Department of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

SURETY BONDS REMAIN AN 

UNDERUTILIZED TOOL TO 

PROTECT MEDICARE FROM 

SUPPLIER OVERPAYMENTS 

Daniel R. Levinson 

Inspector General 

March 2013 

OEI-03-11-00350 
 

 

EXECUTIVE SUMMARY: SURETY BONDS REMAIN AN UNDERUTILIZED 

TOOL TO PROTECT MEDICARE FROM SUPPLIER OVERPAYMENTS 

OEI-03-11-00350 

WHY WE DID THIS STUDY 

In 2009, the Centers for Medicare & Medicaid Services (CMS) began to require suppliers 

of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) to obtain a 

minimum of $50,000 in surety bond coverage per location. A surety bond is issued by an 

entity (the surety) guaranteeing that the surety will pay CMS the amount of any monetary 

obligations incurred during the term of the bond, and for which the supplier is 

responsible, up to the surety’s maximum obligation. Surety bonds can discourage 

enrollment of fraudulent suppliers and aid the recovery of debts owed to Medicare. We 

set out to determine the extent to which CMS maintains complete and accurate surety 

bond data and to determine the amount of supplier debt that could have been recovered 

through surety bonds. 

HOW WE DID THIS STUDY 

We requested from CMS information on all outstanding overpayments that were 

identified for collection between October 2, 2009, and April 1, 2011. We also requested 

information regarding suppliers’ surety bond coverage and requested CMS’s written 

procedures for recovering DMEPOS overpayments through surety bonds. 

WHAT WE FOUND 

Two years after the surety bond requirement was implemented, CMS did not have 

accurate surety bond information for all suppliers. Information for thousands of bonded 

suppliers was missing, and surety bond amounts were not consistently maintained by 

supplier location. Bonded suppliers have tens of millions in uncollected overpayments. 

As of July 2012, CMS reported it collected $263,000 from the millions in overpayments 

eligible for surety bond recovery. Most of these overpayments will likely remain 

uncollected because a number of suppliers had overpayments of more than $50,000, and 

CMS can recover only up to the amount of the surety bond. 

WHAT WE RECOMMEND 

We recommend that CMS: (1) improve oversight of supplier data to ensure accurate and 

consistent information, (2) immediately begin utilizing the surety bond requirement to 

recover outstanding overpayments from suppliers’ surety bonds, (3) consider using the 

legislative authority given by the Patient Protection and Affordable Care Act of 2010 to 

require increased surety bond amounts for suppliers that receive high overall Medicare 

payments, and (4) revise collection guidelines to state that collection of debts through 

surety bonds is based on dates of service. CMS concurred with all four recommendations. 
 

TABLE OF CONTENTS 

Objectives ....................................................................................................1 

Background..................................................................................................1 

Methodology................................................................................................7 

Findings......................................................................................................11
 

Two years after the surety bond requirement was implemented, 

CMS did not have complete or accurate surety bond information 

for all suppliers ..............................................................................11
 

CMS has yet to recover millions of dollars in supplier debt..........12 

Conclusion and Recommendations ............................................................15 

Agency Comments and Office of Inspector General Response .....18 

Appendix A: Agency Comments ..............................................................20 

Acknowledgments......................................................................................23 
 

 

 

 

OBJECTIVES 

To determine: 

1.	 the extent to which the Centers for Medicare & Medicaid Services 

(CMS) maintains complete and accurate surety bond information for 

suppliers of durable medical equipment, prosthetics, orthotics, and 

supplies (DMEPOS), and 

2.	 the number of DMEPOS suppliers with overpayment debt, the extent 

to which these suppliers had surety bond coverage, and the amount of 

overpayment debt that could have been recovered through surety 

bonds from October 2009 to April 2011. 

BACKGROUND 

Historically, Medicare Part B DMEPOS have been highly vulnerable to 

fraud and abuse. As early as 1997, the Office of Inspector General (OIG) 

reported that 1 of every 14 DMEPOS suppliers (suppliers) and 1 of every 

9 new applicants did not have a required physical address.1 Additionally, 

41 percent of suppliers failed to meet at least one supplier standard, such as 

those related to warranties, information for customers, and inventories. A 

2005 Government Accountability Office (GAO) report concluded that 

Medicare’s standards for screening suppliers for enrollment were insufficient 

to prevent illegitimate businesses from enrolling in Medicare.2 In 2007 and 

2008, OIG conducted unannounced site visits in South Florida and 

Los Angeles and found that some suppliers visited were not in compliance 

with basic supplier standards, providing further evidence of the insufficiency 

of supplier enrollment standards.3 

CMS has taken steps to improve the supplier enrollment process. For 

example, CMS has implemented new accreditation and supplier enrollment 

standards and now requires certain types of suppliers to obtain surety bonds.4 

A surety bond is a bond issued by an entity (the surety) guaranteeing that a 

supplier will fulfill an obligation or series of obligations to Medicare. If the 

obligation is not met, the surety covers losses up to the bond amount. 

1

 OIG, Medical Equipment Suppliers: Assuring Legitimacy, OEI-04-96-00240, 

December 1997. 

2

 GAO, More Effective Screening and Stronger Enrollment Standards Needed for 

Medical Equipment Suppliers, GAO-05-656, September 2005.
 3

 OIG, South Florida Suppliers’ Compliance with Medicare Standards: Results from 

Unannounced Visits, OEI-03-07-00150, March 2007; OIG, Los Angeles County 

Suppliers’ Compliance With Medicare Standards: Results From Unannounced Site Visits, 

OEI-09-07-00550, February 2008. 

4 42 CFR §§ 424.57(c)(22), 424.57(c)(24), and 424.57(c)(26). 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 1 
 

 

 

Specifically, the surety bond guarantees that the surety will pay CMS the 

amount (including accrued interest) of any overpayments, civil monetary 

penalties, or assessments incurred during the term of the bond and for which 

the supplier is responsible, up to the surety’s maximum obligation.5 

Surety Bonds for DMEPOS Suppliers 

Section 4312(a) of the Balanced Budget Act of 1997, P.L. 105-33, amended 

section 1834(a) of the Social Security Act to require as a condition of 

enrollment that DMEPOS suppliers maintain a surety bond of at least 

$50,000. CMS promulgated a final rule on January 2, 2009, requiring 

certain DMEPOS suppliers to “furnish CMS with a surety bond.”6 The final 

rule became effective on March 3, 2009. New suppliers were required to 

obtain a surety bond by May 4, 2009, while enrolled suppliers had until 

October 2, 2009, to obtain a surety bond.7 

According to the final rule, the purpose of the surety bond requirement is to 

(1) limit Medicare’s risk from fraudulent suppliers; (2) enhance the 

enrollment process to ensure that only legitimate suppliers are enrolled or 

remain enrolled; (3) ensure recovery of erroneous payments resulting from 

fraudulent billing practices; and (4) ensure that beneficiaries receive 

products and services that are reasonable and necessary from legitimate 

suppliers.8 

The final rule provides exemptions from the surety bond requirement for the 

following types of suppliers: 

	 government-operated suppliers (if the supplier has provided CMS with a 

comparable surety bond under State law); 

	 State-licensed orthotic and prosthetic personnel in private practice 

making custom-made orthotics and prosthetics (if the business is 

solely owned and operated by the orthotic and prosthetic personnel, and 

if the business is billing only for orthotics, prosthetics, and supplies); 

	 physicians and nonphysician practitioners (if the items are furnished only 

to the physician or nonphysician practitioner’s own patients as part of the 

service); and 

	 physical and occupational therapists in private practice (if the business is 

solely owned and operated by the physical or occupational therapist, 

items are furnished only to the therapist’s own patients as part of the 

5

 42 CFR § 424.57(d)(5). 

6

 74 Fed. Reg. 166–167 (Jan. 2, 2009). 

7

 42 CFR § 424.57(d)(1). 

8

 74 Fed. Reg. 166–167 (Jan. 2, 2009). 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 2 
 

 

 

 

 

 

 

 

 

 

service, and the business is billing only for orthotics, prosthetics, and 

supplies).9 

All nonexempt suppliers are required to obtain a surety bond from an 

authorized surety.10 CMS requires nonexempt suppliers to provide surety 

bond information and documentation upon enrollment. The supplier must 

submit a copy of the original surety bond with the enrollment application.11 

The surety bond must be in the amount of at least $50,000 for each assigned 

National Provider Identifier (NPI) for which the supplier is seeking to 

acquire Medicare billing privileges.12 A supplier with multiple practice 

locations must secure a surety bond for each location.13 A supplier has the 

option of obtaining a single surety bond that encompasses all of its practice 

locations.14 

Suppliers against which final adverse actions have been taken are considered 

to pose a higher than average risk to the program and must obtain an 

elevated surety bond, at a rate of an additional $50,000 for each final adverse 

action imposed against them.15 For example, if a supplier’s billing privileges 

had been revoked or suspended in the preceding 10 years, the supplier would 

need to secure an elevated surety bond in the amount of $100,000 (i.e., the 

base amount of $50,000 plus an additional $50,000 because of the final 

adverse action). 

Provisions in the Patient Protection and Affordable Care Act of 2010 also 

give the Secretary of Health and Human Services the authority to increase 

9

 42 CFR § 424.57(d)(15)(i). 

10 42 CFR § 424.57(d)(2). As defined at 42 CFR 424.57(a), the term “authorized surety” 

means a surety that has been issued a Certificate of Authority by the U.S. Department of 

the Treasury as an acceptable surety on Federal bonds and the certificate has neither
 

expired nor been revoked. 

11 42 CFR § 424.57(d)(2) and (d)(4); CMS, Medicare Program Integrity Manual, 

Pub. No. 100-08, ch. 10, § 21.7(A)(2). 

12 42 CFR § 424.57(d)(2). 

13CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 10, § 21.7(A)(3). 

Suppliers generally pay a fee of approximately $1,500 (or 3 percent of the value of a 

$50,000 bond) to obtain a bond. 

14 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 10, § 21.7(A)(3). 15 42 CFR §§ 424.57(a) and (d)(3); CMS, Medicare Program Integrity Manual, 

Pub. No. 100-08, ch. 10, § 21.7(A)(3). An adverse legal action includes a 

Medicare-imposed revocation of any Medicare billing number; revocation or suspension
 

of a license to provide health care by any State licensing authority; revocation for failure 

to meet quality standards; a conviction of a Federal or State felony offense within the last 

10 years preceding enrollment, revalidation, or re-enrollment; or an exclusion or
 

debarment from participation in a Federal or State health care program.
 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 3 
 

 

 

 

 

 

surety bond requirements for suppliers on the basis of the company’s billing 

volume.16 

CMS Contractors 

Two types of contractors have responsibilities with regard to suppliers: 

durable medical equipment Medicare administrative contractors (DME 

MAC) process DMEPOS claims, and the National Supplier Clearinghouse 

(NSC) oversees supplier enrollment. 

DME MACs. DME MACs are responsible for processing DMEPOS claims 

and determining whether those claims are complete and should be paid. In 

certain instances, improper payments are made to providers, suppliers, or 

beneficiaries, resulting in underpayments or overpayments. If a DME MAC 

makes a final determination of an overpayment, it must follow specific 

procedures when recovering, reporting, and referring overpayments.17 On a 

monthly basis, DME MACs must submit to CMS a detailed report of all 

outstanding overpayments and all actions occurring for any overpayment in 

the preceding month.18 

NSC. NSC is responsible for overseeing Medicare supplier enrollment. 

NSC processes all new supplier applications for billing numbers and ensures 

that enrolled suppliers meet established standards.19 Before granting billing 

privileges, NSC may conduct an unannounced site visit to determine 

whether a supplier meets all Medicare supplier standards. NSC is required 

to perform unannounced site visits for moderate- and high-risk suppliers, but 

may also conduct unannounced site visits to any supplier. If NSC finds after 

a site visit that a supplier no longer meets the supplier standards, NSC has 

the authority to revoke the supplier’s billing privileges.20 Suppliers’ billing 

privileges also may become inactive. This can happen for a number of 

reasons, such as voluntary inactivation or failure to submit claims for four 

consecutive quarters. 

Additionally, NSC issues letters to suppliers that require elevated surety 

bond amounts and revocation letters to suppliers that lack required surety 

bonds. NSC also provides CMS with data on the status of suppliers’ surety 

bonds and of their accreditation. 

16 The Patient Protection and Affordable Care Act, P.L. 111-148 § 6402(g) (amending 

Social Security Act, § 1834(a)(16)(B)). 

17 CMS, Durable Medical Equipment Medicare Administrative Contractor: Attachment
 

J-01—Statement of Work Procurement of DME MAC Jurisdictions A & B, §§ 5.4 and 5.5.
 18 Ibid, § 5.3, p. 55. 

19 CMS, National Supplier Clearinghouse Medicare Administrative Contractor Statement
 

of Work, §§ I.A., I.B., and II.1.14.
 20 42 CFR §§ 424.57(c)(8), 424.517, and 424.518; 76 Fed. Reg. 5862, 5866 (Feb. 2, 

2011). 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 4 
 

 

 

 

 

 

Prior to October 2010, NSC used the Provider Information Management 

System (PIMS) to store and maintain supplier information. However, in 

October 2010, NSC transferred supplier information from PIMS to the 

Provider Enrollment, Chain, and Ownership System (PECOS), so supplier 

information is now stored in PECOS. PECOS is the repository for all 

collected and verified health care provider enrollment information, including 

surety bond information, and provides a single national enrollment record 

for each provider or supplier. 

Overpayment Recovery Through Surety Bonds 

In January 2012, CMS finalized its procedures for recovering, through surety 

bonds, overpayments made to suppliers. These procedures became effective 

on February 21, 2012. According to these procedures, DME MACs can 

make a claim against a surety for the recovery of overpayments related to 

payments made on or after March 3, 2009.21 

Debt Collection Procedures. The procedures for collection on surety bonds 

incorporate the existing collection procedures for all providers in the 

Medicare Financial Management Manual. 

22 Under these procedures, once 

the DME MAC makes a final determination on an overpayment, a first 

demand letter is sent to the supplier (for overpayments of $10 or more). The 

first demand letter requests that the supplier refund the overpaid amount, 

informs the supplier how the DME MAC will recover the overpayment if 

repayment is not made, explains when interest will begin to accrue, and 

informs the supplier of the right to request a review or hearing. If the 

overpayment is not paid in full by the 30th day after the first demand letter is 

sent to the supplier, interest begins to accrue on the 31st day. 23 

Once 101 days have passed since the initial demand letter was sent and no 

payment or partial payment has been received, the DME MAC must attempt 

to recover the overpayment through the surety bond.24 The DME MAC 

notifies the surety by letter that the amount of the overpayment (plus any 

accrued interest) must be paid to CMS within 30 days. The DME MAC can 

seek repayment only up to the total sum of the surety bond (i.e., $50,000 for 

most suppliers).25 

If the surety does not pay the amount of the overpayment within 30 days, the 

overpayment becomes eligible for debt referral to the Department of the 

21 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.21.7.1. 22 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, 

§ 15.21.7.1(A)(2).
 23 CMS, Medicare Financial Management Manual, Pub. No. 100-06, ch. 4, § 90.2.
 24 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, 

§ 15.21.7.1(A)(2).
 25 Ibid. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 5 
 

 

 

 

 

 

 

Treasury.26 Once the overpayment debt has been referred and accepted, 

DME MACs terminate active collection efforts.27 

Related OIG Studies 

As stated previously, in 1997 OIG reported that 1 of every 14 suppliers and 1 

of every 9 new applicants did not have a required physical address.28 

Additionally, 41 percent of suppliers failed to meet at least one supplier 

standard, such as those related to warranties, information for customers, and 

inventories. The report noted that the ease and low expense of acquiring a 

supplier number facilitated the entry of abusers into Medicare. 

In 2006, OIG conducted unannounced site visits of 1,581 suppliers in three 

South Florida counties and found that 31 percent did not maintain physical 

facilities or were not open and staffed, contrary to Medicare requirements.29 

In a subsequent report, OIG found that nearly half of 491 South Florida 

suppliers whose billing privileges had been revoked appealed and received 

hearings and that hearing officers reinstated the billing privileges of 

91 percent of these suppliers.30 However, two-thirds of the suppliers whose 

billing privileges were reinstated had subsequently had these privileges 

revoked or inactivated, and some individuals connected to suppliers with 

reinstated billing privileges had been indicted. 

In 2007, OIG conducted unannounced site visits of suppliers in Los Angeles 

County and found that 13 percent of the 905 suppliers visited did not 

maintain a physical facility or were not open and that an additional 9 percent 

did not meet additional standards.31 

In a May 2010 report, OIG determined the collection status, as of 

June 2008, of overpayments—identified by program safeguard contractors— 

that had been made to South Florida suppliers and referred to claims 

processors for collection in 2007. OIG found that the collection rate of those 

overpayments was only 1 percent, compared to a national DMEPOS 

collection rate of 3 percent.32 Additionally, the report found that Medicare 

26 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, 

§ 15.21.7.1(A)(2). Debts ineligible for referral include those in bankruptcy status, in an 

appeal status, under a fraud and abuse investigation, or for which the debtor is deceased. 27 CMS, Medicare Financial Management Manual, Pub. No. 100-06, ch. 4, § 80.2. 28 OIG, Medical Equipment Suppliers: Assuring Legitimacy, OEI-04-96-00240,
 

December 1997. 

29 OIG, South Florida Suppliers’ Compliance with Medicare Standards: Results From
 

Unannounced Visits, OEI-03-07-00150, March 2007. 30 OIG, South Florida Durable Medical Equipment Suppliers: Results of Appeals, 

OEI-03-07-00540, October 2008. 

31 OIG, Los Angeles County Suppliers’ Compliance with Medicare Standards: Results 

From Unannounced Site Visits, OEI-09-07-00550, February 2008.
 32 OIG, Collection Rate for Overpayments Made to Medicare Suppliers in South Florida, 

OEI-03-09-00570, May 2010. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 6 
 

 

could have recovered an additional $15 million, or 6 percent, of 

South Florida DMEPOS overpayment dollars if the surety bond requirement 

had been in place at the time of the study. 

In September 2011, OIG issued an early alert memorandum report detailing 

the early findings of the current study.33 OIG found that CMS had not 

finalized procedures for recovering DMEPOS overpayments through surety 

bonds.34 In addition, as of July 2011, no overpayments had been recovered 

through surety bonds since October 2, 2009, the date the surety bond 

requirement became effective for all suppliers. 

METHODOLOGY 

Scope 

Our study focused on nonexempt suppliers with overpayments identified 

between October 2, 2009—the date that all nonexempt suppliers were 

required to have a surety bond—and April 1, 2011. These overpayments 

were still outstanding as of August 31, 2011. 

Data Collection 

In August 2011, we requested from CMS information on overpayments 

made to all bonded suppliers. Specifically, we requested information on 

currently outstanding overpayments made to bonded suppliers that were 

identified for collection between October 2, 2009, and April 1, 2011 (i.e., an 

initial demand letter had been sent to the supplier during that timeframe). 

We defined an outstanding overpayment as the total supplier-owed principal 

amount of all overpayments not under appeal, minus any adjustments, 

reductions, or partial payments, for which the supplier was not in active 

repayment status. We requested the total outstanding overpayment amount, 

plus accrued interest, for each bonded supplier and supplier location. We 

requested each supplier’s billing status as of August 31, 2011. 

In addition to the total overpayment amounts for each bonded supplier, we 

requested the amount of surety bond coverage for each separate supplier 

location. 

In response to our data request, CMS stated that it would be difficult to 

provide the surety bond information for the specific suppliers with 

outstanding overpayments because overpayment data and surety bond data 

are maintained in different database systems. Instead, CMS provided 

overpayment data from its DME MACs for all suppliers (both exempt and 

33 OIG, Use of Surety Bonds to Recover Overpayments Made to Suppliers of Durable 

Medical Equipment, Prosthetics, Orthotics, and Supplies: Early Findings, 

OEI-03-11-00351, September 2011. 

34 CMS subsequently finalized these procedures in January 2012. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 7 
 

 

 

 

 

 

 

 

 

 

nonexempt) with outstanding overpayments identified between October 2, 

2009, and April 1, 2011. CMS provided us with this information at the end 

of September 2011. 

Separately, CMS provided surety bond information for all suppliers who 

were bonded between October 2, 2009, and April 1, 2011. However, OIG 

identified problems with these data, which caused CMS to have multiple 

delays in providing updated data to OIG. The final data related to suppliers’ 

surety bonds was not received until July 2012. 

Data Analysis 

Overpayment Data. DME MACs provided to OIG information for a total of 

3,111 suppliers with outstanding overpayments. Because suppliers can bill 

multiple DME MACs (depending on the beneficiary address), some 

suppliers appeared in more than one DME MAC’s overpayment information. 

We combined all overpayments for these suppliers to determine the 

overpayment amount for each unique supplier NPI. To do this, we verified 

that each supplier’s NPI, name, address, and billing status were consistent 

across contractors. We determined that a total of 2,927 unique suppliers had 

outstanding overpayments identified between October 2, 2009, and April 1, 

2011. 

From the overpayment data set, we excluded suppliers that had an 

overpayment amount of less than $10.35 We also excluded suppliers with 

billing privileges that were inactive or revoked before October 2, 2009, 

because they would not be subject to the surety bond requirement. 

Additionally, we excluded suppliers that CMS reported as exempt or that we 

determined were likely to be exempt from the surety bond requirement. To 

determine which suppliers were likely to be exempt, we used the primary 

specialty code provided by CMS for each nonbonded supplier.36 The total 

number of suppliers with outstanding overpayments meeting our inclusion 

criteria was 1,429. 

35 DME MACs do not send a demand letter unless the overpayment is $10 or more 

(CMS, Medicare Financial Management Manual, Pub. No. 100-06, ch. 4, § 90.2); 

however, there were a number of identified overpayments in the data set provided by 

CMS that were under $10. 

36 We considered suppliers with any of the following primary specialty codes to be 

exempt from the surety bond requirement: physician, physical therapist, medical supply 

company with orthotic personnel, medical supply company with prosthetic personnel, 

prosthetic personnel, orthotic personnel, and optician. Suppliers we considered 

nonexempt included those with the following primary specialty codes: medical supply 

company, medical supply company with respiratory therapist, home health agency, 

nursing facility, and pharmacy. We excluded two additional suppliers that did not have 

specialty codes and had inactive billing privileges but did not have status dates (i.e., we 

could not determine when they became inactive). 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 8 
 

 

 

Surety Bond Data. In October 2011, CMS provided information for 

54,695 suppliers that had surety bonds between October 2, 2009, and 

April 1, 2011. Because we found discrepancies and inconsistencies within 

this information, we asked CMS to verify it. In December 2011, CMS 

resubmitted to OIG surety bond information for 82,458 suppliers that had 

surety bonds between October 2, 2009, and April 1, 2011. From this data 

set, we combined suppliers with matching NPIs, resulting in a total of 

77,898 suppliers. 

Merged Overpayment and Surety Bond Data. To determine how many of the 

1,429 suppliers with outstanding overpayments also had surety bonds, we 

matched these suppliers’ NPIs with those of the 77,898 suppliers with surety 

bonds.37 We determined that 1,117 suppliers had surety bonds. 

For each of the 1,117 suppliers, we calculated the total amount of 

outstanding debt (overpayment principal plus accrued interest) and the 

amount that could have been recovered from surety bonds. From our 

review of the surety bond data for all 77,898 bonded suppliers, we 

determined that the surety bond information was not always reported by 

practice location. Because we could not determine whether records 

showing surety bond amounts greater than $50,000 reflected elevated 

bonds (for high-risk suppliers) or were data errors, we calculated possible 

recovery amounts for each supplier based on a bond amount of $50,000, 

resulting in a conservative estimate. For the suppliers that owed less than 

$50,000, we used the amount owed as the amount that CMS could have 

recovered. For suppliers that owed $50,000 or more, we used $50,000 as 

the amount CMS could have recovered. 

We also calculated the total amount of debts for the remaining 

312 suppliers that lacked surety bonds. 

Limitations 

The DME MACs provided suppliers’ aggregated overpayment amounts 

identified between October 2, 2009, and April 1, 2011. We did not 

validate any of the overpayment data provided by the DME MACs. 

Because we do not have information on the dates of individual 

overpayments, it is possible that some individual overpayments may have 

been from dates of service prior to surety bond coverage, which would 

make them ineligible for collection through surety bonds. 

37 For suppliers missing an NPI in the overpayment data set, we used the supplier name 

and address to determine whether a match existed in the surety bond data set. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 9 
 

Standards 

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 10 
 

FINDINGS 

Two years after the surety bond requirement was 

implemented, CMS did not have complete or accurate 

surety bond information for all suppliers 

Although surety bond coverage has been one of the requirements of supplier 

enrollment since March 2009, CMS lacked complete or accurate surety 

bond information for all suppliers as of October 2011. Information for 

thousands of bonded suppliers was missing, and surety bond amounts were 

not consistently maintained in PECOS by supplier location. 

Surety bond data for over 27,000 suppliers were missing from 

CMS’s provider data system 

In October 2011, CMS provided OIG with surety bond information for 

54,695 suppliers, which was extracted from PECOS, the current provider 

data system. However, a comparison of these suppliers to the 

CMS-provided list of suppliers with overpayments resulted in very few 

matches. In November 2011, at our request, CMS reviewed the data and 

discovered that information for a large number of suppliers was missing 

from PECOS. CMS determined that errors had occurred during the 

October 2010 transition of supplier data from the previous data system— 

PIMS—to the current data system, PECOS. As a result, data for 

27,763 suppliers had not been transferred from PIMS to PECOS and were 

thus missing from the initial data received. After discovering this error— 

2 years after suppliers were required to have bonds—CMS provided OIG 

with an updated surety bond data set in December 2011 containing 

82,458 suppliers. 

CMS did not consistently maintain surety bond amounts by 

supplier practice location in PECOS, making it difficult to 

determine whether suppliers complied with the surety bond 

requirement 

Suppliers are allowed to obtain one bond to cover multiple practice 

locations, but each location must have at least $50,000 in coverage. 

Therefore, a supplier with 10 locations can obtain a single bond in the 

amount of $500,000 (i.e., $50,000 in coverage for each location). 

According to the surety bond data that CMS provided, 35 percent of the 

77,898 supplier locations had surety bond coverage greatly exceeding 

$50,000 (i.e., bonds over $500,000 per location). Some of these appeared to 

be cases in which multiple supplier locations were covered under one large 

bond, but only the overall bond amount—not the location coverage 

amount—was reported for each location. For example, one supplier had six 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 11 
 

 

 

locations, with a surety bond amount reported as $300,000 for each location. 

Because $300,000 divided by the six locations equals $50,000 in coverage 

per location, it is likely that this supplier had one $300,000 bond that 

covered all six locations for $50,000 each. 

In other cases, the surety bond coverage for specific locations could not be 

determined. For example, CMS reported that one supplier had 12 locations, 

each with surety bond coverage reported as $20 million. Even if this were 

the overall coverage amount, the coverage amount per location would have 

been approximately $1.7 million. 

Although suppliers are required to have a higher bond amount if they meet 

the criteria for having any adverse legal actions imposed against them, CMS 

staff stated that few suppliers meet this criteria. Therefore, it is likely that 

bond amounts that greatly exceed $50,000 per supplier location were not 

accurately listed in CMS’s database. 

CMS can recover debts only up to the amount of the surety bond coverage 

for a particular supplier location. Given the inconsistencies mentioned, it 

would be difficult for CMS to determine from the PECOS data whether a 

supplier with multiple locations covered under one bond was required to 

have elevated bonds for any of its locations. According to CMS, if a 

supplier with multiple locations is required to obtain elevated bond coverage 

for one location but not the others, a manual search of enrollment records 

would have to be performed to determine which location has the elevated 

bond coverage. 

CMS has yet to recover millions of dollars in supplier 

debt 

We calculated the total debts owed by suppliers using the date that 

overpayments were identified. From the data provided by CMS, we found 

1,429 suppliers with outstanding overpayments identified between 

October 2, 2009, and April 1, 2011. As shown in Table 1, these 

1,429 suppliers owed $70 million to Medicare as of August 31, 2011. We 

calculated that $50 million of this debt is owed by 1,117 suppliers that had 

surety bonds. In addition, we calculated that another $20 million is owed by 

312 suppliers without bonds. 

CMS did not finalize its guidelines to contractors for the collection of debts 

through surety bonds until January 2012, more than 2 years after the surety 

bond requirement was implemented. CMS staff stated that significant 

personnel changes delayed the finalization of these guidelines. These 

guidelines specify that recovery through surety bonds applies only to 

overpayments with payment dates made on or after March 3, 2009. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 12 
 

 

Table 1: Medicare Debts Owed by Suppliers as of August 31, 2011 

Surety Bond Coverage Number of 

Suppliers 

Percentage of 

Suppliers 

With Debts 

Total Medicare Debt 

Bonded Suppliers 1,117 78.2% $50,090,879 

Suppliers Without Surety Bonds 

Suppliers With Billing 

Privileges Revoked or 

Inactivated Between 10/3/09 

 and 12/31/09

 Suppliers With Billing 

Privileges Revoked or 

Inactivated After 12/31/09

 Nonexempt Suppliers 

Without Surety Bonds 

312 

289 

22 

1 

21.8% $20,395,517

 Total 1,429 100% $70,486,396 

Source: OIG analysis of overpayment and surety bond data 

In its comments on the draft report, CMS recalculated the debt owed by 

bonded suppliers using data that included only overpayments with dates of 

service on or after March 3, 2009. Using dates of service to determine 

eligible overpayments, CMS found that 1,190 bonded suppliers had a total 

Medicare debt of $32 million—a difference of $18 million from our 

calculation. The use of dates of service to calculate the debt is not 

consistent with CMS’s January 2012 guidelines that apply only to 

overpayments with payment dates of March 3, 2009 or after. Because a 

payment can be made months after the date of service, calculations based on 

dates of service versus dates of payment may differ. Although CMS’s 

calculations show that $18 million of the total debt calculated by OIG may 

not be eligible for recovery through surety bonds, this amount would remain 

an outstanding debt to Medicare. 

Millions of dollars continue to be owed by suppliers. In its comments on 

the draft report, CMS reported that as of July 2012, it has recovered 

$263,000 of the millions in overpayments that it determined were eligible 

for recovery from surety companies. 

With a surety bond amount of $50,000, CMS cannot recover all of the 

overpayments owed by bonded suppliers. Based on our analysis, each of 

the 1,117 bonded suppliers had at least $50,000 in coverage. Because CMS 

is able to recover only up to the amount of the surety bond, most 

($42 million) of the $50 million owed by bonded suppliers will likely 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 13 
 

 

 

 

remain uncollected. Ninety-eight suppliers in our analysis had 

overpayments of more than $50,000; 80 percent of these suppliers owed 

more than $100,000, and 27 percent owed more than $500,000. One 

supplier had a total debt of $5 million. For these suppliers, a surety bond of 

$50,000 would recover only a very small percentage of their debt.38 

Over $20 million in debt is owed by suppliers without surety bonds; the 

majority of these suppliers had their billing privileges revoked or inactivated 

within 3 months after the surety bond requirement date. Of the 

1,429 suppliers with debts, 312 suppliers did not have surety bonds. As 

shown in Table 1, these nonbonded suppliers owed $20 million. Most of 

these suppliers (289) had their billing privileges revoked or inactivated 

between October 3, 2009, and December 31, 2009. CMS reported that it 

did not immediately revoke the billing privileges of suppliers that did not 

have a surety bond by the October 2, 2009, deadline because it needed 

several weeks to confirm whether suppliers had bonds. Because these 

312 suppliers did not obtain surety bonds and are no longer actively billing, 

it is unlikely that their debts will be recovered. 

38 As discussed in the methodology, the overpayments owed by suppliers were identified 

between October 2, 2009, and April 1, 2011. It is possible that some overpayments 

identified may not have been for dates of service covered during the term of the bond 

and, therefore, would not be eligible for collection through the bond. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 14 
 

 

CONCLUSION AND RECOMMENDATIONS 

Fraud and abuse among DMEPOS suppliers is not a recent challenge for 

Medicare; the problem of suppliers enrolling in Medicare and billing 

millions of dollars in fraudulent claims has been well documented for 

years. Although CMS has made changes to strengthen the enrollment 

process, including implementing the surety bond requirement, millions of 

dollars continue to be at risk. 

Section 4312(a) of the Balanced Budget Act of 1997 requires certain 

suppliers to obtain a surety bond as a condition of Medicare enrollment. 

The surety bond requirement is a program integrity tool that is intended to 

safeguard the enrollment process by discouraging fraudulent providers 

from enrolling and by providing an additional method to recover debts. 

However, multiple inaccuracies and inconsistencies within CMS’s surety 

bond data raise concerns regarding CMS’s ability to promptly and 

effectively recover debts from surety bonds. Specifically, surety bond 

amounts for some supplier locations could not be determined because 

overall bond amounts were reported instead of per-location amounts. 

Because CMS can recover debts only up to the bond amount, CMS would 

have difficulty determining the maximum amount that could be recovered 

from bonds without knowing the coverage amounts for specific supplier 

locations. 

The findings in this report also raise concerns about the accuracy of surety 

bond information in CMS’s PECOS database. A significant number of 

suppliers were originally missing from PECOS, an error CMS discovered 

during data collection for this report 2 years after the surety bond 

requirement was implemented. 

Between October 2, 2009, and April 1, 2011, CMS’s contractors identified 

millions in overpayments paid to bonded suppliers. However, as of 

August 2011, CMS had yet to utilize the surety bond requirement to 

recover these overpayments. Furthermore, a number of suppliers had 

overpayments much greater than the $50,000 minimum amount for a 

surety bond; therefore, only a small percentage of these suppliers’ 

overpayments could be recovered under current surety bond requirements. 

As of July 2012, CMS reported that they had collected from supplier 

surety bonds only $263,000 of the millions identified for surety bond 

recovery. While the OIG and CMS total debt calculations differ, it is clear 

that tens of millions of dollars in debt remain uncollected from suppliers. 

By utilizing surety bonds as a program integrity tool, CMS has the 

potential to recover millions of dollars in overpayments from suppliers. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 15 
 

 

To ensure that it is maximizing the effectiveness of this program integrity 

tool, we recommend that CMS: 

Improve Oversight of Supplier Data to Ensure Accurate and 

Consistent Information 

To efficiently recover debts through surety bonds, CMS needs to ensure 

(on an ongoing basis) that supplier information maintained in PECOS is 

accurate, consistent, and accessible. CMS should add new data fields and 

expand the data functions within PECOS specifically for supplier 

information. Edits (i.e., data system processes to ensure proper payment 

of claims) should be established for certain fields to prevent clerical errors. 

For example, surety bonds in the amounts of $5,000 or $500,000,000 for a 

single location should be flagged as potential typographical errors for the 

typical surety bond amount of $50,000. CMS should also create data 

fields so that both per-location and overall surety bond amounts are 

available. This will increase efficiency by allowing CMS to quickly 

obtain the surety bond amount per location, eliminating the need for 

manual searches, and providing an additional accuracy check. 

Additionally, because of the systemic issues and data errors revealed 

throughout our study, CMS should review all surety bond data in PECOS 

to identify other discrepancies or errors resulting from the transition from 

PIMS to PECOS. 

Immediately Begin Utilizing Surety Bonds to Recover Debts 

From Bonded Suppliers 

More than 2 years have passed since the surety bond requirement was 

implemented, yet CMS has not comprehensively used this valuable 

program integrity tool to recover the millions of dollars owed by suppliers. 

CMS should immediately begin making claims against sureties for all 

bonded suppliers with outstanding debts. 

Consider Using the Legislative Authority Given by the Patient 

Protection and Affordable Care Act of 2010 To Require 

Increased Surety Bonds Based on Suppliers’ Billing Volume 

With a surety bond amount of $50,000, $42 million of the $50 million in 

total debt owed by bonded suppliers may remain uncollected because a 

number of suppliers had outstanding overpayments much greater than 

$50,000. Provisions in the Patient Protection and Affordable Care Act 

give the Secretary of Health and Human Services the authority to increase 

surety bond amounts for suppliers based on the billing volume of the 

company. To provide CMS with the ability to recoup a higher percentage 

of overpayments made to suppliers, CMS should consider increasing 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 16 
 

surety bond amounts above $50,000 for suppliers with high overall 

Medicare payments. 

Revise Collection Guidelines to State That Collection of Debts 

Through Surety Bonds is Based on Dates of Service 

The collection guidelines, which were finalized in January 2012, state that 

a surety is liable for overpayments related to payments made on or after 

March 3, 2009. However, in calculating the total debt owed by bonded 

suppliers in response to the OIG draft report, CMS used overpayments 

related to claims with dates of service—not payment dates—after 

March 2009. Therefore, we recommend that CMS revise the collection 

guidelines to state that a surety is liable for overpayments related to 

payments made for claims with dates of service on or after March 3, 2009. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 17 
 

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with all four of the report recommendations but disagreed 

with OIG’s conclusions. 

Regarding the first recommendation, CMS agreed that there are 

opportunities for improvement in how surety bond information is captured 

within PECOS. CMS stated that it will be implementing enhancements to 

PECOS in 2013 to increase accuracy and tracking of surety bond 

information. 

CMS concurred with our second recommendation and has begun 

collecting overpayments from bonded suppliers. As of July 2012, CMS 

collected approximately $263,000 from supplier surety bonds. CMS 

stated that the DME MACs are continuing to make requests for payments 

from sureties; therefore, it expects more overpayments to be collected as a 

result. 

CMS concurred with our third recommendation. CMS is considering 

issues and options related to a requirement that the DMEPOS surety bond 

be commensurate with the volume of a supplier’s billing. CMS also is 

considering the possibility of requiring home health agencies and certain 

other provider and supplier types to obtain and maintain surety bonds as a 

condition of enrollment. 

CMS concurred with our fourth recommendation and will revise the 

guidelines so they state that surety bond collection is based on the date the 

service was provided. 

In its comments to this report, CMS disagreed with OIG’s conclusion that 

bonded suppliers had overpayments of $50 million. CMS stated that it reanalyzed the data and calculated an overpayment amount of $32 million, 

not the $50 million calculated by OIG—a difference of $18 million. CMS 

calculated overpayments using the same criteria as OIG, with the 

exception of excluding overpayments based on claims with dates of 

service prior to March 2009. 

Because the data provided by CMS did not include payment or service 

dates for individual overpayments, OIG agrees that it is possible that some 

of the overpayments identified by OIG may relate to claims with dates of 

service prior to March 2009, making them ineligible for collection through 

surety bonds. OIG stated this methodological limitation in the draft report 

to CMS. Additionally, when OIG began data collection, CMS had yet to 

finalize its guidelines for surety bond collection. While OIG recognizes 

that $18 million may not be recovered through surety bonds based on 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 18 
 

CMS’s guidelines for surety bond collection that were finalized in January 

2012, the $18 million would remain an outstanding debt to Medicare. 

As a result of this study, OIG identified significant problems with surety 

bond data of which CMS had been unaware. CMS also was not prepared 

to collect overpayments using surety bonds until 3 years after the surety 

bond requirement was implemented and has collected a limited amount of 

overpayments from surety bonds to date. Finally, most of the 

overpayments for bonded suppliers will likely remain uncollected because 

a number of the suppliers have overpayments of more than $50,000, and 

CMS can recover only up to the amount of the bond. CMS stated that it 

understands the importance of surety bonds as a program integrity tool and 

is exploring multiple avenues to strengthen this important tool. 

The full text of CMS’s comments is provided in Appendix A. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 19 
APPENDIX A 

Agency Comments 

~§(1; \' (' l4 DEPAKIMENT OF HEAL1H & HUMAN SERVICES Centers for Medicare & Medicaid SeNices 

Administrator 

Washington , DC 20201 

DATE: MAR 0 4 2013 

TO: 	 Daniel R. Levinson 


Inspector General 


FROM: 	 M'ttiilyl'l Tavenner 


Actiilg Admipistrator 


SUBJECT: 	 Office oMuspector General (OIG) Draft Report: "Surety Bonds Remain an 

Underutilized Tool to Protect Medicare from Supplier Overpayments" 

(OEI-03-11-00350) 

The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 

comment on the OIG draft report entitled, "Surety Bonds Remain an Underutilized Tool to 

Protect Medicare from Supplier Overpayments." The objectives ofthe draft report were to 

determine: 1) the extent to which CMS maintains complete and accurate surety bond 

information for suppliers of durable medical equipment, prosthetics, orthotics, and supplies 

(DMEPOS), and 2) identify the number of DMEPOS suppliers with overpayment debt, the 

extent to which these suppliers had surety bond coverage, and the amount of overpayment debt 

that could have been recovered through surety bonds since October 2009. 

Since January 2012, when CMS finalized its contractor guidelines for collection of outstanding 

obligations from DMEPOS suppliers with surety bonds, CMS has been working to recover 

overpayment debts from DMEPOS suppliers by asserting claims against the surety companies. 

As of July 2012, CMS has successfully collected $263,000 from surety companies for DMEPOS 

supplier debts. In addition, there have been cases where DMEPOS suppliers have repaid 

overpayments on their own initiative once they become aware CMS referred their debt to the 

surety company for collection. CMS believes its efforts to collect outstanding obligations from 

surety companies will continue to spur DMEPOS suppliers to satisfy their Medicare debts. 

As noted in our technical comments to OIG, we disagreed with OIG's conclusions drawn from 

the data set utilized in its initial analysis. This is because in its initial request for overpayment 

data for this report, OIG asked for "information for all DMEPOS supplier overpayments 

identified between OctoQ.er 2. 2009. and A pril I . 2011, that currently are outstanding." 

Overpayments identified between October 2, 2009, and April l, 2011, which resulted from 

payments made prior to March 3, 2009, would not have been subject to collection from the 

surety . 

When CMS received the preliminary draft report, we obtained data from all four DME Medicare 

Administrative Contractors (MACs) and attempted to replicate the original OIG report excluding 

all overpayments based upon claims with a date of service prior to March 3, 2009. Our analysis 

indicated I, 190 bonded suppliers had a total Medicare debt (overpayment) of $31,829,604. The 

OIG has appropriately incorporated those comments into the report. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11 -00350) 20 
 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 21 
 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 22 
 

ACKNOWLEDGMENTS 

This report was prepared under the direction of Robert A. Vito, Regional 

Inspector General for Evaluation and Inspections in the Philadelphia 

regional office, and Linda M. Ragone, Deputy Regional Inspector General. 

Maria Schepise Johnson served as the team leader for this study, and 

Courtney Hilts assisted in conducting the study. Central office staff who 

provided support include Scott Manley and Christine Moritz. 

DMEPOS Surety Bonds Remain an Underutilized Tool (OEI-03-11-00350) 23 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Office of Inspector General
 

http://oig.hhs.gov 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as amended, is 

to protect the integrity of the Department of Health and Human Services (HHS) programs, as well as the 

health and welfare of beneficiaries served by those programs. This statutory mission is carried out through 

a nationwide network of audits, investigations, and inspections conducted by the following operating 

components: 

Office of Audit Services 

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting audits with 

its own audit resources or by overseeing audit work done by others. Audits examine the performance of 

HHS programs and/or its grantees and contractors in carrying out their respective responsibilities and are 

intended to provide independent assessments of HHS programs and operations. These assessments help 

reduce waste, abuse, and mismanagement and promote economy and efficiency throughout HHS. 

Office of Evaluation and Inspections 

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide HHS, Congress, 

and the public with timely, useful, and reliable information on significant issues. These evaluations focus 

on preventing fraud, waste, or abuse and promoting economy, efficiency, and effectiveness of 

departmental programs. To promote impact, OEI reports also present practical recommendations for 

improving program operations. 

Office of Investigations 

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations of fraud and 

misconduct related to HHS programs, operations, and beneficiaries. With investigators working in all 

50 States and the District of Columbia, OI utilizes its resources by actively coordinating with the 

Department of Justice and other Federal, State, and local law enforcement authorities. The investigative 

efforts of OI often lead to criminal convictions, administrative sanctions, and/or civil monetary penalties. 

Office of Counsel to the Inspector General 

The Office of Counsel to the Inspector General (OCIG) provides general legal services to OIG, rendering 

advice and opinions on HHS programs and operations and providing all legal support for OIG’s internal 

operations. OCIG represents OIG in all civil and administrative fraud and abuse cases involving HHS 

programs, including False Claims Act, program exclusion, and civil monetary penalty cases. In 

connection with these cases, OCIG also negotiates and monitors corporate integrity agreements. OCIG 

renders advisory opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG enforcement 

authorities.