PRESCRIPTION OPIOIDS

Medicare Needs Better 

Information to Reduce the 

Risk of Harm to 

Beneficiaries

Statement of Mary Denigan-Macauley

Acting Director, Health Care

Testimony 

Before the Subcommittee on Health 

Care, Committee on Finance, U.S. 

Senate

For Release on Delivery 

Expected at 1:00 p.m. ET

Tuesday, May 29, 2018

GAO-18-585T

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-18-585T, a testimony 

before the Subcommittee on Health Care, 

Committee on Finance, U.S. Senate

May 29, 2018

PRESCRIPTION OPIOIDS

Medicare Needs Better Information to Reduce the 

Risk of Harm to Beneficiaries

What GAO Found

In October 2017, GAO found that the Centers for Medicare & Medicaid Services 

(CMS) provided guidance on the monitoring of Medicare beneficiaries who 

received opioid prescriptions to plan sponsors—private organizations that 

implement the Medicare drug benefit, Part D—but it lacked information on most 

beneficiaries at risk of harm from opioid use. Specifically, GAO found that

• CMS provided guidance to plan sponsors on how they should monitor opioid 

overutilization among Medicare Part D beneficiaries, and required them to 

implement drug utilization review systems that use criteria similar to CMS's. 

Prior to 2018, the agency’s criteria focused on beneficiaries who did all the

following: (1) received prescriptions of high doses of opioids, (2) received

prescriptions from four or more providers, and (3) filled prescriptions at four 

or more pharmacies. According to CMS, this approach focused actions on 

beneficiaries the agency determined to have the highest risk of harm. For 

2018, CMS revised the criteria to include more at-risk beneficiaries.

• CMS's criteria, including recent revisions, did not provide sufficient 

information about the larger population of potentially at-risk beneficiaries. 

CMS estimated that, in 2015, 727,016 beneficiaries would have received 

high doses of opioids regardless of the number of providers or pharmacies, 

but only 33,223 would have met its revised criteria. In 2016, CMS began to 

collect information on some of these beneficiaries using a higher dosage 

threshold for opioid use. However, based on Centers for Disease Control and 

Prevention guidelines, CMS’s approach also missed some who could be at 

risk of harm. As a result, CMS had limited information to assess progress 

against the goals of the Medicare and Medicaid programs’ Opioid Misuse 

Strategy, which includes activities to reduce risk of harm to beneficiaries. 

CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and Those Who Would 

Have Met Revised Overutilization Monitoring Criteria

CMS provided oversight on prescribing of drugs at high risk of abuse through a 

variety of projects, but did not analyze data specifically on opioids. According to 

CMS officials, CMS and plan sponsors identified providers who prescribed large 

amounts of drugs with a high risk of abuse, and those suspected of fraud or 

abuse may be referred to law enforcement. However, GAO found that CMS did

not identify providers who may be inappropriately prescribing large amounts of 

opioids separately from other drugs, and did not require plan sponsors to report 

actions they take when they identified such providers. As a result, CMS lacked 

information that it could use to assess how opioid prescribing patterns are 

changing over time, and whether its efforts to reduce harm are effective.

View GAO-18-585T. For more information, 

contact Mary Denigan-Macauley at 

(202) 512-7114 or

deniganmacauleym@gao.gov.

Why GAO Did This Study

Misuse of prescription opioids can lead 

to overdose and death. Medicare and 

Medicaid, two of the nation’s largest 

health care programs, provide 

prescription drug coverage that can 

include opioids. GAO and others have 

reported on inappropriate activities and 

risks associated with these 

prescriptions.

This statement is based on GAO’s 

October 2017 report (GAO-18-15) and 

discusses (1) CMS oversight of 

Medicare beneficiaries who receive 

opioid prescriptions under Part D, and 

(2) CMS oversight of providers who 

prescribe opioids to Medicare Part D 

beneficiaries. For the October 2017 

report, GAO reviewed CMS opioid 

utilization and prescriber data, CMS 

guidance for plan sponsors, and CMS's 

strategy to prevent opioid misuse. 

GAO also interviewed CMS officials, 

the six largest Part D plan sponsors, 

and 12 national associations selected 

to represent insurance plans, 

pharmacy benefit managers, 

physicians, patients, and regulatory 

and law enforcement authorities.

What GAO Recommends

In the October 2017 report, GAO made 

three recommendations that CMS (1) 

gather information on the full number 

of at-risk beneficiaries receiving high 

doses of opioids, (2) identify providers 

who prescribe high amounts of opioids, 

and (3) require plan sponsors to report 

to CMS on actions related to providers 

who inappropriately prescribe opioids. 

HHS concurred with the first two 

recommendations, but not with the 

third. GAO continues to believe the 

recommendation is valid, as discussed 

in the report and in this statement.
Letter

Page 1 GAO-18-585T 

Chairman Toomey, Ranking Member Stabenow, and Members of the 

Subcommittee:

I am pleased to be here to discuss our October 2017 report on oversight 

of opioid prescribing in the Medicare program.1 Misuse of prescription 

opioids, which are used to treat both acute and chronic pain, has become 

a serious public health problem for the U.S. population, including 

Medicare and Medicaid beneficiaries. The Centers for Disease Control 

and Prevention (CDC), within the Department of Health and Human 

Services (HHS), reported that from 1999 to 2013 the rate of drug 

poisoning deaths from prescription opioids nearly quadrupled, and that in 

2016, alone, there were more than 17,000 overdose deaths from 

prescription opioids.

2

The Centers for Medicare and Medicaid Services (CMS), also within 

HHS, administers Medicare and Medicaid, two of the nation’s largest 

health care programs. Medicare is a federal health insurance program for 

people age 65 and older, individuals under age 65 with certain disabilities, 

and individuals diagnosed with end-stage renal disease. Within Medicare 

is Part D, the program’s outpatient prescription drug benefit.3 Medicaid is 

a joint federal-state program that finances health care coverage for 

 1

See GAO, Prescription Opioids: Medicare Needs to Expand Oversight Efforts to Reduce 

the Risk of Harm, GAO-18-15 (Washington, D.C.: Oct. 6, 2017). In January of 2018, we 

also testified before the Subcommittee on Oversight, Committee on Ways and Means, 

House of Representatives on the findings and recommendations from this report. See 

GAO, Prescription Opioids: Medicare Should Expand Oversight Efforts to Reduce the Risk 

of Harm, GAO-18-336T (Washington, D.C.: Jan. 17, 2018).

2

See Department of Health and Human Services, Centers for Disease Control and 

Prevention, Rates of Deaths from Drug Poisoning and Drug Poisoning Involving Opioid 

Analgesics—United States, 1999-2013, Morbidity and Mortality Weekly Report, vol. 64, 

no. 1, (Atlanta, Ga.: Jan. 16, 2015); and P. Seth, L. Scholl, et. al., Overdose Deaths 

Involving Opioids, Cocaine, and Psychostimulants—United States, 2015-2016, Morbidity 

and Mortality Weekly Report, vol. 67, no. 12, Centers for Disease Control and Prevention 

(Mar. 30, 2018). 

3

Medicare consists of Parts A, B, C, and the Part D prescription drug program. Parts A 

and B are known as traditional Medicare or Medicare fee-for-service. Medicare Part C, 

also known as Medicare Advantage, is a private plan alternative to traditional Medicare, 

and covers all traditional Medicare services. 

Letter
Page 2 GAO-18-585T 

certain low-income and medically needy individuals.4 Due to concerns 

about adequacy of oversight, both Medicare and Medicaid are on our list 

of high-risk programs.5

HHS’s Office of Inspector General (HHS-OIG) reported that 14.4 million 

people (about one-third) who participated in Medicare Part D in 2016 

received at least one prescription for opioids, and that Part D spending for 

opioids in 2016 was almost $4.1 billion.6 We and the HHS-OIG have 

previously reported on inappropriate activities that can be associated with 

such prescriptions, including “doctor shopping” to receive multiple opioid 

prescriptions from different providers; the diversion of prescription drugs 

for uses other than what was intended; and questionable prescribing 

practices by providers.7

The Medicaid program also covers opioid prescriptions for its 

beneficiaries. In our prior work, we have reported on potentially 

inappropriate activities involving Medicaid’s prescription drug coverage. In 

2017, for example, we reported on prescriptions for opioid pain 

medication among Medicaid beneficiaries. In that report, we noted that 

while opioid pain medication can constitute proper medical care for 

beneficiaries suffering from painful conditions, the use of these 

medications among Medicaid beneficiaries with diagnosed opioid abuse 

or dependence raises concerns about potential inappropriate 

 4

Within broad federal requirements, states have significant flexibility to design and 

implement their Medicaid programs based on their unique needs, resulting in 56 distinct 

programs. Medicaid programs are administered by the 50 states, the District of Columbia, 

American Samoa, Guam, the Commonwealth of the Northern Mariana Islands, Puerto 

Rico, and the U.S. Virgin Islands. These programs are administered at the state level and 

overseen at the federal level by CMS. 

5

See GAO, High-Risk Series: Progress on Many High-Risk Areas, While Substantial 

Efforts Needed on Others, GAO-17-317 (Washington, D.C.: Feb. 15, 2017). 

6

Department of Health and Human Services Office of Inspector General, Opioids in 

Medicare Part D: Concerns about Extreme Use and Questionable Prescribing, OE-02-17-

00250 (July 2017). 

7

See GAO, Medicare Part D: Instances of Questionable Access to Prescription Drugs, 

GAO-11-699 (Washington, D.C.: Sept. 6, 2011); and Medicare Program Integrity: CMS 

Pursues Many Practices to Address Prescription Drug Fraud, Waste, and Abuse, 

GAO-15-66 (Washington, D.C.: Oct. 24, 2014). See also Department of Health and 

Human Services, Office of Inspector General, High Part D Spending on Opioids and 

Substantial Growth in Compounded Drugs Raise Concerns, OEI-02-16-0029 (June 2016). 
Page 3 GAO-18-585T 

prescribing.8 In addition, in a July 2015 report, we found indicators of 

potential Medicaid prescription-drug fraud and abuse, such as doctor 

shopping.9

In March 2015, HHS announced plans to make addressing opioid abuse 

a high priority through two broad goals: (1) decreasing opioid overdoses 

and overall overdose deaths, and (2) decreasing the prevalence of opioid 

use disorder.10 In 2016, CDC issued guidelines with recommendations for 

prescribing opioids in outpatient settings for chronic pain.11 The guidelines 

recommended that providers use caution when prescribing opioids at any 

dose, carefully reassess evidence of individual benefits and risks when 

increasing opioid dosage to 50 mg morphine-equivalent dose (MED) per 

day or more, and avoid or carefully justify dosage at 90 mg MED or more. 

CDC guidelines also noted that providers should use additional caution in 

prescribing opioids to patients aged 65 and older, because the drugs can 

accumulate in the body to toxic levels. Further, in January 2017, CMS 

issued its Opioid Misuse Strategy for the Medicare and Medicaid 

programs, including Medicare Part D.12 The strategy includes the 

agency’s plans to address concerns about beneficiary use of opioids and 

the prescribing of opioids by providers.

 8

GAO, Medicaid Expansion: Behavioral Health Treatment Use in Selected States in 2014, 

GAO-17-529 (Washington, D.C.: June 22, 2017).

9

GAO, Medicaid: Additional Reporting May Help CMS Oversee Prescription-Drug Fraud 

Controls, GAO-15-390 (Washington, D.C.: July 8, 2015).

10Department of Health and Human Services, Office of the Assistant Secretary for 

Planning and Evaluation, Opioid Abuse in the U.S. and HHS Actions to Address OpioidDrug Related Overdoses and Death (Mar. 26, 2015). Opioid use disorder is defined as a 

problematic pattern of opioid use leading to clinically significant impairment or distress as 

indicated by at least 2 of 11 criteria occurring within a 12 month period. The criteria 

include taking opioids in larger amounts or over a longer period of time than was intended, 

persistent desire or unsuccessful efforts to cut down or control opioid use, or a strong 

desire or urge to use opioids. 

11Department of Health and Human Services, Centers for Disease Control and Prevention, 

CDC Guideline for Prescribing Opioids for Chronic Pain—United States, 2016, Morbidity 

and Mortality Weekly Report, vol. 65, no. 1, (Atlanta, Ga.: Mar. 18, 2016). 

12Centers for Medicare & Medicaid Services, Centers for Medicare & Medicaid Services 

(CMS) Opioid Misuse Strategy 2016 (Jan. 5, 2017).
Page 4 GAO-18-585T 

My remarks today discuss the findings and recommendations from our 

2017 report on CMS efforts to oversee prescription opioids in Medicare.

13

Accordingly, this testimony focuses on how:

(1) CMS oversees beneficiaries who receive opioid prescriptions 

under Medicare Part D, and 

(2) CMS oversees providers who prescribe opioids to Medicare Part 

D beneficiaries.

For our report, we reviewed CMS opioid utilization and prescriber data, 

CMS guidance for plan sponsors—private organizations, such as health 

insurance companies, contracted by CMS to provide outpatient drug 

benefit plans to Medicare beneficiaries—and CMS’s strategy to prevent 

opioid misuse. We also interviewed officials from CMS, the six largest 

Part D plan sponsors, and 12 national associations selected to represent 

insurance plans, pharmacy benefit managers, physicians, patients, and 

regulatory and law enforcement agencies. More detailed information on 

our objectives, scope, and methodology for that work can be found in the 

issued report. We conducted the work on which this statement is based in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

 13See GAO-18-15.
Page 5 GAO-18-585T 

Our October 2017 report found that CMS provided guidance to Medicare 

Part D plan sponsors on how they should monitor opioid overutilization 

problems among Part D beneficiaries. The agency included this guidance 

in its annual letters to plan sponsors, known as call letters; it also 

provided a supplemental memo to plan sponsors in 2012.14 Among other 

things, these guidance documents instructed plan sponsors to implement 

a retrospective drug utilization review (DUR) system to monitor 

beneficiary utilization starting in 2013.15 As part of the DUR systems, 

CMS required plan sponsors to have methods to identify beneficiaries 

who were potentially overusing specific drugs or groups of drugs, 

including opioids.

 14Centers for Medicare & Medicaid Services, Announcement of Calendar Year (CY) 2013 

Medicare Advantage Capitation Rates and Medicare Advantage and Part D Payment 

Policies and Final Call Letter, accessed December 21, 2016, 

https://www.cms.gov/Medicare/Health-Plans/HealthPlansGenInfo/Downloads/2013-CallLetter.pdf; and Centers for Medicare & Medicaid Services, Supplemental Guidance 

Related to Improving Drug Utilization Review Controls in Part D, accessed April 25, 2017, 

https://www.cms.gov/Medicare/Prescription-DrugCoverage/PrescriptionDrugCovContra/Downloads/HPMSSupplementalGuidanceRelatedtoImprovingDURcontrols.pdf. 

15In addition to instructing plan sponsors to implement retrospective DUR systems, the 

guidance in the 2013 call letter includes information on other mechanisms to control 

overutilization. See https://www.cms.gov/Medicare/HealthPlans/HealthPlansGenInfo/Downloads/2013-Call-Letter.pdf. 

CMS Delegated

Monitoring of 

Beneficiaries who 

Receive Opioid 

Prescriptions to Plan 

Sponsors, but Did Not 

Have Sufficient 

Information on Those 

Most at Risk for Harm

CMS Delegated

Monitoring of Individual 

Beneficiaries’ Opioid 

Prescriptions to Plan 

Sponsors
Page 6 GAO-18-585T 

Also in 2013, CMS created the Overutilization Monitoring System (OMS), 

which outlined criteria to identify beneficiaries with high-risk use of 

opioids, and to oversee sponsors’ compliance with CMS’s opioid 

overutilization policy. Plan sponsors may use the OMS criteria for their 

DUR systems, but they had some flexibility to develop their own targeting 

criteria within CMS guidance. At the time of our review, the OMS 

considered beneficiaries to be at a high risk of opioid overuse when they 

met all three of the following criteria:

1. received a total daily MED greater than 120 mg for 90 consecutive 

days,

2. received opioid prescriptions from four or more health care providers 

in the previous 12 months, and

3. received opioids from four or more pharmacies in the previous 12 

months.16

The criteria excluded beneficiaries with a cancer diagnosis and those in 

hospice care, for whom higher doses of opioids may be appropriate.

We found that through the OMS, CMS generated quarterly reports that list 

beneficiaries who met all of the criteria and who were identified as highrisk, and then distributed the reports to the plan sponsors. Plan sponsors 

were expected to review the list of identified beneficiaries, determine 

appropriate action, and then respond to CMS with information on their 

actions within 30 days. According to CMS officials, the agency also 

expected plan sponsors to share any information with CMS on 

beneficiaries that they identified through their own DUR systems. We 

found that some actions plan sponsors may take included the following:

• Case management. Case management may include an attempt to 

improve coordination issues, and often involves provider outreach, 

whereby the plan sponsor will contact the providers associated with 

 16These criteria were in effect through 2017. CMS announced in its April 3, 2017 call letter 

the revisions to the OMS criteria that will take effect in 2018. See Announcement of 

Calendar Year (CY) 2018 Medicare Advantage Capitation Rates and Medicare Advantage 

and Part D Payment Policies and Final Call Letter and Request for Information, accessed 

April 4, 2017. https://www.cms.gov/Medicare/HealthPlans/MedicareAdvtgSpecRateStats/Downloads/Announcement2018.pdf. Some of the 

beneficiaries that meet the OMS criteria may not be using the opioids themselves, but 

rather diverting them by either giving or selling them to others. 
Page 7 GAO-18-585T 

the beneficiary to let them know that the beneficiary is receiving high 

levels of opioids and may be at risk of harm.

• Beneficiary-specific point-of-sale (POS) edits. Beneficiary-specific 

POS edits are restrictions that limit these beneficiaries to certain 

opioids and amounts. Pharmacists receive a message when a 

beneficiary attempts to fill a prescription that exceeds the limit in place 

for that beneficiary.

• Formulary-level POS edits. These edits alert providers who may not 

have been aware that their patients are receiving high levels of 

opioids from other doctors.

• Referrals for investigation. According to the six plan sponsors we 

interviewed, the referrals can be made to CMS’s National Benefit 

Integrity Medicare Drug Integrity Contractor (NBI MEDIC), which was

responsible for identifying and investigating potential Part D fraud, 

waste, and abuse, or to the plan sponsor’s own internal investigative 

unit, if they have one. After investigating a particular case, they may 

refer the case to the HHS-OIG or a law enforcement agency, 

according to CMS, NBI MEDIC, and one plan sponsor.

Based on CMS’s use of the OMS and the actions taken by plan sponsors, 

CMS reported a 61 percent decrease from calendar years 2011 through 

2016 in the number of beneficiaries meeting the OMS criteria of high 

risk—from 29,404 to 11,594 beneficiaries—which agency officials 

considered an indication of success toward its goal of decreasing opioid 

use disorder.

In addition, we found that CMS relied on separate patient safety 

measures developed and maintained by the Pharmacy Quality Alliance to 

assess how well Part D plan sponsors were monitoring beneficiaries and 

taking appropriate actions.17 In 2016, CMS started tracking plan sponsors’ 

performance on three patient safety measures that were directly related 

to opioids. The three measures were similar to the OMS criteria in that 

they identified beneficiaries with high dosages of opioids (120 mg MED), 

beneficiaries that use opioids from multiple providers and pharmacies, 

and beneficiaries that do both. However, one difference between these 

 17The Pharmacy Quality Alliance is a consensus-based, multi-stakeholder membership 

organization that collaboratively promotes appropriate medication use and develops 

strategies for measuring and reporting performance information related to medications. 

The alliance developed all but one of CMS’s Part D patient safety measures, and that one 

measure is not related to opioid safety. 
Page 8 GAO-18-585T 

approaches was that the patient safety measures separately identified

beneficiaries who fulfill each criterion individually.

Our October 2017 report also found that CMS tracked the total number of 

beneficiaries who met all three OMS criteria as part of its opioid 

overutilization oversight across the Part D program. However, the agency

did not have comparable information on most beneficiaries who receive 

high doses of opioids—regardless of the number of providers and 

pharmacies used—and who therefore may be at risk for harm, according 

to CDC’s 2016 guidelines. These guidelines noted that long-term use of 

high doses of opioids—those above a MED of 90 mg per day—are 

associated with significant risk of harm and should be avoided if possible.

Based on the CDC guidelines, outreach to Part D plan sponsors, and 

CMS analyses of Part D data, CMS has revised its current OMS criteria to 

include more at-risk beneficiaries beginning in 2018. The new OMS 

criteria define a high user as an individual 

• having an average daily MED greater than 90 mg for any duration; 

and 

• receiving opioids from four or more providers and four or more 

pharmacies, or from six or more providers regardless of the 

number of pharmacies, for the prior 6 months.18

Based on 2015 data, CMS found that 33,223 beneficiaries would have 

met these revised criteria. While the revised criteria would help identify 

beneficiaries who CMS determined are at the highest risk of opioid 

misuse and therefore may need case management by plan sponsors, 

they did not provide information on the total number of Part D 

beneficiaries who may be at risk of harm. In developing the revised 

criteria, CMS conducted a one-time analysis that estimated there were 

727,016 beneficiaries with an average MED of 90 mg or more, for any 

length of time during a 6 month measurement period in 2015, regardless 

of the number of providers or pharmacies used. According to the CDC 

guidelines, these beneficiaries may be at risk of harm from opioids, and 

 18According to CMS officials, the changes are partially in response to CDC’s 2016 

guidelines. The CDC guidelines noted that patients are at risk of harm above 50 mg MED 

and that providers should generally avoid increasing dosage to more than 90 mg MED of 

opioids, regardless the number of providers or pharmacies. 

CMS Did Not Have 

Sufficient Information on 

Most Beneficiaries 

Potentially at Risk for 

Harm
Page 9 GAO-18-585T 

therefore tracking the total number of these beneficiaries over time could 

help CMS to determine whether it is making progress toward meeting the 

goals specified in its Opioid Misuse Strategy to reduce the risk of opioid 

use disorders, overdoses, inappropriate prescribing, and drug diversion. 

However, CMS officials told us that the agency did not keep track of the 

total number of these beneficiaries, and did not have plans to do so as 

part of OMS. (See fig. 1.)

Figure 1: CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and 

Those Who Would Have Met Revised Overutilization Monitoring Criteria

a

This number includes beneficiaries with an average opioid morphine equivalent dose of 90 

milligrams or more within a 6-month measurement period.

b

This number is an estimate of how many beneficiaries would have met CMS’s revised Overutilization 

Monitoring System (OMS) criteria. CMS calculated these totals by applying the revised OMS criteria 

to 2015 Part D data.

We also found that in 2016, CMS began to gather information from its 

patient safety measures on the number of beneficiaries who use more 

than 120 mg MED of opioids for 90 days or longer, regardless of the 

number of providers and pharmacies. The patient safety measures 

identified 285,119 such beneficiaries—counted as member-years—in 

2016.19 However, this information did not include all at-risk beneficiaries, 

because the threshold was more lenient than indicated in CDC guidelines 

and CMS’s new OMS criteria. Because neither the OMS criteria nor the 

patient safety measures included all beneficiaries potentially at risk of 

harm from high opioid doses, we recommended that CMS should gather 

information over time on the total number of beneficiaries who receive 

high opioid morphine equivalent doses regardless of the number of 

pharmacies or providers, as part of assessing progress over time in 

reaching the agency’s goals related to reducing opioid use. HHS 

concurred with our recommendation.

 19Patient safety measures count member-years, which account for beneficiaries who are 

enrolled in a Part D plan for only part of a year. 
Page 10 GAO-18-585T 

Our October 2017 report found that CMS oversees providers who 

prescribe opioids to Medicare Part D beneficiaries through its contractor, 

NBI MEDIC, and the Part D plan sponsors.

• NBI MEDIC’s data analyses to identify outlier providers. CMS 

required NBI MEDIC to identify providers who prescribe high amounts 

of Schedule II drugs, which include but are not limited to opioids.20

Using prescription drug data, NBI MEDIC conducted a peer 

comparison of providers’ prescribing practices to identify outlier 

providers—the highest prescribers of Schedule II drugs—and reported

the results to CMS.

• NBI MEDIC’s other projects. NBI MEDIC gathered and analyzed

data on Medicare Part C and Part D, including projects using the 

Predictive Learning Analytics Tracking Outcome (PLATO) system. 

According to NBI MEDIC officials, these PLATO projects sought to 

identify potential fraud by examining data on provider behaviors.

• NBI MEDIC’s investigations to identify fraud, waste, and abuse.

NBI MEDIC officials conducted investigations to assist CMS in 

identifying cases of potential fraud, waste, and abuse among 

providers for Medicare Part C and Part D. The investigations were

prompted by complaints from plan sponsors; suspected fraud, waste, 

or abuse reported to NBI MEDIC’s call center; NBI MEDIC’s analysis 

of outlier providers; or from one of its other data analysis projects.

• NBI MEDIC’s referrals. After identifying providers engaged in 

potential fraudulent overprescribing, NBI MEDIC officials said they 

may refer cases to law enforcement agencies or the HHS-OIG for 

further investigation and potential prosecution.

• Plan sponsors’ monitoring of providers. CMS required all plan 

sponsors to adopt and implement an effective compliance program, 

which must include measures to prevent, detect, and correct Part C or 

Part D program noncompliance, as well as fraud, waste, and abuse. 

CMS’s guidance focused broadly on prescription drugs, and did not 

specifically address opioids.

 20Under the Controlled Substances Act, which was enacted in 1970, drugs are classified 

as controlled substances and placed into one of five schedules based on their medicinal 

value, potential for abuse, and risk of dependence. Schedule II drugs have the highest 

potential for abuse of any drugs approved for medical use. 

CMS Oversees 

Providers through its 

Contractor and Plan 

Sponsors, but Efforts 

Did Not Specifically 

Monitor Opioid 

Prescriptions
Page 11 GAO-18-585T 

Our report concluded that although these efforts provided valuable 

information, CMS lacked information necessary to adequately oversee 

opioid prescribing. CMS’s oversight actions focused broadly on Schedule 

II drugs rather than specifically on opioids. For example, NBI MEDIC’s 

analyses to identify outlier providers did not indicate the extent to which 

they may be overprescribing opioids specifically. According to CMS 

officials, they directed NBI MEDIC to focus on Schedule II drugs, because 

these drugs have a high potential for abuse, whether they are opioids or 

other drugs. However, without specifically identifying opioids in these 

analyses—or an alternate source of data—CMS lacked data on providers 

who prescribe high amounts of opioids, and therefore cannot assess 

progress toward meeting its goals related to reducing opioid use, which 

would be consistent with federal internal control standards. Federal 

internal control standards require agencies to conduct monitoring 

activities and to use quality information to achieve objectives and address 

risks.21 As a result, we recommended that CMS require NBI MEDIC to 

gather separate data on providers who prescribe high amounts of opioids. 

This would allow CMS to better identify those providers who are 

inappropriately and potentially fraudulently overprescribing opioids. HHS 

agreed, and in April 2018 reported that it is working with NBI MEDIC to 

separately identify outlier prescribers of opioids.

In addition, our 2017 report found that CMS also lacked key information 

necessary for oversight of opioid prescribing, because it did not require 

plan sponsors to report to NBI MEDIC or CMS cases of fraud, waste, and 

abuse; cases of overprescribing; or any actions taken against providers.22

Plan sponsors collected information on cases of fraud, waste, and abuse, 

and could choose to report this information to NBI MEDIC or CMS. While 

CMS receives information from plan sponsors who voluntarily reported

their actions, it did not know the full extent to which plan sponsors had

identified providers who prescribed high amounts of opioids, or the full 

extent to which sponsors had taken action to reduce overprescribing. We 

concluded that without this information, it was difficult for CMS to assess 

progress in this area, which would be consistent with federal internal 

 21GAO, Standards for Internal Control in the Federal Government, GAO-14-704G 

(Washington, D.C.: Sept. 10, 2014). Internal controls is a process affected by an entity’s 

oversight body, management, and other personnel that provides reasonable assurance 

that the objectives of an entity will be achieved. 

22According to CMS officials, the agency’s regulations currently make reporting 

inappropriate prescribing and any actions against providers voluntary for plan sponsors. 

See 42 C.F.R. § 423.504(b)(4)(vi)(G)(3).
Page 12 GAO-18-585T 

control standards. In our report, we recommended that CMS require plan 

sponsors to report on investigations and other actions taken related to 

providers who prescribe high amounts of opioids. HHS did not concur 

with this recommendation. HHS noted that plan sponsors have the 

responsibility to detect and prevent fraud, waste, and abuse, and that 

CMS reviews cases when it conducts audits. HHS also stated that it 

seeks to balance requirements on plan sponsors when considering new 

regulatory requirements. However, without complete reporting—such as 

reporting from all plan sponsors on the actions they take to reduce 

overprescribing—we believe that CMS is missing key information that 

could help assess progress in this area. Due to the importance of this 

information for achieving the agency’s goals, we continue to believe that 

CMS should require plan sponsors to report on the actions they take to 

reduce overprescribing.

In conclusion, a large number of Medicare Part D beneficiaries use 

potentially harmful levels of prescription opioids, and reducing the 

inappropriate prescribing of these drugs has been a key part of CMS’s 

strategy to decrease the risk of opioid use disorder, overdoses, and 

deaths. Despite working to identify and decrease egregious opioid use 

behavior—such as doctor shopping—among Medicare Part D 

beneficiaries, CMS lacked the necessary information to effectively 

determine the full number of beneficiaries at risk of harm, as well as other 

information that could help CMS assess whether its efforts to reduce 

opioid overprescribing are effective. It is important that health care 

providers help patients to receive appropriate pain treatment, including

opioids, based on the consideration of benefits and risks. Access to 

information on the risks that Medicare patients face from inappropriate or 

poorly monitored prescriptions, as well as information on providers who 

may be inappropriately prescribing opioids, could help CMS as it works to 

improve care.

Chairman Toomey, Ranking Member Stabenow, and Members of the 

Subcommittee, this concludes my prepared statement. I would be 

pleased to respond to any questions that you may have at this time.

Conclusions
Page 13 GAO-18-585T 

If you or your staff members have any questions concerning this 

testimony, please contact me at (202) 512-7114 or 

DeniganMacauleyM@gao.gov. Contact points for our Office of 

Congressional Relations and Public Affairs may be found on the last page 

of this statement. Other individuals who made key contributions to this 

testimony include Will Simerl (Assistant Director) and Carolyn Feis 

Korman (Analyst-in-Charge). Also contributing were Amy Andresen, 

George Bogart, Andrew Furillo, Drew Long, and Vikki Porter.

GAO Contacts and 

Staff 

Acknowledgements

(102814)
This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
The Government Accountability Office, the audit, evaluation, and investigative 

arm of Congress, exists to support Congress in meeting its constitutional 

responsibilities and to help improve the performance and accountability of the 

federal government for the American people. GAO examines the use of public 

funds; evaluates federal programs and policies; and provides analyses, 

recommendations, and other assistance to help Congress make informed 

oversight, policy, and funding decisions. GAO’s commitment to good government 

is reflected in its core values of accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no cost is 

through GAO’s website (https://www.gao.gov). Each weekday afternoon, GAO 

posts on its website newly released reports, testimony, and correspondence. To 

have GAO e-mail you a list of newly posted products, go to https://www.gao.gov

and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of production and 

distribution and depends on the number of pages in the publication and whether 

the publication is printed in color or black and white. Pricing and ordering 

information is posted on GAO’s website, https://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, 

Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube.

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts.

Visit GAO on the web at https://www.gao.gov.

Contact:

Website: https://www.gao.gov/fraudnet/fraudnet.htm

Automated answering system: (800) 424-5454 or (202) 512-7470

Orice Williams Brown, Managing Director, WilliamsO@gao.gov, (202) 512-4400, 

U.S. Government Accountability Office, 441 G Street NW, Room 7125, 

Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

James-Christian Blockwood, Managing Director, spel@gao.gov, (202) 512-4707

U.S. Government Accountability Office, 441 G Street NW, Room 7814, 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations

Public Affairs

Strategic Planning and 

External Liaison

Please Print on Recycled Paper.