Department of Health and Human Services

OFFICE OF

INSPECTOR GENERAL

MEDICARE: 

VULNERABILITIES RELATED 

TO PROVIDER ENROLLMENT 

AND OWNERSHIP 

DISCLOSURE

Suzanne Murrin

Deputy Inspector General for

Evaluation and Inspections

May 2016

OEI-04-11-00591
 

EXECUTIVE SUMMARY – MEDICARE: VULNERABILITIES RELATED TO 

PROVIDER ENROLLMENT AND OWNERSHIP DISCLOSURE 

OEI-04-11-00591 

WHY WE DID THIS STUDY 

The Centers for Medicare & Medicaid Services (CMS) can prevent inappropriate payments, 

protect beneficiaries, and reduce time-consuming and expensive “pay and chase” activities by 

ensuring that providers that intend to engage in fraudulent or abusive activities are not allowed to 

enroll in Medicare. For CMS to identify potentially fraudulent providers, as well as those that 

may be associated with excluded individuals or entities, providers must disclose accurate and 

timely information about their owners (i.e., individuals or corporations with a 5-percent or more 

ownership or controlling interest; agents; or managing employees). 

HOW WE DID THIS STUDY 

For selected providers, we compared three sets of owner names: (1) those on record with 

CMS for Medicare enrollment purposes, (2) those submitted by providers directly to the 

Office of Inspector General (OIG) for this evaluation, and (3) those on record with State 

Medicaid programs for Medicaid enrollment purposes. When we compared names, if we 

found owner names that were not identical but were reasonably similar, we considered 

the names to match. Additionally, we surveyed CMS’s Medicare Administrative 

Contractors regarding their checking of exclusions databases when they process Medicare 

enrollment applications.

WHAT WE FOUND 

Over three-quarters of Medicare providers in our review had owner names on record with 

CMS that did not match those that providers submitted to OIG. Further, nearly all 

providers in our review had owner names on record with CMS that did not match those 

on record with State Medicaid programs. The prevalence of nonmatching owner names 

raises concern about the completeness and accuracy of information about Medicare 

providers’ ownership. It also demonstrates that providers may not be complying with the 

requirement to report ownership changes to CMS. Additionally, 2 of the 11 CMS 

contractors did not check all required exclusions databases, which could allow providers 

with excluded owners to enroll in the Medicare program. The two contractors reported 

that they checked only one of two exclusions databases, and this database does not 

always have the most current information on excluded individuals and entities. Taken 

together, these findings reveal vulnerabilities that could allow potentially fraudulent 

providers to enroll in the Medicare program and limit CMS’s ability to provide adequate 

oversight. 

WHAT WE RECOMMEND

We recommend that CMS (1) review providers that submitted nonmatching owner names 

and take appropriate action, (2) educate providers on the requirement to report changes of 

ownership, (3) increase coordination with State Medicaid programs on the collection and 

verification of provider ownership information in Medicare and Medicaid, and (4) ensure 

that its contractors check exclusions databases as required. CMS concurred with all of 

our recommendations. 
 

TABLE OF CONTENTS

Objectives ....................................................................................................1

Rationale ......................................................................................................1

Background..................................................................................................2

Methodology................................................................................................6

Findings........................................................................................................8

The prevalence of nonmatching owner names raises concern about 

the completeness and accuracy of information about Medicare 

providers’ ownership........................................................................8

Two of eleven CMS contractors reported that they did not check 

exclusions all required exclusions databases, which could allow 

providers with excluded owners to enroll in Medicare....................9

Conclusion and Recommendations............................................................11

Agency Comments and Office of Inspector General Response.....13

Appendixes ................................................................................................14

A: Detailed Methodology ..............................................................14

B: Agency Comments....................................................................19

Acknowledgments......................................................................................21
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 1

OBJECTIVES

To determine the extent to which:

1. Owner names on record with the Centers for Medicare & Medicaid 

Services (CMS) matched the names submitted to the Office of 

Inspector General (OIG) for this evaluation and the names on record 

with State Medicaid programs. 

2. CMS’s contractors checked exclusions databases as part of the 

Medicare enrollment process.

RATIONALE

CMS can prevent inappropriate payments, protect beneficiaries, and 

reduce time-consuming and expensive “pay and chase” activities by 

ensuring that providers that intend to engage in fraudulent or abusive 

activities are not allowed to enroll in Medicare.1 For CMS to identify 

potentially fraudulent providers, as well as those that may be associated 

with excluded individuals or entities, providers must disclose information 

on owners and others with control interest in the business. 

However, in some health care fraud schemes, individuals have concealed 

providers’ true ownership from the Medicare program. For example, in 

October 2009, an individual in southern California was indicted for 

a scheme in which he allegedly recruited relatives and street gang 

members to pose as the “nominee owners”2 of various companies selling 

durable medical equipment.3 The nominee owners then allegedly 

submitted fraudulent claims to Medicare, totaling more than $11 million. 

This individual later pled guilty to one felony count of Medicare fraud and 

faced up to 10 years in prison.4 Additionally, in February 2013, an 

 ____________________________________________________________ 

1

“Provider” means a hospital, critical access hospital, skilled nursing facility, 

comprehensive outpatient rehabilitation facility, home health agency, or hospice, that has 

in effect an agreement to participate in Medicare; or a clinic, rehabilitation agency, or 

public health agency that has in effect a similar agreement but only to furnish outpatient 

physical therapy or speech pathology services; or a community mental health center that 

has in effect a similar agreement but only to furnish partial hospitalization services. 

42 CFR § 400.202. 

2 A “nominee owner” is a “straw owner”—someone who is an owner in name only. 

3

 Department of Justice (DOJ), Justice News: Los Angeles Medicare Fraud Strike Force 

Charges 20 in Health Care Fraud Cases Involving Durable Medical Equipment, 

October 21, 2009. Accessed at http://www.justice.gov/opa/pr/los-angeles-medicarefraud-strike-force-charges-20-health-care-fraud-cases-involving-durable on December 9, 

2015. 

4

 California Criminal Attorney Blog, Santa Ana Man Pleads Guilty to $26-million 

Medicare Fraud Scheme, April 23, 2010. Accessed at 

http://www.californiacriminalattorneyblog.com/2010/04/santa_ana_man_pleads_guilty_t

o.html. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 2

individual in Florida pled guilty for his role in using a holding company to 

purchase facilities that fraudulently billed Medicare $28.3 million.5

 This 

individual and his co-conspirators then sold the facilities to nominee 

owners in an attempt to disassociate from the facilities’ fraudulent 

operations. This individual later pled guilty to conspiracy to commit 

health care fraud and faces up to 15 years in prison.6

There are also concerns about provider ownership information in 

Medicaid. In a companion report issued concurrently with this report, 

OIG found that few State Medicaid programs requested that providers 

disclose all required ownership information.7 In addition, 14 State 

Medicaid programs reported that they did not verify the completeness or 

accuracy of provider ownership information. OIG also found that 14 State 

Medicaid programs reported that they do not check all required exclusions 

databases. Additionally, when we compared the owner names on record 

with State Medicaid programs with the owner names that providers 

submitted to OIG for this review, most did not match. 

BACKGROUND

Medicare Ownership Disclosure

When enrolling in Medicare, providers must disclose specific information 

to CMS, including the identity of any person who has an ownership or 

controlling interest of 5 percent or more, or is an agent or managing 

employee.8 (In this report, we refer to all four types as “owners.”) 

Providers enrolling in Medicare must also disclose whether any owners

have been convicted of a criminal offense, subjected to any civil monetary 

penalties, or excluded from participating in federally funded health care 

programs.9 

 ____________________________________________________________ 

5

 DOJ, Justice News: Leader of $28.3 Million Medicare Fraud Scheme Pleads Guilty, 

February 3, 2014. Accessed at http://www.justice.gov/opa/pr/leader-283-millionmedicare-fraud-scheme-pleads-guilty on December 9, 2015. 

6

 Herald-Tribune, Florida man pleads guilty to Medicare fraud, February 4, 2014. 

Accessed at http://www.heraldtribune.com/article/20140204/ARTICLE/140209890 on 

December 11, 2015. 

7

 OIG, Medicaid: Vulnerabilities Related to Provider Enrollment and Ownership 

Disclosure (OEI-04-11-00590), May 2016.

8

 Social Security Act §§ 1124(a)(2)(B) and 1124A(a)(1)-(2); 42 CFR § 420.206(a)(1). 

In Medicaid, providers that are enrolling must also disclose the name and address of any 

person (individual or corporation) with an ownership or control interest or managing 

employee. 42 CFR §§ 455.104(b) and 420.206(a)(3). 

9

 42 CFR § 420.204(a)(3). In Medicaid, providers that are enrolling must disclose 

whether any owners have been convicted of a criminal offense related to the provider’s

involvement in Medicaid or Medicare. 42 CFR § 455.106(a)(1)-(2). 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 3

Once enrolled in Medicare, providers must report changes of ownership or 

control to CMS within 30 days of the change.10 In addition, providers 

must revalidate (i.e., resubmit and recertify) enrollment information every 

5 years and suppliers must revalidate every 3 years.

11

Regulations require CMS not to enroll providers that fail to disclose all 

required information, and to terminate any existing agreements or 

contracts with such providers.12 Additionally, CMS may revoke providers 

from the Medicare program if any requirements, such as reporting changes 

of ownership or control within 30 days, are not met.13 Although CMS 

states that it generally does not take administrative action against 

providers for not updating their enrollment records, CMS will do so in 

certain situations where the failure to report the change would have caused 

the provider to be ineligible for enrollment in the Medicare program.14

Collection and Verification of Provider Ownership Information

CMS contracts with Medicare Administrative Contractors (MACs) to 

conduct several tasks, such as processing and verifying providers’ 

ownership information. To enroll in Medicare or update existing 

enrollment information, providers enter information into the Internetbased Provider Enrollment, Chain, and Ownership System (PECOS) or 

use the paper enrollment application process (e.g., CMS’s 855A Form), 

which MACs then process through PECOS.15 

PECOS is an electronic Medicare enrollment system through which 

providers can submit and track the status of Medicare enrollment 

applications; view, print, and update enrollment information; complete the 

 ____________________________________________________________ 

10 42 CFR § 424.516(e)(1). In Medicaid, enrolled providers must report changes of 

ownership to State Medicaid programs within 35 days of the change. 42 CFR 

§ 455.104(c)(1)(iv). 

11 42 CFR § 424.515. State Medicaid programs must revalidate provider enrollment 

information every 5 years. 42 CFR § 455.114. 

12 42 CFR § 420.206(c). 

13 Section 15 of Forms CMS-855A and CMS-855B. Accessed at 

https://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/downloads/cms855a.pdf and 

http://www.cms.gov/Medicare/CMS-Forms/CMS-Forms/Downloads/cms855b.pdf, 

respectively, on July 16, 2015. 

14 CMS, Frequently Asked Questions: Will there be a penalty for not reporting the 

ownership change? Accessed at 

https://questions.cms.gov/faq.php?id=5005&faqId=9674 on November 12, 2014. 

15 42 CFR § 424.510. See also CMS, Medicare Program Integrity Manual, Pub. 100-08, 

ch. 15, § 15.1.3.B. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 4

revalidation process; and voluntarily withdraw from the Medicare 

program.16, 17

MACs are required to review providers’ disclosed information, including 

ownership information, to determine its completeness and whether all 

required information and supporting documentation has been submitted.18 

Specifically, MACs must ensure that the provider has completed all 

required data elements in PECOS or on the CMS-855 form, that all 

supporting documentation has been furnished, and that the application was 

completed in accordance with instructions.19 If an application is 

incomplete, MACs inform providers by letter and request that missing 

information be submitted within 30 days.20 

MACs are also required to verify all disclosed information using the most 

cost-effective methods available.

21

 The general purpose of the verification 

process is to ensure that all data furnished on applications are accurate.22 

Examples of verification techniques include, but are not limited to, visiting 

provider Web sites; using third-party sources for data validation; checking 

Web sites for professional licensure and certification in the State (e.g., 

a medical board’s Web site); checking State business Web sites23; and 

checking the Yellow Pages.

24

 If MACs cannot verify providers’ 

information, they request additional information and, if necessary, conduct 

site visits.

 ____________________________________________________________ 

16 CMS, PECOS for Physicians and Non-Physician Practitioners, July 2015. Accessed 

at https://www.cms.gov/Outreach-and-Education/Medicare-Learning-NetworkMLN/MLNProducts/downloads/MEDEnroll_PECOS_PhysNonPhys_FactSheet_ICN903

764.pdf on December 9, 2015. 

17 CMS has provided State Medicaid programs with limited access to PECOS to 

determine if a provider is currently enrolled, is enrolling, or has been denied enrollment 

in the Medicare program. CMS, CMCS Informational Bulletin: Medicaid/CHIP 

Provider Screening and Enrollment, December 23, 2011. Accessed at 

http://www.medicaid.gov/Federal-Policy-Guidance/downloads/CIB-12-23-11.pdf on 

October 28, 2015. 

18 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15, § 15.1.3.C. 

19 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15, §§ 15.7 and 15.1.3.B. 

20 CMS, Frequently Asked Questions: Will I be contacted if my application is found to be 

incomplete or missing information? Accessed at 

https://questions.cms.gov/faq.php?id=5005&faqId=9190 on November 12, 2014. 

21 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15, § 15.7.1.3. 

22 Ibid. 

23 For example, the Web sites of the respective Secretaries of State. 

24 Ibid. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 5

MACs approve, deny, or reject providers’ enrollment applications based 

on their review.25

Program Exclusions 

As part of the process of enrolling providers in Medicare, MACs are 

required to confirm that providers’ disclosed owners are not excluded by 

OIG or listed as excluded in the General Services Administration’s 

Excluded Parties List System (EPLS).26, 27 To do so, MACs must check 

providers against OIG’s List of Excluded Individuals/Entities (LEIE) and 

the EPLS.28 The LEIE is a database that contains all individuals and 

entities currently excluded by OIG from participating in federally funded 

health care programs.29 The EPLS is a Governmentwide database with 

information on individuals and entities that have been suspended or 

excluded from receiving Federal financial assistance and benefits.30 If the 

provider or any of its owners are excluded, then the MAC must deny the 

enrollment application.31

 

“Off-Cycle” Revalidation of Provider Enrollment Information 

In addition to the regular once-every-5-years provider revalidation 

process, CMS has the authority to conduct “off-cycle” revalidations to 

assess and confirm the validity of enrollment information maintained in its 

systems.32 Factors that can trigger off-cycle revalidations include random 

checks, local problems with health care fraud, national initiatives, 

complaints, or other reasons that cause CMS to question providers’ 

compliance with Medicare enrollment requirements.33 As a result of the 

Patient Protection and Affordable Care Act, CMS must use the new 

 ____________________________________________________________ 

25 42 CFR §§ 424.502, 424.525, and 424.530. See also CMS, Medicare Program 

Integrity Manual, Pub. 100-08, ch. 15, § 15.1.1. A decision of “deny” means that the 

enrolling provider has been determined to be ineligible to receive Medicare billing 

privileges. “Reject” means that the provider’s enrollment application was not processed 

due to incomplete information or that additional information or corrected information 

was not received from the provider in a timely manner. 

26 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15, § 15.1.3.C. 

27 In July 2012, the EPLS was consolidated with other Federal procurement systems into 

the System for Award Management (SAM). Phase I consolidation included the Central 

Contractor Registration/Federal Agency Registration, the Online Representations and 

Certifications Application, and the EPLS. What is SAM? Accessed at 

https://www.sam.gov/sam/announce1.htm on September 1, 2015. 

28 CMS, Medicare Program Integrity Manual, Pub. 100-08, ch. 15, § 15.1.3.C. 

76 Fed. Reg. 5866, 5884 (Feb. 2, 2011). 

29 OIG, List of Excluded Individuals and Entities Background Information. Accessed at 

http://oig.hhs.gov/exclusions/background.asp on October 28, 2015. 

30 71 Fed. Reg. 70515–70516 (Dec. 5, 2006). 

31 42 CFR § 424.530(a)(2)(i). See also CMS, Medicare Program Integrity Manual, 

Pub. 100-08, ch. 15, § 15.8.4. 

32 42 CFR § 424.515(d). 

33 Ibid. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 6

enrollment criteria to complete an off-cycle revalidation for each provider 

that was enrolled in Medicare prior to March 25, 2011.

34

METHODOLOGY

We used multiple data collection activities and sources for this report. 

First, for selected providers, we collected and compared three sets of 

owner names: (1) those on record with CMS for Medicare enrollment 

purposes, (2) those submitted by providers to OIG for this evaluation, and 

(3) those on record with State Medicaid programs for Medicaid enrollment 

purposes.35 We collected this information between December 2013 and 

April 2014. For 110 providers enrolled in Medicare, we compared the 

owner names on record with CMS to those that providers submitted to 

OIG. For the 58 of these providers that were enrolled in both Medicare 

and Medicaid, we also compared owner names on record with CMS to 

those on record with State Medicaid programs for Medicaid enrollment 

purposes. 

We also completed an additional analysis on owner names submitted to 

OIG that were not on record with CMS. Specifically, we analyzed the 

effective dates for a given owner’s ownership to determine whether the 

dates fell within the 30-day window during which providers are required 

to notify CMS of such changes. If dates fell within this window, providers 

still had time to notify CMS of the change. In January 2015, 

approximately 1 year after providers submitted owner names to us for this 

evaluation, we collected and reviewed the updated owner names for these 

providers in PECOS to determine whether the providers had notified CMS 

of their ownership changes.

Next, in August 2012, we sent an electronic questionnaire to 11 MACs.36 

The electronic questionnaire collected information on how each MAC 

collects and processes ownership information disclosed by providers. In 

particular, we asked whether each MAC compared ownership information 

that providers disclosed to the LEIE and EPLS.

See the Appendix for a detailed description of the methodology. 

 ____________________________________________________________ 

34 The Patient Protection and Affordable Care Act, P.L. No. 111-148 (March 23, 2010), 

as amended by the Health Care and Education Reconciliation Act of 2010, P.L. 

No. 111-152 (March 30, 2010), § 6401(a). 76 Fed. Reg. 5866 (Feb. 2, 2011) outlines 

new enrollment screening criteria. 

35 Provider types in our review are ambulatory surgical centers, ambulance services, 

independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 

health agencies, hospices, and renal disease facilities. 

36 Eleven MACs were operational at the time of our data collection in August 2012. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 7

Limitations

We did not attempt to collect information not reported or verify 

information that providers submitted to OIG. For example, providers did 

not always report the effective date for a given owner’s ownership. We 

did not attempt to collect these dates if providers had not reported them, 

nor did we did not attempt to verify such dates if providers had reported 

them. 

Additionally, the matching of owner names across two or more sources did 

not necessarily mean that ownership information was complete and 

accurate. Providers could have submitted information that was incomplete 

and/or inaccurate—but that matched—to CMS, OIG, and/or State 

Medicaid programs. 

Finally, the results of comparisons are not projected and pertain only to 

the providers in our review included in each comparison.

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency.
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 8

FINDINGS

The prevalence of nonmatching owner names raises 

concern about the completeness and accuracy of 

information about Medicare providers’ ownership 

Overall, very few (4 of 58) providers in our review had owner names that 

matched across all 3 sources (i.e., CMS, OIG, and State Medicaid 

programs). The prevalence of nonmatching owner names raises concern 

about the completeness and accuracy of information about Medicare 

providers’ ownership.

For over three-quarters of providers in our review, owner 

names on record with CMS did not match those submitted to 

OIG

When we compared the owner names on record with CMS for Medicare 

enrollment purposes to those that providers submitted to OIG for this 

evaluation, we found that 77 percent of providers in our review (85 of 

110) had at least one nonmatching owner name. For 80 providers, some 

owner names matched and some did not match. For five providers, none 

of the owner names matched. Table 1 shows the extent to which owner 

names matched for the 110 providers in our review.

Table 1: Extent to Which Owner Names On Record With CMS Matched 

Those Submitted to OIG, 2013

Additionally, it appears that some providers in our review did not notify 

CMS of changes in ownership within the required timeframe. 

Forty-eight providers in our review submitted 168 owner names to OIG 

that were not on record with CMS. Of these 48 providers, 39 reported the 

effective dates of ownership for 127 owners. For 91 percent of these 

owners (115 of 127), the effective dates fell outside the 30-day window 

during which providers are required to notify CMS of ownership changes. 

Approximately 1 year later, PECOS did not contain the information for 

Description Number of 

Providers

Percentage of 

Providers

Not all owner names matched 85 77.3%

- Some—but not all—owner names matched 80 72.7%

- No owner names matched 5 4.5%

All owner names matched 25 22.7%

 Total 110 100.0%

Source: OIG analysis of ownership information on record with CMS and ownership information submitted to OIG, 

2015.
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 9

6 of the remaining 12 owners, indicating that CMS continued to be 

unaware of these ownership changes. 

For nearly all providers in our review, owner names on record 

with CMS did not match those on record with State Medicaid 

programs

Although Medicare and Medicaid ownership information is collected and 

maintained separately, CMS and State Medicaid programs should have the 

same owner names for providers enrolled in both programs. However, 

when comparing owner names on record with CMS for Medicare 

enrollment purposes to those on record with State Medicaid programs for 

Medicaid enrollment purposes, we found that 90 percent of providers in 

our review (52 of 58) had at least one nonmatching owner name. For 

44 providers, some owner names matched and some did not match. For 

eight providers, none of the owner names on record with CMS matched 

those on record with State Medicaid programs. Table 2 shows the extent 

to which owner names matched for the 58 providers in our review. 

Table 2: Extent to Which Owner Names On Record With CMS Matched 

Those On Record With State Medicaid Programs, 2013 

Description Number of 

Providers

Percentage of 

Providers

Not all owner names matched 52 89.7%

- Some—but not all—owner names matched 44 75.9%

- No owner names matched 8 13.8%

All owner names matched 6 10.3%

 Total 58 100.0%

Source: OIG analysis of ownership information on record with CMS and ownership information on record with State 

Medicaid programs, 2015.

Two of eleven CMS contractors reported that they did 

not check all required exclusions databases, which 

could allow providers with excluded owners to enroll 

in Medicare

MACs are required to check two databases—the LEIE and the EPLS—as 

part of the Medicare enrollment process to confirm that individuals or 

entities that providers disclosed as owners are not excluded. Nine of 

eleven MACs reported that they check both the LEIE and the EPLS to 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 10

confirm this. The remaining two MACs reported that they do not check 

the LEIE but do check the EPLS.37

 

The two MACs that reported that they checked only the EPLS—not the 

LEIE—could inadvertently enroll providers with excluded owners. 

Although the EPLS includes information from the LEIE on excluded 

individuals and entities, there is a delay between when that information is 

posted to the LEIE and when it is uploaded to the EPLS. If a MAC 

searches the EPLS during that delay, the EPLS will be less current than 

the LEIE. 

 ____________________________________________________________ 

37 CMS conducts automatic checks of providers in PECOS against its Medicare 

Exclusion Database (MED) on a monthly basis. The MED is similar to the LEIE, but the 

MED contains more personally identifiable information. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 11

CONCLUSION AND RECOMMENDATIONS

CMS can prevent inappropriate payments, protect beneficiaries, and 

reduce time-consuming and expensive “pay and chase” activities by 

ensuring that providers that intend to engage in fraudulent or abusive 

activities are not allowed to enroll in Medicare. For CMS to identify

potentially fraudulent providers, as well as those that may be associated 

with excluded individuals or entities, providers must disclose accurate and 

timely information about their owners.

However, very few providers in our review had owner names that matched 

across all three program sources—i.e., CMS, OIG, and State Medicaid 

programs. The prevalence of nonmatching owner names raises concerns 

about the completeness and accuracy of information about Medicare 

providers’ ownership. Further, the matching of owner names across two 

or more sources does not mean that ownership information is complete 

and accurate because providers could have submitted information that was 

incomplete and/or inaccurate—but that matched—to CMS, OIG, and State 

Medicaid programs. Additionally, we found that 2 of 11 MACs did not 

comply with the requirement to check both the LEIE and EPLS to confirm 

that individuals or entities that providers disclosed as owners were not 

excluded. 

Taken together, these findings reveal vulnerabilities that could allow 

potentially fraudulent providers to enroll in the Medicare program and 

limit CMS’s ability to provide adequate oversight. Therefore, we 

recommend that CMS:

Review providers that submitted nonmatching owner names 

and take appropriate action

In a separate memorandum, we will refer to CMS the 85 providers that 

had owner names on record with CMS that did not match those submitted 

to OIG. CMS and/or its contractors should review these providers’ 

enrollment records in PECOS. After this review, CMS should determine 

and take an appropriate course of action.

Educate providers on the requirement to report changes of 

ownership

CMS should educate providers on the requirement to report changes of 

ownership to CMS within 30 days and the actions it may take if providers 

do not comply with this requirement. CMS could communicate this 

information to providers through the Medicare Learning Network or could 

instruct the MACs to conduct outreach and education on this issue. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 12

Increase coordination with State Medicaid programs on the 

collection and verification of provider ownership information

in Medicare and Medicaid

CMS should coordinate with State Medicaid programs on the collection 

and verification of ownership information for providers enrolling or 

enrolled in Medicare and Medicaid. For example, CMS could encourage 

State Medicaid programs to use their access to PECOS when verifying 

provider ownership information and to notify MACs when nonmatching 

information is identified. State Medicaid programs and MACs could then 

collaborate to determine why provider ownership information does not 

match and address the issue.

In the longer term, CMS should consider working toward consolidating 

into one centralized system the ownership information for providers 

enrolling or enrolled in Medicare and/or Medicaid. This would make 

processes more efficient by reducing the burden on providers and 

streamlining the enrollment process—providers would no longer have to 

separately disclose ownership information both to CMS and to their 

respective States’ Medicaid programs.

Ensure that its contractors check exclusions databases as 

required

CMS should ensure that all MACs—as part of their respective Medicare 

provider enrollment processes—check the LEIE and EPLS, as required, to 

confirm that individuals and entities that providers disclosed as owners are 

not excluded. The checking of exclusions databases is an important 

safeguard that helps ensure that excluded individuals and entities are kept 

out of the Medicare program. CMS could ensure that MACs conduct 

these required checks as part of its performance evaluations of MACs 

and/or through some other process (e.g., by requiring MACs to attest that 

they conduct the exclusions checks). 

In the aforementioned referral memorandum, we will refer to CMS the 

two contractors that reported not checking the LEIE. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 13

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE

CMS concurred with all four of our recommendations. In its comments, 

CMS stated that it is strongly committed to Medicare program integrity 

efforts and is continuously working to enhance the process for provider 

enrollment and screening. CMS stated that since 2011, when it finalized 

regulations to require the revalidation of Medicare providers, it has taken 

several actions to address this requirement. For example, CMS 

deactivated billing privileges for more than 543,000 providers and 

suppliers as a result of revalidation and screening efforts. 

CMS stated that it will implement a number of actions to address OIG’s 

recommendations. For example, CMS will review the list of providers 

and suppliers that OIG identified as having owner names on record with 

CMS that did not match those submitted to OIG. CMS will develop 

educational materials for providers and suppliers and work with States and 

other relevant stakeholders to enhance processes for collecting and 

verifying provider ownership information. CMS also stated that it has 

already taken action to address our fourth recommendation. OIG provided 

preliminary information to CMS regarding the two contractors that 

reported checking one but not both of the required exclusions databases. 

CMS followed up with these two contractors, and the contractors attested 

to checking these exclusions databases. The two contractors stated that 

that they had mistakenly provided incorrect information to OIG. 

The full text of CMS’s comments is provided in Appendix B. We did not 

make changes to the report based on CMS’s comments. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 14

APPENDIX A

Detailed Methodology

 

Provider Selection

We selected a random sample of 170 providers that were enrolled in 

Medicare and/or Medicaid as of January 1, 2012, in specific provider 

types.38 We designed the sample such that the results of our review would 

be projectable. However, as our data analysis progressed, it became clear 

that providers enrolled in two State Medicaid programs were 

overrepresented in the population because duplicate providers had not 

been removed before we selected our sample.39

We selected the 170 providers using 2 population files in such a way that 

30 providers were enrolled in Medicare, 30 providers were enrolled in 

Medicaid, and 110 providers were enrolled in Medicare and Medicaid. 

 The first population file consisted of 34,984 records for providers 

enrolled in Medicare as of January 1, 2012, in our specified provider 

types. To create this file, we extracted identification and contact 

information from PECOS.40 In particular, for each provider, we 

collected the name, provider type, address, phone number, national 

provider identifier (NPI), and tax identification number (TIN). We 

then selected from this file 30 records that were associated with 

30 distinct providers enrolled in Medicare.

 The second population file consisted of 35,394 providers enrolled in 

Medicaid as of January 1, 2012, in our specified provider types. To 

create this file, we requested and received identification and contact 

information from each of the 52 State Medicaid programs on 

individual and nonindividual providers, including those in our 

specified provider types, enrolled as of January 1, 2012.41 In 

particular, for each provider, we requested the name, provider type, 

 ____________________________________________________________ 

38 Provider types in our review are ambulatory surgical centers, ambulance services, 

independent clinical laboratories, comprehensive outpatient rehabilitation facilities, home 

health agencies, hospices, and renal disease facilities. 

39 To project the results of our analysis, we would have needed to remove duplicate 

providers from the population, sample providers again, and collect ownership information 

again. Because we did not identify this duplication until our data were collected, we did 

not do this because of the time and resources it would require. Therefore, we do not 

make projections in this report. 

40 We used a snapshot of PECOS to ensure that this population file consisted of providers 

enrolled in Medicare as of January 1, 2012. 

41 The 52 State Medicaid programs consist of all 50 States, the District of Columbia, and 

Puerto Rico. We requested information on individual providers for separate OIG 

evaluations. 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 15

address, phone number, Medicaid provider identification number, NPI, 

TIN, Social Security number (SSN), and State license number. To 

compile this file, we combined information received from each 

Medicaid program and created a separate record for each unique 

combination—by Medicaid program—of Medicaid provider 

identification number, NPI, TIN, SSN, and State license number. 

Once we had compiled this information, we limited the file to our 

specified nonindividual provider types, thus reducing it from 

2.86 million to 35,394 providers. From this subset, we selected 

140 providers enrolled in Medicaid, of which at least 110 appeared to 

also be enrolled in Medicare.

Collection of Provider Ownership Information

We collected three sets of current (i.e., as of the date of our data 

collection) owner names and other information: (1) those on record with 

CMS for Medicare enrollment purposes, (2) those submitted by providers 

directly to OIG for this evaluation, and (3) those on record with State 

Medicaid programs for Medicaid enrollment purposes.

We first collected owner names directly from selected providers. From 

November 2013 to January 2014, we sent electronic questionnaires to the 

170 selected providers and requested ownership information (e.g., owner 

names, dates each owner’s ownership took effect, TINs, and SSNs) as of 

the date the provider received the questionnaire. We sent up to two 

written requests by mail and attempted to contact nonresponding providers 

by telephone and email, if this information was available. We received 

responses from 119 providers and did not receive responses from 

29 providers. The remaining 22 providers were considered ineligible 

because they did not meet our selection criteria regarding provider type 

and/or enrollment timeframe.

As part of the questionnaire, we also asked providers whether they were 

enrolled in Medicare and/or Medicaid. If providers indicated that they 

were not enrolled in one or both programs, we no longer classified them as 

being enrolled in the program(s). Of the 119 responding providers, 

113 indicated they were enrolled in Medicare. Further, 100 of the 

113 providers also indicated that they were enrolled in Medicaid. 

Next, we collected owner names on record with CMS for Medicare 

enrollment purposes. From December 2013 to April 2014, we extracted 

ownership information (e.g., owner names, ownership roles) from PECOS 

for selected providers.

Finally, we collected owner names on record with State Medicaid 

programs for Medicaid enrollment purposes. From December 2013 to 

February 2014, we collected ownership information for selected providers 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 16

from State Medicaid programs. State Medicaid programs provided 

electronic and hardcopy documents showing ownership disclosures, as 

well as extracts from ownership-disclosure databases. We received 

information from State Medicaid programs for 71 of the 100 providers 

enrolled in Medicare and Medicaid.

Analysis of Provider Ownership Information

We conducted two comparisons of the three sets of owner names—those 

on record with CMS, those submitted by providers to OIG, and those on 

record with State Medicaid programs. Each comparison involved 

(1) confirming that information being compared was for the same provider 

and (2) evaluating the similarity of owner names.

Comparison of Ownership Information on Record With CMS and 

Ownership Information Submitted to OIG. The first comparison 

determined the extent to which owner names on record with CMS for 

Medicare enrollment purposes matched those submitted to OIG for this 

evaluation. 

We first manually compared each provider’s NPI, TIN, and/or name and 

address in the information on record with CMS to those submitted to OIG. 

We confirmed that 110 of the 113 providers were the same. We removed 

the remaining three providers from our analysis because we were unable 

to confirm that the CMS records and the OIG records were for the same 

provider.

Next, we compared owner names on record with CMS to those that the 

110 providers submitted to OIG. We identified names that matched, 

meaning that the name was on record with CMS and submitted to OIG. 

We also identified names that did not match, meaning that the name was 

on record with CMS but not submitted to OIG or vice versa—and called 

these names “nonmatching.” When we compared names, if we found 

owner names that were not identical but were reasonably similar, we 

considered the names to match. For example, if owner names were not 

identical but were reasonably similar (e.g., “James Harris” and

“Jim Harris”), we considered the names to match. See Figure 1 for an 

illustration of a provider that had two names that matched as well as both 

types of nonmatching names.
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 17

Figure 1: Illustration of Provider’s Owner Names That Did and Did Not 

Match

Name Submitted by 

Provider to CMS

Name Submitted by 

Provider to OIG Match Versus Nonmatch

James Harris Jim Harris Match

Jane Smith Jane Smith Match

Business A Nonmatch

Company B Nonmatch

Note: Blanks illustrate that the individual or entity’s name was not on record with CMS or not submitted to 

OIG. 

Additionally, we completed two analyses on owner names submitted to 

OIG that were not on record with CMS. First, we analyzed the dates on 

which these owners’ ownership took effect to determine whether the dates 

fell within the 30-day window during which providers are required to 

notify CMS of such changes. If dates fell within this window, providers 

still had time to notify CMS of the change. In January 2015, 

approximately 1 year after providers submitted owner names to us for this 

evaluation, we collected and reviewed the updated owner names in 

PECOS for these providers to determine whether the providers had 

notified CMS of their ownership changes. Second, we searched the LEIE 

and EPLS for owner names submitted to OIG that had not been submitted 

to CMS to determine whether these individuals or entities were excluded. 

Because these names were not in CMS’s ownership information, CMS 

could not have previously searched for them in exclusions databases. We 

did not find any of these names in the LEIE or EPLS at the time of our 

review.

Comparison of Ownership Information on Record With CMS and 

Ownership Information on Record With State Medicaid Programs. The 

second comparison determined the extent to which owner names on record 

with CMS for Medicare enrollment purposes matched those on record 

with State Medicaid programs for Medicaid enrollment purposes. 

We manually compared each provider’s NPI, TIN, and/or name and 

address in the information on record with CMS to those on record with 

State Medicaid programs. We confirmed that 58 of these 71 providers 

were the same. We removed the remaining 13 providers from our analysis 

because we were unable to confirm that the records from CMS and the 

records from the State Medicaid programs were for the same providers.

Next, we compared owner names on record with CMS and State Medicaid 

programs for each of the 58 providers. For our comparison of these owner 
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 18

names, we used the same methodology as for our comparison of owner 

names on record with CMS and owner names submitted to OIG. 

MAC Electronic Questionnaire

In August 2012, we sent an electronic questionnaire to the 11 MACs that 

were operational at the time of our data collection. The electronic 

questionnaire collected information on how each MAC collects and 

processes ownership information disclosed by providers. We received 

responses to all applicable questions from each MAC by October 2012. 

We reviewed and analyzed responses to determine whether each MAC 

compared ownership information that providers disclosed to the two 

exclusions databases—i.e., the LEIE and EPLS—that MACs are required 

to check as part of the Medicare enrollment process.
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 19

APPENDIX B

 Agency Comments
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 20
 

Medicare: Vulnerabilities Related to Provider Enrollment and Ownership Disclosure (OEI-04-11-00591) 21

ACKNOWLEDGMENTS

This report was prepared under the direction of Dwayne Grant, Regional 

Inspector General for Evaluation and Inspections in the Atlanta regional 

office, and Jaime Stewart, Deputy Regional Inspector General. 

Rachel Bessette served as the lead analyst for this study. Other Office of 

Evaluation and Inspections staff from the Atlanta regional office who 

conducted the study include David Samchok and Janna Sayer. Central 

office staff who provided support include Clarence Arnold; 

Eddie Baker, Jr.; Scott Horning; Kevin Manley; Scott Manley; and 

Christine Moritz. 

We would also like to acknowledge the contributions of other Office of 

Evaluation and Inspections regional office staff, including 

Deborah Cosimo and Vincent Greiber.
Office of Inspector General

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of individuals served by those programs. 

This statutory mission is carried out through a nationwide network of audits, investigations, 

and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and individuals. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.