For Release on Delivery

Expected at 10:00 a.m.

Thursday, April 6, 2000

GAO/T-HEHS-00-93

MEDICARE

Concerns About HCFA’s

Efforts to Prevent Fraud

by Third-Party Billers

Statement of Leslie G. Aronovitz, Associate Director

Health Financing and Public Health Issues

Health, Education, and Human Services Division

Testimony

Before the Subcommittee on Oversight and Investigations,

Committee on Commerce, House of Representatives

United States General Accounting Office

GAO
Page 1 GAO/T-HEHS-00-93

Mr. Chairman and Members of the Subcommittee:

We are pleased to be here today to discuss the effectiveness of HCFA’s

efforts to prevent fraud by third-party billing companies that submit claims

to Medicare on behalf of providers. With 1999 payments of about $208

billion and responsibility for financing health services delivered by

hundreds of thousands of providers to almost 40 million elderly and

disabled Americans, Medicare is inherently vulnerable to fraud, waste, and

abuse. We, and the Department of Health and Human Services (HHS)

Office of Inspector General (OIG) have issued several reports addressing

the need for sophisticated program safeguards to identify and detect

potentially fraudulent billing practices.

In fiscal year 1999, Medicare’s fee-for-service program covered about 83

percent of Medicare’s beneficiaries. HCFA administers Medicare’s fee-forservice program largely through a network of more than 50 claims

processing contractors–insurance companies such as Mutual of Omaha

and Blue Cross and Blue Shield plans–that process and pay Medicare

claims. Once enrolled in Medicare, physicians, hospitals, and other

providers may submit claims for payment, sometimes through third-party

billers, to Medicare contractors. Third-party billing companies are

businesses that prepare and submit claims on behalf of health care

providers to payers such as Medicare, Medicaid, and private health

insurers. In the first 7 months of fiscal year 1999, Medicare contractors

processed over 508 million claims–averaging more than 72 million claims

per month.

HCFA’s contractors can only review a limited number of claims. Finding

fraud among third-party billing companies is like looking for a needle in a

haystack. Knowing that providers are linked to problematic third-party

billers is like giving HCFA a magnet to look for those needles. In a GAO

report issued last June, we found that HCFA’s efforts to comprehensively

identify and review claims associated with third-party billers fell short for

several reasons.1 First, the identity of a third-party biller submitting a

claim is lost on many electronic claims when multiple entities are

involved, while on paper claims, such information is not recorded at all.

Second, such billers do not register with Medicare, nor are they linked

systematically to the providers they serve. Third, HCFA’s efforts to

develop comprehensive data on all providers, including their use of thirdparty billers, are still several years from completion. Finally, information

1 GAO/HEHS-99-127R, June 2, 1999.

Medicare: Concerns About HCFA’s Efforts to

Prevent Fraud by Third-Party Billers
Medicare: Concerns About HCFA’s Efforts

to Prevent Fraud by Third-Party Billers

Page 2 GAO/T-HEHS-00-93

HCFA does have about providers’ use of third-party billers is not reliable

because HCFA’s database is dependent on provider self-reporting and is

not validated.

Although third-party billing services have been part of the U.S. health care

system since the 1950s, large billing companies emerged in the 1980s,

when Medicare required that hospital-based physicians’ services be

separately billed. In 1990, Medicare required physicians and other

providers to submit claims to Medicare on behalf of all beneficiaries,

increasing providers’ billing workloads. Many providers have turned to

third-party billing companies to assist them in submitting claims and to

provide advice regarding reimbursement matters, as well as overall

business decision-making. Officials of an industry trade association

estimate that there are currently about 5,000 active third-party billing

companies in the United States.

Third-party billing companies prepare either paper or electronic claims for

submission to Medicare contractors. In fiscal year 1999, about 83 percent

of Medicare claims were submitted electronically. Electronic claims may

be submitted directly to a contractor or may be sent through one or more

other entities, known as clearinghouses, before reaching the Medicare

contractor. Third-party billers, and even providers, contract with

clearinghouses to reformat claims to meet Medicare’s requirements.

Medicare claims administration contractors are responsible for processing

and paying Medicare claims. In addition, they are responsible for payment

safeguard activities intended to protect Medicare from paying

inappropriately. These activities include analyzing claims data to identify

potentially inappropriate claims, performing medical review of claims to

determine whether the services provided were medically necessary and

covered by Medicare, and investigating potential cases of fraud and abuse.

To target program integrity resources, contractors attempt to identify

aberrant patterns of claims submitted by providers to determine whether

the claims should be subjected to greater scrutiny. In this connection, the

ability to scrutinize the claims being submitted by individual third-party

billing companies might allow HCFA to identify aberrant patterns

indicative of fraud and abuse in their submissions.

Third-party billing companies often have access to billing information

about multiple health care providers and many of their patients. As a

result, unscrupulous operators of such businesses have an opportunity to

submit false claims. For example, in 1997, a billing company agreed to pay

Background

HCFA Cannot Identify

Claims Submitted By

Third-Party Billers
Medicare: Concerns About HCFA’s Efforts

to Prevent Fraud by Third-Party Billers

Page 3 GAO/T-HEHS-00-93

the government $7.75 million to settle allegations that it had violated the

federal False Claims Act when it filed improperly coded claims. In 1998, a

different third-party biller was found to have submitted duplicate claims

and claims with incorrect diagnosis codes. Although it did not admit guilt,

it agreed to pay the federal government $1.5 million to settle these

allegations. In a third case, a third-party billing company agreed to pay the

government almost $415,000 to settle allegations that it improperly filed

medical supply claims with Medicare on behalf of a provider. The provider

denied that it knew of, or participated in, any fraudulent conduct with

respect to the submission of the claims.

Even when HCFA or its contractors suspect that providers’ claims are

abusive, they are often unable to tell that the claims were submitted by a

third-party biller. This is due to limitations in both the systems for

processing electronic claims and the complete lack of identifying

information on paper claims. For providers, third-party billers, and

clearinghouses to submit claims to Medicare contractors electronically,

they must obtain a submitter number from a Medicare contractor. This

number becomes part of each claim submission. Electronic claim

submissions contain only one submitter number. If a third-party biller

submits a claim directly to a contractor, the number identifies the claim as

coming from that biller. However, when a claim passes through other

entities, such as one or more clearinghouses, before reaching the

contractor for payment, the third-party biller’s number is not always

present. In some cases, one entity may overwrite another’s number, or

entities may decide among themselves whose number to use.

While HCFA has established this process—albeit imperfect—to monitor

the source of electronic claims, no such process exists for paper claims.

Paper claim forms include a section or space to identify the provider but

not the biller. In general, contractors would know if a third-party biller

submitted a paper claim only if the provider specifically informed the

contractor when it first enrolled in Medicare of its intention to use a thirdparty biller, or if the contractor identified a biller while investigating a

provider. An OIG official who has investigated several cases of Medicare

fraud by third-party billing companies told us that when billing companies

used paper claims, it was difficult for the OIG to identify all providers

using a given biller. In the case where a third-party billing company was

submitting fraudulent claims for surgical dressings on behalf of many

nursing homes across the United States, there was no indication that the

same third-party biller was involved. The OIG agents pursued the case

against one nursing home as an individual fraudulent provider, when in

fact 70 nursing homes were involved. After additional cases were opened

by other OIG offices targeting other individual nursing homes, the agents
Medicare: Concerns About HCFA’s Efforts

to Prevent Fraud by Third-Party Billers

Page 4 GAO/T-HEHS-00-93

met to share lessons learned and realized that all the nursing homes used

the same billing company and that a single company was, in fact, the

source of the fraud.

HCFA has no routine registration process to collect comprehensive

information about third-party billers. Although the enrollment process

requires providers to identify the name of the billing company, its address,

phone number, and a contact person, there is no registration process for

third-party billers that would allow HCFA to identify critical information

on the company’s owners, criminal history record, or other identifiers.

Without this information, HCFA might have difficulty identifying an officer

or officers of the company if problems should occur. In addition, although

providers indicating that they plan to use a billing company must provide a

copy of their contract with the biller, the information in the contract may

be minimal. For example, we reviewed one contract that identified the

services the biller would provide but included no identifying information

about the biller other than its name and a signature. Even if HCFA did

have complete information on third-party billers, it has limited recourse if

problems arise. Although HCFA can refer the biller to the HHS OIG or the

Department of Justice, it does not have the ability to take intermediate

administrative actions. According to a HCFA official, whereas the agency

would like to be able to exclude third-party billers from submitting claims

to Medicare, it cannot do so because third-party billers do not have to

enroll with Medicare to participate in the program.

HCFA has made efforts to obtain information on third-party billers, but it

still cannot routinely match a third-party biller with all of the providers it

represents. In May 1996, HCFA issued a new enrollment form for providers

entering Medicare. The form requires detailed information, including an

identification of the third-party billing company a provider plans to use, if

any. While the enrollment form provides information about billers that

HCFA and its contractors previously did not have, HCFA data indicate that

only about 15 percent of Medicare providers have enrolled since HCFA

began using the new form. Thus, the 85 percent of Medicare providers that

enrolled before May 1996 likely have not provided this information to

HCFA. Further, even providers that have completed the new enrollment

form may not have valid information in HCFA’s system. This is due to the

fact that HCFA and the contractors depend on providers to report any

changes. Providers often do not comply with the requirement in

enrollment instructions to notify their claims processing contractors when

they change or add third-party billers, according to HCFA and contractor

officials we talked with. Although notification is legally required, it is

HCFA’s Efforts Show

Limited Results
Medicare: Concerns About HCFA’s Efforts

to Prevent Fraud by Third-Party Billers

Page 5 GAO/T-HEHS-00-93

unlikely as a practical matter that any action would be taken against a noncomplying provider.

In an attempt to gather updated and comprehensive information about

providers, HCFA is drafting a regulation to require providers that enrolled

in Medicare before May 1996 to complete the new enrollment form to fill

this information gap. Providers would also be required to recertify the

information on their enrollment form every 3 years. HCFA plans to have

the regulation in effect by October 1, 2000, and begin requiring providers

to update their enrollment information shortly thereafter. Here again, this

process involves self-reported data that typically will not be validated or

updated by the contractors.

To make provider and third-party biller information more accessible to the

contractors, HCFA is developing a new automated system to access the

provider enrollment database. HCFA intends that the system, known as

the Provider Enrollment, Chain and Ownership System (PECOS) will

provide a complete history of a Medicare provider based on the

information in the provider enrollment application.2 Initially, HCFA plans

to incorporate currently available provider information into the system,

and, according to HCFA officials, will include updated information from

all providers in the future. HCFA plans to implement PECOS for

institutional providers, such as hospitals and nursing homes, by June 2000.

HCFA’s timeline currently indicates that PECOS will be operational for

providers of outpatient services in January 2002. According to a HCFA

official, this timeline was developed prior to addressing all Y2K concerns ;

due to a smooth transition, however, it may be able to move

implementation up to August 2001. Finally, HCFA expects that

comprehensive data on durable medical equipment suppliers will be

brought into PECOS about 12 months after these other efforts are

completed. The system will depend entirely on providers submitting

information to the contractors, without subsequent validation. As a result,

PECOS will only be as useful as the accuracy of the information it

receives.

In an effort to ensure the integrity of Medicare, HCFA and its contractors

need to develop reliable and sophisticated approaches to identifying

potentially fraudulent billing practices. In this regard, contractors should

2 PECOS’ functions include capturing enrollment data, logging and tracking provider enrollment

forms, identifying and profiling provider chains, tracking associations of Medicare providers to these

chains, providing inquiry and reporting capability, and providing a data exchange process that

forwards enrollment and claim information to other processing systems.

Conclusions
Medicare: Concerns About HCFA’s Efforts

to Prevent Fraud by Third-Party Billers

Page 6 GAO/T-HEHS-00-93

be able to easily access information about third-party billers that complete

and submit claims to Medicare for payment. It is especially important to be

able to match up third-party billers with the providers they represent, so

that contractors can identify potentially questionable billing patterns and

subject these claims to more extensive review. Although HCFA has

various efforts underway to better identify providers’ questionable claims

and their associated third-party billers, there continue to be gaps in its

safeguard program. It is important that HCFA complete its provider

recertification program as soon as possible so that it will have available

comprehensive information about all Medicare providers and their billers.

Further, we are concerned about problems with data reliability inherent in

any type of self-reporting program.

Mr. Chairman, this concludes my statement. I will be happy to answer any

questions you or the Subcommittee Members may have.

For future contacts regarding this testimony, please call Leslie G.

Aronovitz, Associate Director, Health Financing and Public Health Issues,

at (312) 220-7767. Other individuals who made key contributions include

Shaunessye Curry and Lynn Filla-Clark.

(201055)

GAO Contact and

Acknowledgements
Orders by Internet

For information on how to access GAO reports on the Internet, send

an e-mail message with “info” in the body to:

Info@www.gao.gov

or visit GAO’s World Wide Web home page at:

http://www.gao.gov

Contact one:

Web site: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

1-800-424-5454 (automated answering system)

Ordering Information

To Report Fraud,

Waste, and Abuse in

Federal Programs