Department of Health and Human Services

OFFICE OF 

INSPECTOR GENERAL 

 

Daniel R. Levinson 

Inspector General 

October 2007 

OEI-06-06-00280 

 

 CMS’S IMPLEMENTATION OF 

SAFEGUARDS DURING FISCAL 

YEAR 2006 TO PREVENT AND 

DETECT FRAUD AND ABUSE 

IN MEDICARE PRESCRIPTION 

DRUG PLANS 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

Office of Inspector General 
 http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, 

as amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides all auditing services for HHS, either by 

conducting audits with its own audit resources or by overseeing audit work done by others. 

Audits examine the performance of HHS programs and/or its grantees and contractors 

in carrying out their respective responsibilities and are intended to provide independent 

assessments of HHS programs and operations. These assessments help reduce waste, 

abuse, and mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on 

significant issues. Specifically, these evaluations focus on preventing fraud, waste, or 

abuse and promoting economy, efficiency, and effectiveness in departmental programs. 

To promote impact, the reports also present practical recommendations for improving 

program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative 

investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries 

and of unjust enrichment by providers. The investigative efforts of OI lead to criminal 

convictions, administrative sanctions, or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support in OIG's internal operations. OCIG imposes program exclusions and civil 

monetary penalties on health care providers and litigates those actions within HHS. 

OCIG also represents OIG in the global settlement of cases arising under the Civil False 

Claims Act, develops and monitors corporate integrity agreements, develops compliance 

program guidances, renders advisory opinions on OIG sanctions to the health care 

community, and issues fraud alerts and other industry guidance. 
 

EXECUTIVE SUMMARY 

 

Δ EXECUTIVE SUMMARY 

OBJECTIVE 

To determine the extent to which the Centers for Medicare & Medicaid 

Services (CMS) implemented safeguards during fiscal year (FY) 2006 to 

prevent and detect fraud and abuse in Medicare prescription drug plans 

(PDP). 

BACKGROUND 

CMS is responsible for safeguarding the Medicare Part D program 

against fraud and abuse. CMS is statutorily required to perform 

financial audits of PDPs contracted to provide drug benefits to Medicare 

beneficiaries. Beyond this requirement, CMS holds considerable 

discretion in structuring safeguards for the program. In total, we 

identified six major safeguard activities conducted by CMS: a complaint 

process, data-monitoring activities, financial audits, monitoring PDP 

sponsor compliance with contract requirements, oversight of PDP efforts 

to reduce fraud and abuse, and providing education and guidance to a 

number of stakeholders on fraud and abuse identification. CMS 

contracted with one Medicare Prescription Drug Integrity Contractor 

(MEDIC) in FY 2006 to perform some of these functions, including 

complaint investigation. 

To identify the status of safeguard implementation and to provide an 

early assessment of progress, we reviewed documents provided by CMS 

and the MEDIC describing and documenting current and planned 

efforts during FY 2006 and conducted a series of structured interviews 

with CMS and MEDIC staff. Although our focus was on PDPs, some of 

the concerns raised may also be applicable to Medicare Advantage 

Prescription Drug Plans and the Retiree Drug Subsidy. 

 OEI-06-06-00280 

FINDINGS 

CMS implemented safeguard activities throughout FY 2006; 

however, further development or application of these activities is 

needed 

Some of CMS’s safeguards have been functioning since enrollment 

began, while others were implemented in a limited capacity or had not 

yet begun. For example, the complaint process has been in place since 

S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS i 
 

 

 

EXECUTIVE SUMMARY 
 

November 2005, but other safeguards, such as data analysis for fraud 

detection, had not yet begun by the end of FY 2006. Compliance audits, 

an important tool for monitoring PDP sponsor compliance, had not 

begun, but CMS staff underwent extensive preparations, including 

protocol development and staff training. CMS reported that initial 

preparation for financial audits began in FY 2006, with the first audits 

expected to begin in January 2008. CMS issued initial guidance for 

PDP compliance plans and is conducting education initiatives; however, 

the slow release of two important guidance documents raises concern. 

In FY 2006, CMS relied largely on complaints to identify potential 

fraud and abuse in the Medicare Part D program; however, not all 

complaints were investigated timely 

During the first year of the program’s operation, CMS relied largely on 

complaints to identify potential fraud schemes and abusive practices. 

Fraud complaints are handled by the MEDIC, which evaluates the 

merit of each complaint, conducts investigations, and makes referrals to 

law enforcement, as appropriate. At the end of our data collection, 

24 percent of the 6,132 complaints that the MEDIC had received were 

open cases, apparently the result of insufficient staff. In addition, CMS 

does not track Medicare Part D fraud and abuse complaints made to 

1-800-MEDICARE, nor does it know if these callers actually follow 

through with instructions to make additional calls to the MEDIC 

hotline. 

Limits to legal authority, jurisdiction, and CMS’s ability to monitor 

enrollees switching plans complicate CMS’s efforts to safeguard 

Medicare Part D PDPs 

We identified three impediments to the effective oversight of Medicare 

Part D, specifically in the areas of financial auditing, Part D marketing, 

and utilization management. For example, CMS does not have the legal 

right to go onto the premises of pharmaceutical benefit managers to 

verify that plans accurately report all remuneration and must rely on 

PDP sponsors to include sufficient requirements in their own contracts. 

Further, CMS has limited authority over insurance brokers, one of the 

most frequent subjects of fraud complaints. Lastly, coordination of 

information between plans about beneficiaries suspected of 

inappropriate utilization had not occurred because the plan sponsors 

have concerns over the Health Insurance Portability and Accountability 

Act of 1996 privacy laws. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS ii 
 

 

 

 

 

 

E X E CUTIVE S U MMAR Y 
 

RECOMMENDATIONS 

To ensure that CMS’s program integrity safeguard activities are 

implemented in a manner that is sufficient to protect the Medicare 

Part D program, we recommend that CMS: 

Develop a comprehensive safeguard strategy for Medicare Part D 

PDPs with specific activities and target dates and ensure that all 

activities are progressing in a timely manner. CMS should develop a 

comprehensive strategy with specific activities and target dates and assign 

staff to follow up on progress. Further, CMS should make Medicare Part 

D safeguard activities a sufficient priority in the budgeting process to 

support their timely and effective administration. 

Ensure that all fraud complaints receive proper attention. CMS should 

have a process in place to monitor the number of open complaints and 

take action if backlogs occur. Additionally, CMS should investigate 

options to immediately transfer fraud complaints submitted to 1-800-

MEDICARE to the appropriate MEDIC. 

Address legal concerns that may impede program integrity efforts. 

Specifically, CMS should: (1) require PDP sponsors to include standard 

wording regarding requirements for record retention and accessibility 

within subcontractor contracts, (2) enforce appropriate sanctions for 

plans whose brokers violate permissible marketing practices, and 

(3) utilize the MEDICs as intermediaries for PDPs to share information 

about their beneficiaries suspected of inappropriate utilization. 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

In its comments to the draft report, CMS responded that many of its 

ongoing activities already satisfy our recommendations. It further 

stated that the report does not fully explain the immense workload 

required for CMS to develop and administer the benefit in its first year 

and indicated that processes and procedures have improved over time. 

CMS additionally reported several advances in this safeguard strategy 

that occurred after the end of our data collection period (FY 2006). We 

revised the draft report, as appropriate, based on these comments. CMS 

did not indicate whether it concurred with our recommendations. We 

ask that, in its final management decision, CMS indicate whether it 

concurs with our recommendations and what steps, if any, it will take to 

implement them. 

O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS iii 
 

Δ TABLE OF CONTENTS 

EXECUTIVE SUMMARY .................................... i 
 

INTRODUCTION ........................................... 1 
 

FINDINGS ................................................. 8 

CMS implemented safeguard activities in FY 2006 ............ 8 

CMS relied largely on complaints ......................... 12 
 

Legal authorities, jurisdiction, and monitoring enrollees ....... 14 
 

RECOMMENDATIONS .................................... 17 
 

Agency Comments and Office of Inspector General Response .... 19 

APPENDIXES ............................................ 23 
 

Appendix A: Medicare Part D Benefits and Operation......... 23 
 

Appendix B: Agency Comments........................... 25 
 

ACKNOWLEDGMENTS ................................... 29 
 
 

 

Δ INTRODUCTION 

OBJECTIVE 

To determine the extent to which the Centers for Medicare & Medicaid 

Services (CMS) implemented safeguards during fiscal year (FY) 2006 to 

prevent and detect fraud and abuse in Medicare prescription drug plans 

(PDP). 

BACKGROUND 

This inspection is an early implementation review of CMS’s efforts to 

prevent and detect fraud in Medicare Part D PDPs. A separate Office of 

Inspector General (OIG) inspection, “Prescription Drug Plan Sponsors’ 

Compliance Plans,” addressed efforts made by the plans themselves.1 

Medicare Part D Prescription Drug Program 

The Medicare Prescription Drug, Improvement, and Modernization Act 

of 2003 (MMA) established the Medicare Part D prescription drug 

program. Effective January 1, 2006, this program provides an optional 

outpatient prescription drug benefit, which is available to all 42 million 

Medicare beneficiaries.2 3 Beneficiaries generally have the option to 

enroll either in a stand-alone PDP for their drug coverage and receive 

all other benefits through traditional Medicare fee-for-service or enroll 

in a Medicare Advantage plan and receive all Medicare benefits, 

including drug coverage, through managed care.4 

The MMA required an aggressive implementation schedule for the 

Medicare Part D benefit. In the approximately 2 years between passage 

of the law and the effective date of Medicare Part D coverage, CMS and 

plan sponsors were conducting implementation activities, including the 

development of procedures, data systems, and infrastructure to carry 

out all necessary functions. Applications for the first PDPs were due in 

March 2005 and beneficiaries began electing coverage in 

November 2005. As of July 2006, approximately 24 million Medicare 

1 OEI-03-06-00100. 

2 Social Security Act § 1860D-1. 

3 Centers for Medicare & Medicaid Services, “Medicare Enrollment: National Trends
 

1966-2005.” Available online at 

http://www.cms.hhs.gov/MedicareEnRpts/Downloads/HISMI05.pdf. Accessed on March 

22, 2006. 

4 CMS, Final Rule, “Medicare Prescription Drug Benefit,” 70 Fed. Reg. 4194 

(January 28, 2005). 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 1 
 

 

 

 

INTRODUCTION 
 

beneficiaries were enrolled in a Medicare Part D drug plan.5 A 

summary of the benefit and its operation is included in Appendix A. 

During 2006, the first full year of the benefit, expenditures totaled more 

than $47 billion.6 To implement the program, CMS received $1 billion 

for startup costs to be used in FYs 2004 and 2005.7

 Of that $1 billion, 

CMS used 44 percent for education and outreach, 5 percent for payroll 

expenses, and the balance primarily for information technology 

improvements.8

 It is unclear what portion of the $1 billion was 

dedicated to program integrity efforts. In addition, CMS received a onetime increase of $100 million from the Deficit Reduction Act (DRA) of 

2005 for Medicare program integrity activities conducted during FY 

2006. 9 A portion of these funds was allocated to activities designed to 

protect Medicare Part D from fraud and abuse. Future funding sources 

for Part D program integrity activities have yet to be determined. 

Program Integrity Staff and Medicare Prescription Drug Integrity Contractors 

Numerous groups within CMS have responsibility for overseeing 

aspects of Part D administration, including the Center for Beneficiary 

Choices, the Office of the Actuary, and the Office of Financial 

Management. However, the Medicare Modernization Act Integrity 

(MMAI) group within the Office of Financial Management’s Program 

Integrity Group is focused specifically on fraud prevention and detection 

in Part D. The MMAI group conducts training, reviews regulations, and 

provides guidance to the Department of Health and Human Services on 

what fraud-related vulnerabilities exist and how they should be 

addressed. It is also responsible for overseeing the Medicare 

Prescription Drug Integrity Contractors (MEDIC). 

5 Center for Medicare & Medicaid Services, “Medicare Advantage, Cost, PACE, Demo, 

and Prescription Drug Plan Contract Report – Monthly Summary Report.” September 

2006. Available online at 

http://www.cms.hhs.gov/PrescriptionDrugCovGenIn/02_EnrollmentData.asp. Accessed
 

on October 18, 2006. 

6 “2007 Annual Report of the Boards of Trustees of the Federal Hospital Insurance and 

Federal Supplementary Medical Insurance Trust Funds,” p. 5. Available online at 

http://www.cms.hhs.gov/ReportsTrust Funds/downloads/tr2007.pdf. 

Accessed on July 24, 2007. 

7 Public Law 108-173 § 1015. 

8 Centers for Medicare & Medicaid Services, “Budget Facts.” February 7, 2005. Available 

online at http://www.cms.hhs.gov/apps/media/ press/release.asp?Counter=1350. Accessed 

on May 30, 2006. 

9 Deficit Reduction Act § 5204 amending Social Security Act § 1817(k)(4)C. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 2 
 

 

 

INTRODUCTION 
 

MEDICs are private firms with which CMS contracts to perform fraud 

prevention and detection activities, including complaint tracking and 

investigation and data mining. Only one MEDIC contract was awarded 

for work conducted during FY 2006 and that contract was awarded on a 

reduced-scope basis. CMS attributed this decision to funding 

limitations. That MEDIC provided the staff dedicated to investigating 

prescription drug fraud complaints during the first year of the Medicare 

Part D benefit. Three regional MEDICs and a data-focused MEDIC 

were each awarded 1-year contracts in September 2006 (after release of 

the DRA funds) with operations beginning in December 2006. 

Fraud and Abuse Strategy 

CMS is responsible for preventing and detecting fraud and abuse in 

Medicare Part D. However, the only activity statutorily required of 

CMS is to conduct financial audits of one-third of the plans each year.10 

Beyond that, CMS exercises considerable discretion in safeguarding the 

program. CMS’s publicly announced plans to combat fraud and abuse 

in Medicare Part D include a range of prevention and detection 

activities; however, the complete strategy has not been laid out as a 

single comprehensive plan. Accordingly, we analyzed CMS’s various 

press releases and guidance documents to identify CMS’s safeguard 

activities. 

In an October 2005 press release, CMS announced that it would be 

“expanding its efforts in fighting fraud and abuse in Medicare [Part D] 

by using state of the art systems and expertise to prevent problems 

before they occur.”11 It further discussed a general three-pronged 

approach to safeguarding the Medicare Part D program which includes: 

(1) implementing new and innovative techniques to monitor and analyze 

data to help identify fraud; (2) working with key partners, such as law 

enforcement and consumer groups; and (3) providing tips for 

beneficiaries to protect themselves. In this same press release, CMS 

announced the selection of eight MEDICs that would then be eligible to 

bid on contracts for future MEDIC work. Also in October 2005, CMS 

released a document titled “Part D Oversight Strategy for 

10 Social Security Act § 1860D-12(b)(3)(C). 

11 CMS Fact Sheet: The New Medicare Prescription Drug Program: Attacking Fraud 

and Abuse. October 7, 2005. Available online at 

www.cms.hhs.gov/apps/media/press/release.asp?Counter=1693. Accessed on 

November 20, 2006. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 3 
 

 

INTROD U C T U C T I O N I O N 

Contractors/Industry.”12 This document states that oversight “will be 

data driven to the extent possible” and identifies four functions that will 

feed into oversight: contractor management, auditing, compliance and 

enforcement, and the functions performed by MMAI and the MEDICs. 

SAFEGUARD ACTIVITIES 

We have defined safeguard activities as any activity or process that is 

able to prevent or detect fraud and abuse, as some activities identified 

as safeguards are not designed explicitly for that purpose. From CMS’s 

press releases, the oversight strategy document, and interviews with 

CMS staff, we identified the following six major types of safeguard 

activities: 

1. Complaint Process—This process involves the intake, tracking, and 

investigation of fraud complaints. Complaints may arise from 

beneficiaries, pharmacists, plan staff, or any other person with a fraud 

complaint pertaining to Medicare Part D. Complaints provide a source 

of direct information about potential fraud. 

2. Data Monitoring—Data monitoring describes the use of data systems 

to assess transactions and look for anomalies that might suggest fraud. 

This includes automated data edits, trend monitoring, and data mining. 

3. Financial Audits—Financial audits verify that plan-reported financial 

data are credible and accurate. The MMA specified that a financial 

audit should be conducted on one-third of all Medicare Part D plans 

each year. Financial audits could cover a wide range of topics and 

would potentially reveal problems that may result in overpayment to 

plans, including misrepresentation of bids, underreporting of rebates, 

and inaccurate prescription drug event data. 

4. Monitoring PDP Sponsor Compliance—CMS conducts a number of 

monitoring activities designed to oversee the operation of PDPs. If 

problems are identified through these activities, CMS can implement 

intermediate sanctions or terminate a PDP contract. The activities 

include account management activities, compliance audits, and 

operational safeguards. 

12 Centers for Medicare & Medicaid Services, “Part D Oversight Strategy for 

Contractors/Industry.” October 24, 2005. 

O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 4 
 

 

 

 

 

 

INTRODUCTION 
 

•	 Account management—CMS account managers act as a nerve center 

into which all types of PDP information feeds and are tasked with 

educating PDP sponsors on new, revised, or misunderstood policies. 

They hear complaints from the PDPs about CMS operations and 

receive regular reports about beneficiary complaints and PDPreported data. 

•	 Compliance audits—CMS staff use compliance audits to measure 

PDP sponsors’ adherence to 14 broad elements that are required of 

them.13 These audits are designed to ensure that plans have 

management controls in place to enable all necessary functions, 

including beneficiary enrollment and claims processing. 

•	 Operational Safeguards—A wide range of management controls 

used in the routine operation of Medicare Part D have both a 

primary role in administration of the benefit and a secondary role of 

fraud prevention and detection. Two examples of operational 

safeguards are the bid review and the formulary and benefit 

review.14 15 

5. Oversight of PDP Efforts To Reduce Fraud and Abuse—As part of the 

contract to administer PDPs, CMS requires PDPs to have in place 

effective fraud control programs and recommends some specific 

13 The 14 elements addressed in the audit protocol are: (1) Enrollment and 

Disenrollment; (2) Provider Communication; (3) Marketing and Beneficiary Information; 

(4) Privacy and Confidentiality; (5) Drug Utilization Management, Quality Assurance, 

and Electronic Prescribing; (6) Pharmacy Access; (7) Formulary, Transition Process, and 

Pharmacy & Therapeutics Committee; (8) Medication Therapy Management; 

(9) Coordination of Benefits/True-Out-of-Pocket Costs; (10) Compliance Plan; 

(11) First-Tier and Downstream Contracts/Maintenance of Records; (12) Claims 

Processing and Payment; (13) Grievances, Coverage Determinations, and Appeals; and 

(14) Licensure and Solvency. 

14 The actuarial aspect of the bid review process is conducted by CMS’s Office of the 

Actuary. CMS staff and contractors review bids to determine whether the assumptions 

underlying financial projections are appropriate and reasonable. Included in this review 

is a detailed statistical analysis to identify outlier values in the bid components. When 

outliers are identified, a more thorough review is initiated and values are substantiated 

prior to approval. Some specific aspects of the review may enable CMS to identify 

inappropriate cost manipulation tactics that could affect total Part D costs. 

15 CMS conducts a formal review to ensure that a PDP’s formulary and benefit structure 

meet minimum specifications, ensuring that beneficiaries have access to a full range of 

medications. The formulary review process is an automated process that checks for these 

specifications. If the formulary does not pass the review, CMS returns the formulary to 

the plan for revision. A similar process is used to ensure that the plan’s benefit package 

matches its formulary. For example, if a plan’s benefit package indicates a certain 

number of cost tiers, the formulary must show drugs available in each of the tiers. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 5 
 

 

 

 

 

 

 

INTRODUCTION 
 

 OEI-06-06-00280 

activities to identify potential fraud and abuse.16 With the ability to 

monitor drug transactions and implement utilization controls that could 

serve as an alert for fraud, PDPs are uniquely situated to identify fraud 

committed by beneficiaries or pharmacies. 

6. Education and Guidance—CMS has an initiative to educate 

beneficiaries about potential fraud schemes and how to protect 

themselves. Training for law enforcement, CMS staff, and other 

Government agencies is also designed to address fraud issues 

developing in Medicare Part D. 

SCOPE 

This review describes the implementation status of CMS safeguard 

activities related to stand-alone PDPs during FY 2006. We did not 

describe safeguard activities conducted by the PDPs themselves. As the 

prescription drug benefit is still new, we also did not seek to determine 

the effectiveness of the safeguards that are in place or planned. We also 

excluded issues of data integrity and security, which is being addressed 

by a separate OIG inquiry. Although our focus was on PDPs, some of 

the concerns raised may also be applicable to MA-PDs and the Retiree 

Drug Subsidy.17 18 

METHODOLOGY 

We reviewed a variety of documents and conducted a series of 

interviews with CMS and MEDIC staff to determine the 

implementation status of safeguard activities at the time of our review. 

Document Review 

We reviewed publicly available documents as well as internal 

documents provided to us by CMS and the MEDIC. Documents 

included press releases, guidance documents, standard operating 

procedures, budget documents, contracts, and training materials. 

16 42 CFR § 423.504(b)(vi)(H). 

17 Medicare Advantage plans offer a complete range of health benefits including hospital
 

and physician coverage. They may choose to offer an additional prescription drug benefit 

through Medicare Part D. 

18 The Retiree Drug Subsidy encourages private employers to provide Part D benefits to 

their retirees by subsidizing the cost for Medicare-eligible beneficiaries. 

S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 6 
 

 

 

INTROD U C T I O N 

Interviews 

We conducted 19 interviews, either in person or by telephone, primarily 

during August and September 2006. These interviews were with CMS 

staff in the Office of Financial Management, the Center for Beneficiary 

Choices, and the Office of the Actuary. Our discussions addressed 

specific program integrity issues involved in various operations of the 

Medicare Part D program. 

Site Visit 

We conducted a site visit with the Enrollment and Eligibility MEDIC, 

Delmarva Foundation, in Easton, Maryland. Delmarva Foundation was 

the only MEDIC in operation at the time of our data collection. During 

this visit, we interviewed managers and senior staff regarding their 

contracting process, operations, and perspectives on fraud 

vulnerabilities. Additionally, we observed the intake of beneficiary 

complaints to the MEDIC fraud hotline by telephone operators, toured 

the facility, and observed the use of the MEDIC’s data systems. We also 

reviewed documentation of the complaint statistics, standard operating 

procedures, and training sessions conducted by MEDIC staff. 

Direct Observation 

Several internal management systems were demonstrated for us by 

both CMS and the MEDIC. At CMS, we observed several modules of 

the Health Plan Management System (HPMS) in use, including bid 

review, formulary submission and review, plan benefit package review, 

and compliance audits.19 During the MEDIC site visit we observed use 

of the Complaint Tracking Module of HPMS, as well as internal MEDIC 

complaint-tracking and data analysis systems. We also used the 

MEDIC’s complaint-tracking data to determine the overall number of 

complaints. 

Standards 

This study was conducted in accordance with the “Quality Standards for 

Inspections” issued by the President’s Council on Integrity and 

Efficiency and the Executive Council on Integrity and Efficiency. 

19 The HPMS is a Web-enabled information system that supports the ongoing operations 

of the Medicare Advantage and Part D programs by facilitating electronic communication 

between CMS and plans. 

O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 7 
Δ FINDINGS 

Some aspects of CMS’s strategy to 

CMS implemented safeguard activities throughout safeguard Medicare Part D have 

FY 2006; however, further development or been operational since enrollment 

application of these activities is needed began in November 2005. Others 

were implemented in a limited 

capacity or had not yet begun. Below are descriptions of each of the six 

safeguard activities, i.e., complaint process, data monitoring, financial 

audits, monitoring PDP sponsor compliance, oversight of PDP efforts to 

reduce fraud and abuse, and education and guidance, and their 

implementation status as of the end of FY 2006. 

Complaint Process—Complaint investigations resulted in 312 referrals 

related to the “$299 Ring” scam and 122 other fraud referrals 

The process to handle complaints has been in place since November 

2005. Generally, complaints are submitted through a public number 

(1-800-MEDICARE) and are routed to regional staff for followup and 

resolution. However, complainants that suggest fraud are advised to 

call to the MEDIC, which receives calls through a toll-free hotline 

number (1-877-7SAFERX) that is dedicated to complaints about 

potential Part D fraud. The MEDIC is responsible for evaluating the 

merit of fraud complaints and conducts investigations to determine 

whether referrals to law enforcement agencies or State insurance 

commissions are appropriate. Shortly after the end of the fiscal year, 

the MEDIC had investigated 1,421 complaints and made 434 fraud 

referrals.20 Specifically, the MEDIC referred 38 cases to OIG, 80 cases 

to State insurance commissioners, and 4 cases to local or State law 

enforcement.21 Additionally, the MEDIC referred 312 cases for a 

particular type of fraud, known as the “$299 Ring” scam. The “$299 

Ring” scam involved a scheme whereby perpetrators called potential 

enrollees and requested bank account numbers to withdraw payment 

for enrollment into a nonexistent PDP. 

Data Monitoring—Neither CMS nor the MEDIC had conducted any significant 

data analysis for fraud detection purposes 

Data-driven fraud detection was mentioned in multiple press releases 

as a critical part of CMS’s fraud control strategy. However, those efforts 

have been slow to materialize. Electronic systems were put in place to 

ensure proper formatting and logical consistency in Part D claims data 

20 The MEDIC complaint descriptors reflect complaints received until October 30, 2006. 

21 A case referral may include numerous individual complaints. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 8 
FINDINGS 

and controls were put in place to ensure that the extra benefits for lowincome enrollees are designated appropriately. However, no significant 

data analysis had been conducted specifically to detect or prevent fraud 

and abuse. 

CMS staff reported that they did not expect to begin these efforts 

immediately and that efforts were further delayed by a lag in data 

submissions. The data lag occurred because it took time for the PDPs to 

submit claims data properly, a consequence of a complex and quickly 

designed system. Additionally, CMS experienced some data problems 

during the early phases of implementation. One example is that some 

beneficiaries appeared to be incorrectly enrolled in two PDPs 

simultaneously, allowing drug transactions to be billed to the incorrect 

PDP. This problem was eventually resolved, but the process of 

correcting those errors did not begin until August 2006. 

Another barrier to conducting data analysis was the lack of a 

centralized data repository. In September 2006, CMS contracted with 

Electronic Data Systems to be the One Program Integrity System 

Integrator (One PI). The One PI will warehouse Medicare data for 

prescription drugs, physician services, and inpatient care, among other 

data. This contract represents a significant step towards the use of 

data-driven fraud detection methods, but no actual data analysis is 

expected until the summer of 2007. When operational, this group will 

be responsible for using data analysis techniques to uncover fraud, 

waste, and abuse. It will also offer powerful data analysis tools and 

make data accessible to CMS program integrity staff and other 

appropriate parties via a Web-based portal. 

Financial Audits—CMS let a contract to develop the financial audit program 

just before the end of FY 2006, with an expectation that the first audits will 

begin in January 2008 

The final reconciliation between CMS and the PDP sponsors is scheduled 

to begin in September 2007, following the June 30, 2007, deadline for 

PDPs to submit rebate information. CMS staff do not plan to begin 

conducting financial audits until the reconciliation is complete, which 

means that the earliest financial audits will likely begin in January 2008. 

These first audits will be designed to verify financial data for plan year 

2006. 

CMS is required to conduct audits on one-third of Medicare Part D 

organizations, including PDPs, each year. However, the one-third audit 

requirement does not specify that CMS audit every plan within a 3-year 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 9 
FINDING 
 S 

period or any other timeframe. Therefore, it is conceivable that some 

plans would not be audited during the Part D program’s initial 3-year 

period. 

In addition, CMS staff expressed concern that funding limitations may 

constrain the depth and/or breadth of the audits. Although CMS took a 

significant step in preparation for the audits by hiring a contractor in 

September 2006 to develop the audit process and protocols, further and 

more costly steps are still needed. By September 2007, CMS expects to 

have a final audit process and protocol, including thresholds for audit 

findings and timelines for conducting audits, but still needs to hire and 

train additional contractors to conduct the audits. The number of staff 

required has not yet been determined but will likely be significant and 

costly. For the financial audits to proceed as planned, CMS will need to 

identify them as a high priority when making budget decisions. 

Monitoring PDP Sponsor Compliance—Efforts to monitor PDP sponsor 

compliance are in place, but compliance audits have been delayed 

Although routine account management activities and operational 

safeguards were in place prior to the first beneficiary enrollment period, 

compliance audits had not started as of the end of FY 2006. CMS staff 

have, however, undergone extensive preparations for conducting 

compliance audits. Audit protocols have been developed and many staff 

at CMS are reportedly trained and ready to begin the audit process. 

Compliance audits were scheduled to begin in the summer of 2006 but 

were delayed because the data system that enables CMS to schedule 

and track compliance audits encountered technical problems. Staff 

anticipated that the first audits would be conducted in early 2007. 

Oversight of PDP Efforts to Reduce Fraud and Abuse—CMS issued 

requirements for PDP sponsors’ fraud, waste, and abuse compliance plans 

As a part of their contracts, PDP sponsors must agree to implement fraud 

control programs.22 CMS issued guidelines to PDP sponsors before the 

benefit began and then updated guidance with the release of the initial 

chapter (issued as chapter 9) of its “Prescription Drug Benefit Manual” in 

April 2006. This chapter describes specific requirements for PDP 

sponsors’ fraud, waste, and abuse compliance plans which address 

primarily basic infrastructure.23 Specific fraud detection activities are 

22 42 CFR § 423.504(b)(vi)(H). 

23 Centers for Medicare & Medicaid Services, “Prescription Drug Benefit Manual,” 

chapter 9.
 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 10 
 

 

 

 

FINDINGS 

recommended but are not required. CMS expected that PDPs would 

incorporate CMS guidance into their compliance plans by January 2007. 

An OIG report, “Prescription Drug Plan Sponsors’ Compliance Plans,” 

found that although all PDP sponsors had a plan to detect, correct, and 

prevent fraud, waste, and abuse in place by January 1, 2006, few PDPs 

addressed all of CMS’s recommendations for specific fraud and abuse 

detection activities.24 

Education and Guidance—Many education efforts were under way, but the 

slow release of two key documents raises concern 

By the end of FY 2006, CMS and the MEDIC had conducted numerous 

training sessions for beneficiaries, PDP sponsors, and law enforcement 

entities. Other educational efforts included advisory opinions, direct 

mailings, training, and conferences. These efforts contribute to 

beneficiary protection, as well as information sharing between law 

enforcement groups working on Medicare Part D integrity issues. 

Despite these efforts, the delayed release of two critical documents 

raises concern. First, although CMS makes most of its Medicare Part D 

guidance materials available on the Internet, the agency has not yet 

completed the “Prescription Drug Benefit Manual.” As of the end of FY 

2006, five chapters had been released in final form, including the 

following: 2, “Part C and D Marketing Guidelines,” 3, “PDP Enrollment 

and Disenrollment Guidance,” 9, “Fraud Compliance Plans,” 

14, “Coordination of Benefits,” and 18, “Grievances, Coverage 

Determinations, and Appeals.” As a result, PDP sponsors are expected 

to cull the information about Medicare Part D requirements from a 

variety of letters and guidance documents. Second, CMS’s only 

Medicare Part D fraud alert issued during the first year of the program 

took several months to release. The alert regarded the “$299 Ring” 

scam. A consumer alert was released in June 2006, but the fraud alert, 

which is intended to be an early alert for law enforcement entities and 

PDP sponsors, had not been released by the end of the fiscal year.25 

CMS staff explained that the delay was due to CMS’s writing, editing, 

and clearance process, as well as its perception that the warning was 

most pertinent during periods of plan marketing and open enrollment, 

which occurred in November 2006. 

24 OEI-03-06-00100. 

25 The fraud alert was released in November 2006. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 11 
 

 

 

FINDINGS 

In FY 2006, CMS relied largely on complaints to 

identify potential fraud and abuse in the 

Medicare Part D program; however, not all 

complaints were investigated timely 

With aspects of CMS’s fraud protection 

program not in place at the time of our 

review, CMS relied largely on complaints 

to identify potential fraud schemes and 

abusive practices in the first fiscal year of 

Medicare Part D operation. CMS staff 

described complaints as an effective fraud and abuse protection tool, 

indicating that beneficiaries are frequently vocal about their 

experiences and often report suspected wrongdoing. Further, CMS staff 

suggested that some types of fraud are best identified by beneficiaries’ 

reporting directly on their experiences. 

Although complaints are a valuable source of information, we noted two 

weaknesses in the complaint process. First, the MEDIC was battling a 

sizeable number of open complaint cases deemed worthy of 

investigation, and second, Medicare Part D fraud complaints submitted 

to 1-800-MEDICARE are not tracked, allowing for the possibility of 

missing important information from valid fraud complaints. 

Shortly after the close of FY 2006, 24 percent of the 6,132 complaints 

received by the MEDIC were open, most of which required further 

investigation 

At the time of our data collection, a single MEDIC (Delmarva 

Foundation), contracted to focus on enrollment and eligibility fraud in 

the early months of Medicare Part D operation, was responsible for 

tracking and investigating all fraud complaints and referring cases of 

merit to law enforcement. The MEDIC conducted complaint intake and 

triage on 6,132 complaints received during FY 2006.26 The triage 

process is used to determine a priority level for further investigation 

and helps to ensure that the most serious fraud complaints are quickly 

identified.27 A few complaints are quickly referred to an enforcement 

agency without ever being investigated by the MEDIC, and many others 

are quickly closed or referred to the PDP because it is clear that fraud is 

not the issue. The remaining complaints are considered “open” until the 

case is referred to and accepted by law enforcement or closed as a result 

of insufficient evidence. 

26 The MEDIC complaint data reflect complaints received through October 30, 2006. 

27 The triage process involves evaluating each complaint on five criteria: patient abuse, 

geographic scope of impact, monetary impact, ability to prosecute, and pattern of fraud. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 12 
FINDINGS 

Shortly after the end of FY 2006, the MEDIC had 1,475 open complaints 

in various stages of investigation. These included complaints awaiting 

review, active investigations, and cases in the preliminary stages of 

referral to law enforcement agencies. Of these, almost half had been 

open for at least 150 days and a few had been open for 300 days or more. 

The significant number of open complaints appears to be the result of an 

insufficient number of investigative staff. The first MEDIC contract 

funded only primary activities, such as complaint intake and 

investigation, forcing the MEDIC to reduce its original plan for the 

range of efforts employed and resources dedicated to fighting fraud. 

Although the MEDIC maintained all complaint intake activities, only 

three full-time and three part-time investigative staff were assigned to 

conduct follow-up investigations. Staff at CMS and staff at Delmarva 

Foundation were optimistic that, with the addition of the three regional 

MEDICs beginning operations in December 2006, the number of open 

complaints would be dramatically reduced. 

Medicare Part D fraud and abuse complaints submitted to 1-800-MEDICARE 

are not logged or tracked 

Both 1-800-MEDICARE and 1-877-7SAFERX are publicized phone 

numbers, but 1-800-MEDICARE is designed as a resource to answer 

general questions and receive all types of Medicare complaints, 

including Medicare Part D fraud complaints. In contrast, 1-877-

7SAFERX is dedicated to complaints about Medicare Part D fraud. 

Although the customer service representatives at 1-800-MEDICARE 

enter most complaints into the Complaint Tracking Module of HPMS, 

Medicare Part D fraud complaints are not entered. When Medicare 

Part D fraud is suspected, the customer service representative advises 

the caller to call the MEDIC at 1-877-7SAFERX. CMS does not track 

how many people have been advised to call the MEDIC, nor does it 

conduct any followup to ensure that the complainant actually called the 

MEDIC. To the extent that callers are not following through with calls 

to 1-877-7SAFERX, valid complaints could be slipping through the 

cracks. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 13 
 

 

F I NDING S 

Limits to legal authority, jurisdiction, and CMS’s 

ability to monitor enrollees switching plans 

complicate CMS’s efforts to safeguard 

Medicare Part D PDPs 

Despite the operation of six types 

of safeguard activities, we 

identified three impediments to 

the effective oversight of Medicare 

Part D, specifically in the areas of 

financial auditing, Part D marketing, and utilization management. 

Although these impediments are not insurmountable, they do make 

CMS’s Medicare Part D oversight responsibility more difficult to fulfill. 

CMS has limited ability to verify that direct and indirect remuneration are 

accurately reported by PDP sponsors 

After the plan year has ended, PDPs must report to CMS all outstanding 

financial information, including direct and indirect remuneration. 

Remuneration received by PDP sponsors may reduce the PDP sponsor’s 

cost of providing Medicare Part D drugs. Such remuneration includes 

manufacturer or pharmaceutical benefit manager rebates, chargebacks, 

discounts, goods in kind, or grants. Remuneration is deducted from PDP 

losses (or added to PDP profits) for the year and may have a significant 

impact on the final payment reconciliation between CMS and PDP 

sponsors, because it directly affects the amount of money that CMS will 

reimburse or recoup from PDPs. Underreporting remuneration could 

result in significant losses to the Medicare Part D program. The onus is 

on PDPs to accurately and completely report this information. However, 

CMS’s ability to check the veracity of this self-reported data is limited to 

financial audits, and auditors will be faced with the difficult task of 

identifying any remuneration that is not reported by PDPs or their 

subcontractors. 

Additionally, CMS staff do not currently have the legal authority to go 

onto the premises of the pharmaceutical benefit managers to verify the 

flow of goods and money. Instead, CMS must rely on PDP sponsors to 

include sufficient requirements in their own contracts with subcontractors. 

Regulations require that a PDP sponsor “agrees to require all related 

entities, contractors, or subcontractors” to allow CMS access to documents 

and information for the purpose of audits.28 However, if the PDP sponsors 

fail to include sufficient access provisions in their contracts with 

subcontractors, the regulations afford CMS no direct regulatory authority 

to independently access information. 

28 42 CFR § 423.505(i)(2). 

O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 14 
 

 

 

FINDINGS 

CMS has limited authority over insurance brokers, one of the most 

frequent subjects of fraud complaints 

Brokers are paid a commission to enroll eligible beneficiaries into a 

plan. Brokers may represent any number of PDPs and receive different 

commissions based on which plan is selected by the beneficiary. 

Dishonest brokers may inappropriately steer potential enrollees to 

particular plans by providing false or limited information. Some of the 

most egregious complaints received to date involve brokers enrolling 

beneficiaries without their consent. Because brokers assist in boosting 

enrollment numbers, plans have few incentives to rein in dishonest 

brokers. CMS requires that plan subcontractors, including brokers, 

comply with all Medicare Part D regulations, but this proves difficult to 

enforce with respect to brokers for several reasons. First, if CMS learns 

that a broker is not in compliance with Part D marketing and 

enrollment requirements, it cannot take direct corrective action against 

the broker itself. Rather, CMS would have to take enforcement actions 

against the PDP sponsor who contracted with the broker. Second, 

because brokers are regulated by State insurance commissions, the 

MEDIC must refer alleged broker misconduct to the appropriate State 

insurance commission and rely on it to take corrective actions against 

the broker. Third, privacy restrictions contained in the Health 

Insurance Portability and Accountability Act of 1996 (HIPAA) 

necessitate that the MEDIC obtain consent from the enrollee before 

sharing case-specific information with the State insurance commission. 

With the cases that have been referred, the MEDIC experienced delays 

and sometimes difficulty getting such consent. 

Overutilization of drugs for the purpose of personal drug abuse or selling 

prescription drugs for profit poses a significant cost risk to Medicare 

Part D; however, plans are limited in their ability to monitor suspect 

enrollees 

Although the inappropriate costs per individual may be small, the 

suspected widespread nature of this type of fraud poses a significant 

risk to the program. The MEDIC staff is aware of approximately 60,000 

persons who were identified by State Medicaid programs because they 

demonstrated unusual drug utilization patterns prior to their transition 

to Medicare Part D. Some State Medicaid programs conducted routine 

data checks to identify potentially inappropriate utilization by 

individuals, known as “overutilizers,” and took steps to control their 

drug access through management structures, such as prior 

authorizations and pharmacy restrictions. Information about specific, 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 15 
FINDINGS 

known overutilization risks in State Medicaid programs was not 

transferred to PDPs when the Medicare Part D benefit began. Thus, 

PDPs must conduct their own analysis to identify these risks. PDPs 

face further difficulty in developing and maintaining knowledge about 

potential overutilizers because most beneficiaries are able to change 

plans every year and Medicare/Medicaid dually eligible beneficiaries are 

able to change plans every month. PDPs and the MEDIC have 

interpreted HIPAA privacy provisions as prohibiting communication 

about suspected overutilizers. As such, plans must develop a new 

utilization profile for an enrollee each time the enrollee changes plans. 

HIPAA provisions allow PDPs to communicate about beneficiaries 

suspected of inappropriate behavior, as long as each PDP currently has 

or previously had a relationship with the beneficiary in question. 

However, there is currently no mechanism by which PDPs can identify 

which other PDPs have or previously had a relationship with a 

beneficiary. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 16 
Δ RECOMMENDATIONS 

CMS is making progress towards fulfilling its plans for preventing and 

detecting fraud and abuse in PDPs; however, some activities were not 

fully implemented by the end of FY 2006. CMS staff report that some 

activities would have been premature or point to funding and data 

limitations as a rationale for delays. Although we recognize the short 

timelines and significant challenges that CMS faced in rapidly 

implementing the Medicare Part D program, the impact on beneficiaries 

as well as the large magnitude of outlays (i.e., $47 billion in 2006) call 

for commensurate safeguard activities. In an effort to continue 

improving CMS’s safeguard strategy, we recommend that CMS: 

Develop a comprehensive safeguard strategy for Medicare Part D PDPs with 

specific activities and target dates and ensure that all activities are 

progressing in a timely manner 

CMS had begun implementation activities in all safeguard areas, but 

CMS staff could not provide timelines for final implementation. CMS 

should develop a comprehensive written strategy document with specific 

activities and target dates and assign staff to follow up on progress. 

This document should serve as a management tool to coordinate 

different CMS groups that may have a role in safeguarding Medicare 

Part D PDPs and aid in identifying areas that may not be adequately 

protected by the safeguards that are in place. It should also be used as 

a prompt to notify appropriate senior staff if implementation activities 

fall behind schedule. Further, CMS should make Medicare Part D 

safeguard activities a sufficient priority in the budgeting process to 

support their timely and effective administration. Of foremost concern 

are commencement of the financial audits, sufficient MEDICs to 

investigate fraud complaints, and the pursuit of innovative data-driven 

techniques to identify potential fraud and abuse. 

Ensure that all fraud complaints receive proper attention 

As the number of MEDICs and staff assigned to investigate complaints 

increases, CMS should have a process in place to monitor the number of 

open complaints and take action if backlogs occur. Additionally, CMS 

should investigate options for customer service representatives to 

directly transfer fraud complaints received by 1-800-MEDICARE to the 

appropriate MEDIC. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 17 
 

RECOMMENDATIONS 

Address legal concerns that may impede program integrity efforts 

Three concerns in particular require attention: 

Require PDP sponsors to include standard wording regarding requirements for 

record retention and accessibility within subcontractor contracts. 

Verification that PDPs report all remuneration is intrinsically difficult. 

For this reason, it is critical for CMS to have full access to primary 

documentation about remuneration, including that maintained by a 

pharmaceutical benefit manager or other subcontractor. Further, CMS 

should not be limited in its ability to access critical information because 

only general or nonspecific requirements are included in subcontractor 

contracts. The standard wording should include provisions for (1) CMS 

accessing information directly from subcontractors; (2) timelines for 

both records maintenance and accessibility; (3) special circumstances, 

such as terminated contracts; and (4) penalties for noncompliance with 

records access provisions. Further, the inclusion of this language 

should be verified through either the financial audits or compliance 

audits. 

Enforce appropriate sanctions for PDPs whose brokers violate permissible 

marketing practices. 

The prevalence of complaints from FY 2006 indicates that improper 

broker marketing practices pose a significant risk for the Part D 

program. Although CMS may be unable to directly penalize brokers 

who are conducting illegal marketing practices, the PDPs have ultimate 

responsibility for their subcontractors.29 CMS guidance requires PDPs 

to monitor the performance of subcontractors, including marketing 

practices. CMS Part D regulations also require that PDP subcontractor 

contracts include a provision allowing CMS or the PDP to take 

corrective action if either CMS or the PDP determines that the 

subcontractor is not performing satisfactorily.30 CMS should be vigilant 

in its oversight of insurance brokers and ensure strong enforcement of 

Part D marketing standards. 

29 42 CFR § 423.505(i). 

30 42 CFR § 423.505(i)(4)(ii). 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 18 
R ECOMMENDATIONS 

Utilize the MEDICs as intermediaries for PDPs to share information about their 

beneficiaries suspected of inappropriate utilization. 

Currently, there is no way for information about extreme or unusual 

utilization by a particular beneficiary to be communicated between the 

beneficiary’s prior PDP to his or her next PDP. Allowing the MEDICs 

to act as repositories of information about beneficiaries suspected of 

fraud would improve PDPs’ ability to identify and monitor drug-seeking 

and drug-selling behavior. Further, early identification of these 

individuals would limit the effectiveness of a beneficiary switching 

plans to avoid targeted actions by the PDPs to prevent fraud. In 

implementing this activity, CMS should explore whether this 

recommendation can be addressed by revising MEDIC contracts. 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

In its comments to the draft report, CMS did not indicate whether it 

concurred with our recommendations, but did provide comments 

regarding each recommendation (see Appendix B). CMS responded that 

many of its ongoing activities already satisfy our recommendations. It 

further stated that the report does not fully explain the immense 

workload required for CMS to develop and administer the benefit in its 

first year and indicated that processes and procedures have improved 

over time. In its technical comments, CMS reported several advances in 

its safeguard strategy that occurred after the end of our data collection 

period (FY 2006). The advances CMS reported include: 

	 continued progress towards commencement of the financial 

audits. Audits are still scheduled to begin by the end of calendar 

year 2007; 

	 successful negotiations to allow MEDICs sufficient access to 

PDP data so that data-driven fraud detection activities can 

begin; 

	 improvement in processing complaints timely. Specifically, CMS 

reported that of 5,286 complaints received by the MEDICs 

between December 2006 and June 2007, only 2 are older than 30 

days; 

 commencement of routine PDP compliance audits in February 

2007; 

 issuance of a self-assessment tool to assist PDPs in improving 

their fraud, waste, and abuse compliance plans; and 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 19 
 

 

R ECOMMENDATIONS 

	 release of four new chapters of the Prescription Drug Benefit 

Manual. 

Comprehensive safeguard strategy 

Regarding our recommendation to develop a comprehensive safeguard 

strategy with specific activities and target dates, CMS stated that the 

MEDIC task orders and Umbrella Statement of Work (USOW) are 

CMS’s comprehensive safeguard strategy for the Part D program. 

Additionally, CMS responded that the broader strategy for fighting 

fraud, waste, and abuse is the three-pronged strategy. Although OIG 

agrees that the task orders and USOW provide an important framework 

for enacting many safeguard activities, these documents are specific to 

the MEDIC activities and do not address the broad coordination that is 

needed between different groups within CMS that each have a role to 

play in safeguarding Medicare Part D. With regard to CMS’s threepronged strategy, the documents we reviewed lacked the details, 

deliverables, and timelines that would extend its use from a broad 

strategic concept to a useful management tool. Therefore, we continue 

to recommend that CMS create a comprehensive safeguard strategy 

that includes specific activities across the range of its existing and 

planned program integrity efforts and tie these activities to target dates 

so that implementation progress can be monitored, strengths can be 

identified, and delays can be addressed. 

Fraud complaints 

Regarding our recommendation to ensure that all fraud complaints 

receive proper attention, CMS stated that ensuring all complaints are 

addressed promptly is a top priority. CMS also expressed concern that 

our draft report misrepresented the MEDIC’s activities in responding to 

complaints but acknowledged early difficulties with the volume of 

complaints. Further, CMS stated that the three MEDICs contracted for 

FY 2007 would be sufficient to fully investigate and resolve fraud 

complaints. 

Because of CMS’s concern that we misrepresented the MEDIC’s 

activities in responding to complaints, we made revisions to avoid 

characterizing open complaint cases as a “backlog” and to more fully 

describe the status of the open cases at the time of our data collection. 

However, the number of open cases and the time that some cases 

remained open suggest that the complaint process is susceptible to 

backlogs. Consequently, OIG continues to recommend that CMS devote 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 20 
 

 

R E C O MMENDA T I O N S 

sufficient resources to ensure that all fraud complaints receive proper 

attention, including implementing a system to monitor the complaint 

caseload for potential backlogs. 

CMS also stated that it will explore the feasibility of transferring Part D 

fraud calls from 1-800-MEDICARE directly to the MEDIC hotline and 

that, until a decision is made, 1-800-MEDICARE customer service 

representatives will remain responsible for making determinations as 

to whether calls should be sent to MEDICs. We clarify that the intent of 

this recommendation is to ensure that once a fraud complaint is 

identified, complainants should be directly connected to the MEDIC, 

rather than being advised to call the MEDIC hotline. We expect that 

customer service representatives will continue to be responsible for 

identifying which calls should be directly connected to the MEDIC. 

Address legal concerns 

Regarding our recommendation to pursue legal authority to obtain 

records directly from subcontractors and to explicitly require 

subcontractors to retain their documents, CMS stated that it currently 

has authority to obtain records from subcontractors and that 

requirements for record retention already exist. OIG interprets the 

existing authority as being dependent on the inclusion of sufficient 

contractual language by PDP sponsors within their subcontractor 

contracts. We modified this recommendation to more specifically 

address this underlying concern. 

Regarding our recommendation to enforce appropriate sanctions for 

PDPs whose brokers violate permissible marketing practices, CMS 

described its authority and a range of potential sanctions it is able to 

impose in the event of noncompliance with marketing guidelines. 

Regarding our recommendation to utilize the MEDICs as intermediaries 

for PDPs to share information with each other about suspected fraud, 

CMS stated that it will evaluate the possibility and potential 

implications of having the MEDICs serve as the intermediaries for PDP 

data. 

Request for final comments 

We ask that, in its final management decision, CMS indicate whether it 

concurs with our recommendations and what steps, if any, it will take to 

implement them. 

O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 21 
 

 

 

 

 

Δ APPENDIX A 

Medicare Part D Benefits and Operation 

Medicare Part D benefits are provided by private insurers, either in the 

form of a stand-alone PDP or as part of a comprehensive Medicare 

managed care plan, known as a MA-PD. PDP plans provide Medicare 

beneficiaries access to prescription drugs for low monthly premiums and 

copayments. The MA-PD plans include hospital and physician 

insurance, as well as the prescription drug benefits. For 2006, there 

were 1,429 PDPs and 1,314 MA-PDs. 

Medicare Part D plans provide coverage that is at least actuarially 

equivalent to a defined standard benefit. The defined standard benefit 

in 2006 provided coverage in four progressive phases: (1) a $250 

deductible; (2) beneficiary coinsurance of 25 percent of drug costs 

between $250 and $2,250; (3) coverage gap with the beneficiary 

responsible for all drug costs between $2,250 and $5,100; and 

(4) catastrophic coverage with a beneficiary coinsurance of 5 percent for 

all drug costs over $5,100. Most drug plans offered in 2006 opted for an 

alternative benefit structure, but the defined standard benefit still 

serves as the baseline. Although beneficiary-paid premiums and other 

cost sharing cover approximately 25 percent of the program’s expected 

cost, the remaining 75 percent is drawn from the Medicare Trust Fund. 

Medicare Part D Program Operations 

Managing the Medicare Part D program requires many coordinated 

activities. For each year, prospective sponsors must submit an 

application demonstrating that all qualifications will be met, including 

an acceptable formulary. CMS staff review the applications and 

formularies to determine an intent to comply with program 

requirements. Accepted applicants may then submit bids, which 

include the benefit designs and attestations that the benefit is 

actuarially equivalent to the defined standard benefit; the expected 

costs of the program; and any cost utilization controls that will be 

employed. Once the bid is deemed acceptable, a contract is let with the 

plan sponsor and the private organization agrees to abide by all 

Medicare Part D regulations. 

Plans may begin marketing activities the October prior to the beginning 

of the plan year. All marketing materials must either use standardized 

language that is on file with CMS or have CMS review the materials for 

accuracy and appropriateness. Open enrollment begins on 

November 15, which allows enrollees to select a plan or change their 

plan designations. Enrollees may evaluate plan options by their use of 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 22 
APPENDIX A 

premiums, deductibles, and copays; the drugs allowed through the 

formularies; restrictions that may be placed on drug utilization; and the 

benefit designs to determine which plan best accommodates their needs. 

Several resources are available to assist beneficiaries in making their 

selections, including the Web-based plan finder and 1-800-MEDICARE 

staff. Some enrollees with low income qualify for additional financial 

assistance to cover the costs of premiums, deductibles, and copays. 

Enrollees that are dually eligible for Medicare and Medicaid will be 

automatically assigned to plans if they do not select plans themselves. 

Once the plan year begins, enrollees are entitled to the prescription 

drug benefits offered by their selected plans. The plans record each 

pharmacy transaction and report summary information about the 

transaction to CMS. The information reported to CMS is called the 

Prescription Drug Event and is used for a year-end reconciliation. The 

plans, however, hold the primary responsibility for tracking each 

beneficiary’s total drug costs and out-of-pocket expenses. Beneficiary 

drug costs and out-of-pocket expenses (formally called true-out-ofpocket, or TrOOP) determine when the beneficiary enters particular 

phases of the benefit. Specifically, total drug costs determine when a 

beneficiary enters the coverage gap and TrOOP determines when the 

catastrophic benefit begins. 

CMS pays plans prospectively; however, certain payments are 

reconciled after the end of the plan year. CMS’s payments to plans 

include: (1) a risk-adjusted prospective payment for each beneficiary 

enrolled, each month; (2) a subsidy to account for the lower premiums, 

deductibles, and copayments offered to qualifying low-income enrollees; 

(3) reinsurance for a portion of drug costs incurred by plans during the 

catastrophic coverage phase; and (4) a payment adjustment (positive or 

negative) for a predetermined risk-sharing agreement. The 

reconciliation process does not begin until plans have fully disclosed 

their direct and indirect remuneration, e.g., rebates, due approximately 

6 months after the end of the plan year. Consequently, payments are 

not fully adjudicated until several months after the plan year, at a 

minimum. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 23 
 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 24 

Agency Comments 

Δ APPENDIX B 
 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 25 

APPENDIX B 
 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 26 

APPENDIX B 
 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 27 

APPENDIX B 
 

 

Δ ACKNOWLEDGMENTS 

This report was prepared under the direction of Kevin K. Golladay, 

Regional Inspector General for Evaluation and Inspections and 

A. Blaine Collins, Deputy Regional Inspector General for Evaluation 

and Inspections in the Dallas regional office. 

Amy Ashcraft served as the team leader for this study, and Tom 

Browning served as the lead analyst. Central office staff who 

contributed include Linda Abbott. 

 O E I - 0 6 - 0 6 - 0 0 2 8 0 S AFEGUARDS T O P REVENT AND DETECT F RAUD AND ABUSE I N MEDICARE P RESCRIPTION DRUG P LANS 28