identified five strategic objectives for program integrity, 

which include antifraud elements and an emphasis on prevention.75

However, according to CMS officials, these objectives were identified 

from discussions with CMS leadership and various stakeholders and not 

through a fraud risk assessment process to identify inherent fraud risks 

from the universe of potential vulnerabilities, as described earlier and 

called for in the leading practices. These strategic objectives were 

presented at an antifraud conference in 2016,76 but were not announced 

publicly until the release of the Annual Report to Congress on the 

Medicare and Medicaid Integrity Programs for Fiscal Year 2015 in June 

2017.

Stakeholder relationships and communication. CMS has established 

relationships and communicated with stakeholders, but, without an 

antifraud strategy, stakeholders we spoke with lacked a common 

understanding of CMS’s strategic approach. Prior work on practices that 

can help federal agencies collaborate effectively calls for a strategy that is 

shared with stakeholders to promote trust and understanding.77 Once an 

antifraud strategy is developed, the Fraud Risk Framework calls for 

managers to collaborate to ensure effective implementation. Although 

 74Centers for Medicare & Medicaid Services, New Strategic Direction and Key Antifraud 

Activities (Nov. 3, 2011); Comprehensive Medicaid Integrity Plan: Fiscal Years 2014-2018; 

Annual Report to Congress on the Medicare and Medicaid Integrity Programs for Fiscal 

Year 2015; Annual Report to Congress on the Medicare and Medicaid Integrity Programs 

for Fiscal Years 2013 and 2014; CMS Medicare and Medicaid Program Integrity Strategy

(Mar. 3, 2013).

75The five strategic objectives are: (1) address the full spectrum of fraud, waste, and 

abuse; (2) proactively manage provider screening and enrollment; (3) continue to build 

states’ capacity to protect Medicaid; (4) extend work in Medicare Parts C and D, Medicaid 

managed care, and the Marketplace; and (5) provide greater transparency into programintegrity issues. 

76National Health Care Anti-Fraud Association conference in Atlanta, Georgia, November 

15–18, 2016.

77GAO, Results-Oriented Cultures: Implementation Steps to Assist Mergers and 

Organizational Transformations, GAO-03-669 (Washington, D.C.: July 2, 2003).
Page 44 GAO-18-88 CMS Fraud Risk Management

some CMS stakeholders were able to describe various CMS programintegrity priorities and activities, such as home health being a fraud risk 

priority, the stakeholders could not communicate, articulate, or cite a 

common CMS strategic approach to address fraud risks in its programs.

Incentives. The Fraud Risk Framework discusses creating incentives to 

help ensure effective implementation of the antifraud strategy once it is 

developed. Currently, some incentives within stakeholder relationships 

may complicate CMS’s antifraud efforts. As discussed earlier, CMS is a 

partner and provides oversight to states’ program-integrity functions. 

Officials from one state told us that they were reluctant to share their 

program vulnerabilities because CMS would use this information to later 

audit the state. Among contractors, CMS encourages information sharing 

through conferences and workshops; however, competition for CMS 

business among contractors can be a disincentive to information sharing. 

CMS officials acknowledged this concern and said that they expect 

contractors to share information related to fraud schemes, outcomes of 

investigations, and tips for addressing fraud, but not proprietary 

information such as algorithms to risk-score providers.

Without developing and documenting an antifraud strategy based on a 

fraud risk assessment, as called for in the design and implement 

component of the Fraud Risk Framework, CMS cannot ensure that it has 

a coordinated approach to address the range of fraud risks and to 

appropriately target and allocate resources for the most-significant risks. 

Considering fraud risks to which the Medicare and Medicaid programs are 

most vulnerable, in light of the malicious intent of those who aim to exploit 

the programs, would help CMS to examine its current control activities 

and potentially design new ones with recognition of fraudulent behavior it 

aims to prevent. This focus on fraud is distinct from a broader view of 

program integrity and improper payments by considering the intentions 

and incentives of those who aim to deceive rather than well-intentioned 

providers who make mistakes. Also, continued growth of the programs, 

such as growth of Medicare Part C and Medicaid managed care, call for 

consideration of preventive fraud control activities across the entire 

network of entities involved.

Further, considering the large size and complexity of Medicare and 

Medicaid and the extensive stakeholder network involved in managing 

fraud in the programs, a strategic approach to managing fraud risks within 

the programs is essential to ensure that a number of existing control 

activities and numerous stakeholder relationships and incentives are 

being aligned to produce desired results. Once developed, an antifraud 
Page 45 GAO-18-88 CMS Fraud Risk Management

strategy that is clearly articulated to various CMS stakeholders would help 

CMS to address fraud risks in a more coordinated and deliberate fashion. 

Thinking strategically about existing control activities, resources, tools, 

and information systems could help CMS to leverage resources while 

continuing to integrate Medicare and Medicaid program-integrity efforts 

along functional lines. A strategic approach grounded in a comprehensive 

assessment of fraud risks could also help CMS to identify future 

enhancements for existing control activities, such as new preventive 

capabilities for FPS or additional fraud factors in provider enrollment and 

revalidation, such as provider risk scoring, to stay in step with evolving 

fraud risks.

The evaluate and adapt component of the Fraud Risk Framework calls for 

federal managers to evaluate outcomes using a risk-based approach and 

adapt activities to improve fraud risk management. Furthermore, 

according to federal internal control standards, managers should 

establish and operate monitoring activities to monitor the internal control 

system and evaluate the results, which may be compared against an 

established baseline.78 Ongoing monitoring and periodic evaluations 

provide assurances to managers that they are effectively preventing, 

detecting, and responding to potential fraud.

CMS has established monitoring and evaluation mechanisms for its 

program-integrity activities that it could incorporate into an antifraud 

strategy.

In Medicare, CMS has taken steps to measure the rate of fraud in a 

particular service area. We have previously reported that agencies may 

face challenges measuring outcomes of fraud risk management activities 

in a reliable way. These challenges include the difficulty of measuring the 

extent of deterred fraud, isolating potential fraud from legitimate activity or 

other forms of improper payments, and determining the amount of 

undetected fraud.79 Despite these challenges, CMS has taken steps to 

estimate a fraud baseline—meaning the rate of probable fraud—in the 

home health benefit. In fiscal year 2016, CMS conducted a pretest in the 

Miami-Dade area of Florida to evaluate its potential measurement 

approach that could later be used in a nationwide study of probable fraud 

among home health agencies. The pretest was not a random sample and 

 78GAO-14-704G.

79GAO-15-593SP.

CMS Has Established 

Monitoring and Evaluation 

Mechanisms That Could Inform 

a Risk-Based Antifraud 

Strategy for Medicare and 

Medicaid

Fraud Risk Framework Component:

Evaluate outcomes using a risk-based 

approach and adapt activities to improve 

fraud risk management

Source: GAO. | GAO-18-88
Page 46 GAO-18-88 CMS Fraud Risk Management

was not intended to produce a rate of fraud, but instead was intended to 

test the interview instruments and data-collection methodology CMS 

might use in a study nationwide. CMS and its contractor collected 

information from home health agencies, the attending providers, and 

Medicare beneficiaries in the Miami-Dade area in order to test these 

interview instruments. CMS completed this pretest, but, according to CMS 

officials, the agency does not yet have plans to roll out a nationwide study 

that would estimate a probable fraud rate for the Medicare FFS home 

health benefit.

In its 2015 annual report to Congress, CMS stated that “documenting the 

baseline amount of fraud in Medicare is of critical importance, as it allows 

officials to evaluate the success of ongoing fraud prevention activities.”80

CMS officials working on the pilot told us that having an estimate of the 

rate of fraud in home health benefits would allow CMS to reliably assess 

its efforts at eliminating or reducing fraud. Without a baseline, officials 

said, the agency cannot know whether its antifraud efforts are as effective 

as they could be. We previously reported that the lack of a baseline for 

the amount of health-care fraud that exists limits CMS’s ability to 

determine whether its activities are effectively reducing health care fraud 

and abuse.81 A baseline estimate could provide an understanding of the 

extent of fraud and, with additional information on program activities, 

could help to inform decision making related to allocation of resources to 

combat health-care fraud.

As described in the Fraud Risk Framework, in the absence of a fraud 

baseline, agencies can gather additional information on the short-term or 

intermediate outcomes of some antifraud initiatives, which may be more 

readily measured. For example, CMS has developed some performance 

measures to provide a basis for monitoring its progress towards meeting 

the program-integrity goals set in the HHS Strategic Plan and Annual 

Performance Plan. Specifically, CMS measures whether it is meeting its 

goal of “increasing the percentage of Medicare FFS providers and 

 80Centers for Medicare & Medicaid Services, Annual Report to Congress on the Medicare 

and Medicaid Integrity Programs for Fiscal Year 2015.

81GAO, Health Care Fraud and Abuse Control Program: Indicators Provide Information on 

Program Accomplishments, but Assessing Program Effectiveness is Difficult, GAO-13-746 

(Washington, D.C.: Sept. 30, 2013).
Page 47 GAO-18-88 CMS Fraud Risk Management

suppliers identified as high risk that receive an administrative action.”82

CMS does not set specific antifraud goals for other parts of Medicare or 

Medicaid; other CMS performance measures relate to measuring or 

reducing improper payments in CHIP, Medicaid, and the various parts of 

Medicare.

CMS uses return-on-investment and savings estimates to measure the 

effectiveness of its Medicare program-integrity activities and FPS.83 For 

example, CMS uses return-on-investment to measure the effectiveness of 

FPS84 and, in response to a recommendation we made in 2012, CMS 

developed outcome-based performance targets and milestones for FPS.85

CMS has also conducted individual evaluations of its program-integrity 

activities, such as an interim evaluation of the prior-authorization 

demonstration for power mobility devices that began in 2012 and is 

currently implemented in 19 states.

Commensurate with greater maturity of control activities in Medicare FFS 

compared to other parts of Medicare and Medicaid, monitoring and 

evaluation activities for Medicare Parts C and D and Medicaid are more 

limited. For example, CMS calculates savings for its program-integrity 

activities in Medicare Parts C and D, but not a full return-on-investment. 

CMS officials told us that calculating costs for specific activities is 

challenging because of overlapping activities among contractors. CMS 

officials said they continue to refine methods and develop new savings 

estimates for additional program-integrity activities.

 82This performance metric refers to providers identified by FPS whose behavior is 

aberrant and potentially fraudulent. CMS can take a variety of administrative actions 

against those providers, from payment suspensions to revoking providers’ billing 

privileges. CMS has met this goal from 2013 to 2015; the 2016 data are pending at the 

time of the writing of this report. 

83We previously found flaws with CMS’s return-on-investment calculation and made two 

recommendations regarding the methodology. CMS has implemented both of the 

recommendations. See GAO, Medicare Integrity Program: CMS Used Increased Funding 

for New Activities but Could Improve Measurement of Program Effectiveness, 

GAO-11-592 (Washington, D.C.: July 29, 2011).

84HHS OIG has reviewed CMS’s methodology and calculations and certified the use of 

adjusted savings, which in 2014 yielded the FPS return-on-investment of approximately 3 

to 1.

85GAO, Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics 

System, but Needs to Define Measures to Determine Its Effectiveness, GAO-13-104 

(Washington, D.C.: Oct. 15, 2012).
Page 48 GAO-18-88 CMS Fraud Risk Management

According to the Fraud Risk Framework, effective managers develop a 

strategy and evaluate outcomes using a risk-based approach. In 

developing an effective strategy and antifraud activities, managers 

consider the benefits and costs of control activities. Ongoing monitoring 

and periodic evaluations provide reasonable assurance to managers that 

they are effectively preventing, detecting, and responding to potential 

fraud. Monitoring and evaluation activities can also support managers’ 

decisions about allocating resources, and help them to demonstrate their 

continued commitment to effectively managing fraud risks.

As CMS takes steps to develop an antifraud strategy, it could include 

plans for refining and building on existing methods such as return-oninvestment or savings measures, and setting appropriate targets to 

evaluate the effectiveness of all of CMS’s antifraud efforts. Such a 

strategy would help CMS to efficiently allocate program-integrity 

resources and to ensure that the agency is effectively preventing, 

detecting, and responding to potential fraud. For example, while doing so 

would involve challenges, CMS’s strategy could detail plans to advance 

efforts to measure a potential fraud rate through baseline and periodic 

measures. Fraud rate measurement efforts could also inform risk 

assessment activities, identify currently unknown fraud risks, align 

resources to priority risks, and develop effective outcome metrics for 

antifraud controls. Such a strategy would also help CMS ensure that it 

has effective performance measures in place to assess its antifraud 

efforts beyond those related to providers in Medicare FFS, and establish 

appropriate targets to measure the agency’s progress in addressing fraud 

risks.

As CMS makes plans to move forward with a strategy and to further 

develop evaluation and monitoring mechanisms, it will be important to 

share its efforts with stakeholders. The Fraud Risk Framework states that 

effective managers communicate lessons learned from fraud risk 

management activities to stakeholders. For example, CMS could be a 

leader to states in measuring the effectiveness of program-integrity 

efforts. Officials in three of the four states we spoke with expressed 

interest in receiving CMS guidance on how to measure the effectiveness 

of their Medicaid program-integrity efforts, such as by providing models 

for how to calculate return-on-investment.

Medicare and Medicaid provide health insurance to over 129 million 

Americans, but the size—in terms of number of beneficiaries and amount 

of expenditures—as well as complexity of these programs make them 

Conclusions
Page 49 GAO-18-88 CMS Fraud Risk Management

inherently susceptible to fraud and improper payments. CMS currently 

manages these risks across its programs as part of a broader approach 

to identifying and controlling for multiple sources of improper payments 

and by developing relationships with an extensive network of 

stakeholders. In Medicare and Medicaid specifically, we note that CMS 

has taken many important steps toward implementing a strategic 

approach for managing fraud. However, the agency could benefit by more 

fully aligning its efforts with the four components of the Fraud Risk 

Framework.

CMS is well positioned to leverage its fraud risk management efforts—

such as demonstrated leadership for combating fraud, existing control 

activities, and stakeholder relationships—to provide additional antifraud 

training, as well as to develop an antifraud strategy based on fraud risk 

assessments for Medicare and Medicaid. We recognize that the effort 

may be challenging, given the size and complexity of Medicare and 

Medicaid, and the need to balance antifraud activities with CMS’s other 

mission priorities. However, by not employing the actions identified in the 

Fraud Risk Framework and incorporating them in its approach to 

managing fraud risks, CMS is missing a significant opportunity to better 

ensure employee vigilance against fraud, and to organize and focus its 

many antifraud and program-integrity activities and related resources into

a comprehensive strategy. Such a strategy would (1) provide reasonable 

assurance that CMS is targeting the most-significant fraud risks in its 

programs and (2) help protect the government’s substantial and growing 

investments in these programs.

We are making the following three recommendations to CMS:

• The Administrator of CMS should provide fraud-awareness training 

relevant to risks facing CMS programs and require new hires to 

undergo such training and all employees to undergo training on a

recurring basis. (Recommendation 1)

• The Administrator of CMS should conduct fraud risk assessments for 

Medicare and Medicaid to include respective fraud risk profiles and 

plans for regularly updating the assessments and profiles. 

(Recommendation 2)

• The Administrator of CMS should, using the results of the fraud risk 

assessments for Medicare and Medicaid, create, document, 

implement, and communicate an antifraud strategy that is aligned with 

and responsive to regularly assessed fraud risks. This strategy should 

Recommendations for 

Executive Action
Page 50 GAO-18-88 CMS Fraud Risk Management

include an approach for monitoring and evaluation. (Recommendation 

3)

We provided a draft of this report to HHS and DOJ for comment. HHS

provided written comments, which are reprinted in appendix I. DOJ did 

not have comments. HHS and DOJ also provided technical comments, 

which we incorporated as appropriate.

In commenting on this report, HHS agreed with our three 

recommendations. Specifically, in response to our first recommendation 

to provide required fraud-awareness training to all employees, HHS 

stated that it will develop and implement a fraud-awareness training plan 

to ensure all CMS employees receive training. 

Regarding our second recommendation to conduct fraud risk 

assessments for Medicare and Medicaid, HHS stated that it is currently 

conducting a fraud risk assessment on the federally facilitated 

marketplace and, when this assessment is complete, will apply the 

lessons learned in assessing this program to fraud risk assessments of 

Medicare and Medicaid. 

In response to our third recommendation to create, document, implement, 

and communicate an antifraud strategy that is aligned with and 

responsive to regularly assessed fraud risks, HHS stated that it will 

develop respective risk-based antifraud strategies after completing fraud 

risk assessments for Medicare and Medicaid.

We are sending copies of this report to the Acting Secretary of Health and 

Human Services, the Administrator of CMS, the Assistant Attorney 

General for Administration at DOJ, as well as appropriate congressional 

committees and other interested parties. In addition, this report is 

available at no charge on the GAO website at http://www.gao.gov.

If you or your staff members have any questions about this report, please 

contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found 

Agency Comments
Page 51 GAO-18-88 CMS Fraud Risk Management

on the last page of this report. GAO staff who made contributions to this

report are listed in appendix II.

Seto J. Bagdoyan

Director of Audits

Forensic Audits and Investigative Service
Page 52 GAO-18-88 CMS Fraud Risk Management

List of Addressees

The Honorable Orrin G. Hatch

Chairman

Committee on Finance

United States Senate

The Honorable Claire McCaskill

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Greg Walden

Chairman

Committee on Energy and Commerce

House of Representatives

The Honorable Kevin Brady

Chairman

Committee on Ways and Means

House of Representatives

The Honorable Pat Tiberi

Chairman

Subcommittee on Health

Committee on Ways and Means

House of Representatives

The Honorable Vern Buchanan

Chairman

Subcommittee on Oversight

Committee on Ways and Means

House of Representatives

The Honorable Michael C. Burgess

Chairman

Subcommittee on Health

Committee on Energy and Commerce

House of Representatives
Page 53 GAO-18-88 CMS Fraud Risk Management

The Honorable Tom Cole

Chairman

Subcommittee on Labor, Health and Human Services, Education and 

 Related Agencies

Committee on Appropriations

House of Representatives
Appendix I: Comments from the Department of 

Health and Human Services

Page 54 GAO-18-88 CMS Fraud Risk Management

Appendix I: Comments from the Department 

of Health and Human Services
Appendix I: Comments from the Department of 

Health and Human Services

Page 55 GAO-18-88 CMS Fraud Risk Management
Appendix I: Comments from the Department of 

Health and Human Services

Page 56 GAO-18-88 CMS Fraud Risk Management
Appendix I: Comments from the Department of 

Health and Human Services

Page 57 GAO-18-88 CMS Fraud Risk Management
Appendix II: GAO Contact and Staff

Acknowledgments

Page 58 GAO-18-88 CMS Fraud Risk Management

Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov

In addition to the contact named above, Tonita Gillich (Assistant Director), 

Irina Carnevale (Analyst-in-Charge), Michael Duane, Laura Sutton 

Elsberg, and Catrin Jones made key contributions to this report. Also 

contributing to the report were Lori Achman, James Ashley, Colin Fallon, 

Leslie V. Gordon, Maria McMullen, Sabrina Streagle, and Shana Wallace.

Appendix II: GAO Contact and Staff 

Acknowledgments

GAO Contact

Staff 

Acknowledgments

(100902)
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (http://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to http://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov and read The Watchblog.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.