Page 1 GAO-16-365R Medicare Program

441 G St. N.W.

Washington, DC 20548

April 13, 2016

Congressional Requesters

Medicare: Opportunities Exist to Recover Potential Overpayments to Providers with 

Criminal Backgrounds

In June 2015, we issued a report on Medicare’s provider and supplier enrollment screening 

procedures to determine the extent to which the Provider Enrollment, Chain and Ownership 

System (PECOS) is vulnerable to fraud. PECOS is a centralized database designed to contain 

providers’ and suppliers’ enrollment information. In our report, we found that two Centers for 

Medicare & Medicaid Services (CMS) procedures appear to be working to screen for providers 

and suppliers listed as deceased or excluded from participating in federal programs or health 

care–related programs. However, we identified weaknesses in two of CMS’s procedures related 

to verifying provider practice locations and physician licensure status.1 We recommended that 

CMS incorporate flags into its software to help identify questionable addresses, revise its 2014 

guidance for verifying practice locations, and collect additional license information.2

This correspondence provides the results of our assessment of CMS’s procedures to verify 

criminal-background information for providers and suppliers in PECOS, as well as a description 

of the steps that CMS has taken, in the interim, to update its criminal-background check 

process. We were not able to incorporate this assessment into our June 2015 report because of 

the length of time that it took to obtain the data, assess their reliability, and analyze the results. 

Our findings are based on data from 2013, the most-current data available to us at the time of 

our review. CMS implemented new procedures in April 2014 to update its criminal-background 

check process. Although CMS has new procedures in place, the results of our review of the 

2013 data provide an opportunity for CMS to recover potential overpayments that were made 

prior to putting the revised procedures in place.

To assess the extent to which CMS has controls in place to verify criminal-background 

information for providers and suppliers in PECOS, we matched the PECOS data of 

approximately 1.2 million unique physicians and nonphysicians, such as physician assistants, 

clinical social workers, and nurse practitioners, as of March 2013, to data from the Federal 

Bureau of Prisons and the National Sex Offender Registry as of February 2014, by Social 

Security number, name, and date of birth, to identify potentially ineligible providers. We 

reviewed CMS supporting documentation and interviewed agency officials to understand how 

CMS controls were applied to Medicare providers and suppliers that we identified as matches to 

 1

See GAO, Medicare Program: Additional Actions Needed to Improve Eligibility Verification of Providers and 

Suppliers, GAO-15-448 (Washington, D.C.: June 25, 2015).

2

The Department of Health and Human Services (HHS) concurred with two of the three recommendations, but did not 

agree with the recommendation to revise its guidance because it believed that incorporating software flags would be 

sufficient. However, we continue to believe the recommendation is valid. As of February 2016, HHS stated that it 

started to implement one of the three recommendations; however, it is too early for us to determine whether the 

agency actions outlined in its official comments would fully address the intent of the recommendations.
Page 2 GAO-16-365R Medicare Program

the law-enforcement databases. We contacted the Medicare Administrative Contractors (MAC) 

to obtain updates on the providers’ status in PECOS as of September 2015. On the basis of 

MACs’ responses, we determined whether the providers had been removed from the Medicare 

program subsequent to March 2013 or whether they remained in the system.

We also calculated Medicare claims that were paid to providers while they were potentially 

ineligible. We assessed the reliability of the PECOS, Federal Bureau of Prisons, National Sex 

Offender Registry, and Medicare claims data by reviewing relevant documentation, interviewing 

knowledgeable agency officials, and performing electronic testing to determine the validity of 

specific data elements in the databases, and determined that these databases were sufficiently 

reliable for the purpose of our review. We did not review about 316,000 durable medical 

equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers, Home Health Agencies 

(HHA), or other providers that did not have an individual Social Security number, name, and 

date of birth associated with their PECOS profiles in the data we received, because these data 

elements were necessary to facilitate our data matching.

In order to provide an overview of the steps that CMS has taken to update its criminalbackground check process, we reviewed federal regulations and CMS procedural manuals that 

outline the procedures that MACs should use to determine provider and supplier enrollment 

eligibility. We met with CMS officials to better understand CMS controls in verifying criminalbackground information on providers and suppliers prior to April 2014 and controls implemented 

after April 2014 under CMS’s new validation procedure. We did not assess the new procedure 

for effectiveness because the data available to us were based on procedures in place in 2013. 

Although CMS has new procedures in place, the results of our review of the 2013 data are still 

outstanding and provide an opportunity for CMS to recover potential overpayments from that 

time.

We conducted this performance audit from June 2015 to April 2016 in accordance with 

generally accepted government auditing standards. Those standards require that we plan and 

perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that the evidence obtained 

provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

CMS requires Medicare providers and suppliers to have an enrollment record in the Internetbased PECOS before they bill for services provided to Medicare beneficiaries.3 PECOS is a 

centralized database that contains enrollment information for providers and suppliers. According 

to CMS, about 1.9 million providers and suppliers were listed in PECOS, as of December 2015. 

In addition, CMS is responsible for developing provider and supplier enrollment procedures to 

help safeguard the program from fraud, waste, and abuse. CMS has contracted with MAC and 

the National Supplier Clearinghouse (NSC) to manage the enrollment process. MACs are 

responsible for verifying provider and supplier application information in PECOS before the 

providers and suppliers are enrolled in Medicare. The NSC is responsible for verifying Medicare 

DMEPOS supplier’s information. CMS requires providers and suppliers to revalidate the 

 3

The term “provider” refers collectively to institutional providers such as hospitals and health-care facilities, as well as 

physicians and nonphysician practitioners who provide health-care services to Medicare beneficiaries. Providers also 

include organ-procurement organizations, skilled-nursing facilities, hospice, and end-stage renal disease centers. The

term “supplier” refers to certain Part B entities such as ambulance-service providers, mammography centers, and 

portable X-ray facilities. Suppliers also include entities that supply Medicare beneficiaries with Medicare DMEPOS

such as walkers and wheelchairs.
Page 3 GAO-16-365R Medicare Program

accuracy of their enrollment information with the relevant MAC every 5 years to maintain billing 

privileges. DMEPOS suppliers must revalidate information with the NSC every 3 years.4 CMS 

may deny or revoke a provider’s or supplier’s enrollment in the Medicare program if, within the 

10 years before enrollment or revalidation of enrollment, the provider, supplier, or any owner or 

managing employee of the provider or supplier was convicted of a federal or state felony 

offense, including certain felony crimes against persons, that CMS has determined to be 

detrimental to the best interests of the program and its beneficiaries.5

Opportunities Exist to Recover Potential Overpayments from a Few Providers Who 

Entered Medicare before CMS Implemented New Background Checks

Opportunities exist for CMS to recover about $1.3 million in potential overpayments to 16 out of 

66 potentially ineligible providers with criminal backgrounds who were enrolled in Medicare 

before CMS implemented more extensive background check processes in April 2014. These 16 

providers had Medicare claims paid to them while they were potentially ineligible. However, we 

plan to refer all 66 providers to CMS for further investigation. CMS can recover outstanding 

potential overpayments made to potentially ineligible Medicare providers within: 1 year of the 

initial determination or redetermination for any reason; within 4 years of the initial determination 

or redetermination for good cause such as new and material evidence; or at any time if reliable 

evidence exists that the initial determination was procured by fraud. In addition, CMS can 

revoke certain providers and suppliers from the Medicare program if it discovers that providers 

or suppliers failed to self-report any final adverse legal action within 30 days, or if it discovers 

that providers, suppliers, or any owner or managing employee of the provider or supplier was 

convicted of a federal or state felony, such as felony crimes against persons, within the last 10 

years preceding revalidation. Providers and suppliers can also be revoked from Medicare based 

on a federal exclusion or debarment, license suspension or revocation, or determination that the 

provider or supplier is no longer operational.6

Before CMS implemented new procedures for reviewing the criminal backgrounds of existing 

and prospective Medicare providers and suppliers in April 2014, the agency relied on verifying 

applicants’ self-reported adverse legal actions by checking whether providers and suppliers had 

previously lost their licenses because of a conviction such as a crime against a person. It did so 

by checking state medical-licensing boards in the state where the provider was enrolling and 

any other state where the provider self-reported an adverse legal action. CMS also checked 

whether the Department of Health and Human Services (HHS) Office of Inspector General 

(OIG) had excluded providers and suppliers from participating in federal health-care programs. 

According to CMS, it also relied on Zone Program Integrity Contractors (ZPIC) to identify 

providers and suppliers with a conviction history. ZPICs are required to investigate allegations of 

fraud made by beneficiaries, providers, CMS, OIG, and other sources; proactively identify 

incidents of potential fraud that exist within its service area; and explore available sources of 

fraud leads. Through their investigations, the ZPICs may determine that a particular provider’s 

or supplier’s Medicare billing privileges should be revoked, such as when a provider has a 

 4

In 2010, Congress passed the Patient Protection and Affordable Care Act (PPACA), which provided CMS with 

increased authority to combat potential fraud, waste, and abuse in Medicare. PPACA requires all existing provider 

and supplier information to be revalidated by 2015. PPACA, § 6401, 124 Stat. 119, 749, amended by § 10603, 124 

Stat. 119, 1006 (codified at 42 U.S.C. § 1395cc(j)). CMS retains the authority to require a provider or supplier to 

revalidate off-cycle when certain compliance-related concerns arise.

5

42 C.F.R. § 424.535 and 42 C.F.R. § 424.530.

6

42 C.F.R. § 424.535.
Page 4 GAO-16-365R Medicare Program

felony conviction, and would refer the case to CMS for further review and action. Using these 

methods, CMS identified providers it deemed ineligible for the program and could remove. 

However, CMS did not always have access to federal or state offense information that identified 

the cause of a provider’s or supplier’s license suspension or exclusion from participating in 

federal health-care programs, which could have led to an earlier ineligibility date.

We found instances of providers who were enrolled in PECOS as of March 2013—that is, 

providers who enrolled before CMS implemented new controls in April 2014—who had billed 

Medicare for services that took place after the effective date of conviction that ultimately made 

them ineligible for the program. Not all of the providers listed in the Federal Bureau of Prisons or 

National Sex Offender Registry data are automatically revoked by CMS. Depending on the 

severity of the offense and whether the applicant self-reported the offense, a provider may still 

be allowed to enroll into the Medicare program. To review the criminal backgrounds of providers 

in PECOS, we compared a list of approximately 1.2 million unique providers in PECOS as of 

March 2013 to Federal Bureau of Prisons and National Sex Offender Registry data as of 

February 2014.7 We found that 146 providers either were incarcerated for a federal offense, 

such as embezzlement and income-tax evasion, or were convicted of a crime that required them 

to register as a sex offender, such as sexual battery or sexual assault.8 Of these providers, we 

determined that CMS had removed 112 providers from the Medicare program as a result of 

procedures in place prior April 2014. Of these 112, CMS revoked 77 providers for felony 

conviction, licensure, or exclusion issues and deactivated 35 for not billing the program 

consecutively within a year, not responding to revalidation requests, or requesting to voluntarily 

withdraw from the program.9 See figure 1 for a summary of actions taken by CMS.

 7

Our review focused on unique physicians and nonphysicians, such as physician assistants, clinical social workers, 

and nurse practitioners. As previously mentioned, we did not review suppliers such as DMEPOS suppliers, HHA, or 

providers that did not have an individual Social Security number, name, and date of birth associated with their 

PECOS profiles.

8

Federal offenses, resulting in an incarceration in the Federal Bureau of Prisons system, included filing false 

corporate tax returns, distributing controlled substances, conspiring to commit health-care fraud, and committing wire 

and mail fraud, among others. Felonies that required an individual to register as a sex offender included illegal use of 

a minor in nudity-oriented material, gross sexual imposition, and sexual exploitation of a minor, among others. 

Because CMS is only required to revoke providers with specifically enumerated health-care related offenses, not all 

providers listed in the Federal Bureau of Prisons or the National Sex Offender Registry data would be automatically 

revoked by CMS. Depending on the severity of the offense and whether the applicant self-reported the offense, a 

provider may be allowed to still enroll into the Medicare program.

9

Deactivation is another tool that CMS has in place outside of the criminal verification process that can assist in 

removing the billing privileges of potentially ineligible providers not identified through criminal background controls. 

When providers or suppliers are in deactivation status, their billing privileges are stopped; however, they can be 

restored upon submission of updated information to PECOS. 
Page 5 GAO-16-365R Medicare Program

Figure 1: CMS Actions for the 146 Providers Included in Our Review with Criminal Backgrounds between 

January 1997 and September 2015

Of the 112 providers that CMS removed from the Medicare program, we found that 52 either 

had committed: (1) a felony, (2) an offense that is part of section 1128 of the Social Security 

Act,10 or (3) an offense that is considered to be a misdemeanor in one state and a felony in 

another.11 All of these offenses occurred before the removal effective date that was provided to 

us by the MACs. Because CMS did not initially have, and therefore did not use, the original 

felony conviction date that ultimately made the provider ineligible to participate in Medicare, it 

missed an opportunity to revoke these providers at an earlier date. Instead, CMS officials used 

other information that CMS identified, such as reported dates of medical-license suspensions, 

HHS OIG exclusion dates, and deactivation dates to calculate effective dates to remove 

providers from Medicare. Although CMS is not required to revisit these revocations or 

deactivations after removing the providers, doing so would assist the agency in determining 

whether earlier felony convictions, identified through automated screening, provide additional 

 10Under section 1128 of the Social Security Act, exclusions from federal health programs are permissive under 

certain circumstances and mandatory in others. 42 U.S.C. § 1320a-7. Mandatory exclusions are required for felony 

convictions relating to health-care fraud or controlled substances, and any convictions relating to patient 

abuse/neglect or to the delivery of Medicare or state health-care programs. 

11As mentioned above, CMS may deny or revoke a providers’ or supplier’s enrollment in the Medicare program if, 

within the 10 years before enrollment or revalidation of enrollment, the provider, supplier, or any owner or managing 

employee of the provider or supplier was convicted of a federal or state felony offense, including certain felony crimes 

against persons, that CMS has determined to be detrimental to the best interests of the program and its beneficiaries.
Page 6 GAO-16-365R Medicare Program

information on whether an earlier effective date for revocation from the program is applicable, 

and whether a potential overpayment occurred.

12

Of these 52 potentially ineligible providers, we identified 10 providers that were paid about 

$1.1 million by Medicare through the fee-for-service program between the time they were 

initially convicted of a crime and the time that they were officially removed from the program. We 

will refer all 52 providers to CMS for further review and action, as appropriate. Current CMS 

policies allow the agency to revisit removal actions to assess whether there are additional 

opportunities to recoup potentially overpayments.

For the remaining 34 providers that matched our federal criminal databases, but that CMS did 

not remove, we examined whether the providers engaged in actions that would potentially 

disqualify them from the Medicare program. In September 2015, we followed up with the MACs 

to determine the status of these 34 providers still active in PECOS. On the basis of the MACs’ 

responses, 20 out of the 34 providers remained active in PECOS because the provider selfreported their adverse legal action; CMS did not deem the adverse legal action to be detrimental 

to the Medicare program; or, the action occurred more than 10 years prior to the date the 

provider was enrolled or revalidated. CMS did not remove the remaining 14 providers because 

the providers did not self-report their adverse legal actions and CMS was not aware of the 

provider’s adverse legal actions. We found that the 14 providers were convicted and 

incarcerated for a federal offense or were convicted of a crime that required them to register as 

a sex offender, potentially falling under CMS’s authority to revoke them from the Medicare 

program. Six out of these 14 providers were paid by Medicare about $195,000 during the year 

after their conviction, while the other 8 were not paid anything by Medicare.13 As previously 

stated, CMS has discretionary authority to revoke providers from the Medicare program if, in the 

preceding 10 years, the provider, supplier, or any owner, or managing employee of the provider 

or supplier was convicted of a federal or state felony offense that CMS has determined to be 

detrimental to the best interest of the Medicare program and its beneficiaries.

14 While some of 

the 14 providers we identified had similar categories of offenses as those that were removed—

such as sex-related offenses as shown in table 1—without additional details on these cases, we 

cannot determine whether the offenses of the 14 providers warranted that these providers be 

revoked from the Medicare program. We will refer all 14 cases to CMS for further review.

As previously mentioned, we plan to refer 66 potentially ineligible providers to CMS. This group 

is made up of 52 providers whose offenses occurred before the removal effective date that was 

provided to us by the MACs and 14 providers that CMS did not remove. Out of the 66 providers 

that we plan to refer, 16 were paid about $1.3 million by Medicare through the fee-for-service 

program. Specifically, 10 providers were paid about $1.1 million between the time they were 

initially convicted of a crime and the time that they were officially removed from the program, 

and six other providers that were not removed were paid about $195,000 during the year after 

their conviction.

 12 In providing technical comments to a copy of the draft correspondence, CMS noted that it is able to backdate the 

revocation to the date of the offense regardless of when it is found.

13For the 14 providers that were not revoked, we calculated the Medicare claims paid from the conviction date to a 

year after their conviction date. We used 1 year to calculate the Medicare claims paid because CMS regulations allow 

for the revocation of a provider from the Medicare program under a reenrollment bar that lasts a minimum of 1 year. 

The Medicare claims information includes the fee-for-service program only.

1442 C.F.R. § 424.535. 
Page 7 GAO-16-365R Medicare Program

Table 1: Types of Offenses Committed by All 146 Providers That We Either Referred or Did Not Refer for 

Further Review 

Referred Not referred

Offense descriptiona Later effective 

date 

Centers for Medicare & 

Medicaid Services 

(CMS) never identified 

for removal 

CMS determined was 

eligible, used an 

earlier effective date, 

or out of scope 

Sex-related offensesb 20 7 41

Drug and controlled substance-related 

offensesc 11 2 6

Health-care related offensesd 11 1 18

Mail and wire fraud 1 3

Theft/embezzlement-related offensese 1 1

Possession of firearm 1 2

Assault 1

Conspiracy to commit bribery 1

Conspiracy 1

Conspiracy to pay and receive healthcare kickbacks1 2

Anti-kickback violation 1

Obscene communication/material 1 2

Crimes against person 1

Income-tax evasion 4 2 2

Illegal remunerations 1

Subtotal 52 14 80

Total referred / not referred 66 80

Source: GAO. I GAO-16-365R

a

The determination of whether to revoke the billing privileges of an individual provider or supplier varies depending on the facts and 

circumstances of each application. CMS may revoke the billing privileges of a provider or supplier from the Medicare program under 

the specific authorities listed in 42 C.F.R. § 424.535.

b

Sex-related offenses include rape, statutory rape, sex assault, sex offense against child, indecent exposure to adult, sex distribution 

of visual depiction of minor engaging in sexually explicit conduct, distribution of child pornography, possession of child pornography, 

lewd or lascivious acts with minor, sex offense, commercial sex, exploitation, and enticement.

c

Drug and controlled substance–related offenses include distribution of controlled substances, conspiracy to distribute controlled 

substance, conspiracy to distribute drugs, conspiracy to manufacture a controlled substance, conspiracy to import and distribute 

human growth hormone, and receiving in interstate commerce a misbranded drug.

d

Health care–related offenses include health-care fraud, conspiracy to commit health-care fraud, and false statement related to 

health-care matters.

e

Theft- and embezzlement-related offenses include theft of government property and theft and embezzlement of employee benefits.

CMS Has Implemented Additional Steps to Facilitate Criminal-Background Checks on 

Medicare Providers

In April 2014, CMS implemented steps that provide more information on the criminal 

backgrounds of existing and prospective Medicare providers and suppliers than it obtained 

previously. Specifically, in order to improve its verification process, CMS supplemented its 

criminal-background controls by screening provider and supplier criminal backgrounds through 
Page 8 GAO-16-365R Medicare Program

an automated screening process.15 Enclosure I outlines CMS’s current criminal verification 

process for Medicare providers and suppliers.

Under this process, MACs are to review an applicant’s self-reported license information and 

whether the applicant has been excluded from participating in federal health-care programs. In 

addition, CMS receives information from ZPICs, discussed earlier in this correspondence, which 

provide a conviction history on providers and suppliers they investigate. The automatedscreening contractor is to supplement these controls by conducting criminal-background checks 

on providers, suppliers, and organization principals (i.e., individuals with 5 percent or more 

ownership in the business). The contractor uses third-party vendor applications available to the 

public to conduct the criminal-background checks.16 As a result, CMS and its contractors obtain 

greater access to data about federal and state offenses and the ability to conduct a more 

comprehensive review of provider and supplier criminal backgrounds than in the past.

According to CMS, the automated-screening contractor began with an initial screening of about 

1.6 million active providers and suppliers in PECOS. The initial screening included checking for 

federal and state offenses, among other checks. According to CMS, the contractor also 

continually monitors all providers and suppliers by conducting weekly screenings of about 

12,000 providers and suppliers per week. This continual monitoring consists of verifying that 

licenses remain current and whether any new offenses exist. The 12,000 providers and 

suppliers include a combination of new Medicare enrollments, revalidations, and changes of 

providers’ or suppliers’ PECOS enrollment information. The weekly screenings are prioritized by 

initial enrollments over updates and individuals over organizations.17 In addition, the contractor

applies criteria provided by CMS, such as selecting felony convictions that occurred within the 

past 10 years, to narrow search results and focus on the offenses that CMS would more likely 

deem as grounds for making a provider or supplier ineligible to participate in Medicare. The 

contractor then flags providers or suppliers with new offenses and reviews their information to 

determine whether to recommend that CMS take action. Finally, the contractor compiles the 

information into a weekly criminal-background report and provides it to CMS.

According to CMS officials, they review the weekly criminal-background report and make a final 

determination on whether the provider or supplier should be revoked from the Medicare 

program based on the type of felony conviction and other supporting information. As mentioned 

previously, an evaluation of the effectiveness of the new automated-screening procedure was 

beyond the scope of this audit. However, on the basis of information provided by CMS, the 

agency’s new procedures provide more information regarding the provider’s or the supplier’s 

offenses, which could lead to a licensure revocation or other disqualifier from Medicare. Further, 

CMS officials report that the agency uses this information to determine whether the earliest date 

is applicable as the effective date of the provider’s or supplier’s revocation. If CMS implements 

 15CMS awarded a contract in 2011 to an automated-screening contractor with the intent to automate functions that 

the MACs previously performed manually, which included criminal-background verifications. The automatedscreening contractor was tasked with developing and applying methods to automate the verification of all existing and 

newly enrolling providers and suppliers. These verifications included checking whether providers and suppliers have 

valid licenses and accreditations, whether they are on the HHS OIG list of providers and suppliers excluded from 

participating in federal health-care programs, and whether they have criminal-background histories that would prevent 

them from participating in the Medicare program.

16A third-party vendor application is a service that collects data on federal and state criminal offenses. 

17The MACs also have the ability within PECOS to override the automated selection process and force a specific 

enrollment to the front of the screening priority queue.
Page 9 GAO-16-365R Medicare Program

this process as designed, the new procedures should help to address the limitation that we 

identified in this correspondence, where in some cases CMS revoked providers and suppliers 

using effective dates that occurred months or years after the provider or supplier committed the 

potentially disqualifying offense.

Agency Comments and Our Evaluation

We provided a draft of this correspondence to HHS for comment. In its written comments, 

reproduced in enclosure II, the agency stated that it is strongly committed to program integrity 

efforts in Medicare and described its efforts to strengthen provider enrollment and screening. 

HHS stated that it will review the list of potentially ineligible providers we referred to CMS and 

take any appropriate actions. However, in its comments, HHS only made reference to the 14

providers we identified as potentially requiring revocation from the Medicare program. These 14

providers, who CMS did not yet remove, received about $195,000 in Medicare funds during the 

year after their convictions—while they were potentially ineligible because of convictions that 

were either not identified or not reported to CMS. In line with HHS’s commitment to strengthen 

Medicare program integrity, we also encourage the agency to review the 52 other providers that 

we reported in our correspondence that we will refer to the agency. These providers were 

already removed from the Medicare program by CMS, but had offenses that occurred before the 

effective date CMS used to remove them from the program. Some of these providers were paid 

a total of $1.1 million by CMS for providing services during that potentially ineligible time. Along 

with its letter, HHS also provided technical comments that were incorporated into this 

correspondence, as appropriate. 

- - - - -

We are sending copies of this correspondence to appropriate congressional committees, the 

Acting Administrator of CMS, and other interested parties.

If your or your staff have any questions about this correspondence, please contact me at (202) 

512-6722 or badgdoyans@gao.gov. Contact points for our Offices of Congressional Relations 

and Public Affairs may be found on the last page of this correspondence. GAO staff who made 

key contributions to this correspondence include Latesha Love (Assistant Director), Ariel Vega 

(Analyst-in-Charge), and Gloria Proa.

Seto J. Bagdoyan

Director, Forensic Audits and Investigative Service

Enclosures – 2
Page 10 GAO-16-365R Medicare Program

List of Requesters

The Honorable Ron Johnson

Chairman

The Honorable Thomas R. Carper

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Susan M. Collins

Chairman

The Honorable Claire McCaskill

Ranking Member

Special Committee on Aging

United States Senate

The Honorable Orrin G. Hatch

Chairman

Committee on Finance

United States Senate

The Honorable Sheldon Whitehouse

United States Senate
Page 11 GAO-16-365R Medicare Program

Enclosure I: CMS’s Criminal-Background Verification Process

In order to improve its verification process, in April 2014 the Centers for Medicare & Medicaid 

Services (CMS) supplemented its criminal-background controls by screening provider and 

supplier criminal backgrounds through an automated screening process. Figure 2 outlines 

CMS’s current criminal-verification process for Medicare providers and suppliers.

Figure 2: CMS’s Current Criminal-Background Verification Process
Page 12 GAO-16-365R Medicare Program

Enclosure II: Agency Comments from the Department of Health and Human Services
Page 13 GAO-16-365R Medicare Program
Page 14 GAO-16-365R Medicare Program

(100162)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at www.gao.gov.

Contact:

Website: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Please Print on Recycled Paper.