MEDICARE 

PROGRAM 

INTEGRITY

CMS Pursues Many 

Practices to Address 

Prescription Drug 

Fraud, Waste, and 

Abuse

Report to the Chairman, Subcommittee 

on Health, Committee on Ways and 

Means, House of Representatives

October 2014

GAO-15-66

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-15-66, a report to the 

Chairman, Subcommittee on Health, 

Committee on Ways and Means, House of 

Representatives

October 2014

MEDICARE PROGRAM INTEGRITY

CMS Pursues Many Practices to Address Prescription 

Drug Fraud, Waste, and Abuse

Why GAO Did This Study

Recent media reports and law 

enforcement actions have highlighted 

the problem of prescription drug fraud, 

waste, and abuse in the United States. 

Medicare, and the Part D prescription 

drug benefit, are susceptible to such 

fraud—a risk made greater by 

Medicare’s size, scope, and 

complexity. GAO and others have 

raised questions about CMS’s 

oversight of its activities to address 

fraud, waste, and abuse in Part D, as 

well as oversight of the contractors 

tasked with this work.

GAO examined (1) practices for 

promoting prescription drug program 

integrity, and (2) the extent that CMS’s 

oversight of Medicare Part D program 

integrity, including the program 

integrity contractors, reflects these 

practices. To develop a list of 

practices, GAO interviewed 14 

stakeholder groups involved in various 

aspects of prescription drug program 

integrity, including provider, 

beneficiary, and anti-fraud groups; 

identified and reviewed related 

documents; and conducted a search of 

eight bibliographic databases that 

included peer-reviewed articles and 

government documents. GAO 

organized the practices based on the 

three categories of GAO’s Fraud 

Prevention Framework. To determine 

how CMS’s oversight reflects these 

practices, GAO analyzed agency 

documents, such as contracts, 

manuals, work products, and CMS 

audits of contractors; and interviewed 

agency officials.

What GAO Found

GAO identified 23 practices for addressing prescription drug fraud, waste, and 

abuse that fall within three categories based on GAO’s Fraud Prevention 

Framework—prevention, detection and monitoring, and investigation and 

prosecution.

The Department of Health and Human Services’ (HHS) Centers for Medicare & 

Medicaid Services’ (CMS) activities to address prescription drug fraud, waste, 

and abuse in the Medicare Part D prescription drug program reflect 14 of these 

23 identified practices, some of which are in multiple categories, and the agency 

plans to implement 3 additional practices.

Practices Implemented, Planned, and Not Pursued by CMS and Its Contractors to Address 

Prescription Drug Fraud, Waste, and Abuse

Category Practice Implemented a Planned

Not 

pursuing

Prevention Providing clinical guidelines ●

Practicing collaboration ●

Educating clinicians and others ●

Using health information technology ●

Limiting supply of abused drugs ●

Using prepayment edits ●

Screening participants of health 

insurance programs

●

Using Prescription Drug Monitoring 

Programs (PDMP)b

●

Detection and Providing clinical guidelines ●

monitoring Practicing collaboration ●

Having compliance programs ●

Conducting data analysis ●

Conducting drug utilization reviews ●

Educating patients and others ●

Limiting certain patients to certain 

providers (“lock-ins”)

●

Using PDMPsb ●

Conducting postpayment reviews ●

Investigation Practicing collaboration ●

and Educating law enforcement and others ●

prosecution Pursuing enforcement options ●

Having investigative staff ●

Reporting to law enforcement ●

Using PDMPsb ●

Source: GAO analysis of relevant literature, CMS documents, and interviews with CMS officials. | GAO-15-66

a

GAO determined that CMS had implemented a practice if the agency required or documented at 

least one activity within that practice, that CMS planned a practice if documentation or officials 

described activities as pilots or in the process of development, and that CMS was not pursuing a 

practice based on reviews of documentation and interviews with officials. 

b

HHS generally agreed with our findings.

PDMPs are state-based programs that operate electronic databases that gather information from 

pharmacies on certain dispensed prescriptions, such as whether a patient has multiple opioid 

prescriptions from multiple providers.

View GAO-15-66. For more information, 

contact Kathleen M. King at (202) 512-7114 or 

kingk@gao.gov.
Page i GAO-15-66 Medicare Program Integrity

Letter 1 

Background 4

We Identified Multiple Prevention, Detection, and Investigation 

Practices to Address Prescription Drug Fraud, Waste, and 

Abuse 9

CMS’s Part D Program Integrity Efforts Reflect Many of the 

Practices We Identified 13

Agency Comments 24

Appendix I Status of Practices by CMS and Its Contractors to Address 

Prescription Drug Fraud, Waste, and Abuse 26

Appendix II Comments from the Department of Health and Human Services 31

Appendix III GAO Contact and Staff Acknowledgments 34

Tables

Table 1: Prevention Practices for Prescription Drug Fraud, Waste, 

and Abuse 10

Table 2: Detection and Monitoring Practices for Prescription Drug 

Fraud, Waste, and Abuse 12

Table 3: Investigation and Prosecution Practices for Prescription 

Drug Fraud, Waste, and Abuse 13

Table 4: Practices Implemented by CMS and Its Contractors for 

Addressing Prescription Drug Fraud, Waste, and Abuse 16

Table 5: CMS Implementation Status and Examples of 23 

Prevention, Detection and Monitoring, and Investigation 

and Prosecution Practices GAO Identified 26

Figures

Figure 1: Example of How a Part D Plan Sponsor Contracts with 

Other Entities 5

Figure 2: CMS Entities with Primary Responsibility for Part D Plan 

Sponsor Oversight 8

Contents
Page ii GAO-15-66 Medicare Program Integrity

Abbreviations

CMS Centers for Medicare & Medicaid Services

CPARS Contractor Performance Assessment Reports System

CPI Center for Program Integrity

D&M detection and monitoring

DEA Drug Enforcement Administration

DUR drug utilization review

FDR First Tier, Downstream or Related Entity

HHS Department of Health and Human Services

I&P investigation and prosecution

MEDIC Medicare Drug Integrity Contractor

MMA Medicare Prescription Drug, Improvement, and 

 Modernization Act of 2003

NBI National Benefit Integrity

O&E outreach and education

OIG Office of Inspector General

OMS Overutilization Monitoring System

PDMP Prescription Drug Monitoring Program

RAC Recovery Audit Contractor

SIU Special Investigation Unit

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-15-66 Medicare Program Integrity

441 G St. N.W.

Washington, DC 20548

October 24, 2014

The Honorable Kevin Brady

Chairman

Subcommittee on Health

Committee on Ways and Means

House of Representatives

Dear Mr. Chairman:

Recent media reports and law enforcement actions have highlighted the 

problem of prescription drug fraud, waste, and abuse in the United 

States.1 Examples of problematic activities include beneficiaries “doctor 

shopping” to receive multiple prescriptions for opioids, such as OxyContin 

or Vicodin, from different providers; providers found to have questionable 

prescribing and billing practices; and diversion of prescription drugs by 

beneficiaries, pharmacies, and others for uses other than intended. 

Medicare and its prescription drug benefit, Part D, are susceptible to such 

fraud—a risk made greater by Medicare’s size, scope, and complexity.2

Since 2006, the Part D program has provided voluntary, outpatient 

prescription drug coverage to the Medicare population. In 2013, Part D 

had nearly 40 million beneficiaries and cost almost $70 billion, or about 

 

1

Fraud involves an intentional act or representation to deceive with the knowledge that the 

action or representation could result in gain. Waste includes inaccurate payments for 

services, such as unintentional duplicate payments. Abuse represents actions inconsistent 

with acceptable business or medical practices. In this report, we use the term “program 

integrity” to refer to activities and practices that address fraud, waste, and abuse.

2

Medicare is a federal health insurance program for people age 65 and older, individuals 

under age 65 with certain disabilities, and individuals diagnosed with end-stage renal 

disease. Medicare Parts A and B are known as original Medicare or Medicare fee-forservice; Part A covers hospital and other inpatient stays, and Part B covers hospital 

outpatient, physician, and other services. Part C is Medicare Advantage, under which 

beneficiaries receive health benefits through private health plans. In Part D, plan sponsors 

offer prescription drug coverage through stand-alone prescription drug plans or through 

Medicare Advantage prescription drug plans, which combine medical and prescription 

drug benefits.

In 1990, we began to report on government operations that we identified as “high risk” for 

serious weaknesses in areas that involve substantial resources and provide critical 

services to the public. Medicare has been included among such programs since 1990. 

See GAO, High-Risk Series: An Update, GAO-13-283 (Washington, D.C.: Feb. 14, 2013).
 

Page 2 GAO-15-66 Medicare Program Integrity

12 percent of total Medicare expenditures. The program is administered 

by the Centers for Medicare & Medicaid Services (CMS), within the 

Department of Health and Human Services (HHS). CMS contracts with 

private companies to provide benefits under Part D.

GAO, the HHS Office of Inspector General (OIG), and others have raised 

questions about CMS’s oversight of its activities to address fraud, waste, 

and abuse in Part D, as well as oversight of the contractors tasked with 

assisting in these activities, the Medicare Drug Integrity Contractors 

(MEDIC).3

To develop a list of practices for addressing prescription drug fraud, 

waste, and abuse, we interviewed stakeholders involved in prescription 

drug program integrity, such as groups representing prescribers, 

pharmacies, beneficiaries, and others, to discuss program integrity 

practices and identify documents that describe such practices.

You asked us to examine practices for addressing fraud, 

waste, and abuse in prescription drug programs, and CMS’s use of these 

practices. We examined (1) practices for promoting prescription drug 

program integrity, and (2) the extent that CMS’s oversight of Medicare 

Part D program integrity, including the MEDICs, reflects these practices.

4

 

3

See, for example, Department of Health and Human Services Office of Inspector 

General, Prescribers with Questionable Patterns in Medicare Part D, OEI-02-09-00603 

(Washington, D.C.: June 2013); MEDIC Benefit Integrity Activities in Medicare Parts C and 

D, OEI-03-11-00310 (Washington, D.C.: January 2013); and GAO, Medicare Part D: 

Instances of Questionable Access to Prescription Drugs, 

Through 

these interviews we identified an initial 213 documents that appeared to 

address program integrity practices related to prescription drug fraud, 

waste, and abuse. We reviewed each document to identify specific 

practices and any relevant activities within those practices. We then 

GAO-11-699 (Washington, D.C.: 

Sept. 6, 2011).

4

We interviewed a total of 14 stakeholder groups: the National Health Care Anti-Fraud 

Association and the Health Care Compliance Association, which represent antifraud and 

compliance entities; AARP, which represents Medicare beneficiaries; America’s Health 

Insurance Plans, which represents private insurers; the Academy of Managed Care 

Pharmacy, the American Pharmacists Association, the National Association of Chain Drug 

Stores, and the National Community Pharmacists Association, which represent 

pharmacies; the Pharmaceutical Care Management Association, which represents 

pharmacy benefit managers; the American Medical Association, which represents 

prescribers; and the Federation of State Medical Boards, the National Association of 

Attorneys General, the National Association of Medicaid Fraud Control Units, the National 

Association of Medicaid Directors, and the Prescription Drug Monitoring Programs Center 

for Excellence, which represent state-based programs.
 

Page 3 GAO-15-66 Medicare Program Integrity

conducted an additional search of eight bibliographic databases that 

included peer-reviewed articles and government documents that yielded 

an additional 642 documents that appeared to address program integrity 

practices related to prescription drug fraud, waste, and abuse. We 

reviewed the most recently published 10 percent, or 64 documents, to 

determine whether they were relevant and if they described additional 

specific practices not already determined through our review of the initial 

213 documents. We did not identify any significantly different practices

and therefore discontinued our review of documents. We reviewed, in 

total, 277 documents. We used GAO’s Fraud Prevention Framework to 

organize the prescription drug program integrity practices we identified in 

our review into one of three categories: prevention, detection and 

monitoring, and investigation and prosecution.5

To determine the extent to which CMS’s oversight of Medicare Part D, 

including the MEDICs, reflects the practices we identified, we interviewed 

agency officials involved in the oversight of the MEDICs and plan 

sponsors. We also analyzed agency documents, such as the MEDIC 

contracts and manuals; MEDIC work products, including the MEDICs’ 

most recent performance evaluations; plan sponsor contract materials 

and memos; CMS findings from its 2013 audits of selected plan sponsors; 

and CMS regulations. We used the reviewed materials and interviews 

with CMS officials to determine which of the practices we identified that 

CMS incorporates into its oversight of the Part D program, as well as the 

practices CMS does not incorporate or plans to incorporate in the future. 

We determined that CMS had implemented a practice if the agency 

required or documented at least one activity within that practice, that CMS 

planned a practice if documentation or officials described activities as 

pilots or in the process of development, and that CMS was not pursuing 

practices based on reviews of documentation and interviews with officials.

We did not evaluate the 

practices we identified for their relative effectiveness. 

We conducted this performance audit from January 2014 to October 2014 

in accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

 

5

The Fraud Prevention Framework was developed by GAO and informed by GAO’s 

internal control standards for the federal government. See GAO, Individual Disaster 

Assistance Programs: Framework for Fraud Prevention, Detection, and Prosecution, 

GAO-06-954T (Washington, D.C.: July 12, 2006). We are currently considering revisions 

to the Fraud Prevention Framework, which we plan to publish in 2015.
 

Page 4 GAO-15-66 Medicare Program Integrity

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

The Medicare Part D program was designed to be administered by 

private organizations—referred to as plan sponsors—that CMS contracts 

with to provide outpatient prescription drug benefit plans to Medicare 

beneficiaries.6

 

6

In this report, we use the term “plan sponsors” to refer to both stand-alone Part D plan 

sponsors as well as Medicare Advantage prescription drug sponsors.

These sponsors may contract with other entities—called 

First Tier, Downstream or Related Entities (FDR)—to help provide these 

benefits. (See fig. 1.) FDRs include pharmacy benefit managers—

companies that provide services such as contracting with a network of 

pharmacies, managing formularies, and performing drug utilization 

reviews on behalf of the sponsors—and pharmacies. CMS holds plan 

sponsors responsible for oversight of their FDRs.

Background

Part D Plan Sponsors
 

Page 5 GAO-15-66 Medicare Program Integrity

Figure 1: Example of How a Part D Plan Sponsor Contracts with Other Entities

Program integrity responsibilities in Medicare Part D are shared by plan 

sponsors, CMS’s Center for Program Integrity (CPI) and Center for 

Medicare, and CMS’s program integrity contractors.

Part D Program Integrity
 

Page 6 GAO-15-66 Medicare Program Integrity

Plan sponsors are required to have comprehensive compliance programs 

that include elements intended to safeguard the Part D program from 

fraud, waste, and abuse.7 CMS issued requirements for these programs 

based on input from various sources, including plan sponsors and 

industry representatives.8

• monitor and audit their FDRs;

CMS requires plan sponsors to

• analyze data to detect and prevent potential fraud, waste, and abuse; 

and

• have a unit, such as a Special Investigation Unit (SIU), specifically 

tasked with identifying and addressing fraud, waste, and abuse, or 

ensure that the responsibilities generally conducted by an SIU are 

conducted by a plan sponsor’s compliance department.

CMS’s CPI oversees Part D program integrity and coordinates with other 

groups within CMS’s Center for Medicare that monitor plan sponsor 

compliance with the Part D program. (See fig. 2.) Within the Center for 

Medicare, one such group is the Medicare Parts C and D Oversight and 

Enforcement Group, which ensures contractual compliance through 

audits of plan sponsors. If those audits identify noncompliance with the 

terms of the Part D contract, CMS may take a variety of actions that 

include requiring corrective action plans, sending warning letters, 

assessing civil money penalties, and terminating or not renewing a 

contract. The other group, the Medicare Drug Benefit and C & D Data 

Group, analyzes data to identify potential patient safety concerns, such as 

overutilization of opioid drugs, that may also indicate potential fraud or 

abuse.

 

7

To protect beneficiaries and the fiscal integrity of the Medicare program, the Medicare 

Prescription Drug, Improvement, and Modernization Act of 2003 (MMA), which established 

the Part D program, requires all Part D sponsors to have programs to safeguard Part D 

from fraud, waste, and abuse. Pub. L. No. 108-173 § 101, 117 Stat. 2066, 2086 (codified 

at 42 U.S.C. § 1395w-104(c)(1)(D)). As a result, CMS issued regulations requiring that 

sponsors adopt and implement a compliance program that includes measures to prevent, 

detect, and correct fraud, waste, and abuse. 42 C.F.R. § 423.504(b)(4)(vi).

8

CMS Compliance Program Guidelines appear in Chapter 9 of the Medicare Prescription 

Drug Benefit Manual, revised January 11, 2013. CMS issues this manual in tandem with 

Chapter 21 of the Medicare Managed Care Manual, which includes the Compliance 

Program Guidelines for Medicare Advantage.

Plan Sponsors’ 

Responsibilities

CMS’s Oversight
 

Page 7 GAO-15-66 Medicare Program Integrity

CPI has primary responsibility for overseeing the two MEDICs tasked with 

promoting program integrity in Medicare Part D:9

• The National Benefit Integrity (NBI) MEDIC is responsible for 

preventing, detecting, and deterring Part D fraud, waste, and abuse. 

This includes intake and handling of complaints from beneficiaries and 

others as well as requests for information from law enforcement; 

investigating providers and others and referring them to law 

enforcement; and analyzing Part D program prescription drug event 

records and other data to identify patterns indicative of potential fraud, 

waste, or abuse.10

• The Outreach & Education (O&E) MEDIC provides Part D fraud, 

waste, and abuse education to plan sponsors and other stakeholders 

by working in concert with CMS to develop educational and training 

tools, and by facilitating information-sharing opportunities, such as 

fraud alerts, conferences, and other meetings.

CPI also oversees the Part D Recovery Audit Contractor (RAC) program, 

which is tasked with reviewing paid Medicare claims—or, for Part D, 

prescription drug event data—from plan sponsors and their pharmacies to 

determine overpayments and underpayments; providing information to 

CPI to help prevent future improper payments; and referring any potential 

fraud identified during the auditing process to the NBI MEDIC to 

investigate. While the Part D RAC may conduct work similar to the NBI 

MEDIC, the focus of the RAC is improper payments—such as 

overpayments—while the MEDIC’s focus is potential fraud, waste, and 

abuse.

 

9

Beginning in fiscal year 2007, CMS awarded contracts to MEDICs to address potential 

fraud and abuse related to the Part D benefit. In fiscal year 2009, CMS added oversight of 

Part C to the MEDICs’ responsibilities.

10Every time a Medicare beneficiary fills a prescription covered under Part D, the sponsor 

must submit a prescription drug event record to CMS. These records include drug cost 

and payment information that enables CMS to administer and monitor the Part D benefit.
 

Page 8 GAO-15-66 Medicare Program Integrity

Figure 2: CMS Entities with Primary Responsibility for Part D Plan Sponsor 

Oversight 
 

Page 9 GAO-15-66 Medicare Program Integrity

We identified a total of 23 practices for addressing prescription drug 

fraud, waste, and abuse that fall within one or more of the three 

categories based on the Fraud Prevention Framework: (1) prevention, 

(2) detection and monitoring, and (3) investigation and prosecution. 

Counting only once the practices that fall within more than one category, 

we identified 16 unique practices.

We identified eight practices related to the prevention of prescription drug 

fraud, waste, and abuse that can include multiple activities, as shown in 

table 1. For example, one prevention practice, limiting the supply of 

abused drugs, can help prevent abuse by restricting the amount of 

potentially abused drugs that are available. This is done by conducting 

the following activities:

• offering “take-back” programs where patients can safely dispose of 

any unused medications, preventing use or abuse by others;

• securing information and materials, such as Drug Enforcement 

Administration (DEA) registration numbers and prescription pads,11

• developing abuse-resistant drugs that could hamper efforts to abuse 

them.

that could prevent bad actors from illegally obtaining prescription 

drugs; and

 

11Among other things, the Controlled Substances Act requires those who manufacture, 

distribute, prescribe, import, or export controlled substances to register with the DEA. 21 

U.S.C. §§ 822, 957. Once registered, DEA provides a certificate with a registration 

number.

We Identified Multiple 

Prevention, 

Detection, and 

Investigation 

Practices to Address 

Prescription Drug 

Fraud, Waste, and 

Abuse

Prevention
 

Page 10 GAO-15-66 Medicare Program Integrity

Table 1: Prevention Practices for Prescription Drug Fraud, Waste, and Abuse

Practice Description/examples

Clinical guidelines Providing clinical guidance to prescribers and pharmacies regarding topics such as

• using the lowest effective dose and judicious prescribing;

• encouraging use of generic drugs as alternatives to brand drugs;

• alternatives to opioid drugs, such as physical therapy; and

• appropriate prescribing of noncontrolled substances, such as to reduce inappropriate 

prescribing of antibiotics.

Collaboration Establishing mutually reinforcing or joint strategies among stakeholders when developing 

programs and/or strategies to address prevention of prescription drug fraud, waste, and abuse.

Education Providing education or training to clinicians, patients, and others on how to prevent abuse, such as

• training clinicians on appropriate prescribing of opioid drugs and

• educating the public on correct use and safe disposal of prescription drugs.

Health information technology Adopting health information technology, such as

• electronic prescribing and

• electronic health records.

Limit the supply of abused drugs Limiting the supply of abused drugs, including

• “take back” programs for safe prescription drug disposal;

• physical and information security, including

• safe storage of drugs;

• safeguarding Drug Enforcement Administration, Medicare National Provider Identifier, and 

other identifiers that can be used to obtain prescription drugs fraudulently;

• securing the prescription drug supply chain; and

• restricting distribution of certain prescription drugs to appropriate entities;

• developing abuse-resistant drugs, including generic versions; and

• prescription verification (by provider or pharmacist), including

• using tamper-resistant prescription pads,

• checking patients’ identification prior to dispensing certain drugs, and

• verifying certain prescriptions with the prescriber.

Prepayment edits Using prepayment edits—controls built into payment systems—to deny claims that should not be 

paid or to flag claims for additional review before payment.

Prescription Drug Monitoring 

Programs (PDMP)

Having clinicians use their states’ PDMPs to ensure patients are not inappropriately receiving 

multiple prescriptions, including a

• prescribers checking PDMPs prior to first prescribing certain prescription drugs and

• pharmacists checking PDMPs prior to dispensing those drugs.

Screening Screening the eligibility of beneficiaries, prescribers, pharmacies, and other entities to ensure that 

they have coverage under or participate in a health insurance program. (Note: This does not 

include screening for potential drug abuse.)

Source: GAO analysis of relevant literature. | GAO-15-66

a

PDMPs are state-based programs that operate electronic databases that gather information from 

pharmacies on certain dispensed prescriptions. Authorized users access the information about a 

patient’s prescription drug history, such as whether a patient has multiple opioid prescriptions from 

multiple providers.
 

Page 11 GAO-15-66 Medicare Program Integrity

We identified nine practices related to the detection and monitoring of 

prescription drug fraud, waste, and abuse, as shown in table 2. For 

example, the collaboration practice includes sharing information about 

specific fraud schemes and potentially fraudulent providers that can help 

other interested parties—such as other insurers—find those schemes and 

providers within their own systems. These practices also help monitor 

individuals who have been identified as potentially abusing drugs or 

health care benefits. For example, one practice we identified is recipient 

restriction programs—called “lock-ins”—that typically require certain 

patients to use one prescribing physician and one dispensing pharmacy—

to better track their prescription drug use.

Detection and Monitoring
 

Page 12 GAO-15-66 Medicare Program Integrity

Table 2: Detection and Monitoring Practices for Prescription Drug Fraud, Waste, and Abuse

Practice Description/examples

Clinical guidelines Providing clinical guidance to prescribers and pharmacies regarding topics such as

• screening patients for potential drug abuse, such as through urine testing or other 

screening tools, and

• more frequent evaluations of patients who are prescribed certain drugs.

Collaboration Establishing mutually reinforcing or joint strategies among stakeholders to help in detection and 

monitoring efforts, such as sharing information on specific fraud schemes, results of data 

analysis, and disciplinary actions taken against providers.

Compliance program Establishing effective compliance programs that include the following elements:

• written policies, procedures, and standards of conduct;

• designation of a compliance officer and committee;

• effective training and education;

• effective lines of communication;

• enforcing standards;

• internal monitoring and auditing; and

• responding promptly to offenses and developing corrective actions.

Data analysis Having dedicated and appropriate staff for collecting and actively analyzing data to identify 

outliers or other markers of potential fraud, waste, or abuse.

Drug utilization review (DUR) Having authorized, structured, ongoing reviews of prescribing, dispensing, and use of 

medication, which can include

• prospective reviews, such as requiring prior authorization for certain drugs, high drug 

doses, or large drug quantities before the drugs are dispensed;

• concurrent reviews; and

• retrospective or retroactive reviews.

Education Educating insurers, providers, patients, and others on how to detect potential prescription drug 

fraud, waste, and abuse. This can include alerting providers to their prescribing patterns.

Postpayment reviews Reviewing claims and other documents after payment to ensure compliance with payment rules 

and that the prescription was medically necessary, including the ability to suspend payments 

and obtain and review medical records.

Alerting providers and beneficiaries to potential errors in services provided or received, such as 

by sending explanation of benefit reports to beneficiaries for their review.

Prescription Drug Monitoring 

Programs (PDMP)

Using PDMP reports to help detect potential problems, which can be solicited reports, such as 

prescribers requesting a report about a particular patient, or unsolicited reports, such as a 

PDMP system automatically sending a prescriber a report on his or her patients and prescribing 

patterns.

a

Recipient restriction programs 

(“lock- ins”)

Requiring certain patients—such as those at risk for abusing drugs, high-users of controlled 

substances, and others—typically to use only one prescribing physician and one dispensing 

pharmacy.

Source: GAO analysis of relevant literature. | GAO-15-66

a

PDMPs are state-based programs that operate electronic databases that gather information from 

pharmacies on certain dispensed prescriptions. Authorized users access the information about a 

patient’s prescription drug history, such as whether a patient has multiple opioid prescriptions from 

multiple providers.
 

Page 13 GAO-15-66 Medicare Program Integrity

We identified six practices related to the investigation and prosecution of 

prescription drug fraud, waste, and abuse, as shown in table 3. Practices 

include having investigative staff knowledgeable of prescription drug 

schemes and experienced in investigating them, as well as having the 

ability to take actions to enforce prescription drug rules.

Table 3: Investigation and Prosecution Practices for Prescription Drug Fraud, Waste, and Abuse

Practice Description/examples

Collaboration Participating in joint investigations, task forces, and other investigative efforts.

Sharing information, as appropriate, regarding ongoing fraud investigations, including 

information about the providers under investigation.

Education Providing education to law enforcement and other investigators on how to investigate 

prescription drug fraud, waste, and abuse.

Enforcement Having and using punitive measures against those involved in potential fraud, waste, or 

abuse of prescription drugs, such as

• restricting providers’ or beneficiaries’ access to or removing them from insurance 

programs and

• pursuing prosecutions.

Investigations/investigative staff Having in-house investigators, such as a Special Investigative Unit, which take

investigative steps such as on-site audits, medical record reviews, and other actions.

Prescription Drug Monitoring Programs 

(PDMP)

Accessing and/or analyzing PDMP data in support of investigations and/or prosecutions. a

Reporting to law enforcement Reporting suspect bad actors and problems to law enforcement agencies.

Source: GAO analysis of relevant literature. | GAO-15-66

a

PDMPs are state-based programs that operate electronic databases that gather information from 

pharmacies on certain dispensed prescriptions. Authorized users access the information about a 

patient’s prescription drug history, such as whether a patient has multiple opioid prescriptions from 

multiple providers.

CMS pursues many of the practices we identified that can be used to 

prevent, detect, and investigate prescription drug fraud, waste, and 

abuse. In addition, CMS plans to add new and strengthen certain existing 

practices, but will not adopt certain other practices for a variety of 

reasons.

Investigation and 

Prosecution

CMS’s Part D 

Program Integrity 

Efforts Reflect Many 

of the Practices We 

Identified
 

Page 14 GAO-15-66 Medicare Program Integrity

CMS activities to address prescription drug fraud, waste, and abuse 

reflect 14 of the 23 total practices we identified, based on interviews with 

officials and review of agency documents. Most of the practices CMS 

pursues—10 of its 14 practices—relate to the detection and monitoring, 

and investigation and prosecution categories.

CMS implements its prescription drug program integrity practices by 

assigning activities to and working with plan sponsors, the MEDICs, and 

others. For example, 

• for prevention, CMS works with the O&E MEDIC to develop 

educational materials that plan sponsors can download from the O&E 

MEDIC’s website and customize for their beneficiaries; 

• for detection and monitoring, CMS requires plan sponsors to have 

compliance programs, which incorporate multiple practices we 

identified, such as data analysis, collaboration, and education; the NBI 

MEDIC also analyzes data and shares the results with plan sponsors; 

and

• for investigations and prosecutions, plan sponsors and the NBI 

MEDIC are expected to have staff who can identify and investigate 

potential fraud, waste, and abuse.

The NBI and O&E MEDICs reported completing work for a variety of 

practices, and CMS rated elements of the MEDICs’ work from satisfactory 

to exceptional on their most recent performance assessments.12

CMS paid approximately $17 million in 2013 to the NBI MEDIC to analyze 

data, process and review complaints, and develop investigations to 

promote Part D program integrity. In the most recently completed contract 

year, the NBI MEDIC reported the following: 

 

12CMS evaluates each MEDIC’s performance annually based on metrics it sets for each 

contractor, primarily related to the timeliness of contractors’ work. For example, CMS 

expects that the NBI MEDIC will send an acknowledgment letter to complainants within 

5 days of receiving the complaint, and expects that the O&E MEDIC will conduct a 

minimum of 10 training presentations each contract year. Scores are based on a five-point 

scale: (1) unsatisfactory, (2) marginal, (3) satisfactory, (4) very good, and (5) exceptional.

CMS rated the contractors on additional elements not included in the examples we 

described.

CMS, with Its Contractors, 

Has Implemented Many 

Program Integrity 

Practices, Particularly 

within the Categories of 

Detection and Monitoring 

and Investigation and 

Prosecution

NBI MEDIC
 

Page 15 GAO-15-66 Medicare Program Integrity

• processing almost 7,000 complaints to determine whether they 

identified potential fraud, for which CMS most recently rated the 

contractor “exceptional”;

• completing 7 data analysis projects and initiating 41 new projects, for 

which CMS most recently rated the contractor “exceptional”; and

• referring almost 400 cases that represented approximately 

$5.1 billion in potential fraud to law enforcement, for which CMS most 

recently rated the contractor “satisfactory” for its investigations and 

“exceptional” for its law enforcement referrals.13

CMS paid approximately $1.7 million in 2013 to the O&E MEDIC to 

provide outreach and education that assists CMS in communicating 

program integrity efforts as well as supporting fraud, waste, and abuse 

oversight audits. In the most recently completed contract year, the O&E 

MEDIC reported the following: 

• developing 59 outreach and education materials, such as fraud 

awareness flyers and frequently asked questions;

• developing 33 training products, such as webinars and job aids; and

• executing 8 conferences, including with stakeholders we interviewed, 

and providing 22 presentations at other conferences and meetings.

CMS rated each element of the O&E MEDIC’s work as “satisfactory.”14

Table 4 identifies the practices implemented by CMS and its contractors.

 

13The NBI MEDIC’s most recently completed Contractor Performance Assessment 

Reports System (CPARS) evaluation was for April 2011 through March 2012. While CMS 

has conducted two subsequent reviews, the ratings had not been posted to CPARS as of 

August 2014. Therefore, we report the MEDIC’s 2013 activities from the most recently 

completed contract year, and the CPARS ratings as of March 2012, since those are the 

most recently available results.

14The O&E MEDIC’s most recently completed contract year for which its CPARS ratings 

are available was October 2012 through September 2013.

O&E MEDIC
 

Page 16 GAO-15-66 Medicare Program Integrity

Table 4: Practices Implemented by CMS and Its Contractors for Addressing Prescription Drug Fraud, Waste, and Abuse

Category Practice Responsible entities and examples of activities

Prevention

a

Collaboration 

(prevention)

CMS has established relationships with a variety of stakeholders to help develop 

programs and strategies to address prescription drug fraud, waste, and abuse, 

including, for example, the agency’s participation in the Public-Private Partnership to 

Prevent Health Care Fraud and as a member of the National Health Care Anti-Fraud 

Association.

Education 

(prevention)

Outreach & Education Medicare Drug Integrity Contractor (O&E MEDIC), in concert with 

CMS Center for Program Integrity, offers a variety of materials and events, such as an 

insert on safe drug disposal that plan sponsors can provide to their beneficiaries, and 

training to Medicare beneficiaries on how to prevent potential fraud.

Prepayment edits Plan sponsors may implement edits at the point of sale to control specific beneficiaries’ 

access to certain medications (see also drug utilization review (DUR) below).

For every prescription, plan sponsors must check a range of information, typically at the 

point of sale or distribution, such as drug interactions, incorrect amounts, and age or 

gender contraindications, such as a woman receiving medications prescribed only to 

men.

Screening Plan sponsors must verify beneficiaries’ Part D eligibility.

CMS finalized a rule in May 2014 establishing a Medicare enrollment requirement for 

Part D prescribers effective June 1, 2015, and strengthening screening for ineligible 

incarcerated beneficiaries starting January 1, 2015.

Detection and 

monitoring (D&M)

b

Collaboration (D&M) Plan sponsors are to share information with CMS regarding potentially fraudulent 

providers or schemes.

National Benefit Integrity (NBI) and O&E MEDICs convene conferences and share 

information on prescription drug fraud, waste, and abuse with plan sponsors, law 

enforcement, beneficiaries, and other stakeholders.

CMS sends memos to all plan sponsors about new Part D fraud schemes and 

potentially fraudulent providers that are also made available on the O&E MEDIC 

website. In addition, CMS sends the results of the NBI MEDIC’s data analyses directly to 

a plan sponsor if the NBI MEDIC identifies particular issues for that sponsor to address.

Compliance program Plan sponsors are to have effective compliance programs.

Data analysis The NBI MEDIC conducts data analysis projects, such as identifying deceased 

prescribers across all plan sponsors, and is to have clinical and analytic staff to conduct 

that work. The NBI MEDIC is also implementing predictive analytic models to identify 

potential fraud in the Part D program.

Plan sponsors are to have clinical and analytic staff, or contract with an entity that can 

provide such staff, to monitor and analyze data as part of their compliance programs.

Drug utilization review 

(DUR)

Plan sponsors are to review beneficiaries’ drug utilization patterns to identify potential 

patient harm and beneficiaries at risk for overutilization, and refer those beneficiaries for 

case management. Plan sponsors are to share information on these beneficiaries when 

they move from one Part D plan to another.

CMS also reports quarterly to plan sponsors the names of beneficiaries overutilizing 

opioids and certain other drugs through CMS’s Overutilization Monitoring System. Plan 

sponsors must report to CMS quarterly on how each identified case is addressed.
 

Page 17 GAO-15-66 Medicare Program Integrity

Category Practice Responsible entities and examples of activitiesa

Education (D&M) O&E MEDIC, in coordination with CMS and the NBI MEDIC, provides training and 

materials to plan sponsors and others on how to identify potential fraud, waste, and 

abuse. For example, the O&E MEDIC, with CMS oversight, developed a Fraud 

Handbook that plan sponsors can access to learn about practical techniques and 

approaches on preventing, detecting, and investigating potential prescription drug fraud.

Postpayment reviews Plan sponsors are to conduct certain postpayment reviews (see also DUR above).

Plan sponsors are also to provide beneficiaries with an explanation-of-benefits 

document to review for potential errors that also has a telephone number to report 

potential fraud.

Part D Recovery Audit Contractor is to review paid Part D claims to identify over- and 

underpayments and recoup overpayments, and refer potential fraud identified during 

that postpayment review to the NBI MEDIC.

Investigation and 

prosecution (I&P)

Collaboration (I&P) The NBI MEDIC responds to law enforcement requests for information and has 

participated in task forces and other investigative efforts.

The O&E MEDIC trains insurance investigators, law enforcement, and others.

CMS hosts quarterly meetings with a variety of stakeholders on prescription drug fraud, 

waste, and abuse.

Education (I&P) O&E MEDIC, in consultation with the NBI MEDIC, provides educational materials on 

how to investigate potential fraud.

Investigations/

investigative staff

Plan sponsors are to have staff who can identify potential fraud.

The NBI MEDIC is to have investigative staff knowledgeable of prescription drug fraud.

Reporting to law 

enforcement

The NBI MEDIC is required to refer investigations to law enforcement.

CMS encourages but does not require plan sponsors to refer potential fraud to law 

enforcement and/or CMS, including the NBI MEDIC.

Source: GAO analysis of CMS documents and interviews with CMS officials. | GAO-15-66

c

a

This table does not include all instances of CMS’s activities to implement the practices we identified.

b

Once prescribers are enrolled, the rule provides that CMS will be able to revoke prescriber billing 

privileges for certain abuses of the program or noncompliance with applicable licensure requirements. 

To implement the exclusion of incarcerated individuals from Part D coverage, the rule redefined 

eligible Medicare service areas to exclude facilities in which individuals are incarcerated. See 

Medicare Program: Contract Year 2015 Policy and Technical Changes to the Medicare Advantage 

and the Medicare Prescription Drug Benefit Programs. 79 Fed. Reg. 29,844 (May 23, 2014).

c

In a March 2014 report, OIG reiterated previous recommendations that it had made to CMS to

amend regulations to require Part D plan sponsors to report to CMS their identification of and 

response to potential fraud and abuse incidents. CMS did not concur with this recommendation, citing 

concerns about creating duplicative reporting. See Department of Health and Human Services Office 

of Inspector General, Less than Half of Part D Sponsors Voluntarily Reported Data on Potential Fraud 

and Abuse, OEI-03-13-00030 (Washington, D.C.: March 2014). CMS officials told us in September 

2014 that if the agency were to impose such a requirement, it would be able to evaluate sponsors’ 

compliance with the reporting requirement, but not whether the reports identified actual fraud as 

defined by law enforcement.

CMS is planning to implement another 3 of the 23 total practices and to 

strengthen 4 that it has already implemented, but officials stated that the 

agency is not pursuing 6 practices for a number of reasons. 

CMS May Adopt Some 

Practices, but Not Others, 

for a Number of Reasons
 

Page 18 GAO-15-66 Medicare Program Integrity

The three additional practices CMS plans to implement are the following: 

• Detection and Monitoring: Prescription Drug Monitoring Program 

(PDMP). CMS officials said the agency is seeking access to PDMP 

data through several avenues.15

• Investigation and Prosecution: PDMPs. CMS officials said CMS and 

the NBI MEDIC are also working with four states—Idaho, Indiana, 

Massachusetts, and New York—to obtain PDMP data as another data 

source to help investigate potential prescription drug diversion. Idaho 

currently is the only state that allows Medicare access to its PDMP, 

while the other states have expressed interest in providing information 

to CMS.

For example, CMS and the NBI 

MEDIC are working with the PDMP Center of Excellence to obtain deidentified PDMP data to assist the MEDIC in detecting potential 

patterns of prescription drug fraud, waste, and abuse.

• Investigation and Prosecution: Enforcement. Under the recently 

issued rule, which established a Medicare enrollment requirement for 

prescribers of drugs covered by Part D,16

 

15PDMPs are state-based programs that operate electronic databases that gather 

information from pharmacies on certain dispensed prescriptions, such as whether a 

patient has multiple opioid prescriptions from multiple providers. Authorized users access 

the information about a patient’s prescription drug history. Each state determines what 

data are collected, and who may access the PDMP and for what purpose. For example, 

some states only allow health care providers to access the PDMP as a patient-safety tool 

for their patients, while others allow law enforcement access for active investigations. 

According to Brandeis University’s PDMP Training and Technical Assistance Center, as of 

June 2014, 49 of 50 states and the District of Columbia had legislation authorizing 

PDMPs, and 48 of those have operational PDMPs.

CMS can revoke a 

physician’s or eligible professional’s Medicare enrollment if the DEA 

or a state agency has suspended or revoked the individual’s

prescriber privileges. CMS may also revoke enrollment where it 

determines the individual has prescribing patterns or conducts 

practices that are abusive or represent a threat to the health and 

safety of Medicare beneficiaries, or both. Prior to this new 

requirement, CMS could not directly take administrative actions 

against a Part D provider. CMS officials also reported that they are 

working with OIG on how best to pursue other enforcement options, 

such as “permissive exclusions,” which allow OIG to exclude 

16Medicare Program: Contract Year 2015 Policy and Technical Changes to the Medicare 

Advantage and the Medicare Prescription Drug Benefit Programs. 79 Fed. Reg. 29,844

(May 23, 2014).
 

Page 19 GAO-15-66 Medicare Program Integrity

providers from federal health programs for certain other actions, such 

as misdemeanor convictions for certain offenses.17

CMS is planning to strengthen four practices that it has already 

implemented, which correspond to all three categories.

• Prevention: Screening. CMS issued a final rule in May 2014 that is 

intended to strengthen Part D prescriber and beneficiary screening. 

The rule establishes a Medicare enrollment requirement for 

prescribers of drugs covered by Part D, effective June 2015.18

The rule is also intended to strengthen screening of Part D 

beneficiaries.

As a 

result, CMS is to screen these prescribers during the Medicare 

enrollment process to verify that they meet specific requirements, 

such as having current licenses or accreditation and valid Social 

Security numbers. Additionally, this final rule authorizes CMS to 

revoke a physician’s or eligible professional’s Medicare enrollment for 

certain abuses of the program, or based upon a suspension or 

revocation of the prescriber’s DEA certificate or state authority to 

prescribe drugs. As with fee-for-service providers, CMS will revalidate 

enrollment information when changes or updates are submitted and 

during a 5-year revalidation process. CMS is still considering whether 

to require pharmacies that dispense covered Part D drugs to enroll 

into the Medicare program.

19

 

17Under section 1128 of the Social Security Act, exclusions from federal health programs 

are permissive under certain circumstances and mandatory in others. 42 U.S.C. § 1320a7. Permissive exclusions are allowed for a variety of reasons, including licensure 

suspension, surrender, or revocation, or misdemeanor controlled substance conviction. 

Mandatory exclusions are required for felony convictions relating to health care fraud or 

controlled substances, and any convictions relating to patient abuse/neglect or to the 

delivery of Medicare or state health care programs.

Currently, plan sponsors are to verify beneficiaries’ 

Part D eligibility. While incarcerated or confined beneficiaries are 

generally ineligible for Part D coverage, recent OIG reports found that 

18Medicare Program: Contract Year 2015 Policy and Technical Changes to the Medicare 

Advantage and the Medicare Prescription Drug Benefit Programs. 79 Fed. Reg. 29,844 

(May 23, 2014).

19Id.
 

Page 20 GAO-15-66 Medicare Program Integrity

CMS paid for prescription drugs for such beneficiaries.20

• Detection and Monitoring: Collaboration. CMS is seeking to 

strengthen collaboration through a new voluntary web-based system 

created by the NBI MEDIC—PLATO—that is intended to allow CMS 

and plan sponsors to more easily share information on fraud schemes 

and potential bad actors.

The new rule 

implements the exclusion of beneficiaries incarcerated for 30 days or 

more from receiving Part D benefits starting January 1, 2015, by 

removing the facilities where individuals are incarcerated from the 

definition of a plan’s service area.

21

• Detection and Monitoring: Compliance Program. CMS is pursuing 

options for improving its oversight of plan sponsors’ compliance 

programs. In 2013, among the plan sponsors that it audited, CMS 

found weaknesses in the majority of plan sponsors’ compliance 

programs for addressing fraud, waste, and abuse. During that year, 

CMS audited 29 plan sponsors, representing 14 percent of all plan 

sponsors and, of those, nearly all (94 percent) had findings related to 

For example, plan sponsors may use the 

system to share information on specific suspect providers so that 

other plan sponsors can determine whether they should also 

investigate or take actions against those providers. CMS officials said 

that they anticipate that PLATO will be accessible to plan sponsors by 

the end of 2014. In addition, according to agency officials, CMS is 

working with the NBI MEDIC to develop and implement predictive 

models in PLATO to help identify potential fraud schemes that can be 

shared with plan sponsors, such as a model for identifying prescribers 

who provide certain controlled substances to patients without a valid 

medical need.

 

20See Department of Health and Human Services Office of Inspector General, Medicare 

Improperly Paid Millions of Dollars for Prescription Drugs Provided to Incarcerated 

Beneficiaries during 2006 through 2010, A-07-12-06035 (Washington, D.C.: January 

2014); and The Centers for Medicare & Medicaid Services Provided Medicare Part D 

Coverage to Beneficiaries Confined in Mental Health Facilities for Court-Ordered 

Purposes, A-07-13-06041 (Washington, D.C.: July 2014).

21PLATO stands for “predictive learning analytics tracking outcome.” Predictive analytic 

technologies are a variety of automated systems and tools that can be used to identify 

particular types of behavior, including fraud, before transactions are completed.
 

Page 21 GAO-15-66 Medicare Program Integrity

fraud, waste, and abuse activities, according to officials.22 These 

officials also reported that almost all weaknesses were addressed 

through a corrective action plan.23 In January 2014, CMS proposed a 

rule that would require, among other things, that plan sponsors hire an 

independent auditor to verify that any required corrective action plans 

addressed deficiencies found during a program audit.24

In addition, CMS officials reported that the agency has an initiative 

under way to gather information that could help improve oversight of 

plan sponsors’ practices to address fraud, waste, and abuse. As part 

of this initiative, CMS interviewed five plan sponsors about how they 

use the information CMS provided to them on new fraud schemes and 

potentially fraudulent providers. Based on this information, CMS 

officials reported that they could change how the agency audits plan 

sponsors’ fraud, waste, and abuse activities, or increase the 

CMS did not 

finalize this requirement in the final rule issued in May 2014, and as of 

October 2014, CMS officials did not provide a proposed completion 

date. 

 

22CMS selects sponsors to audit based on size, past audit findings, and risk, selecting 

both sponsors that may serve as role models, as well as those that are at risk. As of 

August 2014, CMS officials reported that 97 percent of beneficiaries are enrolled with plan 

sponsors that have been audited.CMS’s 2013 audit findings included a lack of evidence 

that plan sponsors’ FDRs or governing bodies were trained in compliance or in how to 

identify and report potential fraud, waste, or abuse; a lack of evidence that plan sponsors 

were conducting reasonable inquiries of potential fraud, waste, or abuse in a timely 

manner; and a lack of evidence that plan sponsors were implementing procedures to 

ensure appropriate corrective actions were taken in response to potential fraud, waste, or 

abuse.

23Corrective action plans are developed by the plan sponsor to address deficiencies 

identified by CMS. Plans are to provide an attainable time frame for implementing 

corrective actions, and include a process for validating and monitoring that the corrective 

actions were taken and remain effective.

A CMS official noted that stricter penalties—specifically, civil money penalties—are 

reserved for weaknesses that result in direct adverse effects on beneficiaries, such as not 

being able to access medications and care.

24Medicare Program: Contract Year 2015 Policy and Technical Changes to the Medicare 

Advantage and the Medicare Prescription Drug Benefit Programs. 79 Fed. Reg. 1,918

(proposed Jan. 10, 2014).
 

Page 22 GAO-15-66 Medicare Program Integrity

requirements for sponsors’ activities, in order to improve oversight.25

• Investigation and Prosecution: Collaboration. CMS is working to 

develop a more formal way to share information about fraudulent 

providers with relevant state medical boards, CMS officials said, so 

that the medical boards can conduct additional investigations to 

determine whether the board should impose sanctions on those 

providers, such as revoking a provider’s medical license.

However, CMS officials noted that any changes will be based on the 

agency’s final assessment of lessons learned from the initiative, which 

was still in progress as of August 2014.

CMS is not pursuing six practices that appear in two categories, 

prevention and detection and monitoring, because the agency considers 

the practices to be outside the scope of its program integrity activities, is 

concerned about limiting beneficiaries’ access to services, or for other 

reasons.

• Prevention, and Detection and Monitoring: Clinical Guidelines. While 

CMS uses clinical guidelines to review plan sponsors’ formularies to 

ensure access to certain drugs, CMS does not require plan sponsors 

to carry out activities within these program integrity practices, such as 

filling only the prescriptions for the lowest effective dose, promoting 

alternatives to opioids, or screening their patients for potential drug 

abuse. However, CMS provides training materials to providers on 

such topics to promote patient safety, and other parts of Medicare 

cover screening for drug abuse under certain conditions.

• Prevention: Health Information Technology. CMS does not use health 

information technology for program integrity purposes, but 

encourages its use by, for example, providing information to Medicare 

beneficiaries on the benefits of electronic health records.

• Prevention: PDMPs. CMS guidance to physicians has encouraged 

prescribers to check their states’ PDMP prior to prescribing certain 

drugs; however, variations in state practices regarding access to 

 

25Both GAO and OIG have reported problems with CMS’s audits of Part D plan sponsors. 

See GAO, Medicare Part D: Some Plan Sponsors Have Not Completely Implemented 

Fraud and Abuse Programs, and CMS Oversight Has Been Limited, GAO-08-760

(Washington, D.C.: July 21, 2008), and Department of Health and Human Services Office 

of Inspector General, Audits of Medicare Prescription Drug Plan Sponsors, OEI-03-09-

00330 (Washington, D.C.: December 2011).
 

Page 23 GAO-15-66 Medicare Program Integrity

PDMPs means that not all prescribers may be able to conduct checks, 

according to CMS officials.

• Prevention: Limit the Supply of Abused Drugs. CMS officials told us 

that the agency does not conduct activities to limit the supply of 

abused drugs because this practice is beyond the scope of Part D 

program integrity efforts. For example, CMS does not operate “take 

back” days where beneficiaries can dispose of any unneeded 

prescription drugs, since, until recently, DEA required a law 

enforcement presence at such events, which CMS cannot provide.

26

• Detection and Monitoring: Lock-ins. CMS does not monitor Medicare 

beneficiaries through a “lock-in” or restricted recipient program. We 

previously recommended that CMS consider a restricted recipient 

program for Medicare Part D that would limit certain beneficiaries to 

one prescriber, one pharmacy, or both for receiving prescriptions, and 

that the agency should seek congressional authority, as appropriate, 

to do so.

CMS also does not address the supply of abuse-resistant drugs, 

officials said, since that is the responsibility of the Food and Drug 

Administration and pharmaceutical manufacturers.

27 CMS, in responding to our recommendation, stated that it 

did not agree that a restricted recipient program was necessarily the 

appropriate control for the Part D program, and raised concerns about 

restricting beneficiaries’ access to services.28

 

26DEA finalized a rule effective October 9, 2014, expanding the options available to 

dispose of controlled substances. See Disposal of Controlled Substances. 79 Fed. 

Reg. 53,520 (Sept. 9, 2014).

However, in August 

2014, OIG recommended that CMS restrict certain beneficiaries to a 

limited number of pharmacies and prescribers, and CMS concurred 

27See GAO-11-699. In that report, CMS policy officials stated that Part D cannot have a 

restricted recipient program because MMA, which established the Part D program, did not 

authorize CMS to establish such restrictions on beneficiaries.

28Following our report, in 2012 CMS conducted a study that identified few beneficiaries 

(less than 1 percent) who would merit a lock-in program. CMS analyzed Part D data to 

identify beneficiaries receiving potentially unsafe doses of prescription opioids for 90 or 

more consecutive days, excluding beneficiaries with cancer or in hospice care. CMS 

concluded that .71 percent (224,964) of all Part D beneficiaries were at high risk for 

potential adverse effects and had a high likelihood of inappropriately using opioids. CMS 

also analyzed the number of prescribers and pharmacies associated with these 

beneficiaries’ opioid prescriptions and found that .07 percent (22,222) of Part D 

beneficiaries received high dosages of opioids from at least four prescribers and at least 

four pharmacies.
 

Page 24 GAO-15-66 Medicare Program Integrity

with the recommendation, but stated the agency needs—and is 

receptive to—legislative authority to “lock in” beneficiaries in Part D.29

Currently, the agency requires plan sponsors to review data to identify 

beneficiaries potentially at risk for overutilization of certain drugs, 

including opioids, and to monitor those beneficiaries.30 Monitoring 

may include notifying their prescribers of the overutilization, case 

management, and point-of-sale edits, which are beneficiary-specific 

edits that can vary based on the situation. For example, the edits may 

prevent a beneficiary from receiving certain types of prescription 

drugs or an excessive amount of a particular drug.31

See appendix I for the status of all 23 program integrity practices we 

identified and whether CMS and its contractors have implemented, 

planned to implement, or are not pursuing them.

We provided a draft of this report to the Department of Health and Human 

Services (HHS) for comment and HHS provided written comments, which 

are reprinted in appendix II. In its comments, HHS generally agreed with 

our findings, and provided more information regarding our finding that 

CMS is not pursuing 6 of the 23 practices we identified for prescription 

drug fraud, waste, and abuse. Generally, the agency provided additional 

information for why CMS is not pursuing certain practices as part of its 

 

29See Department of Health and Human Services Office of Inspector General, Part D

Beneficiaries with Questionable Utilization Patterns for HIV Drugs, OEI-02-11-00170 

(Washington, D.C.: August 2014).

30CMS requires plan sponsors to have drug utilization review (DUR) programs that include 

retrospective reviews of claims and case management for drugs susceptible to abuse, 

including opioids. 42 C.F.R § 423.153. Starting in 2013, CMS implemented a Medicare 

Part D Overutilization Monitoring System (OMS). OMS is similar and in addition to the 

DUR programs, but is focused on opioids and certain other drugs, and includes CMS 

sending quarterly reports to plan sponsors to alert them to their beneficiaries who are 

receiving excessive amounts of those drugs.

OIG recommended in August 2014 that CMS expand both the plan sponsors’ DUR 

programs and OMS to include additional drugs susceptible to fraud, waste, and abuse. 

CMS concurred with the recommendation to expand DUR programs, noting the agency 

already encourages plan sponsors to examine nonopioids as part of those programs. 

CMS did not concur that it should similarly expand OMS, stating that the program is a 

“safety-focused tool,” not a “fraud identification tool.” See OEI-02-11-00170.

31Beneficiaries have a right to appeal the use of these edits, as set forth at 42 C.F.R. 

Part 423, Subpart M, and Chapter 18 of the Medicare Prescription Drug Benefit Manual. 

Agency Comments
 

Page 25 GAO-15-66 Medicare Program Integrity

program integrity efforts, such as the use of clinical guidelines, PDMPs, 

and lock-in programs. Regarding the practice of health information 

technology, while HHS noted that CMS requires the development by 

Part D sponsors of electronic prescription drug programs and the use of 

e-prescribing is encouraged, these activities were not identified by CMS 

officials as specific program integrity efforts. Regarding the practice of 

limiting the supply of abused drugs, HHS described CMS activities that 

we considered under a different practice—the use of prepayment edits. 

Our descriptions and examples of these practices, as well as the other 17 

practices, are included in tables 1, 2, and 3 in this report. HHS also 

provided a recent example of its program integrity efforts to address 

fraud, waste, and abuse in the Part D program, in which HHS sent letters 

to providers identified as very high prescribers of certain controlled 

substances to give information to these providers to help them evaluate 

whether their high prescribing level of these drugs is appropriate for their 

patient population, and to identify areas where their prescribing could be 

modified. HHS also provided technical comments, which we incorporated 

as appropriate.

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Health 

and Human Services, appropriate congressional committees, and other 

interested parties. In addition, the report will be available at no charge on 

the GAO website at http://www.gao.gov. 

If you or your staff have any questions about this report, please contact 

me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices 

of Congressional Relations and Public Affairs may be found on the last 

page of this report. GAO staff who made key contributions to this report 

are listed in appendix III.

Sincerely yours,

Kathleen King

Director, Health Care
Appendix I: Status of Practices by CMS and Its 

Contractors to Address Prescription Drug 

Fraud, Waste, and Abuse

Page 26 GAO-15-66 Medicare Program Integrity

Table 5 shows the 23 prevention, detection and monitoring, and 

investigation and prosecution practices we identified, their CMS status 

(implemented, planned, or not pursuing), and examples of the activities. 

We determined that CMS had implemented a practice if the agency 

required or documented at least one activity within that practice, that CMS 

planned a practice if documentation or officials described activities as 

pilots or in the process of development, and that CMS was not pursuing 

practices based on reviews of documentation and interviews with officials.

Table 5: CMS Implementation Status and Examples of 23 Prevention, Detection and Monitoring, and Investigation and 

Prosecution Practices GAO Identified

Category Practice

Status 

● Implemented

☼ Planned

○ Not pursuing

Responsible entities, examples of activities,

a

Prevention

or explanation 

of status

Clinical guidelines

(prevention)

○ The Centers for Medicare & Medicaid Services (CMS) does not 

use clinical guidelines for program integrity purposes, but the 

agency provides educational materials related to appropriate 

prescribing.

Collaboration

(prevention)

● CMS has established relationships with a variety of stakeholders 

to help develop programs and strategies to address prescription 

drug fraud, waste, and abuse, including, for example, the 

agency’s participation in the Public-Private Partnership to Prevent 

Health Care Fraud and as a member of the National Health Care 

Anti-Fraud Association.

Education (prevention) ● Outreach & Education Medicare Drug Integrity Contractor (O&E 

MEDIC), in concert with CMS Center for Program Integrity, offers 

a variety of materials and events, such as an insert on safe drug 

disposal that plan sponsors can provide to their beneficiaries and 

training to Medicare beneficiaries on how to prevent potential 

fraud.

Health information 

technology

○ CMS does not use health information technology for program 

integrity purposes, but has encouraged its use, such as by 

providing information to Medicare beneficiaries on the benefits of 

electronic health records.

Limit the supply of 

abused drugs

○ CMS does not limit the supply of abused drugs because the

associated activities of this practice are beyond the scope of 

Part D program integrity efforts, according to CMS officials. For 

example, until recently, to accept unneeded controlled 

substances in a “take back” program, the Drug Enforcement 

Administration required a law enforcement presence, which CMS 

cannot provide.

Appendix I: Status of Practices by CMS and 

Its Contractors to Address Prescription Drug 

Fraud, Waste, and Abuse
Appendix I: Status of Practices by CMS and Its 

Contractors to Address Prescription Drug 

Fraud, Waste, and Abuse

Page 27 GAO-15-66 Medicare Program Integrity

Category Practice

Status 

● Implemented

☼ Planned

○ Not pursuing

Responsible entities, examples of activities,

a or explanation 

of status

Prepayment edits ● Plan sponsors may implement edits at the point of sale to control 

specific beneficiaries’ access to certain medications (see also 

drug utilization review (DUR) below).

For every prescription, plan sponsors must check a range of 

information, typically at the point of sale or distribution, such as 

drug interactions, incorrect amounts, and age or gender 

contraindications, such as a woman receiving medications 

prescribed only to men.

Screening ● Plan sponsors must verify beneficiaries’ Part D eligibility.

CMS finalized a rule in May 2014 establishing a Medicare 

enrollment requirement for Part D prescribers effective June 1, 

2015, and strengthening screening for ineligible incarcerated 

beneficiaries starting January 1, 2015.b

Prescription Drug 

Monitoring Programs 

(PDMP)c

○

(Prevention)

CMS guidance encourages but does not require prescribers to 

check PDMPs prior to prescribing and variations in state practices 

mean not all prescribers may be able to conduct checks.

Detection and 

monitoring (D&M)

Clinical guidelines 

(D&M)

○ CMS does not use clinical guidelines for Part D program integrity 

purposes, but other parts of Medicare provide training materials 

to providers, such as on the topic of coverage for Screening, Brief 

Intervention, and Referral to Treatment services to identify, 

reduce, and prevent problematic substance use, abuse, and 

dependence.

Collaboration (D&M) ● Plan sponsors are to share information with CMS regarding 

potentially fraudulent providers or schemes.

National Benefit Integrity (NBI) and O&E MEDICs convene 

conferences and share information on prescription drug fraud, 

waste, and abuse with plan sponsors, law enforcement, 

beneficiaries, and other stakeholders.

CMS sends memos to all plan sponsors about new Part D fraud 

schemes and potentially fraudulent providers that are also made 

available on the O&E MEDIC website. In addition, CMS sends the 

results of the NBI MEDIC’s data analyses directly to a plan 

sponsor if the NBI MEDIC identifies particular issues for that 

sponsor to address.

Compliance program ● Plan sponsors are to have effective compliance programs.

Data analysis ● The NBI MEDIC conducts data analysis projects, such as 

identifying deceased prescribers across all plan sponsors, and is 

to have clinical and analytic staff to conduct that work. The NBI 

MEDIC is also implementing predictive analytic models to identify 

potential fraud in the Part D program.

Plan sponsors are to have clinical and analytic staff, or contract 

with an entity that can provide such staff, to monitor and analyze 

data as part of their compliance programs. 
Appendix I: Status of Practices by CMS and Its 

Contractors to Address Prescription Drug 

Fraud, Waste, and Abuse

Page 28 GAO-15-66 Medicare Program Integrity

Category Practice

Status 

● Implemented

☼ Planned

○ Not pursuing

Responsible entities, examples of activities,

a or explanation 

of status

Drug utilization review 

(DUR)

● Plan sponsors are to review beneficiaries’ drug utilization patterns 

to identify potential patient harm and beneficiaries at risk for 

overutilization, and refer those beneficiaries for case 

management. Plan sponsors are to share information on these 

beneficiaries when they move from one Part D plan to another.

CMS also reports quarterly to plan sponsors the names of their 

beneficiaries overutilizing opioids and certain other drugs through 

CMS’s Overutilization Monitoring System. Plan sponsors must 

report to CMS quarterly how each identified case is addressed.

Education (D&M) ● O&E MEDIC, in coordination with CMS and the NBI MEDIC, 

provides training and materials to plan sponsors and others on 

how to identify potential fraud, waste, and abuse. For example, 

the O&E MEDIC, with CMS oversight, developed a Fraud 

Handbook that plan sponsors can access to learn about practical 

techniques and approaches on preventing, detecting, and 

investigating potential prescription drug fraud.

Recipient restriction 

programs (“lock-ins”)

○ CMS does not monitor Medicare beneficiaries through a “lock-in” 

program. The agency has reported that it has taken a beneficiarycentric approach that discourages such restrictions, and lacks the 

legislative authority to implement such a program, although the 

agency has stated that it is receptive to such authority. In 

addition, in 2012, CMS conducted a study that identified few 

beneficiaries (less than 1 percent) who would merit such a 

programd (see also DUR above).

PDMPsc (D&M) ☼ CMS is negotiating with a national organization to obtain access 

to its PDMP data.

Postpayment reviews ● Plan sponsors are to conduct certain postpayment reviews (see 

also DUR above).

Plan sponsors are also to provide beneficiaries with an 

explanation-of-benefits document to review for potential errors 

that also has a telephone number to report potential fraud.

Part D Recovery Audit Contractor is to review paid Part D claims 

to identify over- and underpayments and recoup overpayments, 

and refer potential fraud identified during that postpayment review 

to the NBI MEDIC.

Investigation and 

prosecution (I&P)

Collaboration (I&P) ● The NBI MEDIC responds to law enforcement requests for 

information and has participated in task forces and other 

investigative efforts.

The O&E MEDIC trains insurance investigators, law enforcement, 

and others.

CMS hosts quarterly meetings with a variety of stakeholders on 

prescription drug fraud, waste, and abuse.
Appendix I: Status of Practices by CMS and Its 

Contractors to Address Prescription Drug 

Fraud, Waste, and Abuse

Page 29 GAO-15-66 Medicare Program Integrity

Category Practice

Status 

● Implemented

☼ Planned

○ Not pursuing

Responsible entities, examples of activities,

a or explanation 

of status

Education (I&P) ● The O&E MEDIC, in consultation with the NBI MEDIC, provides 

educational materials on how to investigate potential fraud.

Enforcement ☼ Starting June 1, 2015, CMS may revoke prescribers’ Medicare 

enrollmentb and CMS officials reported they are starting to work 

with the Health and Human Services Office of Inspector General 

(OIG) to remove more providers from Medicare through 

“permissive exclusions.”e

Investigations/ 

investigative staff 

● Plan sponsors are to have staff who can identify potential fraud.

The NBI MEDIC is to have investigative staff knowledgeable of 

prescription drug fraud.

Reporting to law 

enforcement

● The NBI MEDIC is required to refer investigations to law 

enforcement.

CMS encourages but does not require plan sponsors to refer 

potential fraud to law enforcement and/or CMS, including the NBI 

MEDIC.f

PDMPsc (I&P) ☼ CMS is negotiating with certain states to obtain access to their 

PDMP data.

Source: GAO analysis of CMS documents and interviews with officials. | GAO-15-66

a

This table does not include all instances of CMS’s activities to implement the practices we identified.

b

Once prescribers are enrolled, the rule provides that CMS will be able to revoke prescriber billing 

privileges for certain abuses of the program or noncompliance with applicable licensure requirements. 

To implement the exclusion of incarcerated individuals from Part D coverage, the rule redefined 

eligible Medicare service areas to exclude facilities in which individuals are incarcerated. See 

Medicare Program: Contract Year 2015 Policy and Technical Changes to the Medicare Advantage 

and the Medicare Prescription Drug Benefit Programs. 79 Fed. Reg. 29,844 (May 23, 2014).

c

PDMPs are state-based programs that operate electronic databases that gather information from 

pharmacies on certain dispensed prescriptions. Authorized users access the information about a 

patients’ prescription drug history, such as whether a patient has multiple opioid prescriptions from 

multiple providers.

d

In 2012, CMS analyzed Part D data to identify beneficiaries receiving potentially unsafe doses of 

prescription opioids for 90 or more consecutive days, excluding beneficiaries with cancer or in 

hospice care. CMS concluded that .71 percent (224,964) of all Part D beneficiaries were at high risk 

for potential adverse effects and had a high likelihood of inappropriately using opioids. CMS also 

analyzed the number of prescribers and pharmacies associated with these beneficiaries’ opioid 

prescriptions and found that .07 percent (22,222) of Part D beneficiaries received high dosages of 

opioids from at least four prescribers and at least four pharmacies.

e

Under section 1128 of the Social Security Act, exclusions from federal health programs are 

permissive under certain circumstances and mandatory in others. 42 U.S.C. § 1320a-7. Permissive 

exclusions are allowed for a variety of reasons, including licensure suspension, surrender, or 

revocation, or misdemeanor controlled substance conviction. Mandatory exclusions are required for 

felony convictions relating to health care fraud or controlled substances and any convictions relating 

to patient abuse/neglect or to the delivery of Medicare or state health care programs.
Appendix I: Status of Practices by CMS and Its 

Contractors to Address Prescription Drug 

Fraud, Waste, and Abuse

Page 30 GAO-15-66 Medicare Program Integrity

f

In a March 2014 report, OIG reiterated previous recommendations that it had made to CMS to amend 

regulations to require Part D plan sponsors to report to CMS their identification of and response to 

potential fraud and abuse incidents. CMS did not concur with this recommendation, citing concerns 

about creating duplicative reporting. See Department of Health and Human Services Office of 

Inspector General, Less than Half of Part D Sponsors Voluntarily Reported Data on Potential Fraud 

and Abuse, OEI-03-13-00030 (Washington, D.C.: March 2014). CMS officials told us in September 

2014 that if the agency were to impose such a requirement, it would be able to evaluate sponsors’ 

compliance with the reporting requirement, but not whether the reports identified actual fraud as 

defined by law enforcement.
Appendix II: Comments from the Department 

of Health and Human Services

Page 31 GAO-15-66 Medicare Program Integrity

Appendix II: Comments from the Department 

of Health and Human Services
Appendix II: Comments from the Department 

of Health and Human Services

Page 32 GAO-15-66 Medicare Program Integrity
Appendix II: Comments from the Department 

of Health and Human Services

Page 33 GAO-15-66 Medicare Program Integrity
Appendix III: GAO Contact and Staff 

Acknowledgments

Page 34 GAO-15-66 Medicare Program Integrity

Kathleen M. King, (202) 512-7114 or kingk@gao.gov.

In addition to the contact named above, Karen Doran, Assistant Director; 

Elizabeth Morrison; Lisa Rogers; Eden Savino; and Jennifer Whitworth 

made key contributions to this report.

Appendix III: GAO Contact and Staff 

Acknowledgments 

GAO Contact

Staff 

Acknowledgments

(291181)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.