United States General Accounting Office

GAO Report to the Chairman, Subcommittee

on Human Resources and

Intergovernmental Relations, Committee

on Government Reform and Oversight,

House of Representatives

March 1997 MEDICAID FRAUD

AND ABUSE

Stronger Action

Needed to Remove

Excluded Providers

From Federal Health

Programs

GAO/HEHS-97-63

GAO United States

General Accounting Office

Washington, D.C. 20548

Health, Education, and

Human Services Division

B-275645 

March 31, 1997

The Honorable Christopher Shays

Chairman, Subcommittee on Human Resources

 and Intergovernmental Relations

Committee on Government Reform and Oversight

House of Representatives

Dear Mr. Chairman:

Medicaid, a joint federal-state health program for the poor, spent

approximately $160 billion in 1996 to provide health care coverage for

about 37 million people. Because of its size and complex structure,

Medicaid is vulnerable to fraud and abuse. State Medicaid agencies have

the primary responsibility to protect the program’s financial integrity and

to ensure that beneficiaries have access to quality care. This responsibility

includes ensuring that appropriate safeguards are in place to remove from

state programs those providers that commit fraud or abuse or those that

are incompetent. State Medicaid agencies must report providers they

remove from their programs to the Office of the Inspector General (OIG),

Department of Health and Human Services (HHS). The OIG is responsible

for determining whether the circumstances that resulted in states’

removing providers warrant promptly excluding them from federal health

care programs nationwide.

Exclusion should be a strong deterrent to unacceptable providers, but the

deterrent effect is diluted if they can continue to receive payment for

program services. Concerned that this situation could be occurring, you

asked us to examine how well the OIG’s exclusion process is working. On

September 5, 1996, we testified before the Subcommittee on the

preliminary results of our work,1

 which suggested several weaknesses in

the OIG’s exclusion process. In some instances, these weaknesses have

resulted in unacceptable providers continuing to participate in federal

health care programs. The HHS Inspector General agreed with our findings

and testified that she was taking steps to strengthen the process.

In this report, we present the final results of our work, expanding on our

testimony concerning the weaknesses in the OIG’s process. In addition, we

ascertained what corrective actions the OIG has taken or plans to take and

further examined the problems states experience when using OIG

1

Fraud and Abuse: Providers Excluded From Medicaid Continue to Participate in Federal Health

Programs (GAO/T-HEHS-96-205, Sept. 5, 1996).

Page 1 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

exclusion data. Moreover, we interviewed officials from the OIG and Health

Care Financing Administration (HCFA)—the agency that administers

Medicaid at the federal level—to determine their plans to improve health

care provider data systems, as required by the Health Insurance Portability

and Accountability Act of 1996.

In developing information for this report, we visited Illinois, Maryland,

Missouri, New York, Virginia, and Washington, D.C.2

 To understand the

processes for removing providers from state Medicaid programs, we

worked with officials of state Medicaid agencies, Medicaid fraud control

units (MFCU), and state licensing boards. We also met with officials from

the four OIG field offices—Chicago, New York, Philadelphia, and

Washington, D.C.3

—that oversee these six states and with officials from

OIG and HCFA headquarters. At selected state agencies, we reviewed case

files for a judgmentally selected sample of providers that the states

determined had abused the Medicaid program to ascertain the nature of

the providers’ wrongdoing and whether they had been referred to the OIG.

We followed up at the Chicago, New York, and Philadelphia OIG field

offices to determine whether they acted on the referrals and at Medicare

contractors to determine whether providers continued to participate in

Medicare after they had been excluded from Medicaid. Our scope and

methodology are discussed in more detail in appendix I.

Results in Brief Over the years, the OIG, working with state agencies, has excluded

thousands of providers from participating in federal health care programs

because of health care fraud, abuse, or quality-of-care problems, thus

helping to protect the financial integrity of those programs and decreasing

the likelihood that program beneficiaries receive substandard care.

However, several weaknesses in this exclusion process allow many

unacceptable providers to remain on the rolls of federal health programs.

The weaknesses we identified include (1) lack of controls at OIG field

offices to ensure that all state referrals received are reviewed and acted on

promptly, (2) inconsistencies among OIG field offices as to the criteria for

excluding providers, (3) lack of oversight to ensure that states make

appropriate exclusion referrals to the OIG, and (4) problems states

experience in attempting to identify and remove from their programs

providers that appear on the OIG’s exclusion list.

2

In this report, we refer to Washington, D.C., as a state.

3

In September 1996, the Washington field office became a suboffice of the Philadelphia field office.

Page 2 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

These weaknesses place the health and safety of beneficiaries at risk and

compromise the financial integrity of Medicaid, Medicare, and other

federal health programs. For example, OIG delays in acting on state

referrals allowed one physician to receive nearly $61,000 for services

provided to Medicare patients; these services were provided for more than

2 years after a state Medicaid program had removed him for maintaining

an unacceptable practice. Moreover, difficulties states experienced in

using OIG exclusion data allowed some providers to continue to be

enrolled in a state Medicaid program after they had been excluded

nationwide by the OIG. In one state, there were 13 instances in which this

occurred. One of the providers had been paid over $25,000 since being

excluded by the OIG.

OIG officials attributed many of these problems to repeated cutbacks in

resources occurring in the past several years. The Health Insurance

Portability and Accountability Act of 1996, however, addresses this

concern by providing the OIG with extra funding, specifically for dealing

with health care fraud. Some of this funding, officials said, will be used to

hire additional staff to process exclusion referrals. The act also includes

tools and resources to facilitate identifying unacceptable providers. These

tools include a system of unique billing numbers for health care

providers—to be developed to reduce the potential for inappropriate

payments—and an adverse action data bank—to be established to record

information on any adverse action taken against a health care provider.

When implemented, these tools should help to limit the number of

providers excluded from one program that continue to participate in

others.

In the interim, the HHS Inspector General has initiated actions to improve

the effectiveness of the exclusion process. For example, the OIG has

initiated a system to track all incoming exclusion referrals, staff have

received additional training to improve the consistency and quality of

exclusion processing, and outreach efforts are under way to help ensure

that states forward all required information. While these efforts are

significant, we believe further refinements are necessary to improve the

exclusion process.

Background The Secretary of HHS has delegated to the OIG the authority, under sections

1128 and 1156 of the Social Security Act, to exclude certain health care

Page 3 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

providers from most federal health care programs.4 Under the law, the OIG,

which acts through its Office of Investigations, must exclude, nationwide,

providers that have been convicted of a criminal offense related to

Medicare5

 or any state health care program, a criminal offense related to

patient abuse or neglect, or a felony related to other health care fraud or

controlled substances. Under these circumstances, providers fall into the

category of “mandatory exclusions.”

The OIG also has authority to exclude individuals or organizations if the OIG

determines that the particular facts in a case meet certain criteria. These

actions are termed “permissive exclusions.” They may be based on, for

example, submitting excessive claims, license suspensions and

revocations, and sanctions imposed by federal or state health agencies.

(See app. II for the legal bases for exclusions.)

OIG field offices receive exclusion referrals from state Medicaid agencies,

licensing boards, MFCUs,6

 and others. For mandatory exclusion cases, the

field offices assemble and forward to headquarters the case files

containing evidence of a provider’s criminal conviction. For other

referrals, which could result in permissive exclusions, the field offices

receive documents on disciplinary actions taken by state Medicaid

agencies, licensing boards, or others. The field offices assess the relevant

facts and forward to OIG headquarters the names of providers they

recommend for exclusion. OIG headquarters makes the final decision on

excluding the provider from program enrollment.

When the OIG excludes a provider, it sends notification letters to

organizations—such as state Medicaid agencies, Medicare contractors,

and state licensing boards—in the states in which the provider is known to

practice or operate. When applicable, the provider’s employer is also

notified. In addition, the OIG provides HCFA with periodic cumulative

4

OIG exclusions apply to Medicare (title XVIII of the Social Security Act) and state health care

programs, defined as Medicaid (title XIX), Maternal and Child Health Services Block grant (title V),

and Block Grants to States for Social Services (title XX). As a result of the Federal Acquisition

Streamlining Act of 1994, which mandates and expands the governmentwide effect of all debarments,

suspensions, and other exclusionary actions on federal procurement and nonprocurement programs,

OIG exclusions also apply to health care providers participating in the Federal Employees’ Health

Benefits Program (FEHBP), administered by the U.S. Office of Personnel Management, and the

Civilian Health and Medical Program of the Uniformed Services (CHAMPUS), administered by the

Department of Defense.

5

Medicare is the federal program financing health care for the nation’s elderly and disabled.

6

Most states have MFCUs that must be organizationally independent of the agency that operates the

state Medicaid program. An MFCU is usually a component of the state attorney general’s office.

MFCUs investigate and prosecute provider fraud and cases relating to neglect or abuse of patients in

nursing homes and other facilities.

Page 4 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

reports and monthly updates on excluded providers, which HCFA

distributes nationally.

As of October 1996, about 9,500 providers were excluded from federal

health care programs nationwide. Three exclusion categories—conviction

for program-related crime, conviction for a criminal offense related to

patient abuse or neglect, and license suspensions and

revocations—accounted for 76 percent of these nationwide exclusions.

OIG Process Does Not

Ensure Accountability

and Timely Resolution

of All Exclusion

Referrals

Unless the OIG maintains accountability for state exclusion referrals,

providers that have committed fraud or rendered substandard care to

Medicaid beneficiaries in one state can continue to provide services (1) to

Medicaid beneficiaries in other states, (2) under Medicare, or (3) through

other federal health programs. Likewise, long delays in processing

exclusion referrals allow unacceptable providers to continue to provide

services in federal health care programs. In our review of a judgmental

sample of 88 state exclusion referrals to three OIG field offices, we found

that almost one-half of the referrals had significant processing problems.

Field offices had no record of 11 referrals. Processing time for another 30

referrals, or 34 percent, was 1 year or longer. All of the missing and

delayed referrals occurred among the 66 referrals we followed up on in the

Chicago and New York field offices. In these offices, long delays occurred

for both mandatory referrals—which the OIG is required by law to

exclude—and permissive referrals—for which the OIG has to decide

whether certain exclusion criteria are met. While these referrals remained

unresolved, some providers received thousands of dollars from Medicare.

Accountability Lacking for

Referrals

OIG field offices could not account for all referrals received from state

agencies. While the Philadelphia field office had files for all 22 referrals we

reviewed, the Chicago and New York field offices had no records for 11 of

the 66 state referrals we checked.

The Chicago field office could not locate 5 of 18 referrals from the Illinois

Medicaid program and 1 of 14 referrals from the Illinois MFCU. Moreover,

three of the state Medicaid agency referrals involved serious

quality-of-care issues. For example, in April 1995, the Illinois Medicaid

agency excluded a dentist from its program for providing care that placed

his patients at risk. Among the charges was that the dentist had performed

surgical extractions and had given patients general anesthesia without

documented need. The state Medicaid agency’s case file on this dentist

Page 5 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

showed that he had been referred to the OIG in June 1995. When we

inquired at the Chicago field office in March 1996, however, no record

could be found of the case. After our inquiry, the office opened a case file

on the dentist and he was excluded by the OIG in December 1996. During

the 17-month period between state removal from Medicaid and OIG

exclusion from all federal health care programs, this dentist received over

$13,000 for services provided to Medicare patients.

Likewise, the New York field office had no record for 5 of the 28 referrals

we reviewed that the New York Medicaid officials claimed had been

referred to the OIG. Specifically, the field office had no record of a

physician who had been excluded from the state’s Medicaid program over

a year earlier for a variety of quality-of-care problems, such as failure to

evaluate patient problems and overutilization of laboratory and other

tests. From the time this physician was removed from Medicaid in New

York, Medicare had paid him over $108,000, as of November 1996. In

another case, the field office had no record of a durable medical

equipment supplier who had been removed from Medicaid 2 years earlier,

after an audit determined that the supplier had overbilled the Medicaid

program by more than $173,000.

Delays in Processing

Exclusion Referrals

OIG processing of state referrals was sometimes delayed while the Chicago

and New York field offices waited for states to send in documents needed

by the OIG to exclude the provider nationwide. In mandatory exclusion

cases, the OIG requires copies of conviction and sentencing documents; in

permissive cases, the OIG requires basic information describing what the

provider did to bring about the state removal. The extent to which states

furnished such documentation when referring a case to the OIG varied

among state agencies we contacted. This variation seemed due, in part, to

an absence of clear guidance from the OIG on the documentation needed

for exclusion processing. Moreover, when these documents were not

provided with the referral, case files often did not show any indication of

field office follow-up to obtain the missing information. Even after all the

information was received, some case files showed long periods of

inactivity. OIG guidance requires that after field office staff receive a

permissive exclusion referral, they must decide, within 60 working days,

whether to pursue exclusion. However, the guidance does not set any

standards or performance goals for actually processing state referrals after

the decision is made to pursue an exclusion.

Page 6 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

In contrast to the Chicago and New York field offices, the Philadelphia

field office resolved all of the 22 referrals we reviewed in less than 1 year

and most took 6 months or less. This situation appeared to be due, in part,

to the Maryland MFCU—the state agency whose referrals we selected for

follow-up in the Philadelphia field office—consistently sending the field

office all the required documentation.

The following examples illustrate the delays we found in Chicago and New

York (additional examples can be found in app. III):

• A pharmacy was removed for overbilling the Illinois Medicaid program by

more than $117,000. The Chicago field office took 15 months to forward

this permissive exclusion case to headquarters. The case file showed no

activity for extended periods of time, including a 10-month period.

• In a mandatory exclusion case, the Chicago field office referred a provider

to headquarters for exclusion 19 months after the Illinois MFCU notified it

that the provider had pled guilty and was sentenced in state court for

falsely billing for Medicaid services. Two-and-one-half months after the

case was forwarded to OIG headquarters, the provider was excluded

nationwide.

• In another mandatory exclusion case, a dentist was sentenced in June 1995

for stealing more than $220,000 from New York’s Medicaid program,

charging for more expensive procedures when less expensive ones were

actually performed or charging for services not provided. State delays in

providing documents on the sentencing initially delayed the New York

field office’s processing of the case. These documents were received in

November 1995, but no further action had been taken on the case until a

few days before we reviewed it in November 1996.

• The Medicare program in New York paid a physician nearly $61,000 during

the more than 2-year period from the time the state Medicaid agency in

New York notified the OIG field office that it had removed a physician to

the time the OIG excluded the physician from all federal health programs.

The state had removed the physician from Medicaid for maintaining an

unacceptable practice, keeping inadequate records, and for

inappropriately sharing fees for professional services. We reviewed the

New York field office case file on this permissive exclusion, and it showed

inactivity for extended periods of time, including one 17-month period.

• In a similar permissive exclusion case, OIG headquarters decided not to

pursue exclusion against a physician, who had been removed from New

York’s Medicaid program for providing poor quality of care to Medicaid

beneficiaries, because it considered the case too old to pursue. The field

Page 7 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

office had received the referral 18 months earlier. Since exclusion from

Medicaid, Medicare in New York had paid this physician over $86,000.

Processing of

Permissive Exclusions

Inconsistent Among

Field Offices

We identified inconsistencies in the way the OIG has handled permissive

exclusions, that is, cases in which the OIG has discretion on whether to

recommend nationwide exclusion. In 1987, the OIG was given expanded

discretionary authority to exclude providers nationwide.7

 The OIG,

however, has not always used its expanded exclusion authority

consistently. Given competing demands on the OIG’s time, permissive

exclusions have sometimes had a relatively low priority, OIG officials said.

In October 1992, the OIG instructed its field offices to process state

Medicaid agency and licensing board disciplinary actions only when actual

harm was done to patients and the provider had moved to another state.

Field offices, in turn, asked state agencies to refer only these kinds of

cases. About a year later, however, the OIG rescinded this guidance and

state agencies were asked once again to refer all cases.

We also observed inconsistencies in the way field offices process

permissive exclusion cases. As a result, providers with equally serious

problems could be treated differently by the OIG, depending on location.

For example, the Washington, D.C., field office would not consider

recommending nationwide exclusion unless a state Medicaid agency had

excluded the provider or a licensing board had revoked a license for at

least 1 year, a field office official said. The Chicago and New York field

offices, however, use a 2-year rule of thumb. Moreover, cases that

appeared to be equally serious received different treatment in the same

field office. For example, the New York field office forwarded to OIG

headquarters a physician’s case for nationwide exclusion after the state

Medicaid agency removed the physician. The reasons for removal were

providing excessive services, treating patients inappropriately with the

wrong medications, and not performing sufficient testing to determine the

cause of patients’ complaints. This field office, however, did not forward

the case of another physician, whom the state had removed for similar

reasons about a year earlier. The field office case file lacked an

explanation or rationale for why this case had not been investigated. The

regional inspector general, the head of the field office, said the office’s

large backlog of cases and shortage of staff accounted for the situation.

7

Medicare and Medicaid Patient and Program Protection Act of 1987 (P.L. 100-93).

Page 8 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

OIG Oversight of State

Agencies Could Be

Improved

Section 1902 of the Social Security Act requires state Medicaid agencies to

report to HHS whenever a provider of services is terminated, suspended, or

otherwise sanctioned or prohibited from participating in the program.8

 For

purposes of indicating which providers the OIG may exclude, HHS

regulations define the term “otherwise sanctioned” as intending to cover

all actions that limit the ability of a person to participate in the program,

regardless of what such an action is called, including situations in which

an individual or entity voluntarily withdraws from a program to avoid a

formal sanction (42 C.F.R. 1001.601).

We found, however, that states were not always clear about reporting

requirements and OIG field offices did not monitor state agencies to ensure

that all cases that fell under the OIG’s exclusion authority were being

referred. Consequently, the OIG was not informed of all providers that had

committed fraud or abuse or had furnished poor quality of care in a state

Medicaid program; such providers could therefore continue providing

services to beneficiaries under Medicare or other state Medicaid programs.

Some State Medicaid

Agencies Not Reporting to

the OIG

During our state visits, we found that four state Medicaid agencies did not

always report removals. Two states—Illinois and New York—did not

notify the OIG of certain providers effectively removed from their

programs; Missouri did not report removals to the appropriate OIG field

office. Further, the Medicaid agency in Washington, D.C., did not report

any removals to the OIG because officials were unaware of the reporting

requirements.

In Illinois, the state Medicaid program sometimes negotiates a settlement

agreement with a provider against whom it has initiated removal

proceedings because of, for example, serious quality-of-care problems.

The settlement, in effect, excludes the provider, but the state does not

spend the time and resources needed to pursue a formal action. In such an

agreement, the provider admits no wrongdoing, but agrees to withdraw

from participation in Medicaid. The provider also forfeits the right to

appeal if denied reinstatement at a later date. The provider does not,

however, face the prospect of losing the license to practice because,

according to state Medicaid officials, the case is not referred to the state

licensing board. In addition, the state does not report such a case to the

OIG. This settlement enables Illinois to remove providers from its Medicaid

program relatively quickly and keep them out. But, because the state does

8

Section 1902 of the act also requires MFCUs to operate in accordance with standards established by

the Secretary of HHS. One of these standards requires MFCUs to report convictions to the OIG.

Page 9 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

not refer these actions to the state licensing board or the OIG, the providers

may continue to provide services like those for which the state sought the

provider’s removal from Medicaid.

As of June 1996, about 23 percent of the physicians not allowed to

participate in the Illinois Medicaid program had withdrawn rather than

face an adverse action. When we checked on the Medicare status of four

providers who had withdrawn from Medicaid between 1992 and 1995, we

found that all four were still enrolled in Medicare and three continued to

bill for services. These providers had withdrawn from Medicaid for serious

quality-of-care problems. For example, Medicare paid a podiatrist over

$32,000 for services provided to program beneficiaries after he had

withdrawn from the Illinois Medicaid program in August 1995. The

podiatrist withdrew from the program after the state alleged that he had

provided grossly inferior care to Medicaid beneficiaries. Another provider,

a physician, withdrew in April 1995, after the state charged him with

providing poor care to Medicaid beneficiaries. The following were among

the allegations made by the state: diagnoses were inconsistent with

medical findings, abnormal laboratory test results were not addressed, and

medications were used without clinical indications. Since this physician’s

withdrawal from Medicaid, Medicare has paid him over $7,000.

In commenting on this report, Illinois said that federal requirements for

state reporting of negotiated settlements were unclear. Specifically, the

state questioned whether a direct link existed between the statute—which

requires state Medicaid agencies to report providers who are “otherwise

sanctioned”—and the federal regulation—which defines the term to

explain the circumstances under which the OIG may impose a permissive

exclusion. Although the regulation may be somewhat unclear, the OIG

interprets it as requiring states to report providers who voluntarily

withdraw from the Medicaid program.

We do not know how many states, other than Illinois, allow providers to

avoid adverse action by withdrawing from Medicaid. In four other states

we visited—Maryland, Missouri, Virginia, and Washington, D.C.—such

withdrawals seldom occurred or were not allowed. In the remaining state,

New York, providers are sometimes allowed to withdraw from its

program, but state Medicaid officials said these cases are reported to the

OIG, the state licensing board, and others. New York, however, removes

certain providers it suspects of abuse, but does not report the cases to the

OIG. New York program regulations permit either the provider or the state

Medicaid agency to end the provider’s participation in the program

Page 10 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

“without cause,” with 30 days’ written notice. This practice has been used

primarily against pharmacies that the state suspected were heavily

involved in dispensing prescription drugs easily diverted to illicit use. As a

result, the state agency has been able to deal quickly with pharmacies that

it believed were involved in drug diversion.

In the course of our work, we identified two other problems in state

reporting to the OIG. In Missouri, for over 1 year, referrals from the

Missouri Medicaid program did not reach the OIG’s Chicago field office

because of some confusion associated with the closure of the OIG’s Kansas

City field office and a realignment of responsibilities.9

 One of the referrals

that was not promptly considered involved a pediatric dentist who had

been removed from the Missouri Medicaid program in May 1995, after the

state licensing board had revoked his license. Among the numerous

charges of poor quality of care against this dentist was that while

attempting to administer a local anesthetic, he penetrated the nasal cavity

of one child and pierced the jaw of another. He was also charged with

being abusive to a patient by striking her and, in another case, failing to

consult with a child’s parent before extracting four front teeth. A program

analyst in the Chicago field office told us he first became aware of, and

started working on, this case in March 1996, after receiving information on

the dentist’s license revocation from the state dental board. The dentist

was excluded nationwide by the OIG in August 1996—approximately 15

months after he had been excluded from the Medicaid program in

Missouri.

Finally, in Washington, D.C., Medicaid officials told us they did not report

disciplinary actions to the OIG, and the official with overall responsibility

for provider enrollment and removal did not know of the requirement to

do so. Records in Washington’s Medicaid agency indicated that as of

August 1996, 36 providers had been removed from its program for

disciplinary reasons. In one case, the Medicaid agency had removed a

provider in April 1994 for poor quality of care and patient abuse.

9

In April 1996, Missouri Medicaid officials told us that they reported providers they had removed from

their program to the OIG’s Kansas City investigations field office. According to OIG officials, however,

this office had been closed about a year earlier and the state should have been reporting cases to the

Chicago field office. Missouri officials said that the information sent to the Kansas City field office was

never returned, so they had no way of knowing it was not being received. Chicago OIG officials were

unaware that they were not receiving cases from the state Medicaid agency until we brought this to

their attention.

Page 11 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

State MFCUs May Not

Have Reported All

Convictions

In May 1996, the OIG began an effort, known as Project WEED, designed, in

part, to determine if state MFCUs were reporting all mandatory exclusion

cases. The project identified over 400 convictions resulting from MFCU

investigations that, the OIG contended, had not been reported to its field

offices. Although some of these cases may not have been reported to the

OIG, the OIG may have been unaware of others because field offices lacked

accountability over cases, as discussed earlier. One MFCU representative

we contacted acknowledged his unit had not been reporting cases.

However, a representative from another unit, which accounted for nearly

one-third of the Project WEED cases, told us the cases had been reported

to the appropriate field office.

We believe that the OIG needs to provide clearer guidance to states on its

reporting requirements. We also believe improved oversight by OIG field

offices of key state agencies that refer cases to the OIG, such as MFCUs and

state Medicaid agencies, would at least identify those agencies that are not

reporting. Improved oversight would also allow the OIG to be better

informed about the extent of states’ compliance with statutory reporting

requirements for removed providers.

States Sometimes

Have Difficulty

Identifying

OIG-Excluded

Providers

The OIG and HCFA periodically provide state Medicaid agencies with lists of

providers that have been excluded from federal health care programs.

States are expected to use these exclusion data to ensure that

OIG-excluded providers are removed from their Medicaid programs, if

currently enrolled, or prevented from enrolling at a later date. Limitations

in OIG’s exclusion data and inconsistencies between OIG and state tracking

systems, however, can make it difficult for states to identify excluded

providers. As a result, providers that have been excluded nationwide by

the OIG sometimes continue to be enrolled in state Medicaid programs. The

Health Insurance Portability and Accountability Act of 1996 contains

provisions that could make the identification and tracking of excluded

providers easier and more reliable, but these improvements are most likely

years away from implementation.

Exclusion Data Distributed

to State Medicaid Agencies

About twice a year, the OIG prepares a Cumulative Sanction Report, which

is an alphabetical list of all individuals and organizations that have been

excluded nationwide from federal health programs. For each name listed,

the report shows date of birth and Social Security number (for

individuals), health care specialty or type of business, and address. Also

shown is the authority used to impose the exclusion and the date the

Page 12 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

exclusion took effect. The OIG provides a copy of the report, on a diskette,

to HCFA. HCFA’s Issuances Unit prepares a paper copy of the report, which

is then forwarded to a contractor for printing and distribution to state

Medicaid agencies. The HCFA-prepared report does not identify individuals

or organizations by Social Security or employer identification number.10

We were informed, however, that state Medicaid agencies could obtain a

copy of the complete report, on a diskette, from the OIG. The OIG also

provides HCFA with monthly exclusion updates on diskette, which HCFA

sends to state Medicaid agencies in paper copy and via electronic mail. In

contrast to the cumulative report, both the paper copy and, until recently,

electronic versions of the monthly updates have included the Social

Security numbers of individuals who were excluded since the previous

monthly update.

Identifying Excluded

Providers Is

Time-Consuming and

Cumbersome

In the six states we visited, Medicaid officials responsible for ensuring that

OIG-excluded providers were not enrolled in their programs were generally

unaware of the availability of cumulative exclusion data on diskette, as

well as monthly updates on electronic mail. Thus, to check on providers,

Medicaid officials typically relied on paper copies of the cumulative

exclusion list and monthly updates. Manually comparing the thousands of

names on the OIG cumulative list and the dozens of names on the monthly

updates with their enrollment files is difficult, if not impractical. Moreover,

the paper copy of the cumulative exclusion list received by state Medicaid

agencies lacks identifiers, such as Social Security numbers or employer

identification numbers, which could facilitate checking. Although the OIG’s

diskette of the cumulative exclusion list does not contain employer

identification numbers for organizations, it does have Social Security

numbers for individuals. Thus, states, if made aware that the diskette is

available, could use it to cross-check with their provider enrollment files,

to the extent state files contain Social Security numbers.

When we cross-checked the automated version of OIG’s February 1996

Cumulative Sanction Report against the state Medicaid agency enrolled

provider files, we found excluded providers enrolled in five state Medicaid

programs. For example, we found 13 out-of-state providers who had been

excluded by the OIG between 1988 and 1995, but were still enrolled in the

Illinois Medicaid program. Similarly, we found 10 OIG-excluded providers

enrolled in the Washington, D.C., Medicaid program, two each enrolled in

Maryland and Missouri, and one enrolled in Virginia. One of the Illinois

10Since 1996, the cumulative exclusion list and the monthly update have been available on the Internet,

but also lack identifiers.

Page 13 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

providers had received almost $25,000, while one of the Missouri providers

had received over $9,000. Although none of the other providers had billed

their state Medicaid programs after being excluded by the OIG, state

Medicaid officials acknowledged that these providers would have been

paid had they submitted claims.11

The states we visited tended to use the paper version of the OIG’s monthly

list for a one-time cross-check against their active provider files. However,

most states did not review earlier monthly lists to cross-check for an

excluded provider who tried to enroll in the state’s Medicaid program in

any month after exclusion. Thus, a provider could enroll in a state’s

Medicaid program, after being excluded nationwide by the OIG, and not be

detected. Likewise, some states we visited did not always cross-check

providers that appeared on the monthly update but had out-of-state

addresses. This can lead to problems because many providers can provide

services in more than one state or can relocate, gaining access to

Medicaid. An official in Missouri, for example, told us that although staff

did cross-check the OIG monthly list against in-state and border state

addresses, they did not check names from other states. New York officials

also told us they only cross-checked names with addresses in their state

because too much time would be required to cross-check the entire list. In

our cross-checking, we found that almost all of the OIG-excluded providers

enrolled in state Medicaid programs were listed with out-of-state

addresses on the OIG’s excluded provider list.

HCFA officials have recently updated a software program that would enable

them to compress cumulative exclusion data and transmit the data to the

states on the Internet. This report—unlike the cumulative report already

available on the Internet and available to the public—would include Social

Security numbers for individual providers. However, because of concerns

about maintaining confidentiality for Social Security numbers transmitted

over the Internet, HCFA decided not to electronically transmit to the states

the cumulative report with Social Security numbers and stopped including

Social Security numbers on the monthly updates. Thus, the OIG’s

cumulative and monthly diskettes are currently the only automated means

to obtain excluded providers’ Social Security numbers.

11The OIG has found similar problems in Medicare in Maryland. In Medicare Payments to Excluded and

Unlicensed Health Care Providers, Office of Inspector General, Report No. A-14-96-00202 (Nov. 1996),

the OIG reported that Medicare reimbursed six Maryland providers after they were excluded by the

OIG and six other providers after their licenses were suspended or revoked by the state licensing

board.

Page 14 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

After we gave several state officials an OIG diskette of excluded providers,

including Social Security numbers, they told us that if they could have

these data routinely, they would explore the feasibility of cross-checking

the data against their enrollment files. For example, one state official told

us that once he received automated listings of excluded providers, he

intended to do periodic computer matches of OIG exclusion data and state

provider files. Such matching, however, would still require extensive

manual analysis of the results, he said, because OIG’s format cannot readily

be made compatible with the state’s own files. Moreover, such

computer-matching would not prevent a provider from enrolling in the

program between matches. Much better, he said, would be for the state to

integrate the exclusion data into its enrollment file; this integration would

automatically ensure that OIG-excluded providers would be removed from

the state’s Medicaid program and that OIG-excluded providers not currently

enrolled could not enroll later. Consequently, he said, he had requested

that the Medicaid agency’s information system staff explore the feasibility

of setting up a system for capturing OIG exclusion data. Information system

resources are currently focused on the state’s implementation of managed

care and other priorities, however, he said, so this project most likely will

not receive attention for a long time.

Lack of Common

Identifiers Hampers

Detection

No universal identifier for health care providers currently exists, and

health care providers often have multiple identifiers for the programs and

organizations with which they do business. This makes it difficult to

identify and track excluded providers across health care programs. State

Medicaid agencies, for instance, sometimes have difficulty determining

whether OIG-excluded providers are enrolled or have attempted to enroll in

their programs because identifying information about the providers on the

exclusion list may be incomplete or different from the identifiers used in

state data systems.

Although OIG exclusion data usually include Social Security numbers for

excluded individuals, the data do not include identifiers for certain

excluded organizations, such as pharmacies, home health care agencies,

and medical transportation companies. Almost 800 excluded organizations

were listed on the OIG’s October 1996 cumulative report. Without an

identifier, such as an employer identification number, it is difficult for a

state Medicaid agency to determine whether a provider enrolled in its

program is the same organization as one on the excluded provider list with

the same or a similar name. Although OIG exclusion data usually include

the addresses of excluded organizations, they frequently relocate or

Page 15 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

operate out of multiple locations. But including employer identification

numbers on the OIG exclusion list would not necessarily solve the problem

because organizations can use different numbers.

The lack of common identifiers also hampers tracking providers in states

that use identifiers other than Social Security numbers. Missouri and

Virginia, for example, give individuals the option of enrolling by Social

Security number or employer identification number. To the extent

individuals in these states use employer identification numbers, excluded

providers are unlikely to be detected through computer-matching of Social

Security numbers. Alternatively, these states could attempt to match by

name, but name-matching can result in many erroneous identifications, as

well as the need for time-consuming research and follow-up. In some

states, however, individual providers are identified solely or primarily by

Social Security numbers, making it relatively easy to cross-check the OIG

exclusion data with state enrollment files.

In addition, certain kinds of excluded providers that do not directly bill a

state Medicaid program—such as nurses, pharmacists, or physicians

employed by hospitals, nursing homes, pharmacies, and health

maintenance organizations—are difficult to identify. These providers, once

excluded, can change employers or move to other states and continue to

provide services through federal health care programs without detection.

To at least partly deal with this problem, OIG exclusion data will be added

to the National Practitioner Data Bank—a repository of information on

practitioners (physicians, dentists, and other state-licensed health care

providers) concerning malpractice payments; clinical privilege actions;

and adverse actions taken by hospitals, insurance companies, licensing

boards, and professional societies. The OIG believes that this action will

substantially reduce the number of excluded licensed providers that

continue to indirectly participate in federal health care programs in

hospitals. This is because hospitals, when making appointments to their

medical staff or granting clinical privileges, are required to query the

database for all new practitioners and all current practitioners every 2

years. But not all excluded providers would be exposed by these queries.

For one thing, not all providers are covered by the database because some

are not state licensed. For example, Maryland does not license nurses’

aides. Moreover, some providers may not be affiliated with hospitals.

Other organizations—such as nursing homes, pharmacies, and health

maintenance organizations—are allowed, but not required, to query the

database.

Page 16 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

New Legislation May Make

Identifying Excluded

Providers Easier and More

Reliable

The Health Insurance Portability and Accountability Act of 1996, enacted

in August 1996, has added tools that may help the OIG and states track

unacceptable providers. One of these tools is a system of unique health

identifiers for all health care providers, which the act requires HHS to

establish. Assigning a unique identifier to each health care provider should

make it easier for state Medicaid agencies to determine if excluded

providers are enrolled in their programs, reducing opportunities for

excluded providers to receive inappropriate payment. However, full

implementation will take several years.

The act requires that within 18 months, the Secretary of HHS adopt a

standard for a unique health identifier for all health care providers—both

individuals and organizations. Since 1993, HCFA has been developing a

unique identifier for Medicare providers, known as the National Provider

Identifier (NPI). HCFA plans to adapt the NPI to meet the requirements of the

act and has begun working to encourage states, private payers, and other

federal agencies to adopt the NPI. A proposed regulation announcing the

standard and seeking public comment is expected to be published in

spring 1997, with a final regulation planned for July 1997.

Although the law requires compliance with the standard within 24 months

after it is adopted, according to HCFA officials we spoke with, it will most

likely take much longer to assign NPIs to all health care providers. The law

primarily deals with those providers who bill federal programs

electronically, HCFA officials believe. Thus, HCFA will emphasize assigning

identification numbers to these providers, reserving for later assigning

numbers to other providers, including the estimated thousands who do not

participate in federal programs at all. Implementing the provisions for a

unique identifier may also be delayed because of unresolved questions on

how to (1) meet the cost of implementing the new system, (2) ensure that

all health care providers are identified and assigned NPIs, and (3) minimize

the disruption to health plans and organizations when converting their

provider enrollment files.

Another tool provided for by the act—which may help the OIG, state

Medicaid agencies, and other health care programs keep track of problem

providers—is the Adverse Action Data Bank. Currently, no centralized

database exists to track fraud and abuse in the health care system. The

OIG’s excluded provider list is but one of several databases and information

sources that contain information on problem health care providers. The

Adverse Action Data Bank would provide a comprehensive and centralized

database of “final adverse actions,” such as criminal convictions, civil

Page 17 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

judgements, exclusions from federal health care programs, administrative

sanctions, and other disciplinary actions imposed against health care

providers. This database is to be widely accessible to public and private

health care organizations.

Like assigning unique identifiers, setting up the database will take time to

accomplish. The OIG, in conjunction with the Department of Justice, is

responsible for overseeing the development of the database, but OIG

officials we spoke with estimated implementation was at least a year

away. Although start-up costs could be about $2 million, the costs to

operate the database are largely unknown. Moreover, certain factors could

limit the data bank’s effectiveness. For instance, the law does not contain

sanctions or penalties if a government agency or health plan fails to report

its adverse actions or use the database. Thus, some way must be found to

(1) persuade these entities to report their adverse actions and (2) convince

them, especially state agencies and health plans that will be charged for

inquiries, that the database is useful. In addition, the law specifies that the

database must not duplicate information already contained in the National

Practitioner Data Bank. Moreover, the law exempts from reporting those

settlements in which no findings of liability have been made, such as the

provider withdrawals we found occurring in the Illinois Medicaid program.

HCFA and OIG officials fear that if large numbers of providers attempt to

enter into settlements to avoid being listed in the database, these

exemptions could undermine the usefulness of the database.

The OIG Is Taking

Actions to Strengthen

the Excluded Provider

Process

OIG officials attributed many of the problems we found to resource cuts

over the last several years. For the audit and investigation of health care

providers, the Health Insurance Portability and Accountability Act

appropriates for the OIG not less than $60 million and not more than

$70 million in extra funds for fiscal year 1997, with additional amounts

authorized for subsequent years. Headquarters officials plan to use some

of this money to hire additional field office staff to process exclusion

cases, they said. In addition, under the Project WEED umbrella, the OIG has

taken or planned other corrective actions:

• Tracking of incoming exclusion referrals: Since September 1996, the OIG

field offices have maintained a database on all exclusion referrals from

states. According to a headquarters official, as of December 1, 1996, more

than 4,300 exclusion referrals had been logged in.

• Training of field office staff: In July and September 1996, field office staff

who process exclusion referrals from states received training. It focused

Page 18 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

on what staff need to do to prepare a case for exclusion and reemphasized

the criteria and guidance staff are expected to follow, headquarters

officials said.

• Outreach efforts: The OIG plans to contact state Medicaid agencies, MFCUs,

and licensing boards to ensure that all information needed to process

provider exclusions is forwarded to field offices. Letters will be sent to

these organizations, describing the specific documentation the OIG needs

to process a case for exclusion.

Conclusions When providers defraud federal or state health care programs or give poor

quality care, the OIG has authority to exclude them nationwide from

participation in these programs. The process for excluding providers can

and has operated successfully, with thousands of unacceptable providers

excluded from Medicare, Medicaid, and other federal health care programs

over the years.

However, we found cases in which unacceptable providers in one state’s

Medicaid program can be enrolled as providers under Medicare or in other

states. Because of the amount of communication and coordination needed

at the state and federal levels, the exclusion process is complex.

Nevertheless, we believe that more attention must be paid to a system

designed to help ensure the integrity of federal health programs and

protect beneficiaries from poor quality care. In the long run, certain

provisions of the Health Insurance Portability and Accountability Act of

1996 may assist the OIG and states in addressing these problems, but

implementation is most likely several years in the future. Interim actions

are needed.

The OIG has taken several important actions to address some of the

problems we identified. Tracking of incoming exclusion referrals should

strengthen accountability for referrals received from the states and help

ensure that none are overlooked. Training that has been provided to

current staff should help reduce inconsistencies among field offices and

improve the quality of processing, and plans to hire additional staff should

improve the timeliness of exclusion processing. Outreach to states under

Project WEED has resulted in identifying previously unknown exclusion

cases. The OIG plans for further outreach to states under this project may

result in identifying additional cases and may improve the extent to which

states refer cases to the OIG.

Page 19 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

The OIG believes—and we concur—that these actions should help correct

many of the problems we identified. However, we believe that refinements

to these actions would encourage states to refer more unacceptable

providers to the OIG and help the OIG to process these referrals promptly.

For example, the OIG can further strengthen its exclusion referral process

by clarifying reporting requirements and systematically monitoring key

state agencies’ compliance. It could also follow through on its plans to

contact state agencies to ensure that states provide the documentation the

OIG needs to consider an exclusion action. In addition, the OIG could

establish consistent standards—performance goals or benchmarks—to

facilitate the timely processing of state referrals. Finally, OIG exclusion

data need to be distributed to appropriate state officials in a format that

aids timely comparison with state provider files.

Recommendations to

the HHS Inspector

General

We recommend that the HHS Inspector General

• improve oversight of key state agencies that refer cases to the OIG, such as

the state Medicaid agency and MFCU, to ensure that states understand and

comply with the statutory reporting requirements for state-removed

providers;

• clarify to states that settlements and provider withdrawals to avoid formal

sanctions should be reported to the OIG, in accordance with its regulations

(42 C.F.R. 1001.601);

• provide ongoing, clear, and consistent guidance to the states on the

documentation needed for timely processing;

• establish consistent standards—performance goals or benchmarks—for

the timely processing of state referrals; and

• in collaboration with HCFA, transmit OIG exclusion data either electronically

or by diskette, including Social Security numbers, to state Medicaid

agency officials responsible for enrolling and removing providers.

Agency Comments

and Our Evaluation

We provided a draft of this report to the HHS Inspector General. In

providing written comments, she also incorporated comments from HCFA

(see app. IV). In general, she concurred with our recommendations.

Concerning our recommendation that the OIG establish consistent

standards—performance goals or benchmarks—for the timely processing

of state referrals, the HHS Inspector General said she had recently

reiterated to regional managers that they should apply criteria in the Office

of Investigation’s Special Agent’s Handbook to permissive exclusion cases.

Page 20 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

The handbook criteria require that exclusion documents be forwarded

immediately to the appropriate field office supervisor for evaluation and,

as a general rule, within 60 working days of receipt, a decision should be

rendered on whether or not the OIG will process the case for a permissive

exclusion action. We believe that reemphasizing existing guidance as to

time frames for evaluating whether to process an exclusion referral is an

important step to improve timeliness. However, evaluating whether

processing of a referral is warranted is only the first component of the

overall exclusion process. Thus, we believe additional performance

measures or goals, such as target time frames for completing the cases and

referring them to headquarters, need to be established to improve

timeliness, as well as to help the OIG measure the effectiveness of its work.

The Inspector General expressed concern with our recommendation to

ensure that state Medicaid officials responsible for enrolling and removing

providers were aware of the availability of automated exclusion data with

Social Security numbers. She said that it would be unreasonable and

unnecessarily costly for HCFA, which is responsible for distributing

exclusion data to the states, to provide the cumulative and monthly lists to

each official in a state agency who might need that information. Instead,

she said, the state official who receives the lists should ensure that all

appropriate officials who need to be notified of the exclusion also receive

the information. Nevertheless, the Inspector General said she would

encourage HCFA to remind state officials of their responsibility to ensure

the lists reach those who need them.

In making this recommendation, our principal concern was that state

Medicaid officials responsible for removing unacceptable providers from

their programs were unaware that cumulative exclusion data with Social

Security numbers were available in automated form. If state officials had

such information, they might find it easier to ensure that OIG-excluded

providers were not participating in their programs; in addition, the

problems we found through computer-matching might not have occurred.

To respond to the Inspector General’s comments, we revised this

recommendation and combined it with a previous one to emphasize that

the OIG and HCFA should collaborate to provide complete exclusion data, in

automated form, to the states.

We also requested comments on a draft of this report from the six state

Medicaid agencies included in our review, as well as the MFCUs in Illinois,

Maryland, and New York. We received written responses from the Illinois,

Maryland, Missouri, and New York state Medicaid agencies. In general,

Page 21 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

they agreed with our conclusions and recommendations. In addition, the

Illinois and Missouri state Medicaid agencies and the New York MFCU

provided clarifying comments, which we incorporated as appropriate.

Illinois, however, questioned our language indicating that federal

regulations require states to report voluntary withdrawals to the OIG. The

state suggested that federal reporting requirements as to negotiated

settlements were unclear. Specifically, the state questioned whether a

direct link existed between the law—which requires state Medicaid

agencies to report providers who are “otherwise sanctioned”—and the

federal regulations (42 C.F.R. 1001.601)—which define the term for

purposes of explaining the circumstances under which the OIG may impose

a permissive exclusion. We agree that the regulation is unclear.

Consequently, we revised our language to remove any implication that the

state had violated federal regulations by not reporting negotiated

settlement agreements to the OIG. Nevertheless,the OIG interprets the

regulation as requiring states to report providers who voluntarily withdraw

from the Medicaid program to avoid an adverse action and communicated

its interpretation in a letter to Illinois, dated February 24, 1997. In addition,

the OIG plans to contact all state Medicaid agencies by spring 1997 to

provide them with guidelines on the kind of cases that fall within the OIG’s

exclusion authority and the documentation needed to support an

exclusion. The guidance will cover provider withdrawals to avoid formal

exclusion.

As arranged with your office, unless you announce its contents earlier, we

plan no further distribution of this report until 30 days after the date of

this letter. At that time, we will send copies of this report to the Secretary

and the Inspector General of HHS, the Administrator of HCFA, state officials

in the six states we visited, and other interested parties. We also will make

copies available to others upon request.

Page 22 GAO/HEHS-97-63 Medicaid Fraud and Abuse
B-275645 

Please call me at (312) 220-7600 or Kathryn G. Allen, Assistant Director, at

(202) 512-7059 if you or your staff have any questions about this report.

Other major contributors to this report include Robert T. Ferschl; Paul T.

Wagner, Jr.; Robert E. Lippencott; Alfred R. Schnupp; and Jonathan H.

Barker.

Sincerely yours,

Leslie G. Aronovitz

Associate Director, Health Financing and

 Systems Issues

Page 23 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Contents

Letter 1

Appendix I 

Scope and

Methodology

26

Appendix II 

Legal Basis for

Excluding Providers

Under the Social

Security Act

28

Appendix III 

OIG Process:

Problems With State

Exclusion Referrals

29

Appendix IV 

Comments From the

OIG

34

Table Table I.1: Exclusion Referrals Reviewed by GAO 26

Abbreviations

HCFA Health Care Financing Administration

HHS Health and Human Services

MFCU Medicaid fraud control unit

NPI National Provider Identifier

OIG Office of the Inspector General, HHS

Page 24 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Page 25 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix I 

Scope and Methodology

To understand federal and state processes for excluding providers from

Medicaid, we discussed the processes with Medicaid officials in six states,

four OIG field offices, and OIG headquarters. In our six judgmentally

selected states—Illinois, Maryland, Missouri, New York, Virginia, and

Washington, D.C.—we spoke with officials who managed units that

(1) enrolled providers in state Medicaid programs, (2) removed these

providers when necessary, or (3) operated computer systems supporting

those functions. In these states, we also contacted officials from the state

MFCU—to obtain information on its fraud and abuse convictions—and

selected state licensing boards—to understand the processes for

disciplining providers that violate state licensing requirements.

In the OIG’s Chicago, New York, Philadelphia, and Washington, D.C., field

offices—which process referrals from the six states—we met with staff

responsible for processing referrals; in OIG headquarters, we met with

officials who make exclusion decisions and prepare the cumulative and

monthly lists of excluded providers. At HCFA, we met with officials

responsible for distributing OIG exclusion data to state Medicaid agencies

and others. We also interviewed officials at OIG headquarters and HCFA to

determine their plans to establish an Adverse Action Data Bank and

develop a unique health care identifier, as required by the Health

Insurance Portability and Accountability Act of 1996.

To examine how well the OIG’s provider exclusion process was working,

we examined a sample of cases, referred by selected state agencies, to

determine their disposition by the OIG. Because field offices did not always

log in or otherwise account for all referrals they received, we could not

identify the universe of all cases from which we could draw a sample.

Instead, we judgmentally sampled referrals made by state agencies to the

Chicago, New York, and Philadelphia OIG field offices. See table I.1 for the

OIG field offices and state agencies we visited and the number of cases we

reviewed.

Table I.1: Exclusion Referrals

Reviewed by GAO OIG field office Referring state agency Referrals reviewed

Chicago Illinois Department of Public Aida

Illinois State Police (MFCU)

Missouri Division of Medical Servicesa

18

14

6

New York New York Department of Social Servicesa 28

Philadelphia Maryland MFCU 22

Total 88

a State Medicaid agency.

Page 26 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix I 

Scope and Methodology

In general, these cases represented referrals that state agencies had made

to OIG field offices during 1994 and 1995. We reviewed the case files at OIG

field offices from the Illinois and New York state Medicaid agencies and

the Maryland MFCU. For the Illinois MFCU and Missouri Medicaid agency

cases, we only determined their status at the OIG. In addition, for selected

Illinois and New York Medicaid referrals, we determined if the providers

were enrolled in Medicare, according to the Medicare contractors serving

those states. Because these cases were not randomly selected, results

cannot be generalized to all such cases referred by the states or processed

by the OIG field offices and headquarters. However, the results of the OIG’s

Project WEED indicate that the problems we identified through our work

may be pervasive. In determining the disposition of permissive cases, we

did not question OIG decisions on whether an exclusion was warranted.

To determine whether any nationally excluded providers were still

providing services under state Medicaid programs, we compared the OIG’s

February 1996 list of excluded providers against states’ active provider

files. To ascertain whether states were reporting to the OIG as required, we

also compared states’ lists of providers excluded from their programs

against the OIG’s excluded provider list.

We performed our work between November 1995 and January 1997 in

accordance with generally accepted government auditing standards.

Page 27 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix II 

Legal Basis for Excluding Providers Under

the Social Security Act

Section of the act Exclusion reason

1128(a)(1)a Program-related conviction

1128(a)(2)a Conviction for patient abuse or neglect

1128(a)(3)a Felony conviction related to health care fraud

1128(a)(4)a Felony conviction related to controlled substances

1128(b)(1) Misdemeanor conviction related to health care fraud

1128(b)(2) Conviction for obstructing an investigation

1128(b)(3) Misdemeanor conviction related to controlled substances

1128(b)(4) License revocation or suspension

1128(b)(5) Suspension or exclusion under a federal or state health care

program

1128(b)(6) Excessive claims or furnishing of unnecessary or substandard

items and services

1128(b)(7) Fraud, kickbacks, and related activities

1128(b)(8) Entities owned or controlled by a sanctioned individual

1128(b)(9) Failure to disclose required information

1128(b)(10) Failure to supply requested information on subcontractors and

suppliers

1128(b)(11) Failure to provide payment information

1128(b)(12) Failure to grant immediate access

1128(b)(13) Failure to take corrective action

1128(b)(14) Default on health education loan or scholarship obligations

1128(b)(15) Individuals controlling an excluded entity

1128A(a) Imposition of a civil money penalty or assessment

1156(b) Peer review organization recommendation

aMandatory exclusion provisions.

Page 28 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix III 

OIG Process: Problems With State Exclusion

Referrals

Several examples of (1) cases for which the OIG had no record of state

exclusion referrals when we initially inquired and (2) delays in OIG

processing of state exclusion referrals (discussed on pp. 5-8). The

following are additional examples of these two problems, which we

identified in both the Chicago and New York field offices.

No Record of State

Referrals

Example 1 On June 2, 1995, Illinois notified the OIG’s Chicago field office that it had

removed a physician from its Medicaid program for providing poor quality

care to Medicaid beneficiaries. For example, the state found that the

physician often prescribed medications that had no correlation to patient

symptoms or diseases and that his diagnoses were often unsupported. In

one instance, the physician had prescribed a medication with a high sugar

content for a diabetic. In another, he had prescribed the wrong medication

for an eye problem. The OIG field office had no record of this case, when

we inquired in March 1996. After our review, the field office obtained

information on the removal and began processing the case. The physician

was excluded in December 1996—18 months after the state first reported

the case to the OIG. During this time period, the physician was enrolled in,

but did not bill, Medicare.

Example 2 The Chicago field office had no record, when we inquired in March 1996,

of a physician who had (1) been removed from the state Medicaid program

in September 1995 for defaulting on a state student loan and (2) had his

license revoked in October 1995 for leaving a hospitalized patient without

physician coverage. As in the case above, the field office obtained

information on the case after our review and forwarded the case to

headquarters in June 1996. The case remained unresolved, however, as of

January 1997, over 14 months after it was first referred by the state of

Illinois.

Example 3 When we inquired in March 1996, the Chicago field office had no record of

a physician who, according to state files, had been removed from the

Illinois Medicaid program in September 1995 and reported to the OIG the

following month. The state had removed the physician for repeatedly

Page 29 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix III 

OIG Process: Problems With State

Exclusion Referrals

providing harmful and grossly inferior care to Medicaid beneficiaries.

Among the state’s charges were that the physician failed to observe a

patient during the 18 hours she was in labor in a hospital or to be present

at the delivery, placed a patient at risk by not promptly treating a bladder

infection, and failed to refer a patient to a specialist after long-term

treatment did not control his blood pressure. The field office subsequently

opened a case on the physician in April 1996. According to field office

officials, the case remains unresolved as of January 1997. After this

physician was excluded from Medicaid, he was paid over $9,000 (through

Dec. 1996) for services provided to Medicare beneficiaries in Illinois.

Example 4 In March 1996, the Chicago field office had no record of a referral sent by

the Illinois Medicaid agency 9 months earlier, in June 1995. The state had

removed the provider, a transportation company, from the Medicaid

program for overbilling. The case did not meet OIG criteria for exclusion,

OIG officials later said.

Example 5 New York excluded a durable medical equipment supplier from Medicaid,

effective June 1994, on the basis of a consistent disregard for Medicaid

rules and regulations, as well as unacceptable recordkeeping practices.

The state found over 2,000 claims, totaling more than $120,000, for which

the provider could supply no documentation; for another 148 claims,

totaling about $9,000, the documentation available was inadequate. About

$21,500 of these overpayments had been collected as of November 1996.

Over 2 years have elapsed since this provider was removed by the state,

but the New York field office had no record of an exclusion.

Example 6 The New York field office had no record of a durable medical equipment

dealer who had been excluded from the state’s Medicaid program in

September 1994, after an audit revealed that the provider had billed for

items not ordered by physicians and had “upcoded” some bills, charging

for custom-made items when standard items were provided.

Page 30 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix III 

OIG Process: Problems With State

Exclusion Referrals

Delays in Processing

State Referrals

Example 1 The OIG excluded a transportation company 16 months after the Illinois

Medicaid program reported that it had removed the company for billing for

unauthorized services, using improper procedure codes, and failing to

keep proper records. The field office case file showed no activity for

lengthy periods.

Example 2 Over 16 months elapsed—including one 9-month period when no

processing occurred—before the OIG excluded a pharmacy that had

overcharged the Illinois Medicaid program by $136,000.

Example 3 After an audit revealed incomplete medical records, no documentation of

patient medical histories, and multiple quality-of-care problems, New York

removed a physician from Medicaid for 5 years, effective March 1995. The

OIG’s New York field office was notified of the case in June 1995, but did

not start processing the case until February 1996. Fourteen months after

receiving the referral, the OIG excluded the provider.

Example 4 New York’s Medicaid agency excluded a physician for 5 years, in

April 1994, after (1) an audit concluded the physician was overprescribing

drugs and (2) an undercover investigator was able to obtain prescriptions

on request, after a cursory examination. We could not determine from

state or OIG case files when the OIG was notified, but about a year after

state removal, the New York field office—because it had a backlog of

work—transferred the case to the Boston field office. Thirteen months

later, the Boston field office recommended exclusion and, in

September 1996, the physician was excluded nationwide—more than 2

years after first being removed from New York’s Medicaid program.

Between the state removal and federal exclusion dates, Medicare paid this

provider over $8,700.

Example 5 New York excluded an ophthalmologist for 2 years, effective May 1995,

after an audit determined that the physician rendered inappropriate care

to Medicaid beneficiaries. The state charged, among other things, that the

Page 31 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix III 

OIG Process: Problems With State

Exclusion Referrals

provider performed excessive glaucoma testing and treated patients

inappropriately, using medications that were not indicated. In some cases,

patients were placed at substantial risk. The state notified the New York

OIG field office of this case in August 1995, and the OIG excluded the

provider 1 year later.

Example 6 New York excluded a registered physician assistant for 5 years, effective

March 1995, for conducting an unacceptable practice, maintaining

inadequate records, and providing medical care and services far in excess

of patients’ needs. Among other things, the state charged that the

physician assistant often prescribed medications without adequate

indication and provided medical care to Medicaid beneficiaries without

adequate supervision of a licensed physician. The state notified the OIG of

this case in late April 1995, but other than assigning the case a file number

some time in 1996, the case file showed no activity when we reviewed it

almost 19 months later. Given the age of this case and the office’s backlog,

the regional inspector general said the case was unlikely to be processed

for exclusion.

Example 7 New York removed a physician from its Medicaid program for 5 years,

effective May 1994, for false claims, unacceptable recordkeeping,

excessive services, and failure to meet recognized standards. For example,

the state claimed that the physician provided potentially dangerous care

by frequently prescribing the drug Elavil to substance abusers. The state

also referred the provider to the state licensing board. We could not

determine precisely when the field office received this case, but more than

2-1/2 years after the state removed the physician, the case remained

unresolved. Like the case above, the regional inspector general said that

because of the age of this case, it was unlikely to be processed for

exclusion.

Example 8 New York removed a podiatrist from Medicaid, in May 1995, after she was

convicted of billing Medicaid for services not actually provided. The OIG’s

New York field office was already aware of this case at the time of the

state removal because it had been notified of the physician’s indictment in

February 1994. Although the field office lacked key documents needed to

process the case for exclusion, the case file showed no evidence of

follow-up until November 1996. Since the time the podiatrist had been

removed from Medicaid in New York, Medicare had paid her about $1,900.

Page 32 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix III 

OIG Process: Problems With State

Exclusion Referrals

Example 9 A physician assistant was removed from Medicaid in New York, effective

September 1995, based on an evaluation of quality of care, which showed

that he did little to attempt to improve the health of patients other than

frequently repeating laboratory tests. The Medicaid agency concluded that

this was particularly dangerous because many of his patients had serious

illnesses. In addition, there was no evidence of the assistant’s supervision

by a licensed physician. The OIG was notified of this case in November

1995, but did not open its own case file until May 1996. The case was

referred to headquarters in July 1996 and was still pending when we

reviewed the file in November 1996.

Page 33 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV 

Comments From the OIG

Page 34 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV 

Comments From the OIG

Page 35 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV 

Comments From the OIG

Page 36 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV 

Comments From the OIG

Page 37 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV 

Comments From the OIG

Page 38 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Appendix IV 

Comments From the OIG

(101518) Page 39 GAO/HEHS-97-63 Medicaid Fraud and Abuse
Ordering Information

The first copy of each GAO report and testimony is free.

Additional copies are $2 each. Orders should be sent to the

following address, accompanied by a check or money order

made out to the Superintendent of Documents, when

necessary. VISA and MasterCard credit cards are accepted, also.

Orders for 100 or more copies to be mailed to a single address

are discounted 25 percent.

Orders by mail:

U.S. General Accounting Office

P.O. Box 6015

Gaithersburg, MD 20884-6015

or visit:

Room 1100

700 4th St. NW (corner of 4th and G Sts. NW)

U.S. General Accounting Office

Washington, DC

Orders may also be placed by calling (202) 512-6000 

or by using fax number (301) 258-4066, or TDD (301) 413-0006.

Each day, GAO issues a list of newly available reports and

testimony. To receive facsimile copies of the daily list or any

list from the past 30 days, please call (202) 512-6000 using a

touchtone phone. A recorded menu will provide information on

how to obtain these lists.

For information on how to access GAO reports on the INTERNET,

send an e-mail message with "info" in the body to:

info@www.gao.gov

or visit GAO’s World Wide Web Home Page at:

http://www.gao.gov

PRINTED ON RECYCLED PAPER
United States

General Accounting Office

Washington, D.C. 20548-0001

Official Business

Penalty for Private Use $300

Address Correction Requested

Bulk Rate

Postage & Fees Paid

GAO

Permit No. G100