MEDICARE 

PROGRAM

Continued Action 

Required to Address 

Weaknesses in 

Provider and Supplier 

Enrollment Controls

Statement of Seto J. Bagdoyan, Director, Forensic Audits 

and Investigative Service

Testimony 

Before the Subcommittee on Oversight 

and Investigations, Committee on 

Energy and Commerce, House of 

Representatives

For Release on Delivery 

Expected at 10:15 a.m. ET

Tuesday, May 24, 2016

GAO-16-703T

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-16-703T, a testimony

before the Subcommittee on Oversight and 

Investigations, Committee on Energy and 

Commerce, House of Representatives

May 24, 2016

MEDICARE PROGRAM

Continued Action Required to Address Weaknesses 

in Provider and Supplier Enrollment Controls

What GAO Found

In June 2015 and April 2016, GAO reported on CMS’s implementation of 

enrollment-screening procedures that the Centers for Medicare & Medicaid 

Services (CMS) uses to prevent and detect ineligible or potentially fraudulent 

providers and suppliers from enrolling into its Provider Enrollment, Chain and 

Ownership System (PECOS). GAO identified weaknesses in CMS’s verification 

of provider practice location, physician licensure status, and criminal-background 

histories. These weaknesses may have resulted in CMS improperly paying

thousands of potentially ineligible providers and suppliers. 

• Specifically, in June 2015, GAO’s examination of 2013 data found that about 

23,400 (22 percent) of 105,234 of practice location addresses were 

potentially ineligible. The computer software CMS used as a method to 

validate applicants’ addresses did not flag potentially ineligible addresses, 

such as those that are of a Commercial Mail Receiving Agency (such as a 

UPS store mailbox), vacant, or invalid. GAO recommended that CMS 

incorporate flags into its software to help identify potentially questionable 

addresses, among other things. CMS concurred with this recommendation

and has replaced the PECOS address verification software.

• Also, in June 2015, GAO found that, as of March 2013, 147 out of about 1.3

million physicians listed in PECOS had received a final adverse action 

against their medical license from a state medical board for various felonies

that may have made them ineligible to bill Medicare. However, they were 

either not revoked from the Medicare program until months after the adverse 

action or never removed because CMS only collected information on the 

medical license numbers providers used to enroll into the Medicare program. 

CMS also did not collect adverse-action history or other medical licenses a 

provider may have in other states that were not used to enroll into Medicare. 

GAO recommended that CMS collect and review additional license 

information. CMS has incorporated a new database to obtain additional 

license history. 

• In April 2016, GAO reported on CMS’s process to conduct criminalbackground checks on Medicare providers and suppliers and found that 

opportunities exist for CMS to recover about $1.3 million in potential 

overpayments made to 16 out of 66 potentially ineligible providers with 

criminal backgrounds. In April 2014, CMS implemented procedures to obtain 

greater access to data to verify criminal backgrounds of existing and 

prospective Medicare providers and suppliers than it obtained previously;

however, the results of GAO’s review of the 2013 data identified an 

opportunity for CMS to recover potential overpayments that were made prior 

to putting the revised procedures in place.

In addition to its actions in response to GAO’s recommendations, CMS has 

taken some actions to remove or recover overpayments from potentially 

ineligible providers and suppliers that GAO referred to it in April 2015 and April 

2016, but its review and response to the referrals are ongoing.

Why GAO Did This Study

In fiscal year 2015, Medicare paid 

$568.9 billion for health care and 

related services. CMS estimates that 

$59.6 billion (about 10.5 percent) of 

that total was paid improperly. To 

establish and maintain Medicare billing 

privileges, providers and suppliers 

must be enrolled in a CMS database 

known as PECOS. About 1.9 million 

providers and suppliers were in 

PECOS as of December 2015, 

according to CMS.

GAO published reports in June 2015 

and April 2016 that examined 

Medicare’s provider and supplier 

enrollment-screening procedures to 

determine whether PECOS was 

vulnerable to fraud. This testimony 

discusses the extent to which selected

enrollment-screening procedures are 

designed and implemented to prevent 

and detect the enrollment of ineligible 

or potentially fraudulent Medicare 

providers and suppliers into PECOS. 

In its reports, GAO matched providers 

and suppliers in PECOS, as of March 

2013, to several databases to identify 

potentially ineligible providers and 

suppliers, and used Medicare claims 

data to verify whether they were paid 

during this period. GAO also examined 

relevant documentation, interviewed 

CMS officials, and obtained information 

from the CMS contractors that evaluate 

provider applications. From August 

2015 through May 2016, GAO obtained 

updated information from CMS staff 

and reviewed documents related to 

actions.

CMS has taken or has plans to take

some actions to address all of GAO’s 

recommendations and referrals of 

potentially ineligible providers and 

suppliers.

View GAO-16-703T. For more information, 

contact Seto Bagdoyan at (202) 512-6722 or 

bagdoyans@gao.gov. 
Letter

Page 1 GAO-16-703T 

Chairman Murphy, Ranking Member DeGette, and Members of the 

Subcommittee:

I am pleased to appear before you today to discuss our previous work on 

the controls used to verify the eligibility of Medicare providers and 

suppliers and potential opportunities to recover overpayments to 

providers with criminal backgrounds.1 Medicare is the federally financed 

health-insurance program for persons age 65 or over, certain individuals 

with disabilities, and individuals with end-stage renal disease.2 In fiscal 

year 2015, Medicare paid $568.9 billion for health care and health care–

related services. According to the Centers for Medicare & Medicaid 

Services (CMS)—the agency within the Department of Health and Human 

Services (HHS) that administers the Medicare program—an estimated 

$59.6 billion (10.5 percent) of that total was paid improperly.3 Due to the 

large dollar amount involved in improper payments, the Office of 

Management and Budget has placed Medicare on its list of high-error 

programs.4 Further, because of its size, complexity, and susceptibility to 

 1

GAO, Medicare Program: Additional Actions Needed to Improve Eligibility Verification of 

Providers and Suppliers, GAO-15-448 (Washington, D.C.: June 25, 2015); Medicare: 

Opportunities Exist to Recover Potential Overpayments to Providers with Criminal 

Backgrounds, GAO-16-365R (Washington, D.C.: Apr. 13, 2016).

2

Medicare consists of four parts. Medicare Part A covers items such as inpatient hospital 

care. Part B services include physician and outpatient hospital services. Medicare Part C 

or Medicare Advantage is a Medicare private plan, while Medicare Part D is an outpatient 

prescription drug benefit. 

3

An improper payment is defined as any payment that should not have been made or that 

was made in an incorrect amount (including overpayments and underpayments) under 

statutory, contractual, administrative, or other legally applicable requirements. It includes 

any payment to an ineligible recipient, any payment for an ineligible good or service, any 

duplicate payment, any payment for a good or service not received (except for such 

payments where authorized by law), and any payment that does not account for credit for 

applicable discounts. Improper Payments Elimination and Recovery Improvement Act of 

2012, Pub. L. No. 112-248, § 3(a)(1), 126 Stat 2390 (codified at 31 U.S.C. § 3321 note). 

4

The Office of Management and Budget designates a program as “high-error” based on 

improper-payment information in agencies’ annual Performance and Accountability 

Reports and Agency Financial Reports. Specifically, a program is considered high-error if 

it has improper payments greater than $10 million and over 2.5 percent of all payments 

made under that program, or if the program has more than $100 million in estimated 

improper payments.

Letter
Page 2 GAO-16-703T 

mismanagement and improper payments, we have designated Medicare 

as a high-risk program.5

To enroll in Medicare and bill for services provided to Medicare 

beneficiaries, CMS requires prospective providers and suppliers to be 

listed in the Provider Enrollment, Chain and Ownership System (PECOS). 

PECOS is a centralized database designed to contain providers’ and 

suppliers’ enrollment information. According to CMS, there were about 

1.9 million health-care providers and suppliers enrolled in PECOS as of 

December 31, 2015.

My remarks today highlight the key findings of our June 2015 report on 

CMS’s Medicare provider and supplier enrollment-screening procedures 

and our April 2016 report on potential overpayments to providers with 

criminal backgrounds. Accordingly, this testimony discusses the extent to 

which selected enrollment-screening procedures are designed and 

implemented to prevent and detect the enrollment of ineligible or 

potentially fraudulent Medicare providers and suppliers into PECOS.

In June 2015, we reported on the implementation of four enrollmentscreening procedures that CMS uses to prevent and detect ineligible or 

potentially fraudulent providers and suppliers from enrolling into PECOS, 

including verifying provider practice locations and physician licensure 

status, and screening for providers and suppliers listed as deceased or 

excluded from participating in federal programs or health care–related 

programs. To assess the extent to which CMS had controls to verify the 

eligibility of Medicare providers and suppliers, we reviewed CMS 

procedural manuals and directives, and interviewed CMS officials about 

provider and supplier enrollment-screening procedures. We matched the 

list of providers and suppliers present in PECOS, as of March 29, 2013, 

and durable medical equipment, prosthetics, orthotics, and supplies 

(DMEPOS) suppliers, as of April 6, 2013 (the most-current data available 

at the time of our review) to the following databases: (1) the United States 

Postal Service (USPS) Address Matching System Application Program 

Interface;6 (2) Federation of State Medical Boards (FSMB) licensure data; 

 5

GAO, High-Risk Series: An Update, GAO-15-290 (Washington, D.C.: February 2015).

6

In this statement, we refer to the USPS Address Management System Application 

Program Interface as the USPS address-management tool.
Page 3 GAO-16-703T 

(3) the Social Security Administration’s (SSA) full death file;7 and (4) the 

HHS Office of Inspector General’s (OIG) List of Excluded Individuals and 

Entities (LEIE) to determine whether ineligible or potentially fraudulent 

Medicare providers, suppliers, and DMEPOS suppliers were in PECOS. 

For the USPS address-management tool, we selected a generalizable 

sample from the addresses that the USPS address-management tool 

identified as being a Commercial Mail Receiving Agency (CMRA), vacant, 

or invalid and took additional steps to confirm whether the practice 

location address was an eligible address. In addition, we obtained 

Medicare claims data from 2005 through 2013 from CMS for all of our 

matches to determine how much the providers and suppliers were paid 

with Medicare funds, if at all, while they may have been ineligible. On the 

basis of our discussions with agency officials and our own testing, we 

concluded that the data elements used for this report were sufficiently 

reliable for our purposes. In November 2015, February 2016, and May 

2016, CMS officials provided us with updates on actions taken to address 

our three recommendations made in the June 2015 report. From August 

2015 through May 2016, CMS officials also provided updates on the 

actions taken on the cases we referred.

In April 2016, we reported on a fifth enrollment-screening process CMS 

used to conduct criminal-background checks on Medicare providers and 

suppliers. To assess the extent to which CMS had controls in place to 

verify criminal-background information for providers and suppliers in 

PECOS, we matched the PECOS data of approximately 1.2 million 

unique physicians and nonphysicians as of March 2013 to data from the 

Federal Bureau of Prisons and the National Sex Offender Registry as of 

February 2014, by Social Security number, name, and date of birth, to 

identify potentially ineligible providers.8 We also reviewed CMS 

supporting documentation and interviewed agency officials. We also 

 7

SSA maintains death data including names, Social Security numbers, dates of birth, and 

dates of death. SSA shares a comprehensive file of this death information, which includes 

state death data, with certain eligible entities, including CMS, according to SSA. We used 

this comprehensive file, which we call the “full death master file,” for our analysis. A subset 

of the full death master file that does not include state death data is available to the public. 

8

Our findings are based on data from 2013, the most-current data available to us at the 

time of our review. CMS implemented new procedures in April 2014 to update its criminalbackground check process. Although CMS has new procedures in place, the results of our 

review of the 2013 data provide an opportunity for CMS to recover potential overpayments 

that were made prior to putting the revised procedures in place.
Page 4 GAO-16-703T 

calculated Medicare claims that were paid to providers while they were 

potentially ineligible. We assessed the reliability of data and determined 

that these databases were sufficiently reliable for the purpose of our 

review. More details on our scope and methodology can be found in the 

issued reports.9 In May 2016, CMS officials provided us with an update 

on the 66 providers we referred to CMS for further review. We conducted 

the work on which this statement is based in accordance with generally 

accepted government auditing standards.10

In our June 2015 and April 2016 reports examining CMS screening 

procedures, we found weaknesses in CMS’s verification of provider 

practice location, physician licensure status, providers listed as deceased 

or excluded from participating in federal programs or health care–related 

programs, and criminal-background histories. These weaknesses may 

have resulted in CMS improperly paying thousands of potentially ineligible 

providers and suppliers. We made recommendations to address these 

weaknesses, which CMS has indicated it has implemented or is taking 

steps to address. Additionally, as a result of our work, we referred 597 

unique providers and suppliers to CMS. According to CMS officials, they 

have taken some actions to remove or recover overpayments from the 

potentially ineligible providers and suppliers we referred to them in April 

2015 and April 2016, but CMS’s review and response to the referrals are 

ongoing.

In our June 2015 report, we found thousands of questionable practice 

location addresses for providers and suppliers listed in PECOS, as of 

March 2013, and DMEPOS suppliers, listed as of April 2013.11 Under 

federal regulations, providers and suppliers must be “operational” to 

 9

GAO-15-448 and GAO-16-365R.

10Those standards require that we plan and perform the audit to obtain sufficient, 

appropriate evidence to provide a reasonable basis for our findings and conclusions 

based on our audit objectives. We believe that the evidence obtained provides a 

reasonable basis for our findings and conclusions based on our audit objectives.

11GAO-15-448. All providers and suppliers must list a physical practice location address in 

their application, regardless of provider or supplier type.

Limitations Exist in 

Certain CMS 

Screening 

Procedures for 

Preventing and 

Detecting Enrollment 

of Ineligible or 

Potentially Fraudulent 

Medicare Providers 

and Suppliers

Practice Location 

Verification Procedures
Page 5 GAO-16-703T 

furnish Medicare covered items or services, meaning that they have a 

qualified physical practice location that is open to the public for the 

purpose of providing health care–related services. The location must be 

properly staffed, equipped, and stocked to furnish these items or services. 

Addresses that generally would not be considered a valid practice 

location include post office boxes, and those associated with a certain 

type of CMRA, such as a United Parcel Service (UPS) store.12 We 

checked PECOS practice location addresses for all records that 

contained an address using the USPS address-management tool, a 

commercially available software package that standardizes addresses 

and provides specific flags on the address such as a CMRA, vacant, or 

invalid address.13 As illustrated in figure 1, on the basis of our analysis of 

a generalizable stratified random sample of 496 addresses, we estimate 

that about 23,400 (22 percent) of the 105,234 addresses we initially 

identified as a CMRA, vacant, or invalid address are potentially ineligible 

addresses.14 About 300 of the addresses were CMRAs, 3,200 were 

vacant properties, and 19,900 were invalid.

 12On the basis of USPS guidance, a CMRA is a third-party agency that receives and 

handles mail for a client. Not all CMRAs would disqualify an applicant from PECOS 

enrollment. For example, a hospital may be legitimately designated as a CMRA and could 

be considered an eligible practice location. Post office boxes and drop boxes are not 

acceptable except in some cases where the provider is located in rural areas.

13The USPS address-management tool includes addresses as of December 15, 2013. 

This software is not currently being used by CMS. Instead, CMS uses the other 

software—called Finalist—to standardize practice location addresses. A vacancy refers to 

a provider or supplier that is no longer at the location provided on the application form. 

USPS would flag a location as vacant if it used to deliver mail there and has not delivered 

mail there in more than 90 days. An invalid address is when an address is not recognized 

by USPS, was incorrectly entered in PECOS, or was missing a street number.

14As part of our initial analysis using the USPS address-management tool, we identified 

105,234 (about 11 percent) of the 980,974 address listed in PECOS that appeared in the 

USPS address-management tool as a CMRA, a vacant address, or an invalid address. 

For more information on our estimates and methodology, see GAO-15-448.
Page 6 GAO-16-703T 

Figure 1: GAO Sample Estimates of Provider and Supplier Practice Location Addresses in PECOS Using the USPS AddressManagement Tool

Note: Estimated numbers do not add to totals due to rounding. All estimates in this figure have a 

margin of error, at the 95 percent confidence level, of plus or minus 10 percentage points or fewer. 

These data are from March 2013 (Medicare providers and suppliers) and April 2013 (suppliers of 

durable medical equipment, prosthetics, orthotics, and supplies).

a

We did not submit addresses of providers in PECOS that reassigned their benefits to a group. These 

providers did not have a practice location address listed in PECOS and were not included in our work.

Of the 23,400 potentially ineligible addresses submitted as practice 

locations, we estimate that, from 2005 to 2013, about 17,900 had no 

claims associated with the address, 2,900 were associated with providers 

that had claims that were less than $500,000 per address, and 2,600 

were associated with providers that had claims that were $500,000 or 

more per address. Because some providers are associated with more 

than one address, it is possible that some of the claim amounts reported 

may be associated with a different, valid practice location. Due to how we 

compiled claims by the National Provider Identifier, we were unable to 

determine how much, if any, of the claim amount may be associated with 

a different, valid address.

In our June 2015 report, we found limitations with CMS’s Finalist software 

used to validate practice location addresses. The Finalist software is one 

technique used by the Medicare Administrative Contractors (MAC) and 

the National Supplier Clearinghouse (NSC) to validate a practice 
Page 7 GAO-16-703T 

location.15 According to CMS, Finalist is integrated into PECOS to 

standardize addresses and does so by comparing the address listed on 

the application to USPS records and correcting any misspellings in street 

and city names, standardizing directional markers (such as NE or West) 

and suffixes (such as Ave. or Lane), and correcting errors in the zip code. 

However, the Finalist software does not indicate whether the address is a 

CMRA, vacant, or invalid address—in other words, whether the location is 

potentially ineligible to qualify as a legitimate practice location. CMS does 

not have these flags in Finalist because the agency added coding in 

PECOS that prevents post office box addresses from being entered, and 

believed that this step would prevent these types of ineligible practice 

locations from being accepted.

Further, some CMRA addresses are not listed as post office boxes. For 

example, in our June 2015 report we identified 46 out of the 496 sample 

addresses that were allowed to enroll in Medicare with a practice location 

that was inside a mailing store similar to a UPS store. These providers’

addresses did not appear in PECOS as a post office box, but instead 

were listed as a suite or other number, along with a street address. Figure 

2 shows an example of one provider we identified through our search and 

site visits as using a mailbox-rental store as its practice location and 

where services are not actually rendered. This provider’s address 

appears as having a suite number in PECOS and remained in the system 

as of January 2015. According to our analysis of CMS records, this 

provider was paid approximately $592,000 by Medicare from the date it 

enrolled in PECOS with this address to December 2013, which was the 

latest date for which CMS had claims data at the time of our review.16

 15CMS contracts with the MACs and the NSC to manage the enrollment process. MACs 

are responsible for verifying provider and supplier application information in PECOS 

before the providers and suppliers are permitted to enroll into Medicare. The NSC is 

responsible for verifying information regarding DMEPOS suppliers.

16The claims amount was calculated based on all claims associated with the National 

Provider Identifier that was listed on the matched address. Because some providers are 

associated with more than one address, it is possible that some of the claim amounts 

reported may be associated with a different, valid practice location. Due to how we 

obtained compiled claims by the National Provider Identifier, we were unable to determine 

how much, if any, of the claim amount may be associated with a different, valid address.
Page 8 GAO-16-703T 

Figure 2: Mailbox Rental Store with a Suite Number Address Used as a Provider 

Practice Location

Our June 2015 report also found locations that were vacant or addresses 

that belonged to an unrelated establishment. For example, we visited a 

provider’s stated practice location in December 2014 and instead found a 

fast-food franchise there (see fig. 3—the name of the franchise has been 

blurred). In addition, we found a Google Maps image dated September 

2011 that shows this specific location as vacant. Although the provider 

was not paid by Medicare from the date this practice location address 

was flagged as vacant, by remaining actively enrolled into PECOS, the 

provider may be eligible to bill Medicare in the future.
Page 9 GAO-16-703T 

Figure 3: Fast-Food Franchise Listed as Provider’s Practice Location

In March 2014, CMS issued guidance to the MACs that revised the 

practice location verification methods by requiring MACs to only contact 

the person listed in the application to verify the practice location address 

and use the Finalist software that is integrated in PECOS to standardize 

the practice location address. Additional verification, such as using 

411.com and USPS.com, which was required under the previous 

guidance, is only needed if Finalist cannot standardize the actual 

address.

17 In our June 2015 report, we noted that our findings suggest 

that the revised screening procedure of contacting the person listed in the 

application to verify all of the practice location addresses may not be 

sufficient to verify such practice locations. For example, two providers in 

our sample of 496 addresses that the USPS address-management tool 

flagged as CMRA, invalid, or vacant successfully underwent a MAC 

revalidation process in 2014. The MAC used the new procedure of calling 

 17411.com is an online directory of contact information for people and businesses. 

USPS.com offers the ZIP Code Lookup tool, which standardizes addresses using USPS 

address records.
Page 10 GAO-16-703T 

the contact person to verify the practice location. Each of these two 

providers had a UPS or similar store as its practice location.

To help further improve CMS’s enrollment-screening procedures to verify 

applicants’ practice location, we made two recommendations to CMS in 

our June 2015 report. First, we recommended that CMS modify the CMS 

software integrated into PECOS to include specific flags to help identify 

potentially questionable practice location addresses, such as CMRA, 

vacant, and invalid addresses. The agency concurred with this 

recommendation. On May 16, 2016, CMS provided us with supporting 

documentation that shows that the agency replaced its current PECOS 

address verification software to include Delivery Point Verification 

(DPV)—which is similar to the software we used when conducting the 

work in the June 2015 report—as an addition to the existing functionality. 

According to CMS officials, this new DPV functionality flags addresses 

that may be CMRA, vacant, or invalid. By updating the address 

verification software, CMS can ensure that providers with ineligible 

practice location are not listed in PECOS.

Second, we recommended in our June 2015 report that CMS revise its 

guidance for verifying practice locations to include, at a minimum, the 

requirements contained in the guidance in place prior to March 2014. 

Such a revision would require that MACs conduct additional research, 

beyond phone calls to applicants, on the practice location addresses that 

are flagged as a CMRA, vacant, or invalid address to better ensure that 

the address meets CMS’s practice location criteria. The agency did not 

concur with this recommendation, stating that the March 2014 guidance 

was sufficient to verify practice locations. However, our audit work shows 

that additional checks on addresses flagged by the address-matching 

software as a CMRA, vacant, or invalid can help verify whether the 

addresses are ineligible. As our report highlighted, we identified providers 

with potentially ineligible addresses that were approved by MACs using 

the process outlined in the existing guidance. Therefore, we continue to 

believe that the agency should update its guidance for verifying potentially 

ineligible practice locations. In February 2016, CMS officials told us that, 

as part of configuring the PECOS address verification software to include 

the DPV functionality and flag CMRAs, vacancies, invalid addresses, and 

other potentially questionable practice locations, the agency plans to 

validate the DPV through site visits and follow its current process to take 

administrative action if the results are confirmed. CMS officials told us 

that they believe that by implementing the first recommendation by 

incorporating software flags and revising its guidance for verifying 

potentially ineligible practice location, if necessary, the second 
Page 11 GAO-16-703T 

recommendation will be addressed. As of May 17, 2016, CMS had not 

provided us with details and supporting documentation of how it will 

revise its guidance. Accordingly, it is too early for us to determine whether 

the agency’s actions would fully address the intent of the 

recommendation. We plan to continue to monitor the agency’s efforts in 

this area.

CMS has taken some actions to remove or recover overpayments from 

potentially ineligible providers and suppliers that we referred to it, based

on our June 2015 report. On April 29, 2015, we referred 286 unique 

providers to CMS for further review and action as a result of our 

identification of providers with potentially ineligible practice location 

address. From August 2015 to May 2016, CMS has provided updates on 

these referrals. On the basis of our analysis of CMS’s updates, CMS has 

taken the following actions:

• taken administrative action to remove the provider or collect funds for 

29 of the providers,18

• corrected the invalid addresses for 70,

• determined that the questionable location was actually valid for 84, 

and

• determined that the provider had already been removed from the 

program for 102. 

However, CMS did not take action on 1 provider because it was unable to 

find the practice location for this provider.

In our June 2015 report, we found 147 out of about 1.3 million physicians 

with active PECOS profiles had received a final adverse action from a 

state medical board, as of March 2013. Adverse actions include crimes 

against persons, financial crimes, and other types of health care–related 

felonies. These individuals were either not revoked from the Medicare 

program until months after the adverse action or never removed (see fig. 

4).19

 18According to CMS, it plans to collect about $7,900 from 2 of the 29 providers. 

19GAO-15-448.

Applicants’ Licensure 

Information Verification
Page 12 GAO-16-703T 

Figure 4: Summary of the Adverse License Actions Related to 147 Physicians Who 

Were Not Revoked for Months or Never Removed from Medicare, as of March 2013

All physicians applying to participate in the Medicare program must hold 

an active license in the state they plan to practice in and also to selfreport final adverse actions, which include a license suspension or 

revocation by any state licensing authority. CMS requires MACs to verify 

final adverse actions that the applicant self-reported on the application 

directly with state medical board websites. We found that because 

physicians are required to self-report adverse actions, the MACs did not 

always identify unreported actions when enrolling, revalidating, or 

performing monthly reviews of the provider.20 As a result, 47 physicians 

out of the 147 physicians we identified as having adverse actions have 

been paid approximately $2.6 million by the Medicare program during the 

time CMS could have potentially barred them from the Medicare program 

between March 29, 2003, and March 29, 2013.

 20According to CMS guidance, when an applicant first enrolls into Medicare, MACs must 

corroborate adverse legal actions and licensure information directly with state medical 

board websites. MACs must research all enrolled providers each month using multiple 

state medical board websites in their respective jurisdictions. Medicare providers must go 

through the revalidation process every 5 years. 
Page 13 GAO-16-703T 

Some of the adverse actions that were unreported by physicians occurred 

within the state where the provider enrolled in PECOS, while others 

occurred in different states. For example, we identified a physician who 

initially enrolled into Medicare in 1985 and was suspended for about 5 

months in 2009 by the Rhode Island medical board. In 2011, his 

information was revalidated by the MAC. This provider did not self-report 

the adverse action, and the MAC did not identify it during its monthly 

reviews or when revalidating the provider’s information. CMS bars 

providers that are already enrolled in Medicare who do not self-report 

adverse actions for 1 year. This individual billed Medicare for about 

$348,000 during the period in which he should have been deemed 

ineligible. CMS officials highlighted that delays in removing physicians 

from Medicare may occur due to MAC backlogs, delays in receipt of data 

from primary sources, or delays in the data-verification process.

In March 2014, CMS began efforts to improve the oversight of physician 

license reviews by providing the MACs with a License Continuous 

Monitoring report, which was a good first step. However, the report only 

provides MACs with the current status of the license that the provider 

used to enroll in the Medicare program. Without collecting license 

information on all medical licenses, regardless of the state the provider 

enrolled in, we concluded that CMS may be missing an opportunity to 

identify potentially ineligible providers who have license revocations or 

suspensions in other states, which can put Medicare beneficiaries at risk.

To help improve the Medicare provider enrollment-screening procedures, 

in our June 2015 report we recommended that CMS require applicants to 

report all license information including that obtained from other states, 

expand the License Continuous Monitoring report to include all licenses, 

and at least annually review databases, such as that of FSMB, to check 

for disciplinary actions. The agency concurred with the recommendation, 

but stated it does not have the authority to require providers to report 

licenses for states in which they are not enrolled. While providers are not 

currently required to list out-of-state license information in the enrollment 

application, CMS can independently collect this information by using other 

resources. Therefore, we clarified our recommendation to state that CMS 

should collect information on all licenses held by providers that enroll into 

PECOS by using data sources that contain this information, which is 

similar to the steps that we took in our own analyses.

In February 2016, CMS officials told us that CMS will take steps to ensure 

that all applicants’ licensure information is evaluated as part of the 

screening process by MACs and the License Continuous Monitoring 
Page 14 GAO-16-703T 

report, as appropriate, and will also regularly review other databases for 

disciplinary actions against enrolled providers and suppliers. In May 2016, 

CMS officials stated that CMS has established a process to annually 

review databases and has incorporated the FSMB database into its 

screening process. On May 19, 2016, CMS officials provided us with 

supporting documentation that shows that the FSMB database was 

incorporated into its automatic screening process. By incorporating the 

FSMB database into its automatic screening process, CMS will be able to 

regularly check this database for licensure updates and disciplinary 

actions against enrolled providers and suppliers, as well as to collect all 

license information held by providers that apply to enroll in PECOS.

On April 29, 2015, we referred the 147 unique providers to CMS for 

further review and action as a result of our identification of revoked 

licenses. On the basis of our analysis of CMS’s updates as of May 2016, 

CMS has taken the following actions:

• taken administrative action to remove the provider or collect funds for 

21 providers,21

• determined that the provider had already been removed from the 

program for 48,

• determined that the adverse actions were disclosed or partially 

disclosed for 71, and

• has ongoing reviews of 6.

CMS did not take action on 1 provider because it was unable to find the 

adverse action for this provider.

In our June 2015 report, we found that about 460 (0.03 percent) out of the 

1.7 million unique providers and suppliers in PECOS as of March 2013 

and DMEPOS suppliers as of April 2013 were identified as deceased at 

the time of the data we reviewed.22 The MAC or CMS identified 409 of the 

 21According to CMS, it plans to collect $40,300 from 2 of the 21 providers.

22GAO-15-448. To help ensure that Medicare maintains current enrollment information 

and to prevent others from utilizing the enrollment data of deceased providers and 

suppliers, MACs are required to check that providers and suppliers in PECOS are not 

deceased.

Deceased and Exclusion 

Verification Procedures
Page 15 GAO-16-703T 

460 providers and suppliers as deceased from March 2013 to February 

2015. Additionally, 38 out of the 460 providers and suppliers we found to 

be deceased were paid a total of about $80,700 by Medicare for services 

performed after their date of death until December 2013, which was the 

most-recent date CMS had Medicare claims data available at the time of 

our review. Not identifying a provider or supplier as deceased in a timely 

manner exposes the Medicare program to potential fraud. It is unclear 

what caused the delay or omission by CMS and the MACs in identifying 

these individuals as deceased or how many overpayments they are in the 

process of recouping.

On April 29, 2015, we referred 82 unique providers to CMS for further 

review and action as a result of our identification of providers whose 

status was deceased. From August 2015 to May 2016, CMS has provided 

updates on these referrals. On the basis of our analysis of CMS’s 

updates, CMS has taken the following actions:

• taken administrative action to remove the provider for 4 of the 

providers,23

• determined that the provider had already been removed from the 

program for 25,

• determined that the provider had already been removed from the 

program but updated the provider’s PECOS profile to reflect the date 

of death for 22, and

• started but not completed the review on 31 providers that were 

reported to be deceased and had submitted claims for payments.24

We found in our June 2015 report that about 40 (0.002 percent) out of the 

1.7 million unique providers and suppliers enrolled in PECOS were listed 

in LEIE, as of March 2013.25 These individuals were excluded from 

participating in health care–related programs. Of those 40 excluded 

providers and suppliers, 16 were paid approximately $8.5 million by 

 23According to CMS, it will not collect any claims on any of the 4 providers. 

24The remaining 31 cases were provided to CMS in April 2015. In October 2015, the 

agency confirmed that it will review these cases. As of May 2016, CMS has not provided 

supporting documentation that it has completed the review of theses providers.

25GAO-15-448.
Page 16 GAO-16-703T 

Medicare for services rendered after their exclusion date until the MAC or 

the NSC found them to be excluded.26 When we followed up with the 

MACs in September and October 2014, we found that the MACs had 

removed 38 of the 40 providers and suppliers from PECOS from March 

2013 to October 2014. However, for two matches that we identified, the 

MACs had not taken any action.27 Given the small number of cases 

identified (40) and the MACs’ removal of 38 out of these 40 providers 

during our review, we did not make a recommendation to CMS. On April 

29, 2015, we referred the two providers that the MACs did not remove, as 

well as the 16 providers that were paid $8.5 million by Medicare for 

services rendered after their exclusion date, to CMS for further review 

and action. From August 2015 to May 2016, CMS has provided updates 

on these referrals. On the basis of our analysis of CMS’s updates, CMS 

did not take action on 2 providers because CMS deemed the providers 

eligible. Further, CMS has not completed the review on 14 providers that 

were reported to be excluded and had submitted claims for payments.28

As part of CMS’s enrollment-screening process, CMS has controls in 

place to verify criminal-background information for providers and 

suppliers in PECOS. CMS may deny or revoke a provider’s or supplier’s 

enrollment in the Medicare program if, within the 10 years before 

enrollment or revalidation of enrollment, the provider, supplier, or any 

owner or managing employee of the provider or supplier was convicted of 

a federal or state felony offense, including certain felony crimes against 

persons, that CMS has determined to be detrimental to the best interests 

 26We calculated the Medicare claims data paid from 2005 to 2013 to the excluded 

providers and suppliers by considering only claims paid for services rendered after the 

exclusion date through the date CMS or MACs found the providers or suppliers to be 

excluded, since providers’ and suppliers’ exclusion periods could have expired after March 

2013.

27One MAC conducted additional research on one of the two providers and found that the 

provider was listed in the HHS OIG list; however, it was not in the Medicare Exclusion 

Database. It is unknown why the provider was not listed in the Medicare Exclusion 

Database. The other MAC searched the other provider and did not identify this provider in 

the System for Award Management or LEIE.

28The remaining 14 cases were provided to CMS in April 2015. As of May 2016, CMS has 

not provided supporting documentation that it has completed the review of theses 

providers.

Criminal-Background 

Screening Procedures
Page 17 GAO-16-703T 

of the program and its beneficiaries.29 In our April 2016 report, we found 

that 16 out of 66 potentially ineligible providers we identified with criminal 

backgrounds received $1.3 million in potential overpayments. These 

providers were convicted of drug and controlled substance, health-care, 

mail and wire fraud, or sex-related offenses and were enrolled in 

Medicare before CMS had implemented more-extensive background 

check processes in April 2014.

Before CMS revised procedures for reviewing the criminal backgrounds of 

existing and prospective Medicare providers and suppliers in April 2014, 

the agency relied on verifying applicants’ self-reported adverse legal 

actions by checking whether providers and suppliers had previously lost 

their licenses because of a conviction such as a crime against a person. 

CMS also checked whether the HHS OIG had excluded providers and 

suppliers from participating in federal health-care programs. According to 

CMS, it also relied on Zone Program Integrity Contractors (ZPIC) to 

identify providers and suppliers with a conviction history. However, CMS 

did not always have access to federal or state offense information that 

identified the cause of a provider’s or supplier’s license suspension or 

exclusion from participating in federal health-care programs, which could 

have led to an earlier ineligibility date. 

In our April 2016 report, we found 52 providers whose offenses occurred 

before the removal effective date that was provided to us by the MACs 

and 14 additional providers that CMS did not remove. As mentioned 

earlier, out of these 66 providers, 16 were paid about $1.3 million by 

Medicare through the fee-for-service program. Specifically, 10 providers 

were paid about $1.1 million between the time they were initially 

convicted of a crime and the time that they were officially removed from 

the program, and six other providers that were not removed were paid 

about $195,000 during the year after their conviction. We referred all 66 

cases to CMS for further review and requested an initial status update on 

these providers by June 20, 2016. On May 16, 2016, CMS stated that it 

determined that 52 of the providers had already been deactivated or 

revoked; however, our report indicates that these providers were 

deactivated and revoked and the effective removal date needed review. 

Further, CMS indicated that it will continue to review these providers to 

 2942 C.F.R. § 424.535 and 42 C.F.R. § 424.530.
Page 18 GAO-16-703T 

determine whether additional updates or actions are needed since we 

found that theses providers had offenses that occurred before the 

removal effective date that was provided by the MACs. Further, CMS 

informed us that it will continue to review the remaining 14 providers.

Additionally, in April 2016, we reported that in April 2014 CMS 

implemented steps that provide more information on the criminal 

backgrounds of existing and prospective Medicare providers and 

suppliers than it obtained previously. Specifically, CMS supplemented its 

criminal-background controls by screening provider and supplier criminal 

backgrounds through an automated screening process. Under this 

revised process, MACs are to review an applicant’s self-reported license 

information and whether the applicant has been excluded from 

participating in federal health-care programs. In addition, CMS receives 

information from ZPICs, which provide a conviction history on providers 

and suppliers they investigate. The automated-screening contractor is to 

supplement these controls by conducting criminal-background checks on 

providers, suppliers, and organization principals (i.e., individuals with 5 

percent or more ownership in the business). The contractor uses thirdparty vendor applications available to the public to conduct the criminalbackground checks. As a result, CMS and its contractors obtain greater 

access to data about federal and state offenses and the ability to conduct 

a more-comprehensive review of provider and supplier criminal 

backgrounds than in the past.

Chairman Murphy, Ranking Member DeGette, and Members of the 

subcommittee, this concludes my prepared remarks. I look forward to 

answering any questions that you may have at this time.

If you or your staff have any questions about this testimony, please 

contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for 

our Offices of Congressional Relations and Public Affairs may be found 

on the last page of this statement.

Individuals making key contributions to this testimony were Latesha Love, 

Assistant Director; Gloria Proa; Ariel Vega; and Georgette Hagans. 

Additionally, Marcus Corbin; Colin Fallon, and Maria McMullen provided 

technical support; Shana Wallace, Jim Ashley, and Melinda Cordero 

provided methodological guidance; and Brynn Rovito and Barbara Lewis 

provided legal counsel.

GAO Contact and 

Staff 

Acknowledgments

(100872)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. 

Listen to our Podcasts and read The Watchblog.

Visit GAO on the web at www.gao.gov.

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.