Department of Health and Human Services 

OFFICE OF

INSPECTOR GENERAL

 

 

SOUTH FLORIDA MEDICARE 

COMPREHENSIVE OUTPATIENT 

REHABILITATION FACILITIES 

Daniel R. Levinson 

Inspector General 

November 2011 

OEI-05-10-00090 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES i 

 EXECUTIVE SUMMARY

OBJECTIVES

1. To determine whether Comprehensive Outpatient Rehabilitation 

Facilities (CORF) in South Florida were operational (i.e., at the 

location on file with the Centers for Medicare & Medicaid Services 

(CMS) and open during business hours). 

2. To describe CMS actions against CORFs that were not operational.

BACKGROUND

CORFs provide multidisciplinary outpatient rehabilitation services at a 

single location. Medicare allowed approximately $70 million for almost 

40,000 beneficiaries nationwide who received CORF services in 2010. 

Of this amount, more than $22 million was for claims by South Florida 

CORFs. In 2010, more than 25 percent of all CORFs were in South 

Florida.

Previous work has demonstrated that CORFs in South Florida may be 

vulnerable to fraud, waste, and abuse. For example, the Office of 

Inspector General estimated that in 2003, three South Florida CORFs 

received between $720,000 and $1.6 million each in inappropriate 

payments for services. A 2004 report by the Government 

Accountability Office found that per-beneficiary payments to CORFs in 

South Florida were two to three times higher than per-beneficiary 

payments to other outpatient therapy providers. 

To determine whether CORFs in South Florida were at the location on 

file with CMS and were open during business hours, we conducted 

unannounced site visits to all South Florida CORFs. We also 

determined the amount that Medicare allowed for claims from

nonoperational CORFs and reviewed documentation about CMS actions 

against nonoperational CORFs.

FINDINGS

Eighteen of the one hundred one South Florida CORFs were not 

operational. Ten CORFs were not at the location on file with CMS. 

Eight CORFs were not open during business hours. Medicare allowed 

$2.2 million for services provided by these CORFs in 2010.
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES ii

EXECUTIVE SUMMARY

CMS took action against most of the nonoperational CORFs based 

on a special enrollment project and routine oversight. CMS took 

action against 16 of the 18 nonoperational CORFs in the months after 

we completed our site visits. A special enrollment project resulted in 

10 actions against nonoperational CORFs, and routine oversight 

resulted in 6 such actions. 

RECOMMENDATIONS 

Periodically conduct unannounced site visits to CORFs. Continuing 

to periodically conduct nationwide unannounced site visits would enable

CMS to identify and remove nonoperational CORFs from the program 

and potentially reduce erroneous Medicare payments. CMS could focus 

unannounced site visits in high-risk areas or base them on fraud-risk 

assessments. 

Use additional program safeguards for CORFs. CMS should use other 

program safeguards to prevent potentially nonoperational CORFs from 

enrolling in the Medicare program and to monitor existing CORFs. Other 

safeguards may include a moratorium on the enrollment of new CORFs

and payment suspensions. 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with our recommendations. CMS stated that it 

currently conducts unannounced enrollment and revalidation site visits 

to CORFs and that it plans to increase the frequency of unannounced, 

out-of-cycle site visits to CORFs. CMS also stated that it will continue 

to take administrative actions, as appropriate. CMS stated that these 

actions may include, but are not limited to, prepayment review, autodeny edits, payment suspensions, and revocations. We did not make 

any changes to the report based on CMS’s comments.
 TABLE OF CONT ENTS

EXECUTIVE SUMMARY ................................ ..... i

INTRODUCTION ............................................ 1 

FINDINGS .................................................. 8 

Eighteen of the one hundred one South Florida CORFs were

not operational .......................................... 8 

CMS took action against most of the nonoperational CORFs 

based on a special enrollment project and routine oversight...... 9 

RECOMMENDATIONS ..................................... 12

Agency Comments and Office of Inspector General Response ... 12

APPENDIX ................................................ 14

A: Detailed Methodology................................ . 14

B: Agency Comments ................................... 17

ACKNOWLEDGMENTS ..................................... 20
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 1 

 INTRODUCTION

OBJECTIVES 

1. To determine whether Comprehensive Outpatient Rehabilitation 

Facilities (CORF) in South Florida were operational (i.e., at the 

location on file with the Centers for Medicare & Medicaid Services 

(CMS) and open during business hours). 

2. To describe CMS actions against CORFs that were not operational.

BACKGROUND

CORFs provide multidisciplinary outpatient rehabilitation services at a 

single location. Medicare allowed approximately $70 million for almost 

40,000 beneficiaries nationwide who received CORF services in 2010. 

Of this amount, more than $22 million was for claims by South Florida 

CORFs. 

CORFs are disproportionately concentrated in South Florida. Over 

one-fourth of the 303 CORFs that billed Medicare in 2010 were located 

in South Florida.

Vulnerabilities with CORFs in South Florida

Previous work has demonstrated that CORFs in South Florida may be 

vulnerable to fraud, waste, and abuse. The Office of Inspector General 

(OIG) estimated that in 2003, three South Florida CORFs received 

between $720,000 and $1.6 million each in inappropriate payments for

services.1, 2, 3 A 2004 report by the Government Accountability Office 

(GAO) identified aberrant billing patterns among South Florida CORFs. 

GAO found that per-beneficiary payments to CORFs in South Florida

were two to three times higher than per-beneficiary payments to other 

outpatient therapy providers.4 

In May 2009, the Health Care Fraud Prevention and Enforcement 

Action Team (HEAT) initiative was launched in Miami to increase 

efforts to reduce Medicare fraud. A collaboration between officials from 

1 OIG, Review of Comprehensive Outpatient Rehabilitation Facility Therapy Services 

Provided by Ultimate Rehabilitation Agency, Inc., A-04-05-02009, September 2008. 

2 OIG, Review of Comprehensive Outpatient Rehabilitation Facility Therapy Services 

Provided by Action Rehabilitation Center, Inc., A-04-05-02010, November 2008.

3 OIG, Review of Comprehensive Outpatient Rehabilitation Facility Therapy Services 

Provided by Care Alliance of America, Inc., A-04-05-02011, November 2009.

4 GAO, Comprehensive Outpatient Rehabilitation Facilities: High Medicare Payments in 

Florida Raise Program Concerns, August 2004.
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 2 

I N TRODUCTION

the Department of Health and Human Services and the Department of 

Justice, the HEAT initiative builds upon existing programs that combat 

fraud and identifies new methods to prevent fraud.

CORF Services 

CORFs are required to offer the following core services: CORF 

physician services, physical therapy services, and social and/or 

psychological services. CORF physician services are administrative and 

include such tasks as consultation with, and medical supervision of, 

CORF staff and review of patient treatment plans, as appropriate.5

In addition to offering core services, CORFs may elect to offer

occupational therapy, speech-language pathology, respiratory therapy, 

prosthetic and orthotic devices, supplies and durable medical 

equipment, and nursing as well as other services. 

 

A CORF must maintain a physical location that provides safe and 

sufficient space for the scope of services offered.6 Except for a single 

home environment evaluation visit and except for physical therapy, 

occupational therapy, and speech-language pathology services, all 

CORF services must be provided on CORF premises.7 The majority of 

physical therapy, occupational therapy, and speech-language pathology 

services must also be provided on CORF premises for all CORF 

patients.8

CORF Enrollments 

To enroll in Medicare, a CORF must submit an application that collects 

a variety of information, including the address at which the CORF will 

provide services (i.e., the practice location). 9

Before approving a CORF’s enrollment, CMS arranges for an initial site 

visit. This visit is part of a process called “survey and certification,” in 

which CMS contracts with State survey agencies to assess the 

prospective CORF’s compliance with certain Federal regulations. The 

survey and certification process culminates in a recommendation by the 

 

5 CMS, Medicare Benefit Policy Manual, Pub. No. 100-02, ch. 12 § 20.1. Accessed at 

http://www.cms.hhs.gov on May 19, 2011.

6 42 CFR § 485.62(a)(7).

7 42 CFR § 485(e). 

8 CMS, Medicare Benefit Policy Manual, Pub. No. 100-02, ch. 12 § 30(A). Accessed at 

http://www.cms.hhs.gov on May 19, 2011.

9 Form CMS-855A. Accessed at http://www.cms.hhs.gov on May 19, 2011. 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 3 

INTRODUCTION

State survey agency to CMS as to whether the CORF should be accepted 

into the Medicare program. 

After being accepted, each CORF must continue to meet the initial 

enrollment requirements. Each CORF is required to be periodically 

resurveyed by its State survey agency to ensure continued compliance 

with all requirements.10 CMS also requires CORFs to report enrollment 

application changes, including changes in practice location, within 

90 days of the changes. 11

Postenrollment Site Visits

 

After a CORF is enrolled in the Medicare program, CMS may conduct

unannounced site visits.12 CMS cites the use of unannounced 

postenrollment site visits as a successful way to determine whether 

providers are operational and are at the location on file with CMS.13

The Medicare Program Integrity Manual provides guidelines regarding

unannounced site visits. When conducting a site visit to verify that a 

provider is operational, CMS should attempt to make its determination 

using only an external review of the facility. CMS requires that 

reviewers document visits using written observations of the facilities

and photographs, as appropriate.

 

14 Unannounced site visits should take 

place during posted business hours, or between 9 a.m. and 5 p.m. if no 

business hours are posted.15

CMS Administrative Actions

 

CMS may take the following administrative actions against 

nonoperational providers, including CORFs: 

● Investigation. CMS investigations may include site visits and 

interviews with CORF staff and Medicare beneficiaries, as well 

as analysis of claims data. 

10 42 CFR § 488.20(b)(1).

11 42 CFR § 424.516(e)(2). A change in ownership or control must be reported within 30 

days. 42 CFR § 424.516(e)(1).

12 CMS, Medicare Program Integrity Manual Pub. No. 100-08, ch. 15, § 15.20. Accessed 

at http://www.cms.hhs.gov on May 19, 2011.

13 Preamble to final rule implementing sections of the Patient Protection and Affordable 

Care Act, as amended by the Health Care and Education Reconciliation Act of 2010. 

76 Fed. Reg. 5862, 5869 (Feb. 2, 2011). 

14 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.20.1. 

Accessed at http://www.cms.hhs.gov on February 22, 2011.

15 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.20.1 

Accessed at http://www.cms.hhs.gov on May 19, 2011.
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 4 

INTRODUCTION

● Prepayment review. CMS reviews documentation from 

providers before deciding whether to pay claims.

● Payment suspension. CMS temporarily stops some or all 

payments to a provider. CMS may suspend payments to a 

provider if there is a credible allegation of fraud against that 

provider.16 

● Revocation. CMS may revoke Medicare billing privileges for a 

CORF that is no longer operational.17 

● Deactivation. CMS may deactivate a provider’s billing 

privileges when a CORF has not submitted claims for 

12 consecutive months. 18 This reduces the risk that the 

provider’s billing privileges will be used for fraudulent purposes. 

Temporary Moratoria

CMS may also reduce the potential for fraud, waste, or abuse among 

CORFs by imposing a moratorium on CORF enrollment. CMS’s 

authority to impose moratoria on specific provider types, specific 

geographic areas, or both was established by the Patient Protection and 

Affordable Care Act and implemented in 2011.19

South Florida High Risk Enrollment Project

Concurrent to our review, CMS conducted a special enrollment project—

the South Florida High Risk Provider Enrollment Project—that 

targeted fraud among specific provider types that are vulnerable to 

abuse. As part of the project, CMS conducted site visits to all CORFs in 

South Florida to verify their existence. 

CMS used the results of these site visits, along with other information, 

to create a fraud-risk score for each CORF. CORFs with high fraud-risk 

scores could be subject to a variety of administrative actions. In some 

16 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 8, § 8.3.1.1. Accessed 

at http://www.cms.hhs.gov on August 16, 2011. See also 42 CFR §§ 405.371(a)(2) and 

405.372(a)(4).

17 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.27.2(A). 

Accessed at http://www.cms.hhs.gov on January 31, 2011. See also 42 CFR § 424.535(a)(5).

18 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.27.1. 

Accessed at http://www.cms.hhs.gov on January 31, 2011. See also 42 CFR § 424.540(a).

19 The Patient Protection and Affordable Care Act, P.L. 111-148, § 6401(a)(3) (adding 

section 1866(j)(6) of the Social Security Act, which was redesignated as section 1866(j)(7) by 

the Health Care and Education Reconciliation Act of 2010, P.L. 111-152, § 1304). 

Implementing regulations for moratoria on newly enrolling Medicare providers and 

suppliers are located at 42 CFR § 424.570. 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 5 

INTRODUCTION

cases, CMS used evidence from the site visits to take action against 

CORFs that were not operational.

METHODOLOGY

We performed unannounced site visits to all CORFs with a practice 

location in one of three Core Based Statistical Areas (CBSA) in Florida: 

the Miami–Miami Beach–Kendall CBSA, the Fort Lauderdale–

Pompano Beach–Deerfield Beach CBSA, and the West Palm Beach–

Boca Raton–Boynton Beach CBSA. We refer to these CBSAs 

collectively as South Florida. We determined whether these CORFs 

were operational (i.e., were at the location on file with CMS and were

open during business hours). We also reviewed documentation about 

CMS actions against CORFs that were not operational at the time of 

our site visits. See Appendix A for a detailed description of our 

methodology.

Scope

We focused our review on whether CORFs were operational—that is, 

whether they were at the locations on file with CMS and were open 

during business hours. We focused on these criteria to limit our 

interaction with CORF staff and reduce the risk of alerting staff at 

potentially fraudulent CORFs to our presence. 

Data Sources and Data Collection

Identifying CORF locations. To identify CORF locations for our 

South Florida site visits, we first used the 2009 Outpatient National 

Claims History (NCH) file to identify CORFs that submitted claims in 

2009 for a practice location in South Florida. We then located addresses 

for all 132 CORFs through the Provider Enrollment, Chain, and 

Ownership System (PECOS) and a data request to CMS.

Site visits to CORFs. We conducted unannounced site visits to 

determine whether these CORFs maintained a physical facility at the 

location on file with CMS and were open during business hours. We 

recorded all observations using a standard form. We conducted all site 

visits in May 2010.

Updates after site visits. To account for changes in our information 

between the time we identified our study population and the dates of 

our site visits, we requested address updates and changes in enrollment 

status from CMS for all CORFs that we found to be nonoperational. 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 6 

INTRODUCTION

CMS actions against nonoperational CORFs. To describe CMS actions 

against nonoperational CORFs following our site visits, we requested 

the results of the special enrollment project through April 2011. Along 

with the results of the special enrollment project, we also received data 

about routine actions that CMS took through April 2011 for these 

nonoperational CORFs.

Payments to nonoperational CORFs

Analysis

. We used the 2010 Outpatient NCH 

file to determine how much Medicare allowed for services reportedly 

provided by nonoperational CORFs.

Before analyzing our results, we removed 31 CORFs from our analysis. 

Twenty-nine were no longer enrolled in the Medicare program at the 

time of our site visits. We removed one CORF because we were unable 

to complete the full site visit protocol. We removed another CORF 

because it was closed for remodeling during the time of our visits. We 

performed our analysis on the remaining 101 CORFs.

We defined “operational” as at the location on file with CMS and open 

during business hours. We determined whether a CORF met these 

criteria in the following manner: 

• We determined that a CORF was at the location on file with 

CMS if it maintained a physical facility with its name clearly 

marked somewhere other than a building directory (e.g., a sign 

on or near the primary entrance to the CORF). 

• We determined that a CORF was open if it was accessible to 

CMS and beneficiaries during regular business hours (i.e., the 

door was unlocked) during either of two visits on separate days.

CORFs that did not meet at least one criterion were considered 

nonoperational for the purposes of this report.

We aggregated the results of our site visits to determine the number of 

CORFs that (1) maintained a physical facility at the location on file with 

CMS and (2) were open during business hours. We also categorized site 

reviewers’ observations about what they found (e.g., a sign with a 

different business name) at the location on file with CMS.

Payments to nonoperational CORFs. We calculated the total amount 

that Medicare allowed for 2010 for CORFs that were not at the location 

on file with CMS and for CORFs that were not open. For each CORF, 

we also calculated the amount Medicare allowed in 2010 following our 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 7 

INTRODUCTION

site visits (i.e., from the date of our last site visit through 

December 2010). 

Review of CMS actions against nonoperational CORFs

Standards

. We reviewed 

CMS actions against the nonoperational CORFs identified by our site 

visits. We determined for how many CORFs CMS took each type of 

action (e.g., prepayment review) and whether the actions resulted from 

the special enrollment project or from routine oversight. We aggregated 

these results to determine the number of nonoperational CORFs that 

CMS took action against after our site visits, as well as the 

nonoperational CORFs that had been subject to each type of action.

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors 

General on Integrity and Efficiency. 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 8 

 FINDINGS

Eighteen of the one hundred one 

South Florida CORFs were not operational

Eighteen of the one hundred one

CORFs in South Florida were not 

at the location on file with CMS or 

were not open during business hours. Medicare allowed $2.2 million for 

services provided by these CORFs in 2010, $450,000 of which was 

allowed after our site visits. An additional five CORFs were open only

during the second visit made to their locations. We considered these 

CORFs open for the purposes of this review. 

Ten CORFs were not at the location on file with CMS

After taking into account the CORFs that submitted address updates to 

CMS, 10 of the CORFs that we visited did not maintain a facility at the 

location on file with CMS. Medicare allowed $1.4 million for these 

10 CORFs in 2010.

As Table 1 shows, when site reviewers visited the location on file with 

CMS, they found different businesses, unmarked office suites, and a 

private residence with no indication that a CORF was located there. In 

one case, site reviewers found an eviction notice posted on the door of an 

empty CORF facility. See Photo 1 for an example of an empty storefront 

that reviewers found at the location CMS had on file for one CORF.

TABLE 1

Description of the 

location on file 

with CMS for 

10 nonoperational

CORFs.

What OIG Found at Location on File

Description Count

Sign with a different business name 4

No sign indicating a business name 4

Private residence with no sign indicating a CORF 1

Eviction notice 1

 Total 10

Source: OIG unannounced site visits to CORFs, May 2010.
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 9 

FINDINGS

PHOTO 1 

There was no 

indication that a 

CORF was 

operational at this 

location. 

Source: OIG unannounced site visits to CORFs, May 2010.

Eight CORFs were not open during business hours

Eight CORFs maintained a visible sign at the location on file with CMS 

but were locked during business hours on 2 separate days. Site 

reviewers visited seven of the eight CORFs during their posted business 

hours. The remaining CORF did not have posted business hours and 

was visited during reasonable business hours (9 a.m. to 5 p.m.). 

Medicare allowed $800,000 for these eight CORFs in 2010.

Five additional CORFs were locked during business hours on the first 

date we visited and open on the second day. These CORFs were 

considered open for the purposes of this report because they were open 

on our second visit. However, these CORFs may have been open on our 

second visit because they became aware of our review.

CMS took action against most of the 

nonoperational CORFs based on a special 

enrollment project and routine oversight

CMS took action against 16 of the 

18 nonoperational CORFs in the 

months after we completed our 

site visits. These actions included 

investigation, prepayment review, and revocation. More than half of 

these actions were because of CMS’s special enrollment project. The 

rest were because of routine oversight activities that apply to all 

Medicare providers. See Chart 1 for the actions that CMS took against 

nonoperational CORFs that we identified in our site visits. 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 10

0

1

2

3

4

5

6

7

8

9

10

Prepayment 

review

Revocation Investigation

Number of CMS Actions

Special Enrollment Project

Routine Oversight

CHART 1

CMS actions 

against 

nonoperational

CORFs.

Source: OIG unannounced site visits to CORFs and CMS actions against CORFs, May 2010.

FINDINGS

The special enrollment project resulted in actions against 10 nonoperational

CORFs

Based on the results of the special enrollment project, CMS revoked the 

billing privileges of six nonoperational CORFs and monitored four 

others with prepayment review. During the special enrollment project, 

CMS conducted site visits to Medicare providers in South Florida, 

including CORFs. As a result of this project, CMS took action against 

10 nonoperational CORFs that may not have been identified through 

routine oversight.

Actions based on the special enrollment project were not always timely. 

For one CORF, CMS took 9 months to take action. After finding this 

CORF to be nonoperational on two separate visits, CMS made a third 

visit 6 months later. Another 3 months elapsed before CMS put the 

provider on prepayment review. Similarly, CMS took almost 7 months 

to revoke another CORF’s billing privileges. CMS found this CORF to 

be nonoperational on two separate visits. Five months elapsed before 

CMS returned for a third site visit and found “for rent” signs posted at

the location. Another 2 months elapsed before CMS finalized the 

revocation of this CORF’s billing privileges. 

 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 11

FINDINGS

Routine CMS oversight resulted in actions against six nonoperational

CORFs

CMS revoked the billing privileges of three CORFs, monitored

two others with prepayment review, and investigated another as a 

result of routine oversight. CMS revoked the billing privileges of three 

CORFs because they were found to be nonoperational during site visits 

that were not related to the special enrollment project. 

CMS took no action against two nonoperational CORFs

After the OIG site visits, CMS visited these two CORFs as part of the 

special enrollment project and found them to be operational. Almost a 

year later, CMS reported that prepayment review actions were pending 

for these CORFs. These actions were based on fraud indicators 

unrelated to the site visits. 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 12

RECOMMENDATIONS RECOMMENDATIONS

Eighteen of the one hundred one CORFs in South Florida were not 

operational. Ten of these CORFs were not found at the location on file 

with CMS, and eight were not open during business hours. 

CMS also identified nonoperational CORFs in South Florida and was 

able to remove or monitor most of them. CMS actions included 

revocation of billing privileges, prepayment review, and investigation. 

By using a special enrollment project, CMS was able to identify and 

take action against more CORFs than it would have using routine 

oversight alone. However, in some cases, CMS took several months to 

take action against CORFs after identifying them as nonoperational. 

Further, CMS was unable to prevent these CORFs from initially 

enrolling in the Medicare program.

Given the number of CORFs that OIG and CMS found to be 

nonoperational, CMS should continue its attempts to protect the 

integrity of the Medicare program and beneficiaries from potentially 

fraudulent CORFs. Therefore, we recommend that CMS:

Periodically conduct unannounced site visits to CORFs 

CMS advocates the use of unannounced postenrollment site visits to 

determine whether providers are operational. Notably, CMS used 

unannounced site visits as a key component of its special enrollment 

project. Continuing to periodically conduct nationwide unannounced 

site visits to CORFs would enable CMS to identify and remove 

nonoperational CORFs from the program and potentially reduce 

erroneous Medicare payments. CMS could focus unannounced site 

visits in high-risk areas or base them on fraud-risk assessments. 

Use additional program safeguards for CORFs 

CMS should use other program safeguards to prevent potentially 

nonoperational CORFs from enrolling in the Medicare program and to 

monitor existing CORFs. Such safeguards may include payment 

suspensions and a moratorium on the enrollment of new CORFs. 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with our recommendations. In response to our first 

recommendation, CMS stated that it currently conducts unannounced 

enrollment and revalidation site visits to CORFs and that it plans to 

increase the frequency of unannounced, out-of-cycle site visits to 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 13

RECOMMENDATIONS

CORFs. CMS also plans to compare CORF enrollment information with 

public records to identify potential changes to enrollment information 

that would warrant further investigation. In response to our second 

recommendation, CMS stated that it will continue to take 

administrative actions, as appropriate. CMS stated that these actions 

may include, but are not limited to, prepayment review, auto-deny edits, 

payment suspensions, and revocations. CMS also stated that it had 

referred certain providers to OIG for investigation. We did not make 

any changes to the report based on CMS’s comments. For the full text 

of CMS’s comments, see Appendix B.
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 14

Detailed Methodology

We conducted unannounced site visits to all Comprehensive Outpatient 

Rehabilitation Facilities (CORF) in three Core Based Statistical Areas 

(CBSA) in Florida: the Miami–Miami Beach–Kendall CBSA, the

Fort Lauderdale–Pompano Beach–Deerfield Beach CBSA, and the

West Palm Beach–Boca Raton–Boynton Beach CBSA. We refer to these 

CBSAs collectively as South Florida. We determined whether each 

CORF was at the location on file with the Centers for Medicare & 

Medicaid Services (CMS) and was open during business hours. We then 

reviewed documentation about actions that CMS took against the 

noncompliant CORFs and determined how much money Medicare 

allowed for services reportedly provided by these CORFs in 2010.

Scope

To concentrate our visits on CORFs with recent activity in the Medicare 

program, we focused our review on CORFs that submitted claims for 

Medicare payment in 2009. At the time we developed our study 

population, data on claims from 2009 were the most recent available.

Data Sources and Data Collection

Identifying CORF locations. We identified CORFs that submitted claims 

in 2009 using the bill type and provider identification numbers 

(provider ID) fields in the 2009 Outpatient National Claims History 

(NCH) file. We counted each provider ID that had claims with bill type 

75 as a CORF.20 We then used the State code from the NCH file to 

identify all CORFs in Florida. 

Using two sources, we located an address for each CORF in Florida. 

Our primary source for CORF addresses was the practice location field 

from the Provider Enrollment, Chain, and Ownership System 

(PECOS).21 Most CORFs have enrollment information, such as practice 

locations, stored in PECOS.22 When a CORF did not have an address 

available in PECOS, we requested this information from CMS. 

20 Bill type is a variable used to describe the type of Medicare facility that delivered the 

services billed. 

21 PECOS is the system of record for Medicare provider enrollment information. PECOS 

is populated based on the initial provider enrollment application and updated any time a 

provider submits an updated application to CMS. 

22 A CORF that enrolled before 2004 and has not submitted an updated application may 

not have an enrollment record in PECOS.

 APPEN DIX ~ A
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 15

APPENDIX~A

Finally, we matched the ZIP Code from each address to the ZIP Codes 

corresponding to each CBSA to determine whether the address was 

located in one of the three South Florida CBSAs. This process resulted 

in 132 CORFs with addresses in South Florida. 

Site visits to CORFs. We conducted unannounced site visits to these 

132 CORFs to determine whether they were at the location on file with 

CMS and were open during business hours. We recorded all 

observations using a standard form. We conducted all site visits from 

May 17 through May 28, 2010. 

We designed our site visit protocol to ensure that we gave providers the 

benefit of the doubt when determining whether they were operational. 

For example:

● All visits to CORFs were made during posted business hours if 

hours were posted or during reasonable business hours (9 a.m. 

to 5 p.m.) if none were posted.

● If a CORF was locked, we conducted a second visit to that 

location on a different day. We considered CORFs to be open if 

they were open on either the first visit or (if applicable) the 

second visit. 

● When the building at a CORF location on file with CMS was a 

multisuite office building, site reviewers searched for the CORF

by name as well as by suite number. We considered the CORF

to be at the location on file with CMS if site reviewers could find 

it in any suite or office space in the building.

● If a CORF had a sign posted indicating that visitors should ring 

a buzzer or doorbell to enter the facility, site reviewers did so. If 

the door was opened (e.g., someone came to the door or the lock 

was released), we considered the CORF to be open.

● If a CORF had a sign posted indicating that it was available by 

appointment only, a site reviewer attempted to make an 

appointment for services with that CORF (i.e., called the phone 

number listed on the sign). If the site reviewer was able to 

make an appointment, we considered the CORF to be open.

● If we found a different business name at the CORF location on 

file with CMS, we attempted to determine if the CORF we were 

looking for was operating under the name we found. First, we 

requested from CMS all names for CORFs that we did not find 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 16

APPENDIX~A

and reviewed this information to ensure that we captured all 

possible aliases. Second, as a final check, we reviewed public 

Web sites, including the National Provider Identifier registry, to 

determine whether the CORF we were looking for could be 

operating under the name we found. If we were able to connect 

the two names, we categorized the CORF as being at the 

location on file with CMS. 

CMS actions against nonoperational CORFs. Data received from the 

South Florida High Risk Enrollment Project (special enrollment project) 

through December 2010 included:

● administrative actions taken against nonoperational CORFs, 

● the source of these administrative actions (i.e., special 

enrollment project activity or routine oversight),

● the effective dates of these actions,

● the dates that CMS finalized these actions, and

● the dates and results of all of CMS’s site visits and in-depth 

investigations related to the special enrollment project.

Analysis

Updates after site visits. CMS indicated that it deactivated the billing 

privileges of 26 CORFs and revoked the billing privileges of 3 others 

before the dates of our site visits. We removed these 29 CORFs from 

our analysis. 
A P PEN D x B 


Agency Comments 

.,.t>J ....,CJ.... -

('" .t.. DEPARTMENT OF HEALTH & HUMAN SERVICES Centers for Medicare & Medicaid Services 

, .....<tm 

DATE: 

TO: 

FROM: 

SUBJECT: 

Administrator 

Washington, OC 20201 

OCT 1 22011i 

Daniel R. Levinson 

Inspector General 

Donald M. Berwick, M.D. 

Administrator 

Office of Inspector General (OlG) Draft Report: "South Florida Medicare 

Comprehensive Outpatient Rehabilitation Facilities" (OEl-OS-! 0-00090) 

'Ine Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 

comment on the Officc oflnspector General (OlG) draft report entitled. "South Florida Medicare 

Comprehensive Outpatient Rehabilitation Facilities." The purpose of this report is two-fold. 

First, it seeks to determine whcther Comprehensive Outpatient Rehabilitation Facilities (CORFs) 

in South Florida were operational (Le., at the location on file with CMS and open during 

business hours). Secondly, it describes CMS actions against CORFs that were not operational. 

CORPs provide multidisciplinary rehabilitation services at a single location. According to OlO's 

report, Medicare allowed approximately $70 million for CORP services for almost 40,000 

beneficiaries in 2010. Ofthis, more than $22 million was for claims by CORPs in South Florida. 

The Affordable Care Act provides important new tools for CMS to use to strengthen the integrity 

ofthe Medicare, Medicaid, and CHIP programs, including enhanced provider and supplier 

screening requirements, the authority to suspend payments to providers/suppliers pending 

investigations of credible allegations of mud, and the authority to impose enrollment moratoria 

on new providers and suppliers when necessary to combat fraud and abuse. 

CORF services have historically been vulnerable to abuse. To combat this abuse, CMS is taking 

additional steps to address potential vulnerabilities in the enrollment and claims payment process 

for this supplier group, using the authorities granted under the Affordable Care Act. This 

includes continuing to conduct unannounced site visits to CORFs and exploring options to use 

payment suspensions in conjuJlction with revocation actions for providers/suppliers detennined 

to be non-operational. 

According to the OlG report. CMS took action against most of the non-operational CORPs based 

on a special enrollment project and routine oversight. CMS believes it took the appropriate 

action on all non-operational CORFs identified by OlG in this study. eMS' definition oftaking 

action includes, but is not limited to, conducting its own unannounced site visit and taking the 

OEI·05·10 · 00090 SOUTH FLORIDA MEDICARE COMPREHENSIVE OUTPATIENT REHABILITATION FACILITIES 17 
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 18

APPENDIX ~ B
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 19

APPENDIX ~ B
 

OEI - 0 5 - 1 0 - 00090 S OUTH F LORIDA MEDICARE C OMPREHENSIVE OUTPATIENT R EHABILITATION FACILITIES 20

 ACKNOWLEDGMENTS

This report was prepared under the direction of Ann Maxwell, Regional 

Inspector General for Evaluation and Inspections in the Chicago 

regional office, and Thomas Komaniecki, Deputy Regional Inspector 

General. 

Laura Kordish served as the team leader for this study, and Lisa Minich 

and Mara Werner served as lead analysts. 

We would also like to acknowledge the contributions of Office of 

Evaluation and Inspections central and regional offices. Contributing 

staff from these offices include Melissa Baker, Tim Chettiath, 

Ben Dieterich, Kevin Farber, Robert Gibbons, Jennifer Gist, 

Rose Goldberg, Melissa Hafner, Scott Horning, Maria Maddaloni, 

Dan Mallinson, Kevin Manley, Conswelia McCourt, Beth McDowell, 

Jeremy Moore, Christine Moundas, Brian Pattison, Margo Rodriguez, 

Megan Ruhnke, Rachel Siman, Arianne Spaccarelli, Holly Williams, and 

Chetra Yean.
Office of Inspector General http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of Department of Health and Human Services (HHS) 

programs, as well as the health and welfare of beneficiaries served by those programs. This 

statutory mission is carried out through a nationwide network of audits, investigations, and 

inspections conducted by the following operating components:

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS.

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties.

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.