MEDICARE 

PROGRAM 

INTEGRITY

CMS Continues 

Efforts to Strengthen 

the Screening of 

Providers and 

Suppliers 

Report to the Chairman, Committee on 

Finance, U.S. Senate

April 2012

GAO-12-351

United States Government Accountability Office

GAO
United States Government Accountability Office

Highlights of GAO-12-351, a report to the 

Chairman, Committee on Finance, U.S. 

Senate

April 2012

MEDICARE PROGRAM INTEGRITY

CMS Continues Efforts to Strengthen the Screening 

of Providers and Suppliers 

Why GAO Did This Study

According to the Centers for Medicare 

& Medicaid Services (CMS)—the 

agency within the Department of 

Health and Human Services (HHS) 

that administers the Medicare 

program—more than 1.5 million health 

providers and suppliers of medical 

equipment were enrolled in the 

Medicare program in 2011, and 30,000

more enroll each month. CMS has

established Medicare enrollment 

standards and procedures intended to 

ensure that only qualified providers 

and suppliers can enroll. While most 

providers and suppliers pose a limited 

risk to the Medicare program, our 

previous work found persistent

weaknesses in CMS’s Medicare 

enrollment standards and procedures 

that increased the risk of enrolling 

entities intent on defrauding the 

program. In 2010, the Patient 

Protection and Affordable Care Act 

(PPACA) authorized CMS to 

implement procedures to strengthen 

the Medicare enrollment process. 

GAO was asked to review CMS’s 

Medicare provider enrollment 

procedures. In this report, GAO 

describes (1) how CMS and its 

contractors use provider and supplier 

enrollment information to prevent 

improper payments and factors that 

may affect the usefulness of this 

information, and (2) the extent to which 

CMS has implemented new provider 

and supplier enrollment screening 

procedures since the enactment of 

PPACA. To do so, GAO reviewed 

relevant regulations and documents, 

and interviewed officials from CMS and 

a sample of four of the agency’s 

contractors based on the volume of 

claims they processed and the status 

of their contracts with CMS. 

What GAO Found

Medicare claims are screened against enrollment information, using automated

enrollment-related prepayment edits, in an effort to prevent improper payments to 

ineligible providers and suppliers—such as those that are no longer active in the 

Medicare program or are not properly licensed to provide the services for which 

they have submitted claims. Officials with the contractors we interviewed 

described the use of several types of prepayment edits to ensure that claims data 

are valid. For example, verification edits are intended to check the provider’s 

National Provider Identifier (NPI), which indicates whether the claim was 

submitted by an active provider or supplier. However, factors such as the 

frequency with which contractors have updated provider and supplier enrollment 

information and limitations of the data used may affect the timeliness and 

accuracy of data used to screen claims—in turn limiting the ability of the edits to 

prevent improper payments from occurring. For example, to update information 

maintained in the Provider Enrollment, Chain and Ownership System (PECOS)—

CMS’s centralized database for Medicare enrollment information—the 

contractors have relied on a variety of data sources that vary in the frequency 

with which they are updated and the ease with which the data can be accessed. 

We have previously reported concerns about the accuracy of the enrollment 

information in PECOS and recommended CMS increase its oversight of its 

contractors’ provider and supplier enrollment activities. CMS acknowledged 

these concerns and indicated that the agency is working to address these issues.

Since the enactment of PPACA, CMS has implemented some new provider and 

supplier enrollment screening procedures and other measures intended to 

strengthen the existing Medicare enrollment process. New screening procedures 

include the designation of three different levels of risk of fraud, waste, and abuse, 

with categories of providers and suppliers assigned to limited, moderate, and 

high-risk levels—and those in the highest level subject to the most rigorous 

screening. For example, providers and suppliers in all three risk levels must 

undergo licensure checks, while those in moderate- and high-risk levels are 

subject to unannounced site visits. In addition, CMS implemented new 

application fees for some providers and suppliers. CMS also added two new 

Medicare contractors, an automated screening contractor and a site visit 

contractor, to conduct enhanced enrollment screening and site visits. CMS 

officials said that they expect the new automated screening contractor to identify 

additional data sources against which to screen, such as financial, tax, and 

business data sources. CMS’s implementation of some additional enrollment 

screening procedures is still in progress. For example, by the end of 2012, CMS 

plans to contract with two Federal Bureau of Investigation-approved contractors 

to conduct fingerprint-based criminal background checks of high-risk providers 

and suppliers. In addition, the agency plans to extend the requirement for surety 

bonds to high-risk providers and suppliers beyond those already required of 

suppliers of durable medical equipment, orthotics and supplies. A surety bond 

guarantees that if a provider or supplier does not fulfill its obligation to Medicare, 

CMS can recover its losses via the surety bond. 

HHS reviewed a draft of this report and in its written comments noted CMS’s 

ongoing efforts to improve provider and supplier enrollment procedures. HHS 

also provided technical comments, which were incorporated as appropriate.

View GAO-12-351. For more information, 

contact Kathleen M. King at (202) 512-7114 or 

kingk@gao.gov. 
Page i GAO-12-351 Provider and Supplier Medicare Enrollment

Letter 1 

Background 6

Claims Are Screened against Enrollment Information to Prevent 

Improper Payments, but Prevention Depends on Timely and 

Accurate Information 13

CMS Has Implemented Some New Enrollment Screening 

Procedures Since PPACA, While Others Remain in Progress 18

Concluding Observations 27

Agency Comments 28

Appendix I Comments from the Department of Health and Human Services 30

Appendix II GAO Contact and Staff Acknowledgments 32

Table

Table 1: Categories of Medicare Providers and Suppliers 

Designated by Risk Level for Enrollment Screening 20

Figure

Figure 1: Medicare Enrollment and Claims Payment Process Prior 

to January 2012 11

Contents
Page ii GAO-12-351 Provider and Supplier Medicare Enrollment

Abbreviations

A/B MAC Medicare Administrative Contractor servicing both Part A

 and Part B lines of business 

CHIP State Children’s Health Insurance Program

CMS Centers for Medicare & Medicaid Services 

CPI Center for Program Integrity 

DME durable medical equipment 

DMEPOS durable medical equipment, prosthetics, orthotics, and 

 supplies 

DME MAC Durable Medical Equipment Medicare Administrative 

 Contractor 

DMF Death Master File 

EDI Electronic Data Interchange 

EPLS Excluded Parties List System 

FBI Federal Bureau of Investigation 

FFS fee-for-service 

HHS Department of Health and Human Services 

HIPAA Health Insurance Portability and Accountability Act 

IRS Internal Revenue Service 

LEIE List of Excluded Individuals/Entities 

NPI National Provider Identifier 

NSC National Supplier Clearinghouse 

OIG Office of Inspector General 

PECOS Provider Enrollment, Chain and Ownership System 

PPACA Patient Protection and Affordable Care Act 

QASP Quality Assurance Surveillance Plan 

SSA Social Security Administration

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-12-351 Provider and Supplier Medicare Enrollment

United States Government Accountability Office

Washington, DC 20548

April 10, 2012

The Honorable Max Baucus

Chairman

Committee on Finance

United States Senate

Dear Mr. Chairman:

For more than 20 years, we have designated Medicare as a high-risk 

program because of serious management challenges due to its size, 

complexity, and susceptibility to fraud, waste, abuse, and improper 

payments.1 In 2011, Medicare covered 48.4 million individuals 65 years 

and older and eligible individuals with disabilities, and total Medicare 

program expenditures were $565 billion.2 For fiscal year 2011, the 

Department of Health and Human Services (HHS) estimated the agency 

made improper payments of nearly $29 billion in the Medicare fee-forservice (FFS) program.3

More than 1.5 million health providers and suppliers of medical equipment 

were enrolled in the Medicare program in 2011, according to the Centers 

 

1

Fraud represents intentional acts of deception with knowledge that the action or 

representation could result in an inappropriate gain. Waste includes inaccurate payments 

for services, such as unintentional duplicate payments. Abuse represents actions 

inconsistent with acceptable business or medical practices. An improper payment is any 

payment that should not have been made or that was made in an incorrect amount 

(including overpayments and underpayments) under statutory, contractual, administrative, 

or other legally applicable requirements. In 1990, we began to report on government 

operations that we identified as “high risk” for serious weaknesses in areas that involve 

substantial resources and provide critical services to the public. See GAO, High-Risk 

Series: An Update, GAO-11-278 (Washington, D.C.: February 2011).

2

Medicare consists of four parts. Medicare Part A covers inpatient hospital care, skilled 

nursing facility care, some home health care services, and hospice care. Part B services 

include physician and outpatient hospital services, diagnostic tests, mental health 

services, outpatient physical and occupational therapy, ambulance services, prosthetics, 

orthotics, and supplies. Medicare Parts A and B are known as original Medicare or 

Medicare Fee-for-Service (FFS). CMS also contracts with private health plans to 

administer a Medicare private plan, known as Medicare Part C or Medicare Advantage, 

and drug plan sponsors to administer the Medicare outpatient prescription drug benefit 

known as Medicare Part D.

3

HHS, Fiscal Year 2011 Agency Financial Report (Washington, D.C.: Nov. 15, 2011).

 
 

Page 2 GAO-12-351 Provider and Supplier Medicare Enrollment

for Medicare & Medicaid Services (CMS)—the agency within HHS that 

administers the Medicare program—and 30,000 more enroll each month. 

CMS has established Medicare enrollment standards and procedures 

intended to ensure that only qualified providers and suppliers can enroll in 

the Medicare program.4 For example, standards for suppliers of durable 

medical equipment, prosthetics, orthotics, and supplies (DMEPOS) 

include proper licensure and a physical facility on an appropriate site that 

is accessible to beneficiaries and CMS. This information must be verified 

prior to enrollment.5

According to CMS, the majority of providers and suppliers enrolling in 

Medicare are legitimate and pose a limited risk to the Medicare program.

However, our previous work found persistent weaknesses in CMS’s 

Medicare enrollment standards and procedures that increased the risk of 

enrolling entities intent on defrauding the Medicare program. For 

example, we found that the Medicare enrollment process for home health 

agencies did not routinely include verification of the criminal background

of applicants, and without this information individuals and businesses that 

misrepresent their criminal backgrounds could be allowed to enroll in the 

Medicare program.

Screening at the time of enrollment is a crucial step 

to reduce the risk of enrolling providers intent on defrauding or abusing 

the program.

6

 

4

The term provider refers collectively to institutional providers such as hospitals, and 

health care facilities, as well as physicians and nonphysician practitioners who provide 

health care services to Medicare beneficiaries. Providers also include organ procurement 

organizations, skilled nursing facilities, hospice, and end-stage renal disease centers. The 

term suppliers refers to certain Part B entities such as ambulance service providers, 

mammography centers, and portable X-ray facilities. Suppliers also include entities that 

supply Medicare beneficiaries with durable medical equipment, prosthetics, orthotics, and 

supplies (DMEPOS) such as walkers and wheelchairs. Medicare law defines durable 

medical equipment (DME) as equipment that serves a medical purpose, can withstand 

repeated use, is generally not useful in the absence of an illness or injury, and is 

appropriate for use in the home. This report will use the term providers and suppliers 

when referring to all Medicare providers and suppliers but will specify DMEPOS suppliers 

when necessary.

We also conducted covert testing and found that 

DMEPOS suppliers were enrolled who did not meet Medicare’s standards 

5

Enrolling in Medicare enables providers or suppliers to submit claims for services and 

supplies provided to Medicare beneficiaries. 

6

See GAO, Medicare: Improvements Needed to Address Improper Payments in Home 

Health, GAO-09-185 (Washington, D.C.: Feb. 27, 2009).
 

Page 3 GAO-12-351 Provider and Supplier Medicare Enrollment

or were not legitimate businesses.7

In 2010, the Congress passed the Patient Protection and Affordable Care 

Act (PPACA), which included provisions that will expand health insurance 

coverage to millions of individuals, and provided CMS with increased 

authority to combat fraud, waste, and abuse in Medicare.

We recommended stricter scrutiny of 

the enrollment processes for home health agencies and DMEPOS 

suppliers due to the higher incidence of improper payments among these 

providers. We also recommended strengthening Medicare enrollment 

standards and procedures as a key strategy for reducing fraud, waste, 

abuse, and improper payments in Medicare.

8 Certain of 

these provisions are designed to strengthen Medicare’s provider 

enrollment standards and procedures. For example, PPACA requires 

HHS to designate a level of screening according to the assessed risk of 

fraud, waste, and abuse with respect to the category of provider or 

supplier. At a minimum, PPACA requires all providers and suppliers to be 

subject to licensure checks, which may include checks in multiple states. 

PPACA gives CMS the authority to require additional screening 

procedures, such as criminal background checks, depending on the type 

of risk presented by the type of provider or supplier.9

CMS oversees a network of contractors that implement and monitor the 

Medicare program. Among these contractors are the Medicare 

Administrative Contractors (A/B MAC) that enroll and pay providers and 

suppliers, except for DMEPOS suppliers, for the services they provide to 

Medicare beneficiaries for Medicare Part A and Part B, the National 

Supplier Clearinghouse (NSC) that manages DMEPOS supplier 

enrollment, and the Durable Medical Equipment Medicare Administrative 

Contractors (DME MAC) that pay claims for DMEPOS items.10

 

7

See GAO, Medicare: Covert Testing Exposes Weaknesses in the Durable Medical 

Equipment Supplier Screening Process, 

The A/B 

GAO-08-955 (Washington, D.C.: July 3, 2008).

8

Pub. L. No. 111-148, 124 Stat. 119 (2010), as amended by the Health Care and 

Education Reconciliation Act of 2010 (HCERA), Pub. L. No. 111-152, 124 Stat. 1029, 

which we refer to collectively as PPACA. 

9

PPACA, § 6401, 124 Stat. 119, 747-753, amended by § 10603, 124 Stat. 119. 1006 

(codified at 42 U.S.C. § 1395cc(j)).

10CMS currently contracts with 10 A/B MACs that are responsible for their own geographic 

regions, known as jurisdictions. A total of 14 jurisdictions now exist and future 

consolidations will bring the total to 10 jurisdictions. There are four DME MACs that 

process claims for DMEPOS supplies.
 

Page 4 GAO-12-351 Provider and Supplier Medicare Enrollment

MACs also educate their enrolled providers and suppliers on CMS 

policies and procedures, provide information to beneficiaries, and 

undertake efforts to detect and prevent fraud and abuse. The NSC serves 

as the centralized contractor for the enrollment process and site visits for 

DMEPOS suppliers. In 2011, CMS awarded contracts to two new 

contractors—an automated screening and a national site visit 

contractor—to perform aspects of the provider and supplier enrollment 

screening process, including various screening activities and site visits 

beginning in 2012. Effective implementation by CMS of PPACA’s provider 

and supplier enrollment provisions, through these and other contractors, 

is expected to aid CMS in its efforts to ensure that it only enrolls and pays 

providers and suppliers that meet Medicare’s enrollment standards.

You asked us to examine how CMS uses enrollment information to 

prevent payment of improper or potentially fraudulent Medicare claims 

and to assess changes to CMS’s Medicare provider enrollment 

procedures since the passage of PPACA. This report addresses (1) how 

CMS and its contractors use provider and supplier information to prevent 

improper payments and factors that may affect the usefulness of the 

enrollment information, and (2) the extent to which CMS has implemented 

new provider and supplier enrollment screening procedures since 

enactment of PPACA.

To assess how CMS and its contractors use provider and supplier 

enrollment information to prevent improper payments and factors that 

may affect the usefulness of the information, we obtained and reviewed: 

claims processing documents, including CMS procedural manuals and 

directives; claims processing schematics; and the criteria used to develop 

and implement prepayment edits that use enrollment information to 

ensure claims are only paid to providers and suppliers that are eligible to 

bill Medicare.11

 

11We did not assess prepayment edits based on CMS policies on coverage of medical 

care or medical necessity.

We examined the role of the data in the Provider 

Enrollment, Chain and Ownership System (PECOS) —CMS’s centralized 

database for Medicare enrollment information—in the Medicare claims 

payment process. In addition, we reviewed our past reports and those 

issued by the HHS Office of Inspector General (HHS OIG) that discussed 
 

Page 5 GAO-12-351 Provider and Supplier Medicare Enrollment

the accuracy of PECOS data.12 We interviewed CMS officials and a total 

of four A/B and DME MACs on how they use provider and supplier 

enrollment information to prevent improper payments. We interviewed 

A/B MACs whose workloads were fully implemented by 2010 and whose 

contracts were not being recompeted during the course of our work.13

To assess the extent to which CMS has implemented new provider and 

supplier enrollment screening procedures since the enactment of PPACA, 

we reviewed agency documents, including the Proposed and Final Rule 

that implemented PPACA’s provider screening and other enrollment 

provisions, documents that described how PPACA-related enrollment 

processes compared to previous CMS enrollment procedures, and 

documents describing new processes that were not yet fully 

implemented.

In 

addition, we assessed A/B MAC claims processing workloads in order to 

select A/B MACs that had the largest percentages of the national 

workload. Our sample selection strategy resulted in two A/B MACs and 

two DME MACs.

14

 

12Due to CMS’s recent implementation of agreements with new contractors to manage 

certain aspects of the Medicare provider enrollment process, we did not assess whether 

these contractors will improve the accuracy of the data in PECOS.

We limited our review to only those PPACA provisions 

that establish provider and supplier enrollment conditions that must be 

met before enrollment in Medicare. We also interviewed CMS officials 

about provider and supplier enrollment screening procedures that were 

developed and implemented as a result of these PPACA provisions. In 

addition, we conducted interviews with the two A/B MACs to learn about 

their experiences implementing new enrollment procedures authorized by 

PPACA. We also interviewed NSC officials responsible for enrolling 

Medicare DMEPOS suppliers.

13In response to contracting reform requirements in the Medicare Prescription Drug, 

Improvement, and Modernization Act of 2003, CMS has been transitioning its claims 

processing contracts from 51 contractors to no more than 10 MACs that will process 

Medicare Part A and Part B provider and supplier enrollment applications and pay claims, 

except for DMEPOS enrollment and claims. Due to this consolidation and transitioning of 

workloads between contractors, we avoided selecting MACs that could have lost their 

contracts during the course of our engagement.

14Medicare, Medicaid, and Children’s Health Insurance Programs; Additional Screening 

Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions 

and Compliance Plans for Providers and Suppliers, 76 Fed. Reg. 5862 (Feb. 2, 2011).
 

Page 6 GAO-12-351 Provider and Supplier Medicare Enrollment

We conducted this performance audit from July 2011 to February 2012 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Medicare comprises 12 percent of the federal budget and is the third 

largest federal program after defense and Social Security. For fiscal year 

2011, HHS reported an estimate of almost $29 billion in Medicare FFS 

improper payments. Our Standards for Internal Control in the Federal 

Government suggests that agencies should continually perform 

monitoring activities to reduce the incidence of improper payments.15

However, our prior reports found weaknesses in CMS’s monitoring of 

Medicare provider and supplier enrollment and claims payment 

contractors.16 Partly in response to our work, CMS took steps to 

implement new DMEPOS supplier quality standards in an accreditation 

rule issued in August 2006 and proposed additional DMEPOS supplier 

enrollment standards in January 2008. To further address these concerns 

and create a focal point for all Medicare program integrity activities, in 

2010, CMS established a Center for Program Integrity (CPI).17

 

15GAO, Standards for Internal Control in the Federal Government, 

CPI, in 

collaboration with other components within CMS, develops and 

implements the agency’s Medicare program integrity mission and goals. 

Among these goals is a reduction in instances of fraud, waste, and abuse, 

GAO/AIMD-00-21.3.1

(Washington, D.C.: November 1999). Internal controls are components of an 

organization’s management that provide reasonable assurances that certain objectives, 

including effectiveness and efficiency of operations, are being achieved.

16See GAO, Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending for 

Power Wheelchairs, GAO-05-43 (Washington, D.C.: Nov. 17, 2004), Medicare: More 

Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment 

Suppliers, GAO-05-656 (Washington, D.C.: Sept. 22, 2005), Medicare: Improvements 

Needed to Address Improper Payments for Medical Equipment and Supplies, GAO-07-59

(Washington, D.C.: Jan. 31, 2007), Medicare: Improvements Needed to Address Improper 

Payments in Home Health, GAO-09-185 (Washington, D.C.: Feb. 27, 2009), and Medicare 

Contracting Reform: Agency Has Made Progress with Implementation, but Contractors 

Have Not Met All Performance Standards, GAO-10-71 (Washington, D.C.: Mar. 25, 2010).

17CPI also coordinates CMS’s program integrity efforts for Medicaid and the Children’s 

Health Insurance Program.

Background 
 

Page 7 GAO-12-351 Provider and Supplier Medicare Enrollment

as well as strategies to ensure program vulnerabilities are identified and 

resolved.

According to CMS, the agency is pursuing an aggressive program 

integrity strategy to prevent payment of potentially fraudulent claims, 

rather than to recover funds from providers and suppliers after payment 

has already been made. Because identifying and prosecuting providers 

and suppliers engaged in potentially fraudulent activity is time consuming, 

resource intensive, and costly, CMS has designed measures intended to 

prevent enrollment by entities that might attempt to defraud or abuse the 

Medicare program. For example, the agency requires that applicants use 

a unique 10 digit National Provider Identifier (NPI) number and affirm that 

they are not excluded from participating in another federal health 

program. DMEPOS suppliers must also undergo pre-enrollment site 

visits. In addition, the agency requires enrollment information to be 

entered into PECOS, a single, centralized, provider and supplier 

enrollment database that assists with data sharing across the contractors’ 

different geographic coverage areas. In addition, CMS has historically 

required the A/B MACs and the NSC to conduct activities, such as 

monthly reviews of state licensing board actions, to determine if individual 

providers continue to meet state licensing requirements and to conduct 

periodic checks to determine if entities continue to meet federal and state 

requirements for their respective provider or supplier type. With the 

implementation of the automated screening contract, these checks will be 

automated and conducted on a continuous basis, according to CMS.

Since the Medicare program was created in 1965, it has been 

administered through a network of private contractors. CMS uses these 

contractors to conduct claims administration activities, to implement 

provider outreach and education, and to answer beneficiary inquiries 

through the 1-800-Medicare help line. Contractors also perform program 

integrity activities such as auditing providers and suppliers, reviewing 

claims for medical necessity, and conducting investigations of potential 

fraud, waste, and abuse. Central to program operations are the 

A/B MACs that manage Medicare provider and supplier enrollment, 

except for DMEPOS suppliers, and pay and review the claims submitted 

in their jurisdictions. In 2011, A/B MACs managed more than 1.5 million 

Medicare providers and suppliers. The previous year, A/B and DME 

MACs paid approximately 4.5 million claims each work day on behalf of 

CMS. Additionally, CMS contracts with the NSC to centralize the 

enrollment process and site visits for DMEPOS suppliers. In 2010, 

Medicare spent about $8.1 billion on DMEPOS supplies. In 2011, CMS 

Medicare Contractors
 

Page 8 GAO-12-351 Provider and Supplier Medicare Enrollment

added two new Medicare contractors to centralize and standardize the 

provider and supplier enrollment screening process.

To become eligible to bill for services or supplies provided to Medicare 

beneficiaries, providers and suppliers must apply to the program.18

Entities applying to the Medicare program may complete an online 

enrollment form using PECOS or submit a paper application that is 

manually entered into PECOS by the A/B MACs or the NSC. Enrolling 

providers and suppliers submit identifying information such as their name, 

address, specialty area, and information about applicable licensure and 

accreditation.19

After the enrollment data are entered into PECOS, the A/B MACs and the 

NSC handle different aspects of the application process. The A/B MACs 

process all provider and supplier applications except for those for 

DMEPOS suppliers and the NSC processes all enrollment applications 

from DMEPOS suppliers nationally. Provider and supplier applications in 

PECOS are confirmed by the A/B MAC overseeing the jurisdiction where 

the services will be provided and by the NSC for DMEPOS suppliers. 

Contracts awarded in 2011 to new automated screening and site visit 

contractors altered this structure. CMS’s new provider screening 

contractor will automate many of the required enrollment checks that the 

A/B MACs and the NSC have done manually and will allow CMS to 

monitor all providers and suppliers on a continuous basis to help ensure 

they continue to meet Medicare enrollment requirements. These 

contractors assumed some functions from the A/B MACS and the NSC in 

early 2012.

 

18To remain eligible for payment, providers and suppliers must continue to meet CMS’s 

Medicare enrollment requirements and periodically revalidate their enrollment information 

with the A/B MACs or the NSC. 

19Licensure is a mandatory process by which a state government grants permission to an 

individual practitioner or health care organization to engage in an occupation or 

profession. Accreditation is a formal process by which a recognized body, usually a 

nongovernmental organization, assesses and recognizes that a health care organization 

meets applicable predetermined standards. Whereas licensure is a mandatory process, 

accreditation is usually voluntary although CMS requires accreditation as a condition for 

suppliers enrolling in Medicare. Some of the other required enrollment information 

includes: an agreement for electronic funds transfer, a Social Security or tax identification 

number, name of medical or professional school and year graduated, or residency status.

Medicare Enrollment 

Process
 

Page 9 GAO-12-351 Provider and Supplier Medicare Enrollment

Prior to CMS’s automated screening contractor assuming these 

responsibilities, the A/B MACs and the NSC confirmed the provider and 

supplier enrollment information by checking various data sources such as 

the Social Security Administration (SSA) to verify an individual’s Social 

Security number, the National Plan and Provider Enumeration System to 

verify the provider’s NPI, and state licensing boards to determine if the 

provider is appropriately licensed to furnish medical services within a 

given state. CMS also required the A/B MACs and the NSC to check 

additional data sources including the HHS OIG’s List of Excluded 

Individuals/Entities20 (LEIE) and the General Service Administration’s 

Excluded Parties List System21 (EPLS). Starting March 25, 2011, CMS 

required the A/B MACs to conduct site visits for categories of providers 

and suppliers designated as moderate and high risk. The NSC will 

continue to conduct site visits related to enrollment of DMEPOS suppliers. 

In addition, due to long-standing concerns about high rates of fraud, 

waste, and abuse by DMEPOS suppliers, they have been subject to 

additional enrollment requirements.22 For example, DMEPOS suppliers 

must meet additional quality standards before they can be enrolled in 

Medicare, including proper accreditation, the successful completion of a 

site visit inspection, and posting of a $50,000 surety bond.23

 

20The OIG’s LEIE includes all individuals and entities currently excluded from participating 

in federally funded health care programs including Medicare and Medicaid. Exclusions are 

imposed for a number of reasons including: (1) Medicare or Medicaid fraud, as well as any 

other offenses related to the delivery of items or services under Medicare, Medicaid, 

CHIP, or other State health care programs; (2) patient abuse or neglect; (3) felony 

convictions for other health care-related fraud, theft, or other financial misconduct; and 

(4) felony convictions relating to unlawful manufacture, distribution, prescription, or 

dispensing of controlled substances. 

21The EPLS includes information on entities debarred, suspended, proposed for 

debarment, excluded, or disqualified by federal government agencies from receiving 

federal contracts or federally approved subcontracts and from certain types of federal 

financial and nonfinancial assistance and benefits.

22The Medicare Prescription Drug Improvement and Modernization Act required the 

Secretary to establish and implement quality standards for DMEPOS suppliers. Pub. L. 

No. 108-173, § 302, 117 Stat. 2066, 2223 (Dec. 8, 2003).

23A surety bond is a bond issued by an entity guaranteeing that a provider or supplier will 

fulfill its obligation to Medicare. If the obligation is not met, CMS is required to recover its 

losses via the surety bond. DMEPOS suppliers are required to obtain and submit a bond 

of no less than $50,000 for each NPI that is assigned by CMS. Because DMEPOS 

suppliers must obtain an NPI by practice location, a DMEPOS supplier with 20 practice 

locations would be required to secure a $1 million surety bond.
 

Page 10 GAO-12-351 Provider and Supplier Medicare Enrollment

CMS oversees contractors that manage the three major computer 

systems used to process Medicare Part A, Part B, and DMEPOS claims. 

Together, these computer systems are referred to as the “shared 

systems,” because claims from all the A/B MACs and DME MACs are 

processed by these systems. CMS refers to the contractors that manage 

these systems as the “shared systems maintainers.”24 Provider and 

supplier enrollment information in PECOS is downloaded to the shared 

systems in provider files that are used in claims processing.25

 

24System maintenance includes activities such as programming software changes needed 

to correct errors or to implement functionality through “hard coded” edits.

Information 

in the provider files is intended to ensure that providers and suppliers are 

eligible to receive payment for the services for which they have submitted 

claims. Although multiple contractors are involved in the claims payment 

process, the A/B and DME MACs are ultimately responsible for timely and 

accurate processing and payment of provider and supplier claims. For the 

relationship between the various contractors prior to January 2012 see 

figure 1.

25Although the A/B and DME MACs we interviewed referred to it as a provider file, it also 

includes enrollment information on suppliers.

Claims Processing and 

Enrollment-Related 

Prepayment Edits
 

Page 11 GAO-12-351 Provider and Supplier Medicare Enrollment

Figure 1: Medicare Enrollment and Claims Payment Process Prior to January 2012

a

Providers and suppliers include institutional providers such as hospitals and health care facilities, as 

well as physicians and nonphysician practitioners, who provide health care services to Medicare 

beneficiaries as well as certain Part B entities such as ambulance service providers, mammography 

centers, and portable X-ray facilities. The A/B MACS do not manage enrollment or claims processing 

for DMEPOS.

b

DMEPOS suppliers include organizations that supply Medicare beneficiaries with durable medical 

equipment such as walkers and wheelchairs.

Providers and suppliers submit most claims to Medicare electronically. 

Upon electronic submission, claims first pass through an Electronic Data 

Interchange (EDI) process that makes sure the claims are formatted 

using the nationally established standards to exchange electronic 
 

Page 12 GAO-12-351 Provider and Supplier Medicare Enrollment

information between business entities.26

If a Medicare claim is in the correct electronic format and passes the front 

end edits, it is then sent for further processing in the shared systems. 

There, the claim is subject to a series of prepayment edits that can 

prevent payment of an incomplete or incorrect claim and may reduce 

improper payments and help minimize the extent to which the program is 

vulnerable to fraud, waste, and abuse. Prepayment edits include provider 

enrollment-related edits and subsequent edits that screen Medicare 

claims against other criteria, such as medical necessity.

In the EDI process, the claim is 

subject to automated prepayment controls called “edits.” Here, front end 

edits screen the claim for formatting errors or missing data. For example, 

a front end edit checks the claim to ensure that it contains the required 

10 digit NPI but would not check the validity of the NPI. Medicare 

contractors reported that Medicare Parts A and B and DMEPOS claims 

that do not pass front end edits are considered unprocessable and are 

returned by the contractors to the appropriate provider or supplier, which 

may then correct the error(s) and resubmit the claim.

Enrollment-related prepayment edits can be implemented on either the 

national or local level. The national enrollment-related prepayment edits 

are CMS-directed edits that are “hard coded” into the shared systems by 

the systems maintainers. National edits are updated quarterly and are 

standard across all A/B or DME MACs. In contrast, local prepayment 

edits are created and managed by the individual A/B or DME MACs. They 

may develop local enrollment-related prepayment edits based on 

differences in state law that determine the scope of a provider’s or 

supplier’s practice. CMS may also direct the A/B and DME MACs to 

develop local edits because they can be implemented on a more flexible 

schedule than CMS’s quarterly updates to national edits.

 

26The Health Insurance Portability and Accountability Act (HIPAA) mandated that covered 

entities in the health care industry use standard formats for electronic claims and claimsrelated transactions. 42 U.S.C. § 1320d-2. CMS’s EDI includes two systems—the 

Common Edits and Enhancements module and the Common Electronic Data 

Interchange—that are used for Medicare Part A and Part B claims and DMEPOS claims, 

respectively. Paper claims are put into electronic format for processing.
 

Page 13 GAO-12-351 Provider and Supplier Medicare Enrollment

Medicare claims are screened during the payment process by a series of 

enrollment-related prepayment edits that check claims against provider 

and supplier information maintained in PECOS. Such edits are designed 

to prevent payments to providers and suppliers that the data indicate are 

ineligible to receive Medicare payment. While prepayment edits are in 

place to prevent improper payments, factors such as frequency of 

information updates and the limitations of the data used to update 

information in PECOS may affect the timeliness and accuracy of provider 

and supplier information. In turn, this may limit the extent to which 

enrollment-related edits prevent payments to ineligible providers and 

suppliers.

Enrollment-related prepayment edits are designed to prevent payments to 

ineligible providers and suppliers—such as those that are no longer active 

in the Medicare program or that are not properly credentialed or licensed 

to provide the services for which they have submitted claims. Ineligible 

providers and suppliers may be enrolled in Medicare despite CMS’s and 

its contractors’ enrollment screening efforts. Officials with the A/B and 

DME MACs we interviewed described the application of prepayment edits 

to claims as a cascading series of checks that occurs progressively as the 

claim moves through the process according to the edits’ “if/then” logic. 

For example, a certain edit will compare the NPI contained in a provider’s 

file with the date of service contained in the claim, and if the NPI was 

active on the date of service, then the claim would move to the next stage 

of processing. The two types of enrollment-related prepayment edits are 

provider and supplier verification edits and specialty edits.

• Provider and supplier verification prepayment edits: Medicare 

claims are subject to edits that verify basic provider and supplier 

enrollment information. These enrollment-related verification edits 

screen the claim’s data to ensure that the provider or supplier is 

eligible for payment. For example, such edits verify the validity of the 

entity’s NPI, which indicates whether the claim was submitted by an 

active provider or supplier. Verification edits at this stage of claims 

processing also screen claims to ensure that the provider’s or 

supplier’s enrollment date is before the claim’s date of service, thus 

indicating that they were an active provider or supplier on that date 

and therefore generally eligible for payment. A/B and DME MAC 

officials reported that claims failing these enrollment verification 

prepayment edits are not paid. Information on a denied claim due to 

provider or supplier ineligibility, including reason codes that explain 

the reason(s) for which the claim was not paid, is sent to the provider 

Claims Are Screened 

against Enrollment 

Information to 

Prevent Improper 

Payments, but 

Prevention Depends 

on Timely and 

Accurate Information

Enrollment-Related 

Prepayment Edits Are 

Designed to Prevent 

Payments to Ineligible 

Providers and Suppliers
 

Page 14 GAO-12-351 Provider and Supplier Medicare Enrollment

or supplier. These codes include reasons such as “the provider must 

update license information with the payer” and “invalid provider 

identifier.” One DME MAC estimated that the number of claims denied 

due to the claim’s date of service occurring outside of a DMEPOS 

supplier’s “effective dates” for billing eligibility was only about 36,000 

claims out of a total of about 50 million claims per year.

• Specialty prepayment edits: Enrollment-related specialty 

prepayment edits screen for provider- or item-specific information 

about providers or suppliers, such as their eligibility to bill for certain 

services that can only be provided by a certain provider type or 

specialty. For example, limited license providers such as chiropractors 

can only be paid for a limited number of allowable billing codes 

determined by CMS. Specialty edits screen claims to ensure that the 

claim contains these allowable codes. DME MAC officials told us that 

edits at this stage would also ensure, for example, that a podiatrist is 

only paid for podiatry services and not ophthalmology services.27

Verification and specialty enrollment-related prepayment edits may be 

implemented as either national or local edits. According to one A/B MAC 

we spoke with, because there is little differentiation among Part A 

providers most enrollment-related prepayment edits for these providers 

are implemented as national edits, which are programmed into the shared 

systems. A/B MAC officials reported that additional enrollment-related 

local edits are more likely to be implemented for Part B provider claims 

due to differences among states regarding reimbursement for certain 

services and provider types. These Part B specialty edits are 

implemented as local edits by the A/B MAC responsible for that state. 

Regarding DME claims, one contractor we spoke with reported that CMS 

more frequently standardizes the DME claims payment process. This 

assures uniform coverage decisions across all DME MACs. DME MAC 

officials reported that DME specialty edits include those applied to 

oxygen, pharmacy, prosthetics, and orthotics claims. For example, DME 

MAC officials told us that the edits applied to oxygen claims ensure that 

only suppliers who have the required valid license to provide oxygen 

services receive payment. All three types of claims—Part A, Part B, and 

DME—that fail prepayment edits, whether at the national or local level, 

 

27Medicare claims also undergo prepayment edits that are not related to provider 

enrollment information. Examples include edits that screen for excessive units of service—

known as medically unlikely edits—and compliance with Medicare coverage policies.
 

Page 15 GAO-12-351 Provider and Supplier Medicare Enrollment

are denied and returned to the provider or supplier with a reason code 

that explains why the claim was not paid. For example, it may indicate 

“this provider type/provider specialty may not bill this service.” 

While prepayment edits are implemented to reduce the likelihood of 

improper payments due to provider or supplier ineligibility, the 

effectiveness of specific enrollment-related edits is not assessed by the 

A/B or DME MACs or CMS. A/B MAC officials reported that they generally 

do not need to analyze data on claims that are not paid because a 

prepayment edit indicates the provider or supplier is ineligible to bill for 

services. Thus, these contractors do not report on which of the 

prepayment edits prevented the improper payment. A/B MAC officials 

explained that each enrollment-related prepayment edit is developed to 

perform a specific function and therefore they do not rank edits in order of 

their effectiveness in preventing improper payments. Additionally, they 

told us that they do not submit reports to CMS that identify which 

enrollment-related prepayment edits are most effective. CMS requires 

A/B MACs to submit quarterly supplements to monthly workload reports 

that provide the agency with information on the number of denied claims 

and reasons for denials, but this information is used to identify problem 

areas for resolution, measure trends in denial rates, and monitor fraud 

and abuse workloads. Although officials from one A/B and two DME 

MACs told us that they may generate reports on claim activity, these data 

generally are used for internal workload planning purposes or as the 

basis for provider education on proper coding, not to determine the 

effectiveness of certain categories of edits.28

The ability of enrollment-related edits to prevent improper payments 

depends on the timeliness and accuracy of provider and supplier 

enrollment information contained in PECOS. In turn, the timeliness and 

accuracy of information in PECOS—which is downloaded as provider files 

into the shared systems each night—is affected by factors such as the 

frequency with which contractors update this information and limitations of 

the sources of the information used. A/B MACs and the NSC are 

responsible for updating PECOS when conducting initial and revalidation 

 

28For example, A/B MACs indicated that many provider-related claim denials are due to 

providers submitting claims for dates of service outside of the provider’s eligibility dates.

Edits Depend on Timely 

and Accurate Information 

in PECOS
 

Page 16 GAO-12-351 Provider and Supplier Medicare Enrollment

enrollment for providers and suppliers.29

We have previously reported concerns about the accuracy of the provider 

and supplier enrollment information in PECOS and CMS’s oversight of 

A/B MACs’ provider and supplier enrollment activities. CMS has 

acknowledged these concerns and indicated that the agency is working to 

address these issues. For example, we recently reported that incomplete 

However, A/B MACs and the 

NSC were not able to confirm the status, such as licensure, of every 

provider or supplier in PECOS on a daily basis. Instead, certain aspects 

of provider and supplier status have been checked less frequently. For 

example, A/B MACs were required to conduct monthly reviews of provider 

licensure status and an A/B MAC official told us that they searched 

individual state websites for this information. A/B MACs and NSC also 

have relied on a variety of data sources such as state licensure boards, 

the HHS OIG’s exclusions list, and SSA’s Death Master File (DMF) to 

update provider and supplier information in PECOS. These sources vary 

in the ease with which A/B MACs and the NSC have been able to access 

their data and the frequency with which they are updated. For example, 

CMS officials reported that the A/B MACs had to manually access state 

data sources to update licensure status. In addition, contractors we spoke 

with said SSA releases updates to its DMF monthly and therefore there is 

an interval between a provider’s death and when that information can be 

updated in PECOS. As a result, payments may still be made for claims 

submitted under a deceased provider’s NPI for medical services allegedly 

provided after the provider’s death. One A/B MAC official said that 

PECOS must first be updated to reflect the provider’s status and this 

information in turn must be downloaded into the shared systems in a 

timely manner to prevent an improper payment from being made. This is 

because, while enrollment-related prepayment edits can identify and deny 

invalid claims, the edits use the existing provider and supplier information 

to do so. Thus, if the PECOS provider and supplier information is not 

current or is inaccurate, the edits will be ineffective in preventing improper 

payments.

 

29PPACA requires all existing provider and supplier information to be revalidated by 2015. 

PPACA, § 6401, 124 Stat. 119, 749, amended by § 10603, 124 Stat. 119. 1006 (codified 

at 42 U.S.C. § 1395cc(j)). After the revalidation of all providers and suppliers required by 

PPACA, CMS’s current cycle for revalidation—3 years for DMEPOS suppliers and 5 years 

for all other providers and suppliers—will apply. CMS retains the authority to require a 

provider or supplier to revalidate off-cycle when certain compliance-related concerns 

arise. PECOS data must also be updated when there is a change of address or other 

change to provider or supplier status. 
 

Page 17 GAO-12-351 Provider and Supplier Medicare Enrollment

or conflicting provider contact information in PECOS limited CMS from 

using its own data to operate its Physician Feedback Program.30

Furthermore, in 2010 we reported that A/B MACs had difficulty 

recognizing when nursing home provider information in PECOS was 

incomplete or inaccurate and CMS oversight of A/B MACs in this regard 

was limited.31 In that same report, we found that although CMS conducted 

desk reviews and onsite audits from years 2000 through 2009 to review 

contractors’ management of nursing home providers’ enrollment 

functions, these audits were limited. In addition, beyond these audits, 

CMS did not conduct checks on the PECOS database for internal 

consistency. According to a CMS official, this limited oversight was due to 

a lack of resources and competing priorities within the agency. As a result 

of these findings, we recommended that CMS more closely monitor the 

activities of A/B MACs’ provider and supplier enrollment activities to help 

ensure the accuracy and completeness of PECOS data. CMS concurred 

with this recommendation and recently reported that the agency is 

evaluating the criteria it uses to assess A/B MACs’ performance as it 

relates to the timeliness and accuracy of processing Medicare enrollment 

applications.32 Further, the agency reported that it plans to evaluate the 

completeness and accuracy of provider and supplier enrollment data as 

part of reviews of the contractors’ enrollment operations. Given that these 

activities have not been implemented, we could not determine their effect 

on the completeness and accuracy of PECOS data used to process 

claims or whether improper payments result from inaccurate information 

in the provider files.

 

30The Medicare Improvements for Patients and Providers Act of 2008 (MIPPA) required 

HHS to establish and begin implementing by January 1, 2009, a Physician Feedback 

Program that would include distribution of confidential feedback reports to physicians on 

the resources used to provide care to Medicare beneficiaries. Pub. L. No. 110-275, § 131, 

122 Stat. 2492, 2526-2527 (July 15, 2008). See GAO, Medicare Physician Feedback 

Program: CMS Faces Challenges with Methodology and Distribution of Physician Reports, 

GAO-11-720 (Washington, D.C.: Aug. 12, 2011).

31See GAO, Nursing Homes: Complexity of Private Investment Purchases Demonstrates 

Need for CMS to Improve the Usability and Completeness of Ownership Data, 

GAO-10-710 (Washington, D.C.: Sept. 30, 2010).

32CMS uses its Quality Assurance Surveillance Plans (QASP) to evaluate A/B and DME 

MAC’s fulfillment of contract requirements. The QASP describes CMS’s plan for 

inspecting the work within the various business functions that the MACs conduct.
 

Page 18 GAO-12-351 Provider and Supplier Medicare Enrollment

Since the enactment of PPACA, CMS has implemented new provider and 

supplier enrollment screening procedures and has also implemented 

other measures intended to strengthen existing procedures. However, the 

implementation of some additional enrollment screening procedures by 

CMS is still in progress.

Since the enactment of PPACA, CMS has implemented some new 

provider and supplier enrollment screening procedures, and put in place 

other measures intended to strengthen existing procedures.33

To strengthen the screening activities already conducted by CMS’s 

contractors, PPACA required that the level of screening applied to each 

category of provider and supplier be based on their assessed risk of 

fraud, waste, and abuse and that screening procedures for Medicare 

providers and suppliers be explicitly established. On February 2, 2011, 

CMS published a Final Rule to implement these new screening 

procedures. The Final Rule requires, among other things, that the A/B 

MACs and the NSC conduct enrollment screening based on categories of 

New 

screening procedures that define conditions for provider and supplier 

enrollment in Medicare include CMS’s determination of different levels of 

screening according to the risk of fraud, waste, and abuse with respect to 

categories of providers or suppliers, and a new application fee for some 

types of providers. CMS also published a regulation consistent with its 

existing practice, requiring providers and suppliers to include their NPI on 

all enrollment applications and claims, and added two new Medicare 

contractors—an automated screening contractor and a site visit 

contractor—that are intended to conduct enhanced enrollment screening 

and site visits.

 

33PPACA also applies to certain enrollment provisions related to Medicaid or to the state 

Children’s Health Insurance Program (CHIP). Medicaid is the federal-state program that 

covers acute health care, long-term care, and other services for low-income people. CHIP 

is the joint federal-state program that provides health coverage to children whose families 

have incomes that are low, but not low enough to qualify for Medicaid. This report does 

not discuss how PPACA affects either Medicaid or CHIP.

CMS Has 

Implemented Some 

New Enrollment 

Screening Procedures 

Since PPACA, While 

Others Remain in 

Progress 

CMS Implemented Some 

New Screening Procedures 

and Added Measures 

Intended to Strengthen 

Other Existing Procedures

Provider and Supplier Risk 

Levels 
 

Page 19 GAO-12-351 Provider and Supplier Medicare Enrollment

providers and suppliers and levels of risk.34

CMS stated that it assigned these categories of provider and supplier risk 

levels based on the agency’s experience with claims data used to identify 

potentially fraudulent billing practices, as well as on the expertise of its 

contractors charged with investigating and identifying instances of 

Medicare fraud across providers and suppliers. The agency also based 

these risk levels on prior findings in reports by GAO and HHS OIG. In 

addition, CMS will adjust the screening level of an individual provider or 

supplier from ‘‘limited’’ or ‘‘moderate’’ to ‘‘high’’ based on other factors, 

such as whether the provider or supplier has had its Medicare billing 

privileges revoked, has been terminated or is otherwise precluded from 

billing Medicaid, or has been subject to any final adverse action within the 

past 10 years such as license revocation or suspension, or certain felony 

convictions.

CMS assigned these new risk 

levels—limited, moderate, and high—to categories of providers and 

suppliers based on determinations of which categories were at a greater 

risk for fraud, waste, and abuse. (See table 1.) A/B MACs and the NSC 

designate the appropriate screening level in PECOS for each enrolling 

provider and supplier upon submission of an application. Screening levels 

are designated based upon CMS guidance. As of October 2011, A/B 

MACs and the NSC had entered the screening level information in 

PECOS for all providers and suppliers that submitted an application.

 

34Medicare, Medicaid, and Children’s Health Insurance Programs; Additional Screening 

Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions 

and Compliance Plans for Providers and Suppliers, 76 Fed. Reg. 5862 (Feb. 2, 2011).
 

Page 20 GAO-12-351 Provider and Supplier Medicare Enrollment

Table 1: Categories of Medicare Providers and Suppliers Designated by Risk Level for Enrollment Screening

Risk level Categories of Medicare providers and suppliers

Limited Physician or nonphysician practitioners and medical groups or clinics, with the exception of physical therapists and 

physical therapy groups. Ambulatory surgical centers, competitive acquisition programs/Part B vendors, end-stage 

renal disease facilities, federally qualified health centers, histocompatibility laboratories,a hospitals, including critical 

access hospitals, Indian Health Service facilities, mammography screening centers, mass immunization roster 

billers,b

Moderate

organ procurement organizations, pharmacies newly enrolling or revalidating, radiation therapy centers, 

religious nonmedical health care institutions, rural health clinics, and skilled nursing facilities.

Ambulance suppliers, community mental health centers, comprehensive outpatient rehabilitation facilities, hospice 

organizations, independent diagnostic testing facilities, independent clinical laboratories, physical therapy including 

physical therapy groups, portable X-ray suppliers, and currently enrolled (revalidating) home health agencies.

High Prospective (newly enrolling) home health agencies and prospective (newly enrolling) suppliers of durable medical 

equipment, prosthetics, orthotics, and supplies.

Source: GAO analysis of CMS Final Rule with Comment Period, Medicare, Medicaid, and Children’s Health Insurance Programs: 

Additional Screening Requirements, Applications Fees, Temporary Enrollment Moratoria, Payment Suspensions and Compliance Plans 

for Providers and Suppliers, 76 Fed. Reg. 5862 (Feb. 2, 2011).

a

The responsibility of the histocompatibility laboratory is to provide an evaluation of certain genetic 

data and pertinent patient immunologic risk factors that will allow the clinician and patient to decide 

which approaches to transplantation are in the patient’s best interest.

b

Mass immunization roster billers are providers and suppliers who enroll in the Medicare program to 

offer the influenza (flu) vaccinations to a large number of individuals, and they must be properly 

licensed in the states in which they plan to operate influenza clinics.

Based on these new risk levels, providers and suppliers are subject to 

different screening procedures, with those in the high-risk level subject to 

the most rigorous screening. While PPACA requires that all categories of 

providers and suppliers be subject to licensure checks, it gave CMS 

discretion to establish a risk-based application of other screening 

procedures. CMS determined that providers and suppliers in all 

categories also must continue to undergo existing enrollment checks 

using various data sources to verify certain information such as Social 

Security number, NPI, HHS OIG exclusion, and taxpayer identification 

number.35 According to CMS’s new risk-based screening, moderate- and 

high-risk providers and suppliers additionally must undergo unscheduled 

or unannounced site visits, while high-risk providers and suppliers also 

will be subject to fingerprint-based criminal background checks.36

 

35A taxpayer identification number is an identification number used by the Internal 

Revenue Service (IRS) in the administration of tax laws. It is issued either by the SSA or 

by the IRS.

36All individuals with a direct or indirect ownership interest of 5 percent or greater in highrisk providers and suppliers are subject to fingerprint-based criminal background checks.
 

Page 21 GAO-12-351 Provider and Supplier Medicare Enrollment

PPACA required HHS, for the first time, to impose an application fee on 

each institutional provider and on suppliers. In response, effective 

March 25, 2011, CMS, in its Final Rule, required all institutional providers 

and suppliers enrolling in Medicare, adding a practice location, or 

revalidating their enrollment to pay a $505 application fee.37 PPACA 

specifies that amounts collected as the result of the application fee shall 

be used for program integrity efforts, including to cover the cost of 

enrollment screening and to carry out other screening.38 However, 

PPACA permits CMS to grant a hardship exception for institutional 

providers and suppliers on a case-by-case basis if the agency determines 

that the imposition of the application fee would cause a hardship.39

According to CMS officials, an institutional provider or supplier working 

with underserved populations or engaged in extensive charity work would 

be a possible candidate for a hardship exception. CMS has instructed its 

contractors in guidance on March 23, 2011, not to process any Medicare 

enrollment applications without the proper application fee having been 

paid or a hardship exception approved.40

 

37Institutional providers include hospitals, home health agencies, community mental health 

centers, and skilled nursing facilities. Application fees do not apply to physicians, 

nonphysician practitioners, physician organizations, and nonphysician organizations. 

Suppliers include DMEPOS suppliers and other suppliers including ambulance service 

providers, mammography centers, and independent clinical laboratories.

CMS transmits information 

about application fee payments by institutional providers and suppliers—

38PPACA, § 6401, 124 Stat. 119, 748, amended by § 10603, 124 Stat. 119. 1006 (codified 

at 42 U.S.C. § 1395cc(j)). PPACA established that fee amounts for subsequent years 

would be equal to the preceding year’s fee adjusted by the percentage change in the 

Consumer Price Index (for all urban consumers) for the 12-month period ending on 

June 30 of the prior year.

39CMS stated that a provider or supplier requesting a hardship exception must submit 

documentation of the need for an exception. For example, the application must include a 

letter and supporting documentation that describe the significant burden and why it merits 

an exception.

40A/B MACs and the NSC must notify a provider or supplier who does not submit a fee or 

hardship exception request that it has 30 days from the date of the letter to pay the 

application fee, and that failure to do so will result in the rejection of the enrollment 

application (for initial enrollments and new practice locations) or revocation of the 

provider’s Medicare billing privileges (for revalidation). The letter must also state that 

because a hardship exemption request was not submitted with the original application, 

such a request will not be considered in lieu of the fee. If the fee is paid within the 30 day 

period, the contractor may begin processing the application.

Application Fee
 

Page 22 GAO-12-351 Provider and Supplier Medicare Enrollment

which are made through an electronic payment system—to the A/B 

MACS or the NSC via PECOS.41

PPACA required HHS to promulgate a regulation for the inclusion of an 

NPI on all Medicare applications and claims by all providers and suppliers 

that qualify for an NPI—a practice that was already in effect.42 The 

regulation was published as an interim Final Rule on May 5, 2010, and 

was effective July 6, 2010.43 Prior to the PPACA requirement for a 

specific regulation, CMS had required contractors to confirm that 

providers and suppliers included their NPI on Medicare enrollment 

applications and claims. Since 2006, the agency has required that 

enrollment applications include an NPI and since 2008 providers and 

suppliers have been required to report their NPI on Medicare claims.44

In a further effort to strengthen its enrollment processes, at the end of 

2011, CMS contracted with an automated screening contractor to assume 

screening responsibilities from the A/B MACs and the NSC, and a site 

visit contractor to assume site visit responsibilities from the A/B MACs.

CMS awarded a contract in September 2011 to an automated screening 

contractor that began screening new Medicare enrollments for all 

providers and suppliers, on December 31, 2011. Additionally, CMS 

officials said that the screening contractor was setting up baseline data 

and will assume the screening function for the A/B MACs and the NSC by 

the end of March 2012. The screening contractor will screen all providers 

and suppliers including DMEPOS suppliers. The automated screening 

contractor is responsible for electronically screening applicant information 

against various data sources used for enrollment to determine that the 

 

41The provider or supplier must pay the application fee electronically through 

http://www.pay.gov. Pay.gov is the federal government website where individuals can 

submit payment to various federal agencies on-line.

42PPACA, § 6402, 124 Stat. 119, 753-763 (codified at 42 U.S.C. § 1320a-7k). 

43Medicare and Medicaid Programs; Changes in Provider and Supplier Enrollment, 

Ordering and Referring, and Documentation Requirements, and Changes in Provider 

Agreements, 75 Fed. Reg. 24437 (May 5, 2010).

44HIPAA required that HHS adopt standards for unique health identifiers. In a Final Rule, 

CMS adopted the NPI as the standard unique health identifier for health care providers.

Centers for Medicare & Medicaid Services, The National Provider Identifier Rule, 69 Fed. 

Reg. 3434 (Jan. 23, 2004). Consistent with the NPI Final Rule, beginning in 2006, the 

Medicare program required providers and suppliers to report their NPIs on their enrollment 

applications.

NPI Regulation 

New Screening and Site Visit 

Contractors
 

Page 23 GAO-12-351 Provider and Supplier Medicare Enrollment

provider or supplier meets Medicare eligibility criteria such as valid 

licensure, accreditation, and a valid NPI, and is not on exclusion lists, 

such as the HHS OIG list of providers and suppliers excluded from 

participating in federally funded health care programs. This screening 

process results in a report to the A/B MACs and NSC that indicates the 

screening components that the applicant passed and also screening 

components flagged for additional review. The A/B MACs and NSC, 

which remain responsible for enrollment and revalidation, obtain 

documentation from the provider or supplier on any flagged information 

that requires additional review to determine if the applicant meets 

Medicare enrollment or revalidation requirements. In addition to 

conducting screening at enrollment and revalidation, the automated 

screening contractor conducts checks of certain screening information on 

an ongoing basis. For example, the automated screening contractor is 

responsible for validating licensure status at least weekly. Previously, A/B 

MACs and the NSC were responsible for manually reviewing stateprovided licensure information monthly to determine if any enrolled 

Medicare providers’ or suppliers’ licenses had been revoked, suspended, 

or otherwise inactivated in the last 60 days.

CMS officials said that the automated screening contractor is developing 

an individual risk score for each provider or supplier. This individual risk 

score is similar to a credit risk score. The contractor’s risk scores may be 

used eventually as additional risk criteria that determine screening 

activities for providers and suppliers.

CMS officials said the new automated screening contractor provides a 

centralized point for Medicare enrollment screening and allows for a 

national view of provider and supplier information, rather than the more 

limited regional view that the A/B MACs provided previously. For 

example, the automated screening contractor has been able to access 

information about providers and suppliers who operate across geographic 

regions. In addition, CMS officials said that the agency has taken a 

centralized approach to automated screening of enrollment data because 

of weaknesses observed in enrollment screening efforts, which were due 

generally to the large number of providers and suppliers for which the A/B 

MACs and the NSC had to manually screen applications and the lack of 

efficient access to data sources containing enrollment information. 

According to CMS officials, they expect the new automated screening 

contractor to improve the integrity of the enrollment and revalidation 

processes by automating the data checks and integrating new data 

sources. For example, CMS has directed the automated screening 
 

Page 24 GAO-12-351 Provider and Supplier Medicare Enrollment

contractor to identify additional data sources for screening checks, such 

as financial, tax and business, and geospatial data sources.

Additionally, in December 2011, CMS contracted with a site visit 

contractor to perform nationwide physical site visits for all providers and 

suppliers, except DMEPOS suppliers, in the moderate- and high-risk 

screening categories in all states and six U.S. territories. The site visit 

contractor began conducting site visits and making site visit reports 

available electronically through a portal accessible to CMS and its other 

contractors in February 2012. These site visits previously were performed 

by the A/B MACs. The A/B MACs will order any required on-site visits 

through the site visit contractor, which will schedule and conduct them 

and provide the results to the appropriate A/B MAC. However, the NSC 

will continue to conduct site visits related to provider enrollment of 

DMEPOS suppliers.45

CMS requires two types of site visits: routine and rapid response. 

According to CMS, routine site visits involve a physical location 

verification and collection of required data elements using predefined 

checklists. Rapid response site visits are triggered by an alert of possible 

fraudulent activity, and may require the same elements as a routine site 

visit but with rapid reporting and response due to the alert. Except for 

DMEPOS suppliers, the national site visit contractor collects site visit 

information at the physical provider or supplier site using defined 

questionnaires and gathers photographic evidence for transmission to 

CMS. The data elements required during routine and rapid response site 

visits include validation of the physical location of the provider or supplier, 

including capturing global positioning system coordinates of the site, 

photographs of the door of the provider or supplier office, and signage of 

the office. The contractor is required to conduct site visits and deliver 

completed site visit reports within a specified time period. Depending on 

the request from CMS or an A/B MAC, the contractor will make site visits 

within 30, 15, or 7 days, for routine visits, or within 36 hours for rapid 

response visits. CMS estimated that in the first year of the contract, the 

site visit contractor would conduct nearly 60,000 site visits within 30 days, 

almost 5,000 site visits within 15 days, almost 1,000 site visits within 

7 days, and about 30 rapid response site visits. CMS officials said the 

 

45CMS at times exercises its authority to conduct a site visit or request its contractors to 

conduct a site visit for any Medicare provider or supplier.
 

Page 25 GAO-12-351 Provider and Supplier Medicare Enrollment

national site visit contractor is expected to provide consistency of site 

visits across the country and, similar to the automated screening 

contractor, reduce the A/B MACs’ workloads.

CMS’s implementation of some enrollment screening procedures 

authorized by PPACA remains in progress, including efforts to (1) extend 

surety bond requirements to additional providers and suppliers, 

(2) conduct fingerprint-based criminal background checks of high-risk 

providers and suppliers, (3) require enrolling providers and suppliers to 

disclose additional types of information, and (4) require compliance and 

ethics programs for providers and suppliers.

CMS is in the process of drafting a proposed rule to extend the surety 

bond requirement to certain providers and other suppliers.46 Previously, 

surety bonds generally had been required only for DMEPOS suppliers.47

Specifically, CMS officials said that they are seeking comments on 

extending surety bonds to home health agencies and independent 

diagnostic testing facilities (and, potentially, outpatient rehabilitation 

facilities) and that they expected to issue a proposed rule to require 

surety bonds as conditions of enrollment for certain other types of 

providers in the fall of 2012. PPACA extended CMS’s authority to impose 

surety bonds on certain additional providers and suppliers, based on a 

determination about their level of risk.48

While CMS is considering extending surety bonds to additional providers 

and suppliers, a 2011 HHS OIG report stated that CMS did not have 

finalized procedures for recovering DMEPOS overpayments through 

surety bonds, and therefore, as of July 2011, no overpayments had been 

recovered through surety bonds since October 2, 2009, the date the 

The surety bond would be in an 

amount commensurate with the provider’s or supplier’s billing volume, but 

not less than $50,000. CMS officials also said they are considering giving 

a new supplier provisional enrollment and then setting the amount of the 

surety bond after a review of billing activities.

 

46A surety bond is a three-party agreement in which a company, known as a surety, 

agrees to compensate the bondholder if the bond purchaser fails to keep a specified 

promise.

47Social Security Act § 1834(a)(16)(B). 

48PPACA, § 6402, 124 Stat. 119, 753-763.

Several New Screening 

Procedures Remain in 

Progress

Extend Surety Bond 

Requirements to Additional 

Providers and Suppliers
 

Page 26 GAO-12-351 Provider and Supplier Medicare Enrollment

surety bond requirement became effective.49 However, in January 2012, 

CMS released guidance on claims against surety bonds for DMEPOS 

suppliers.50

CMS officials said the agency was working with the Federal Bureau of 

Investigation (FBI) to gain access to its criminal background information 

for use in conducting fingerprint-based criminal background checks of 

high-risk providers and suppliers. PPACA authorized, but did not require, 

the use of criminal background checks in its risk-based provider and 

supplier screening. In order to conduct criminal background checks, CMS 

officials said they will contract with FBI channelers, whose contracts were 

recently recompeted by the FBI; CMS officials said that as of December 

2011, 20 contracts were approved and 13 had been awarded by the 

FBI.

The guidance states that the surety—a company that 

provides the surety bond —is liable for any overpayments incurred during 

the term of the surety bond and that the surety must pay CMS within 

30 days of receiving written notice of an overpayment. CMS’s guidance 

also advises DME MACs on how to collect overpayments incurred during 

the term of a surety bond. CMS officials said that they expect that many 

of the requirements for obtaining and maintaining DMEPOS surety bonds 

can be easily applied to home health agencies and independent 

diagnostic testing facilities.

51

 

49HHS-OIG, Use of Surety Bonds to Recover Overpayments Made to Suppliers of Durable 

Medical Equipment, Prosthetics, Orthotics, and Supplies: Early Findings, 

OEI-03-11-00351 (Sept. 12, 2011).

CMS plans to contract with two channelers, one to conduct 

background checks and one to handle provider and supplier 

fingerprinting. CMS officials said they are developing a scope of work to 

solicit among the FBI-approved channelers and expect to have contracts 

in place before the end of 2012. CMS officials also said that they plan to 

develop guidance to further define A/B MAC and NSC responsibilities and 

work flow of these checks.

50The guidance states that payment from the surety bond includes amounts up to the 

maximum obligation of the bond including: the amount of any unpaid claim, plus accrued 

interest, for which the DMEPOS supplier is responsible; and the amount of any unpaid 

claim, civil monetary penalty, or assessment imposed by CMS or the HHS OIG on the 

DMEPOS supplier, plus accrued interest.

51Channelers are contractors who help collect the criminal history record information for 

the FBI. FBI-approved channelers receive the fingerprint submission and relevant data, 

collect the associated fee(s), electronically forward the fingerprint submission with the 

necessary information to the FBI for a national criminal background check, and receive the 

electronic record check result for dissemination to the individual or authorized recipient.

Conduct Fingerprint-Based 

Criminal Background Checks 

of High-Risk Providers and 

Suppliers
 

Page 27 GAO-12-351 Provider and Supplier Medicare Enrollment

CMS officials said the agency was developing and reviewing regulations 

to address the requirement for increased disclosures for enrolling or 

revalidating Medicare providers and suppliers. PPACA requires providers 

and suppliers to disclose any current or previous affiliation with another 

provider or supplier that has uncollected debt; has been or is subject to a 

payment suspension under a federal health care program; has been 

excluded from participation under Medicare, Medicaid, or CHIP; or has 

had its billing privileges denied or revoked at the time of initial enrollment 

or revalidation of enrollment. CMS officials noted that the development of 

these regulations is complicated by many issues that need to be 

addressed, such as provider and supplier concern about what information 

will be collected, what CMS will do with information once it is collected, 

and how to address concerns about maintaining the privacy and security 

of the information. CMS officials said the agency did not meet its own 

time frame for publishing a regulation to address this PPACA provision by 

November 2011 and they are not certain when the regulation will be 

published.

CMS officials said that the agency was studying criteria found in HHS 

OIG model plans as it worked to address the PPACA requirement that the 

agency establish the core elements of compliance and ethics programs 

for providers and suppliers. PPACA required that Medicare providers 

establish compliance programs that contain the core elements 

established by CMS in consultation with the HHS OIG. In general, a 

compliance program is the internal set of policies, processes, and 

procedures that a provider organization implements to help it act ethically 

and lawfully. In this context, a compliance program is intended to help 

provider and supplier organizations prevent and detect violations of 

Medicare laws and regulations. CMS does not have a projected target 

date for implementation.

Timely and accurate Medicare provider and supplier enrollment 

information maintained in the PECOS database are essential to reducing 

fraud, waste, and abuse and the likelihood of making improper payments.

Although PECOS information has been routinely updated by CMS’s A/B 

MACs and the NSC using multiple national and state data sources, 

limitations in these data sources and in the frequency with which updates 

are made may lead to delays in, or failures to, accurately update 

information in PECOS, resulting in payments to ineligible providers or 

suppliers. As a result of the provisions in PPACA, CMS has begun to 

supplement its previous provider enrollment activities with new 

procedures and contracts that have the potential to improve the accuracy 

Requiring Providers and 

Suppliers to Disclose 

Additional Information

Development of Regulations for 

a Compliance and Ethics 

Program 

Concluding 

Observations 
 

Page 28 GAO-12-351 Provider and Supplier Medicare Enrollment

and timeliness of information stored in PECOS. In particular, CMS’s new 

enrollment screening and site visit contracts shift some provider 

enrollment activities from the A/B MACs and NSC to centralized national 

contractors. CMS anticipates that the new screening contractor will 

improve the accuracy and timeliness of updates to the provider 

enrollment information in PECOS by automating the process and using 

additional data sources for enrollment screening. In addition, CMS 

expects that the new site visit contractor will enable the agency to 

conduct routine and targeted site visits of certain providers and suppliers 

in categories considered at greater risk for submitting improper or 

potentially fraudulent Medicare claims. Our previous work has found, and 

we recommended, that contractor monitoring is needed to ensure that 

CMS and its contractors identify and address the causes of improper 

payments. However, it is too early to determine whether these new 

contractors—and the agency’s pending action on other PPACA provisions 

intended to strengthen provider enrollment standards—will improve the 

integrity of the Medicare provider enrollment and claims payment 

processes and reduce the likelihood of improper payments.

HHS reviewed a draft of this report and in its written comments 

highlighted continuing steps that CMS is taking to improve the accuracy 

and timeliness of data used to screen providers and suppliers and to 

further strengthen contractor oversight and PECOS data integrity. In its 

general comments, HHS noted that, since we conducted our work, CMS 

has increased the frequency with which it receives the SSA’s DMF and 

now populates PECOS with this information weekly, rather than monthly. 

In addition, CMS will use its new automated screening contractor to 

routinely monitor changes that can affect enrollment status, such as death 

or loss of required licenses for providers and suppliers. HHS also 

commented that CMS is taking action to further strengthen quality control 

by performing follow-up analysis to ensure actions reported during the 

enrollment and revalidation processes are properly updated in PECOS. 

HHS noted that CMS is taking steps to improve the QASP process used 

to evaluate specific contractor functions by improving the depth at which 

these studies are performed and concentrating on areas that affect the 

quality of PECOS data. HHS’s comments are printed in appendix I. HHS 

also provided technical comments, which we incorporated as appropriate.

Agency Comments
 

Page 29 GAO-12-351 Provider and Supplier Medicare Enrollment

As agreed with your office, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Health 

and Human Services, the Administrator of CMS and other interested 

parties. The report also will be available at no charge on the GAO Web 

site at http://www.gao.gov.

If you or your staff members have any questions about this report, please 

contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our 

Offices of Congressional Relations and Public Affairs may be found on 

the last page of this report. Other major contributors to this report are 

listed in appendix II.

Sincerely yours,

Kathleen M. King

Director, Health Care
Appendix I: Comments from the Department of 

Health and Human Services

Page 30 GAO-12-351 Provider and Supplier Medicare Enrollment

Appendix I: Comments from the Department 

of Health and Human Services
Appendix I: Comments from the Department of 

Health and Human Services

Page 31 GAO-12-351 Provider and Supplier Medicare Enrollment
Appendix II: GAO Contact and Staff 

Acknowledgments

Page 32 GAO-12-351 Provider and Supplier Medicare Enrollment

Kathleen M. King, (202) 512-7114 or kingk@gao.gov

In addition to the contact named above, Karen Doran, Assistant Director; 

April Brantley; Jennel Harvey; Anne Hopewell; Laurie Pachter; 

Monica Perez-Nelson; and Jessica Colbert Smith made key contributions 

to this report.

Appendix II: GAO Contact and Staff 

Acknowledgments 

GAO Contact 

Staff 

Acknowledgments 

(290941)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.