MEDICARE 

PROGRAM 

INTEGRITY

Greater Prepayment 

Control Efforts Could 

Increase Savings and 

Better Ensure Proper 

Payment

Report to Congressional Requesters

November 2012

GAO-13-102

Don't have a QR code 

reader? Several are 

available for free online.

To access this report 

electronically, scan this 

QR Code.

United States Government Accountability Office

GAO
United States Government Accountability Office

Highlights of GAO-13-102, a report to 

congressional requesters

November 2012

MEDICARE PROGRAM INTEGRITY

Greater Prepayment Control Efforts Could Increase 

Savings and Better Ensure Proper Payment

Why GAO Did This Study

CMS reported an improper payment 

rate of 8.6 percent ($28.8 billion) in the 

Medicare fee-for-service program for 

fiscal year 2011. To help ensure that 

payments are made properly, CMS 

uses controls called edits that are 

programmed into claims processing 

systems to compare claims data to 

Medicare requirements in order to 

approve or deny claims or flag them for 

further review.

GAO was asked to assess the use of 

prepayment edits in the Medicare 

program and CMS’s oversight of 

MACs, which process claims and 

implement some edits. This report 

examines the extent to which (1) CMS 

and its contractors employed 

prepayment edits, (2) CMS has 

designed adequate processes to 

determine the need for and to 

implement edits based on national 

policies, and (3) CMS provides 

information, oversight, and incentives 

to MACs to promote use of effective 

edits. GAO analyzed Medicare claims 

for consistency with selected coverage 

policies, reviewed CMS and contractor 

documents, and interviewed officials 

from CMS and selected contractors.

What GAO Recommends

GAO recommends that CMS take 

seven actions to strengthen its use of 

prepayment edits, such as 

restructuring some edits, centralizing 

implementation of others, fully 

documenting processes, encouraging 

more information sharing about 

effective edits, and assessing the 

feasibility of increasing incentives for 

edit use. The Department of Health 

and Human Services generally agreed 

with GAO’s recommendations and 

noted CMS’s plans to address them.

What GAO Found

Use of prepayment edits saved Medicare at least $1.76 billion in fiscal year 2010, 

but GAO found that savings could have been greater had prepayment edits been 

more widely used. GAO illustrated this point using analysis of a limited number of 

national policies and local coverage determinations (LCD), which are established 

by each Medicare administrative contractor (MAC) to specify coverage rules in its 

jurisdiction. GAO identified $14.7 million in payments in fiscal year 2010 that 

appeared to be inconsistent with four national policies and therefore improper. 

These payments could have been prevented through automated prepayment 

edits. GAO also found more than $100 million in payments that were inconsistent 

with three selected LCDs and that could have been identified using automated 

edits. 

The Centers for Medicare & Medicaid Services (CMS) has three processes with 

some appropriately designed steps to identify the need for, and to implement, 

edits based on national policies, but each of these processes has at least one 

weakness. The weaknesses include incomplete analysis of vulnerabilities to 

improper payment that could be addressed by edits; lack of specific time frames 

for implementing edits and other corrective actions; flaws in the structure of some 

edits; lack of centralization in the implementation of some edits, which leads to 

inconsistencies; incomplete assessment of whether edits are working as 

intended; and lack of full documentation of the processes. For example, GAO 

found that Medicare paid $8.6 million in fiscal year 2010 for claims that exceeded 

CMS’s limits on the quantity of certain services that can be provided to a 

beneficiary by the same provider on a single date of service. Although edits had 

been implemented to limit service quantities, a weakness in their structure 

caused them to miss instances in which quantity limits were exceeded. 

CMS informs MACs about vulnerabilities that could be addressed through 

prepayment edits, but the agency does not systematically compile and 

disseminate information about effective local edits to address such 

vulnerabilities. CMS oversees MACs’ use of edits partly through its review of 

certain MAC reports, but these reports are not intended to provide a 

comprehensive overview of their edits. In January 2011, CMS expanded its 

oversight activities and began requiring MACs to report on how they had 

addressed certain vulnerabilities to improper payment, some of which could be 

addressed through edits. While CMS increased the funding in fiscal year 2011 for 

contractors’ medical review activities, including edit development, the agency 

provided relatively small incentives—3 percent or less of all contract award 

fees—to promote use of effective prepayment edits by MACs. 

View GAO-13-102. For more information, 

contact Kathleen King at (202) 512-7114 or 

kingk@gao.gov.
Page i GAO-13-102 Medicare Prepayment Edits

Letter 1 

Background 6

Prepayment Edits Saved Medicare at Least $1.76 Billion in 2010 but 

Were Not Used to Full Extent Possible 15

CMS’s Processes for Identifying Needs for, and Implementing, 

Prepayment Edits Based on National Policies Have Weaknesses 22

CMS Informs MACs about Some Vulnerabilities That Could Be 

Addressed through Local Edits but Provides Relatively Small 

Financial Incentives to Promote Their Use 31

Conclusions 40

Recommendations for Executive Action 42

Agency Comments, Third-Party Views, and Our Evaluation 43

Appendix I Scope and Methodology 45

Appendix II Hypothetical Example of How Medicare Claims Can Avoid 

Triggering Medically Unlikely Edits (MUE) 51

Appendix III Comments from the Department of Health and Human Services 52

Appendix IV GAO Contact and Staff Acknowledgments 57

Tables

Table 1: Scope, Mode, and Description of Selected Types of 

Prepayment Coverage, Payment, and Coding Edits 9

Table 2: Internal Control Standards or Activities That Apply to 

CMS’s Determination of the Need for, and Implementation 

of, Prepayment Edits Based on National Policies 15

Table 3: Payments for Claims That Appeared to Be Inconsistent 

with Selected National Policies and Therefore Improper 

and That Could Have Been Identified through Automated 

Edits, Fiscal Year 2010 18

Contents
Page ii GAO-13-102 Medicare Prepayment Edits

Table 4: Payments for Claims That Were Inconsistent with Selected 

Local Coverage Determinations (LCD) Issued by Medicare 

Administrative Contractors (MAC), Fiscal Year 2010 21

Table 5: Percentage of A/B Medicare Administrative Contractor 

(MAC) Award Fees Allocated to Specified Performance 

Areas, Fiscal Year 2011 39

Table 6: Internal Control Standards or Activities That Apply to 

CMS’s Determination of the Need for, and Implementation 

of, Prepayment Edits Based on National Policies 49

Figure

Figure 1: Average Number of Quality Assurance Surveillance Plan 

(QASP) Standards Used by CMS to Evaluate A/B and DME 

Medicare Administrative Contractors’ (MAC) 

Performance in Most Recent Reviews 36
Page iii GAO-13-102 Medicare Prepayment Edits

Abbreviations

ARTS Automated Reporting and Tracking System

CERT Comprehensive Error Rate Testing

CMS Centers for Medicare & Medicaid Services

CUE Clinically Unlikely Edit

CWF Common Working File

DME durable medical equipment

FAR Federal Acquisition Regulation

HCPCS Healthcare Common Procedure Coding System

HHS Department of Health and Human Services

ICD International Classification of Diseases

LCD local coverage determination

MAC Medicare administrative contractor

MIP Medicare Integrity Program

MMA Medicare Prescription Drug, Improvement, and 

 Modernization Act of 2003

MUE Medically Unlikely Edit

NCCI National Correct Coding Initiative

NCD national coverage determination

OIG Office of Inspector General

OPT ocular photodynamic therapy

PIMR Program Integrity Management Reports

QASP Quality Assurance Surveillance Plan 

RAC recovery audit contractor

SAF Standard Analytic File

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-13-102 Medicare Prepayment Edits

United States Government Accountability Office

Washington, DC 20548

November 13, 2012

The Honorable Thomas R. Carper

Chairman

The Honorable Scott P. Brown

Ranking Member

Subcommittee on Federal Financial Management, Government

 Information, Federal Services, and International Security

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable John S. McCain

United States Senate

Since 1990, we have designated Medicare a high-risk program, due in 

part to its size and its susceptibility to improper payments.1

 

1

An improper payment is any payment that should not have been made or that was made 

in an incorrect amount (including overpayments and underpayments) under statutory, 

contractual, administrative, or other legally applicable requirements. Improper Payments 

Elimination and Recovery Act of 2010, Pub. L. No. 111-204, § 2(e), 124 Stat. 2224, 2227 

(codified at 31 U.S.C. § 3321 note). The Medicare program generally makes fee-forservice payments directly to health care providers, based on their submitted claims for 

services provided to beneficiaries.

In fiscal year 

2011, the Medicare program covered about 48 million elderly or disabled 

beneficiaries and paid about $550 billion in claims for health care services 

provided. The Centers for Medicare & Medicaid Services (CMS), which 

administers the program, has stated that one of its key goals is to pay 

claims properly the first time—that is, to ensure that payments go to 

legitimate providers in the right amount for reasonable and necessary 

services covered by the program for eligible beneficiaries. If claims are 

paid properly the first time, the agency does not need to spend additional 

resources to recover improper payments. CMS has estimated that 

8.6 percent—or about $28.8 billion—of the $336 billion in Medicare fee-

 
 

Page 2 GAO-13-102 Medicare Prepayment Edits

for-service payments in fiscal year 2011 were improper.2

One internal control strategy that CMS uses in an effort to pay claims 

properly and to administer the Medicare program effectively is the 

application of “prepayment edits”—instructions that CMS’s contractors 

program into claims processing systems that serve as internal controls by 

comparing claim information to Medicare requirements in order to 

approve or deny claims or to flag them for additional review.

CMS has 

strategies in place to prevent, or identify and recoup, improper payments.

3 CMS 

contracts with private firms to process and pay approximately 4.8 million 

Medicare claims per business day. In 2006, CMS began transitioning 

responsibility for claims administration for Medicare Parts A and B and 

durable medical equipment (DME) from the contractors known as fiscal 

intermediaries and carriers to Medicare administrative contractors (MAC), 

which are referred to, respectively, as A/B MACs and DME MACs.4

 

2

Medicare fee-for-service consists of Medicare Part A, which covers inpatient hospital 

care, skilled nursing facility care, some home health services, and hospice care, and 

Medicare Part B, which covers physician and hospital outpatient services, diagnostic tests, 

mental health services, outpatient physical and occupational therapy, ambulance services, 

some home health services, durable medical equipment, prosthetics, orthotics, and 

supplies, among other things.

CMS 

also has other types of contractors to help identify and recover improper 

payments, address fraud and abuse, or develop specific types of edits. 

MACs and these other contractors also share responsibility with CMS for 

identifying vulnerabilities to improper payments—billing practices or 

patterns that are or may be associated with significant amounts of 

improper payments, which we refer to hereafter as “vulnerabilities”—and

3

Internal controls are components of an organization’s management that provide 

reasonable assurance that the organization achieves effective and efficient operations, 

reliable financial reporting, and compliance with applicable laws and regulations. Internal 

control standards provide a framework for identifying and addressing major performance 

challenges and areas at greatest risk for mismanagement. 

4

As of May 2012, CMS had implemented 5-year contracts in all 4 of the DME MAC 

jurisdictions and 11 of the 14 existing A/B MAC jurisdictions. Three A/B MAC jurisdictions 

are being served by legacy contractors—fiscal intermediaries and carriers. CMS 

anticipates replacing the remaining fiscal intermediaries and carriers with MACs and 

consolidating A/B MAC jurisdictions from 14 to 10. For simplicity—and because CMS 

intends to convert all claims administration contractors to MACs—we use the term MAC to 

refer to all claims administration contractors in this report, except where specifically noted.
 

Page 3 GAO-13-102 Medicare Prepayment Edits

for taking action to address them.5

The Medicare program has defined categories of items and services 

eligible for coverage and excludes from coverage items or services that 

are determined not to be “reasonable and necessary” for the diagnosis 

and treatment of an illness or injury or to improve functioning of a 

malformed body part.

Most of the prepayment edits 

implemented by CMS and its contractors are automated, meaning that if a 

claim does not meet the criteria of the edit, it is automatically denied. 

Other prepayment edits are manual, meaning that they flag individual 

claims for review by trained contractor staff to determine whether the 

claim should be paid. Whereas automated edits are applied to all claims, 

manual edits are applied to very few. Less than 0.25 percent of claims 

received manual review that involved clinician review of the medical 

record.

6 CMS determines what services are covered under 

what conditions within the broad categories defined in law. CMS sets 

some national Medicare coverage and payment policies that apply to all 

beneficiaries. These include national coverage determinations (NCD), 

which describe the circumstances under which Medicare will cover 

particular items or services nationwide. CMS works with several 

contractors to implement prepayment edits for certain national coverage 

and payment policies. In addition to prepayment edits related to service 

coverage and payment, prepayment edits may be implemented to verify 

that the claim is properly filled out, that providers are enrolled in 

Medicare, or that patients are eligible Medicare beneficiaries.7

Each MAC has the authority to develop local coverage determinations 

(LCD) that delineate the circumstances under which services are 

considered reasonable and necessary and are therefore covered in the 

geographic area where that MAC processes claims. These local policies 

cannot conflict with national coverage and payment policies established 

by CMS or by law. MACs’ authority to develop LCDs leads to differences 

 

5

Examples of vulnerabilities are providers billing Medicare for ambulance services that 

should be billed to the hospital that provided the beneficiary’s inpatient care, and high 

utilization of diabetic test strips.

6

42 U.S.C. § 1395y(a)(1)(A).

7

For more information on edits related to provider enrollment information, see GAO, 

Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of 

Providers and Suppliers, GAO-12-351 (Washington, D.C.: Apr. 10, 2012).
 

Page 4 GAO-13-102 Medicare Prepayment Edits

in Medicare coverage policy in different areas of the country.8

Given your interest in ensuring sound fiscal oversight of the Medicare 

program, you asked us to examine the use of prepayment edits that 

implement coverage and payment policies to achieve savings, as well as 

CMS’s oversight of MACs, which develop and implement some edits. For 

this report, we assessed the extent to which (1) CMS and its contractors 

employed prepayment edits; (2) CMS has designed adequate processes 

to determine the need for prepayment edits and to implement edits based 

on national policies; and (3) CMS provides information, oversight, and 

incentives to MACs to promote use of effective prepayment edits.

MACs may 

create prepayment edits either to enforce their LCDs or to enforce 

national Medicare policies set by CMS, although not every LCD or 

national policy is structured in a way that makes edit development 

feasible. CMS has responsibility for providing information and oversight to 

MACs with respect to their use of prepayment edits to promote effective 

stewardship of Medicare funds.

To address all three objectives, we reviewed the Medicare Program

Integrity Manual, which provides guidance for Medicare contractors, and 

interviewed CMS officials and representatives of selected contractors 

responsible for developing prepayment edits. We focused on edits that 

implement coverage and payment policies, and did not include edits 

based on beneficiary or provider enrollment data or edits designed to 

verify that a claim has been properly filled out.

To assess the extent to which CMS and its contractors employed 

prepayment edits, we reviewed data from two CMS data systems—the 

Automated Reporting and Tracking System (ARTS), which tracks MACs’ 

claims administration costs, and the Program Integrity Management 

Reports (PIMR) system, which collects savings and usage data about 

prepayment edits. We conducted an analysis of paid Medicare claims 

from fiscal year 2010. Through a few selected examples, we assessed 

whether there were paid claims (1) that appeared to be inconsistent with 

certain national policies, which would provide examples of potentially 

 

8

For example, we reported in 2003 that two of four carriers—which predated MACs as the 

claims administration contractors responsible for processing Part B claims—had local 

coverage policies for magnetic resonance angiography and two did not. See GAO, 

Medicare: Divided Authority for Policies on Coverage of Procedures and Devices Results 

in Inequities, GAO-03-175 (Washington, D.C.: Apr. 11, 2003).
 

Page 5 GAO-13-102 Medicare Prepayment Edits

improper payments, and (2) that were inconsistent with local coverage 

determinations (LCD), which would provide examples of the potential for 

increased savings associated with more widespread use of local edits. 

The national policies we chose for our analysis were among those that 

CMS had developed into NCDs or that had been identified with improper 

payments in excess of $500,000 by Medicare contractors responsible for 

identifying improper payments. The LCDs we chose were those for which 

MACs had implemented automated edits that led to relatively large 

savings for the Medicare program in their jurisdictions.9

To assess the extent to which CMS has designed adequate processes to 

determine the need for prepayment edits and to implement edits based 

on national policies, we reviewed relevant documentation, including 

documents from CMS describing its processes, and reports that CMS 

uses to track vulnerabilities and corrective actions. We evaluated CMS’s 

processes using criteria outlined in our internal control documents, 

Standards for Internal Control in the Federal Government and Internal 

Control Management and Evaluation Tool.

We reviewed only 

examples where payments could have been prevented with automated 

edits because, unlike manual edits, automated edits can be used without 

an additional cost for claim reviewers’ time for each additional claim 

analyzed.

10

To assess the extent to which CMS provides information, oversight, and 

incentives to MACs to promote use of effective prepayment edits, we 

reviewed relevant documentation, including MACs’ statements of work

The specific standards used 

were risk assessment, control activities (documentation), and monitoring.

11

 

9

We also used other criteria to select these local policies, which included feasibility of 

analysis and implementation of similar policies by fewer than half of all MACs at the start 

of fiscal year 2010.

and various reports MACs are required to submit to CMS, and analyzed 

data from CMS’s performance reviews of MACs.

10See GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999), and GAO, Internal Control 

Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001). 

11Statements of work are those documents generally incorporated in contract solicitations 

and, subsequently, contracts, that specify, either directly or with reference to other 

documents, the work the government expects the contractors to perform.
 

Page 6 GAO-13-102 Medicare Prepayment Edits

We performed appropriate electronic data checks for the data used in our 

analyses and interviewed agency officials who were knowledgeable about 

the data from PIMR, ARTS, and the Medicare claims database to ensure 

that the data were reliable enough for our purpose. We found the data 

were sufficiently reliable for the purpose of our analyses. We conducted 

this performance audit from July 2011 through November 2012 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

About three-quarters of all Medicare beneficiaries receive their care on a 

fee-for-service basis, with providers submitting claims for payment for 

each service provided.12 CMS contracts with claims administration 

contractors—primarily MACs—to process claims from over 1 million 

hospitals, physicians, and other health care providers. In fiscal year 2011, 

MACs and other claims administration contractors processed about 

1.2 billion claims. Medicare claims administration contractors have had a 

role in determining coverage since 1965, when the Medicare program 

was enacted. At that time, Congress arranged for many Medicare 

functions to be contracted out to private insurers to allow the program to 

be implemented rapidly by organizations already processing claims for 

hospitals and physicians.

Medicare law defines the categories of services covered by the program 

and provides the Secretary of the Department of Health and Human 

Services (HHS) with the authority to specify which services within these 

categories are covered and under what conditions.13

 

12The remaining beneficiaries are enrolled in a Medicare Advantage plan, in which private 

insurance plans offer health care coverage to Medicare beneficiaries.

The Secretary 

delegates this responsibility to CMS, which, in turn, carries out some of 

these responsibilities through MACs. Consistent with Medicare law, CMS 

sets national coverage, payment, and coding policies regarding when and 

how services will be covered by Medicare, as well as coding and billing 

1342 U.S.C. § 1395y(a).

Background 

Medicare Coverage 

Policies
 

Page 7 GAO-13-102 Medicare Prepayment Edits

requirements for claims. CMS develops or implements the following types 

of national policies:

• NCDs, which CMS typically develops for services that have the 

potential to affect a large number of beneficiaries and that have the 

greatest effect on the Medicare program.14 For example, this can 

include new technologies introduced into health care practice, such as 

use of Positron Emission Tomography scans for diagnostic 

purposes.15 Development of NCDs is a lengthy process, which 

requires review of clinical evidence and allows for public comment. 

According to CMS, the agency has the resources to develop 

approximately 12 NCDs per year. As of February 2012, there were 

328 NCDs.

• National payment policies that specify how payment will be made for 

covered services in certain situations—such as how physicians who 

collaborate on providing the same service to a beneficiary will be paid.

• National Correct Coding Initiative (NCCI) coding policies, which aim to 

reduce inappropriate payments through the use of automated edits 

that deny improperly coded claims. NCCI edits include code-pair 

edits, which deny payment for services that should not be billed 

together. NCCI edits also include Medically Unlikely Edits (MUE), 

which deny payment for services where the quantity billed is at a level 

not likely to be provided under normal medical practice, such as daily 

doses of drugs higher than the maximum amounts in the prescribing 

information or services that are anatomically impossible, such as 

more than one appendectomy on the same beneficiary. CMS allows 

exceptions to MUEs and some code-pair edits when providers believe 

the services provided are clinically appropriate. In such cases, special 

codes called modifiers are included on the claim to indicate why the 

services were clinically appropriate.

 

14CMS officials also noted that outside groups or individuals can request an NCD and the 

agency must consider the request.

15Positron Emission Tomography is a diagnostic imaging procedure used to evaluate 

metabolism in normal tissue as well as in diseased tissues in conditions such as cancer, 

ischemic heart disease, and some neurologic disorders.
 

Page 8 GAO-13-102 Medicare Prepayment Edits

MACs may develop local coverage policies as long as these policies are 

consistent with national policy. MACs develop the following types of local 

coverage policies:

• LCDs, which specify the circumstances under which services will be 

covered in a MAC’s jurisdiction.16 According to CMS, allowing MACs 

to develop LCDs allows for timely local reaction to changes in the 

practice of medicine. MACs also use LCDs to place limits on services 

that may be overused or abused in their jurisdictions.17 Before 

implementing or revising an LCD, a MAC must review clinical 

evidence and incorporate the information reviewed into the proposed 

LCD, provide notice of proposed changes on its website, and, in some 

cases, seek public input from potentially affected individuals or 

organizations, such as physicians whose billing could be affected by 

the policy. There are currently thousands of LCDs.

• Limits on quantities of services that will be covered in a MAC’s 

jurisdiction. A quantity limit may be included within an LCD or 

developed separately as a Clinically Unlikely Edit (CUE).

CMS and its contractors have developed and implemented various types 

of prepayment edits based on national and local coverage policies. (See 

table 1.)

 

16The four DME MACs are required to use one set of LCDs. In contrast, the A/B MACs 

may have similar policies, but are not required to do so.

17For example, a DME MAC has set maximum allowable amounts for certain drugs that 

are inhaled using a nebulizer.
 

Page 9 GAO-13-102 Medicare Prepayment Edits

Table 1: Scope, Mode, and Description of Selected Types of Prepayment Coverage, Payment, and Coding Edits

Type Scope Mode Description

Edits based on national 

coverage determinations 

(NCD)

National or 

local

Automated or 

manual

These edits compare information from claims with Medicare 

requirements in NCDs, which specify the circumstances under which a 

service is covered, to identify claims that should not be paid.

Edits based on national 

payment policies

National or 

local

Automated or 

manual

These edits compare information from claims with policies regarding 

payments to providers and coverage limitations contained in the 

Medicare Claims Processing Manual and other CMS documents, to 

identify claims that should not be paid.

Code-pair edits developed 

through the National 

Correct Coding Initiative 

(NCCI) 

National Automated These edits deny payment for services that should not be billed together 

in order to prevent improper payment of these services.

Medically Unlikely Edits 

(MUE) developed through 

the NCCI

National Automated These edits deny payment for services where the number of units billed 

on the claim line exceeds the maximum number a provider would bill 

under most circumstances for a beneficiary on a single date of service in 

order to prevent improper payment of these services.

Edits based on local 

coverage determinations 

(LCD)

Local Automated or 

manual

These edits compare information on claims to LCDs, to determine 

whether the claim should be paid. In the absence of a national coverage 

policy, local contractors may determine the circumstances under which a 

service is covered. LCDs also can articulate additional detail about how 

a national coverage policy will be applied.

Clinically Unlikely Edits 

(CUE)

Local Automated These edits are similar to MUEs but are developed and implemented at 

the local level.

Source: GAO analysis of CMS documents and interviews with CMS officials.

Note: The prepayment edits listed here focus on clinical criteria, including procedure and diagnosis 

codes. Other prepayment edits include edits that identify improper provider and beneficiary data.

MACs are responsible for processing and paying claims, generally in 

specific geographic jurisdictions, in compliance with coverage and 

payment policies. Health care providers generally submit claims to the 

MAC responsible for the geographic area where the services were 

delivered or the beneficiary resides.18

 

18This description of Medicare claims processing also applies to claims administration 

contractors known as fiscal intermediaries and carriers, which CMS expects to replace 

with MACs by early 2013. Ambulance services are billed based on where the ambulance 

is garaged. Laboratory services are billed based on either where the specimen is taken or 

where it is analyzed.

Providers submit claims using a 

standardized coding system, known as the Healthcare Common 

Procedure Coding System (HCPCS), to identify the medical services, 

Medicare Claims 

Processing and Review
 

Page 10 GAO-13-102 Medicare Prepayment Edits

equipment, and other goods provided.19

Medicare fee-for-service claims processing includes several basic steps 

that involve three types of systems: MAC front-end systems, shared 

systems, and the Common Working File (CWF).

Claims also identify relevant 

patient diagnoses, using a different coding system called the International 

Classification of Diseases (ICD).

• MAC front-end systems. Claims are submitted to MACs, whose frontend computer systems perform automated checks to determine 

whether claims meet certain requirements, such as that the data are 

complete.

• Shared systems. Claims that meet the initial requirements in the frontend systems are sent to one of three shared systems—depending on 

the type of claim—where they are subjected to prepayment edits 

based on coverage and payment policy criteria.20 Claims that do not 

meet these criteria are either automatically denied or flagged for 

review by trained staff. These systems also verify that providers are 

enrolled in Medicare. Claims that are not denied by automated edits 

or suspended for manual review by manual edits in the shared 

systems are then sent to the CWF, the central CMS system that 

authorizes payment.

• Common Working File. The CWF verifies beneficiary eligibility, 

coordinates Part A and Part B benefits, and determines the extent of 

Medicare’s responsibility for payment, based on such factors as 

whether beneficiaries’ deductibles have been met or utilization limits 

have been reached. From there, claims are returned to the relevant 

shared system for final processing and then payments are sent to 

providers.

 

19Many HCPCS codes are based on the Current Procedural Terminology codes, which 

are maintained by the American Medical Association and which many private insurers use 

for processing claims. HCPCS also includes codes for other items, such as ambulance 

services and durable medical equipment used in a beneficiary’s home.

20The three systems are called the Fiscal Intermediary Standard System (FISS), the MultiCarrier System (MCS), and the ViPS Medicare System (VMS). FISS processes Part A and 

certain types of Part B claims from institutional providers. MCS processes other Part B 

claims. VMS processes DME claims. 
 

Page 11 GAO-13-102 Medicare Prepayment Edits

The process of determining whether claims are consistent with Medicare 

coverage, payment, and medical coding policies—which includes the 

application of edits based on these policies, as well as manual review of 

flagged claims—is known as the medical review process. Of the two 

categories of prepayment edits used by MACs in this process—

automated and manual—automated are less resource intensive. CMS 

policy requires that automated edits be used whenever possible. 

However, many improper claims can be identified only through more 

costly manual review, because staff may have to review associated 

medical records and claims history or exercise clinical judgment to 

determine whether a service is reasonable and necessary and therefore 

should be approved for payment. CMS officials indicated that there are 

about 17,000 prepayment edits related to medical coverage issues in 

PIMR.21 However, some edits—in particular, those that require manual 

review—may not be in use at any given time for various reasons, such as 

the staff costs associated with manual review, or because changes in 

provider behavior make the edit unnecessary. In addition, edits can vary 

in complexity and the policy issues covered, since some automated edits 

address only a portion of one coverage policy, while other automated 

edits address multiple policies.22

There are limitations to the use of prepayment edits and associated 

manual review as medical review strategies because some claims can be 

 

21Edits developed through the National Correct Coding Initiative (NCCI) are not in PIMR, 

and therefore are not included in this total.

22CMS also recently launched the Fraud Prevention System, a predictive modeling system 

that screens all Medicare fee-for-service claims on a prepayment basis in order to identify 

potentially fraudulent claims. The Fraud Prevention System analyzes claims to identify 

unusual billing patterns and assigns risk scores to claims to prioritize them for 

investigation.
 

Page 12 GAO-13-102 Medicare Prepayment Edits

identified as improper only after a payment is made.23 CMS employs 

recovery audit contractors (RAC) to find and correct overpayments and 

underpayments after claims have been processed. Although some of the 

improper payments identified by RACs could have been prevented by 

prepayment edits, others can be identified only after payment through 

review of medical records. CMS requires RACs to provide information, 

based on their analyses, about vulnerabilities, including those that could 

be addressed through prepayment edits.

CMS’s oversight of MACs is governed by the terms of the MACs’ 

contracts, which in turn reflect provisions of the Medicare Prescription 

Drug, Improvement, and Modernization Act of 2003 (MMA). The MMA 

includes a requirement for CMS to use competitive procedures to select 

contractors to process claims; to develop performance standards for 

these contractors, including standards for customer satisfaction; and to 

provide incentives for these contractors to provide high-quality service.24

CMS established the MAC contracts as cost-plus-award-fee contracts, a 

type of cost-reimbursement contract designed to provide sufficient 

motivation to encourage excellence in contract performance.25

 

23For example, some Medicare payments are so-called “bundled payments” for a group of 

related services that should be billed together for specified treatments. However, services 

that should be billed as part of a bundle under some circumstances also can be billed 

separately under other circumstances. When a claim is submitted for an individual service 

that could be part of a bundled payment, MACs may pay the claim not knowing that a 

claim for the bundled set of services will be submitted in the future. In such cases, 

overpayments must be addressed after claims have been processed. An example of a 

service that could be billed either as part of a bundle or separately is an ambulance trip 

that transfers a patient from a hospital to a skilled-nursing facility. If the ambulance trip is 

associated with a patient’s Part A hospital stay, then the ambulance transfer is covered as 

part of a bundled payment for the patient’s Part A stay. A separate payment for this type of 

ambulance trip when a patient is in a Part A stay would be an overpayment. However, if 

the patient’s stay in the hospital is not being covered by Medicare Part A, then the 

ambulance provider may bill Medicare for the ambulance trip, if the trip meets other 

Medicare coverage rules. 

Specifically, a MAC may earn an incentive, known as an award fee, 

based on performance, in addition to reimbursement for allowable costs 

24Pub. L. No. 108-173, § 911, 117 Stat. 2066, 2378 (Dec. 8, 2003) (codified at 42 U.S.C. 

§ 1395kk). MMA also established the application of the Federal Acquisition Regulation 

(FAR) to MAC contracts, except where inconsistent with specific MMA provisions. The 

FAR establishes uniform policies for acquisition of supplies and services by executive 

agencies. 48 C.F.R. ch.1.

2548 C.F.R. § 16.305.

CMS Oversight of MACs
 

Page 13 GAO-13-102 Medicare Prepayment Edits

and a base fee for the contract, which is fixed at the inception of the 

contract. Under the terms of these contracts, CMS sets requirements for 

MACs with respect to prepayment edits and other aspects of the medical 

review process. In general, CMS requires MACs to target medical review 

to areas that pose the greatest financial risk to the Medicare program and 

where their efforts are likely to produce the best return on investment, and 

also to implement automated prepayment edits whenever appropriate. 

CMS also requires MACs to assess the effectiveness of their edits and to 

submit their medical review strategies to CMS for review and approval. 

However, MACs have considerable discretion in developing local 

coverage policies and in deciding how to implement edits to address both 

local and national coverage policies.

CMS assesses MACs’ performance in part through its Quality Assurance 

Surveillance Plan (QASP) review and its Award Fee Plan review.26

CMS monitors the accuracy of the MACs’ claims payment determinations 

through its Comprehensive Error Rate Testing (CERT) Program, which 

measures improper payments. Each year, CMS establishes a national 

error rate goal under the Government Performance and Results Act of 

1993. To calculate error rates, CMS’s CERT Program contractor 

randomly samples Medicare fee-for-service claims and reviews them after 

payment. Currently, CMS publishes error rates by type of error, type of 

For 

the QASP review, which is generally conducted annually, CMS evaluates 

each MAC’s performance against a MAC-specific subset of performance 

standards in accordance with the statement of work and other 

requirements specified in related CMS policy documents. The Award Fee 

Plan identifies the criteria upon which the MAC will be evaluated and 

provides an explanation of when the MAC can potentially earn an 

incentive based on its performance. On an annual basis, CMS creates an 

award fee plan for each MAC that contains metrics that are generally 

more challenging to achieve than the requirements outlined in the 

statement of work. The pool of award fees available to each MAC is 

established during contract negotiations and depends in part on the 

negotiated division of fees between award fees and base fees.

 

26CMS’s performance assessment program also includes the Quality Control Plan 

Review, which is CMS’s review of the MAC’s quality control plan, which describes the 

plans, methods, and procedures—or internal controls—that a contractor will use to meet 

performance standards in the statement of work, such as those related to quality, quantity, 

time frames, responsiveness, and customer satisfaction.
 

Page 14 GAO-13-102 Medicare Prepayment Edits

claim—for example, DME—and clinical setting, as well as nationally.27

Prior to 2009, CMS also published contractor-specific error rates. 

However, in that year, CMS implemented a new methodology for CERT 

claim reviews, and as a result, the error rates computed for 2009 were not 

comparable to those computed for previous years.28 CMS used 

contractor-specific error rates in award fee plan reviews in fiscal year 

2011.

CMS, like other agencies, is responsible for maintaining internal control—

the component of an organization’s management that provides 

reasonable assurance that the organization achieves effective and 

efficient operations, reliable financial reporting, and compliance with 

applicable laws and regulations. Internal control standards provide a 

framework for identifying and addressing major performance challenges 

and areas at greatest risk for mismanagement. As noted above, GAO has 

published guidelines for internal controls, and we used these guidelines to 

assess some of CMS’s processes. (See table 2 for the specific internal 

control standards and activities we used.) 

 

27In 2011, 85 percent of the improper payments identified by CERT were for claims in 

which the medical documentation submitted either was inadequate to support payment for 

the services billed or indicated that the services billed were not medically necessary based 

upon Medicare coverage policies. 

28CMS’s revisions included a strict adherence to policy documentation requirements, the 

removal of claims history as a valid source for review information, and the determination 

that medical record documentation created by a supplier is insufficient to substantiate a 

claim.

Internal Control
 

Page 15 GAO-13-102 Medicare Prepayment Edits

Table 2: Internal Control Standards or Activities That Apply to CMS’s Determination 

of the Need for, and Implementation of, Prepayment Edits Based on National 

Policies

Standard or 

activity Description of elements applicable to our assessment

Risk assessment Management comprehensively identifies risk using various 

methodologies as appropriate.

A determination is made on how best to manage or mitigate the 

risk and what specific actions should be taken.

Documentation Internal control and all transactions and other significant events are 

clearly documented, and the documentation is readily available for 

examination.

a

The documentation appears in management directives, 

administrative policies, or operating manuals in either paper or 

electronic form.

All documentation and records are properly managed and 

maintained.

Monitoring Corrective action is taken or improvements made within 

established time frames to resolve the matters brought to 

management’s attention.

Agency personnel obtain information about whether their internal 

control is functioning properly.

Source: GAO.

Notes: Information is from GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999), and GAO, Internal Control Management 

and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001).

a

Documentation is an activity under the standard called Control Activities.

CMS reported that the use of prepayment edits saved Medicare 

$1.76 billion in fiscal year 2010, but the reported total is likely to be an 

underestimate because CMS does not collect information on savings from 

all of its current edits. Moreover, the savings could have been greater had 

prepayment edits been more widely used. Our analysis of Medicare data 

using only a limited number of national policies identified payments that 

appeared to be improper and that might have been prevented through 

wider use of automated edits. We also found that wider use of edits 

based on LCDs could have led to increased savings. Using just three 

MAC-issued LCDs as examples, we found that MACs in other geographic 

areas processed Medicare payments totaling more than $100 million for 

services that were not covered under the three policies we selected.

Prepayment Edits 

Saved Medicare at 

Least $1.76 Billion in 

2010 but Were Not 

Used to Full Extent 

Possible 
 

Page 16 GAO-13-102 Medicare Prepayment Edits

Although CMS’s PIMR data indicate that Medicare savings from 

prepayment edits were $1.76 billion in fiscal year 2010, that total is 

probably an underestimate because CMS does not collect information on 

savings from all of its current edits.29

CMS also does not centrally track all of its costs related to developing and 

implementing edits. Our analysis of ARTS data showed that MACs 

incurred about $59 million in costs for tasks directly related to prepayment 

edits and medical review in their most recent contract year.

For example, although the savings 

total included $497 million in savings from some NCCI code-pair edits, it 

did not include savings from other NCCI code-pair edits or from MUEs. In 

addition to lacking complete information about total savings from edits, 

CMS also lacked reliable information about savings associated with 

particular types of edits. For example, PIMR did not contain reliable data 

about fiscal year 2010 savings attributable to automated edits versus 

manual edits or to edits based on national policy versus those based on 

local policy. Although PIMR captured both kinds of information, CMS 

officials said these data were unreliable because not all MACs defined 

and reported information about edits in the same way. However, in 2011, 

CMS issued new reporting instructions for contractors to standardize 

definitions for various types of edits.

30

 

29PIMR’s calculation of savings accounts for $239 million in claims denials that were 

subsequently reversed. Medicare requires that a denied claim be adjusted, rather than

resubmitted as a new claim, and PIMR captures data about payment amounts for adjusted 

claims.

However, 

ARTS data do not capture all costs related to prepayment edits and 

medical review. For example, CMS does not track its staff costs to 

develop national edits or to oversee MACs’ edit development and 

implementation, which include tasks such as conducting medical review 

of claims, developing LCDs, and analyzing the effectiveness of edits. In 

30We analyzed MACs’ costs for specific tasks related to prepayment edits and medical 

review, based on the most recent contract periods for which we had data at the time of our 

analysis. These contract periods, which were almost always 1 year, ranged from a period 

ending July 30, 2010, to one ending March 31, 2011, depending on the time frame for 

each contract. Medicare Integrity Program (MIP) funds were used to pay the costs for the 

tasks we included in our review. MIP was established to enhance efforts to address 

Medicare’s vulnerabilities to fraud, waste, and abuse. Costs of various tasks in the MIP 

category—which also includes provider outreach and education and coordination of 

benefits—are paid with MIP funds. MACs are permitted to direct the MIP funds they 

receive among these tasks but are not permitted to use MIP funds for tasks in other 

categories. On average, the MIP category accounted for 30 percent of A/B MACs’ total 

costs and 19 percent of DME MACs’ total costs in the most recent contract period.

Use of Prepayment Edits 

Led to Reported Savings of 

$1.76 Billion, but That 

Total Is Probably an 

Underestimate
 

Page 17 GAO-13-102 Medicare Prepayment Edits

addition, ARTS data do not include approximately $1.1 million in costs 

incurred for another contractor to develop NCCI edits.

Our analysis of Medicare claims data, for which we selected five national 

Medicare policies, found cases in which Medicare paid for services that 

appeared to be inconsistent with its national coverage and coding 

policies. Specifically, we found $14.7 million in payments from fiscal year 

2010 that appeared to be inconsistent with four of the selected policies 

and therefore improper.31 At least some of these payments that were 

improper could have been prevented by prepayment edits. (See table 3.) 

For each of the four policies, the steps we followed for our analysis also 

could have been followed on a prepayment basis using automated edits 

because the steps consisted of a review of only the procedure codes, 

diagnosis codes, and quantities provided, all of which could be 

determined prior to claim payment. (See app. I for a description of the 

analytic approach.) For the remaining policy, we found no payments that 

appeared to be inconsistent.

 

31Our analysis used Medicare data on final action claims, which include detail about 

disputes resolved and adjustments made up until the point when CMS finalized these data 

in June 2011. However, CMS officials indicated that in fiscal year 2010 some claims might 

have been adjusted after CMS finalized its data on these claims. According to CMS 

officials, this was because the Affordable Care Act of 2010 mandated retroactive changes 

to the physician fee schedule that required CMS to reprocess some adjudicated claims. 

CMS officials said this reprocessing was not completed until December 2011.

Wider Use of Automated 

Edits Based on National 

Policies Could Have 

Prevented Some Improper 

Payments
 

Page 18 GAO-13-102 Medicare Prepayment Edits

Table 3: Payments for Claims That Appeared to Be Inconsistent with Selected 

National Policies and Therefore Improper and That Could Have Been Identified 

through Automated Edits, Fiscal Year 2010

Policy

Medicare payment 

amount identified 

(dollars in millions) Description

Medically Unlikely 

Edits (MUE)

$8.6 a Medicare limits service quantities that can 

be billed for the same beneficiary, on the 

same day, by the same provider. We 

identified payments where the quantity of 

services was greater than those limits and 

the claims did not include modifiers to 

explain why the limit was exceeded.

National coverage 

determination 

(NCD) on vagus 

nerve stimulation

5.0 Medicare does not cover vagus nerve 

stimulation, which involves delivering an 

electrical pulse to the brain, for treatment 

of resistant depression. We identified paid 

claims for vagus nerve stimulation where 

depression was a diagnosis on the claim.

NCD on ocular 

photodynamic 

therapy (OPT) and 

NCD on verteporfin

1.1

b

Medicare requires that OPT and 

verteporfin be delivered together as a 

treatment for vision problems. Also, a 

diagnostic test is required prior to 

treatment. We identified paid claims where 

OPT and verteporfin were not delivered on 

the same day or the diagnostic test was 

not performed.

Total $14.7

Source: GAO analysis of Medicare data.

a

We analyzed only claims from noninstitutional providers of outpatient services, such as physician 

services. In addition, we analyzed only MUEs for which CMS had published the service or item limits. 

CMS does not publish the service or item limits for some MUEs designed to identify services or items 

commonly billed fraudulently.

b

CMS issued separate NCDs for OPT and verteporfin.

We found that Medicare paid $8.6 million for claims that exceeded the 

MUE quantity limits for a single beneficiary under most circumstances on 

a single date of service.32

 

32CMS allows providers to use modifiers on claims in order to report units of service in 

excess of an MUE limit to indicate that the provider deems it to be medically reasonable 

and necessary. Our analysis does not include claims with modifiers. 

By the beginning of fiscal year 2012, CMS had 

established quantity limits for about 10,800 HCPCS codes for services 
 

Page 19 GAO-13-102 Medicare Prepayment Edits

provided by physicians and other noninstitutional outpatient service 

providers.33

Claims can have multiple lines, with a single service claimed on each line. 

MUEs look for excess quantities of services provided to a single 

beneficiary by a single provider on each individual claim line. (See app. II 

for an example of how excess quantities of services could be billed in a 

way that avoids triggering an MUE.) Therefore providers still could be 

paid for more than the maximum quantity specified under the policy if 

quantities were divided among multiple lines on the same claim or among 

multiple claims for the same beneficiary. When we analyzed claims using 

the method actually applied by MUEs—in which each claim line was 

analyzed independently—we found only about $400,000 in paid claims 

that exceeded the MUE quantity limits. However, when we analyzed 

claims using the quantity limits to identify payments for the same 

beneficiary, same provider, and same date of service—whether on the 

same claim line or multiple claim lines—we found $8.6 million in paid 

claims that exceeded quantity limits.34

We also found $6.1 million in payments that appeared to be inconsistent 

with three selected NCDs and therefore improper. For a fourth NCD, we 

did not find any payments that appeared to be inconsistent. Using one of 

the three NCDs, which prohibits use of vagus nerve stimulation to treat 

resistant depression, we found that Medicare paid about $5.0 million in 

fiscal year 2010 for vagus nerve stimulation for claims with diagnoses for 

depression.35

 

33We analyzed claims using MUEs for approximately 8,900 HCPCS codes for claims from 

noninstitutional providers of outpatient services for which CMS publishes quantity limits to 

inform providers about correct coding practices. However, quantity limits are not published 

for some MUEs that are intended to deter potential fraud or abuse. The contractor 

responsible for creating MUEs reported that the proportion of unpublished MUEs has been 

increasing and was about 15 percent of the MUEs in effect as of July 2012.

In addition, using two NCDs that address a treatment for 

34The $8.6 million we identified represented payments for all quantities where the total 

quantity for a single day exceeded the limits established by MUEs because MACs are 

instructed to deny payment for the entire quantity when they identify it as exceeding the 

MUE limit. 

35The vagus nerve stimulation NCD covers a set of procedures in which an implanted 

device delivers an electrical signal that travels through the vagus nerve to the brain. CMS 

determined in 2007 that vagus nerve stimulation was not reasonable and necessary for 

resistant depression. Our analysis was designed to mimic an automated edit used by at 

least one MAC, which denies claims for vagus nerve stimulation procedures when a 

diagnosis for depression is included on the claim.
 

Page 20 GAO-13-102 Medicare Prepayment Edits

age-related macular degeneration, we found $1.1 million in payments that 

appeared to be improper.36 These two related NCDs stipulate that this 

macular degeneration treatment must use both ocular photodynamic 

therapy (OPT) and the drug verteporfin together and that beneficiaries 

must receive a diagnostic test prior to treatment.37 The $1.1 million we 

found was for claims for the therapy without the diagnostic test, the 

therapy without the drug, or the drug without the therapy. We did not find 

any payments that appeared to be inconsistent with the remaining NCD, 

which establishes that Medicare does not cover lumbar artificial disc 

replacement for beneficiaries older than age 60.38

Our analysis of Medicare claims using three selected LCDs demonstrated 

the potential for increased savings. Variation in Medicare coverage and in 

the prepayment edits used to enforce coverage policy in different 

geographic areas results in Medicare paying for services that are covered 

in some parts of the country but not others. We found that MACs other 

than those whose LCDs we used as the basis for our analysis paid more 

than $100 million for claims that were inconsistent with these three 

LCDs.39 (See table 4.) These payments cannot necessarily be classified 

as improper because other MACs may not have had a similar LCD in 

place.40

 

36Age-related macular degeneration is a condition in which vision is impaired as a result of 

damage to the retina.

However, variation in coverage among MACs can result in 

greater or lesser use of services in some jurisdictions than in others. 

37Claims data from Medicare Part B would not have information about diagnostic tests that 

beneficiaries received prior to enrolling in Medicare or while enrolled in a Medicare 

managed care plan. Treatment with OPT and verteporfin should begin within 1 week of 

the fluorescein angiogram on which the clinical decision to treat is based, according to an 

expert panel convened by the distributors of verteporfin with input from representatives of 

relevant medical organizations.

38In addition to providing health care insurance for individuals 65 and older, Medicare also 

covers health care services for individuals with certain types of disabilities regardless of 

age.

39This does not mean that Medicare would have saved the entire amount we identified if 

automated edits based on these policies had been in place nationwide. One reason is that 

if all MACs had used automated edits to prevent payment for the issues we reviewed, 

medical providers might have substituted different treatments that would have been 

covered by Medicare or might have been able to appropriately code their claims in ways 

that conformed with the policies.

40For each LCD analyzed, we excluded results from the MAC that issued the policy.

Wider Use of Edits Based 

on MACs’ LCDs Could 

Have Led to Increased 

Savings
 

Page 21 GAO-13-102 Medicare Prepayment Edits

Although greater use of services does not necessarily reflect overuse, 

leading health care experts have noted that overuse of services is a 

significant problem that has led to increased health care spending, 

including in the Medicare program. More widespread use of automated 

edits that some MACs found to be among their most effective at 

identifying claims for services that they do not consider reasonable and 

necessary could have led to more consistent coverage throughout the 

country and therefore to savings for the Medicare program as a whole.

Table 4: Payments for Claims That Were Inconsistent with Selected Local Coverage 

Determinations (LCD) Issued by Medicare Administrative Contractors (MAC), Fiscal 

Year 2010

Policy

Amount 

identified

(dollars 

in millions) Description a

LCD on monitored 

anesthesia care

$68.7 Monitored anesthesia care, which involves 

monitoring patients’ vital physiological functions 

while they are under anesthesia, was covered 

by a MAC only for specified diagnoses. We 

identified claims in other MAC jurisdictions that 

did not contain any of the diagnoses required by 

the MAC with the policy.

LCD on parathormone 30.9 A parathyroid hormone test was covered by a 

MAC only for specified diagnoses, such as 

chronic renal disease, vitamin deficiencies, or 

osteoporosis. The policy limited coverage to one 

test per day, under most circumstances. We 

identified claims in other MAC jurisdictions that 

did not contain any of the diagnoses required by 

the MAC with the policy and claims that 

exceeded limits on daily quantities.

LCD on noninvasive 

cerebrovascular studies

4.5 These services, which involve identifying 

potential problems in the structure of, or flow of 

blood in, the carotid artery, were covered by a 

MAC only for certain specified diagnoses. We 

identified claims in other MAC jurisdictions that 

did not contain any of the diagnoses required by 

the MAC with the policy.

b

Total $104.1

Source: GAO analysis of CMS and MAC data. 

Notes: Data are from Medicare claims, CMS Medicare Coverage Database, and MAC-supplied data 

about automated edits.

These LCDs do not conflict with national coverage policy.

a

For each LCD analyzed, we excluded results from the MAC that issued the policy.

b

We analyzed only claims from noninstitutional providers of outpatient services, such as physician 

services, because the MAC whose policy we used applies an automated edit only to those claims for 

this policy.
 

Page 22 GAO-13-102 Medicare Prepayment Edits

In our analysis, we found about $68.7 million in payments for monitored 

anesthesia care that were made by MACs other than the MAC whose 

LCD we used as the basis for this analysis.41 The LCD specified the 

diagnoses for which monitored anesthesia care would be covered by 

Medicare in the MAC’s jurisdiction. The MAC whose LCD we used for this 

analysis had implemented an automated edit to identify claims that lacked 

one of the required diagnoses. In addition, we found about $30.9 million 

in payments for claims for a test of parathyroid hormone levels that was 

performed more than once per day or lacked one of the diagnoses 

required by the MAC whose LCD we used. The LCD identified a set of 

diagnoses for which a parathormone test would be covered as medically 

necessary and generally prohibited coverage for more than one service 

per day.42 Medicare payments in 2 of the 15 MAC jurisdictions made up 

about half—$17.1 million—of the payments we identified as inconsistent 

with the parathormone LCD. Finally, we found about $4.5 million in 

payments in fiscal year 2010 that were inconsistent with an LCD covering 

tests to measure blood flow to the brain. The claims we found did not 

contain any of the diagnoses required by that LCD.

CMS has three processes for identifying the need for, and implementing, 

prepayment edits based on national policies: (1) the NCCI process; 

(2) the Vulnerability Tracking Corrective Action Process; and (3) the NCD 

process. The designs of these processes have steps consistent with our 

internal control standards. However, they also have weaknesses that 

hinder their effectiveness in preventing improper payments.

 

41Monitored anesthesia care involves active monitoring of patients under the influence of a 

local anesthetic.

42Parathyroid hormone is produced by the parathyroid gland, and its benefits include 

facilitating the absorption of calcium. The MAC policy we used excluded one diagnosis 

from the one-per-day limit, and our analysis also applied this exception.

CMS’s Processes for 

Identifying Needs for, 

and Implementing, 

Prepayment Edits 

Based on National 

Policies Have 

Weaknesses 
 

Page 23 GAO-13-102 Medicare Prepayment Edits

The NCCI process, which CMS initiated in 1996, aims to reduce 

inappropriate payments through the development and implementation of 

automated edits that deny certain types of improperly coded claims. The 

NCCI process develops two types of edits. Code-pair edits are designed 

to result in denial of claims for services to a beneficiary with pairs of 

codes that should not be billed together. MUEs are designed to result in 

denial of claims with units of service that exceed the maximum number a 

provider would bill under most circumstances.

The first step outlined in the NCCI process—in which CMS identifies risks 

that can be addressed with NCCI edits—is consistent with our risk 

assessment internal control standard that calls for agencies to identify 

risks comprehensively using various methods. To identify the need for an 

NCCI edit, CMS’s NCCI contractor reviews information from a variety of 

sources, including MAC medical directors, publications of national health 

care organizations, new laws and regulations, and annual changes in 

procedure codes. In general, the NCCI contractor staff told us that they 

propose a code-pair edit whenever they identify a procedure or item 

where proper payment could be enhanced, irrespective of the size of the 

potential vulnerability. However, CMS guidance indicates that the 

magnitude of potential program vulnerability is one possible rationale for 

setting an MUE at a particular level.

CMS has procedures for deciding whether to implement an NCCI edit, 

consistent with our risk assessment standard that calls for deciding on 

appropriate corrective actions. To help CMS determine whether an NCCI 

edit might be appropriate, the NCCI contractor reviews CMS policy, 

standards of medical and surgical practice, current coding practice, and 

provider billing patterns. The contractor then presents information on 

proposed edits in regular meetings with senior-level CMS staff assigned 

to NCCI workgroups, who then decide whether to implement proposed 

edits.43

 

43CMS staff can also decide separately from the workgroup to take other corrective 

actions, such as educating specialty societies or individual providers about coding policy.

CMS generally provides a review and comment period before 

implementing edits to allow for input from representative national 

organizations that may be affected by the edits. CMS considers the 

comments when it makes its final decision about implementing an edit, 

but does not necessarily decide against an edit because of adverse 

comments.

CMS’s NCCI Process to 

Develop Code-Pair Edits 

and MUEs Adheres to 

Some Internal Control 

Standards but Has 

Weaknesses
 

Page 24 GAO-13-102 Medicare Prepayment Edits

CMS implements NCCI edits on a regular timeline, consistent with our 

monitoring standard that calls for taking action within established time 

frames. The NCCI contractor provides a file of new and revised edits to 

CMS on a quarterly basis. The contractors then download this file from 

CMS’s Data Mover to integrate it into the claims payment systems.44

CMS has procedures in place to determine whether NCCI edits are 

operating as intended before applying the edits in processing claims. 

Prior to submitting the edit files to CMS, the NCCI contractor performs a 

series of quality control checks to ensure that the edits are operating 

correctly. Representatives of the MACs we contacted said they also test 

these edits to ensure they are operating correctly within the shared 

systems. 

Representatives of MACs we contacted said they receive the edit files in 

a timely manner.

However, the MUE edits are not working to enforce the MUE limits 

because of how they are structured. Thus, this monitoring step does not 

meet our standard that calls for agencies to assess whether internal 

controls are functioning properly. As noted above, MUEs are structured to 

identify each claim line in which units of service exceed the MUE limit, 

and do not identify excess units billed across multiple claim lines.45 As a 

result, we identified about $8.2 million in Medicare payments in fiscal year 

2010 for quantities of services that exceeded published MUE limits but 

were not identified by MUEs because the excess amounts were billed 

across multiple claim lines.46

Finally, the process for developing NCCI edits is adequately documented, 

consistent with our control activities standard that calls for agencies to 

develop written policies and procedures for their activities. CMS has 

The NCCI contractor recognized this 

weakness in the MUEs and recently recommended to CMS that MUEs be 

restructured so that they are applied against all claims reported for a 

single date of service rather than against each line of a claim.

 

44CMS also publishes on its website the codes with service limits used for most of the 

edits, although some MUE thresholds are confidential. The agency provides public 

information so that providers can bill properly.

45The specific weakness we found for MUEs does not apply to code-pair edits because

code-pair edits do not address quantity limits. 

46In addition, we found about $400,000 in payments where the published MUE limits were 

exceeded on a single claim line.
 

Page 25 GAO-13-102 Medicare Prepayment Edits

documented its processes for NCCI edits in a policy manual that explains 

the rationale for these edits and how edit decisions are made. The 

document is updated annually and is available to the public on the CMS 

website.

CMS’s Vulnerability Tracking Corrective Action Process (Vulnerability 

Tracking) began in November 2008 and is still evolving, according to 

agency officials. It was originally developed to track vulnerabilities 

identified by the RACs and corrective actions taken, but it has expanded 

to include vulnerabilities identified through other means. CMS can decide 

to address these vulnerabilities with prepayment edits or with other types 

of corrective actions.

To identify risks associated with vulnerabilities to improper payments, 

CMS has designed a process that calls for analyzing several sources of 

information, an approach consistent with our risk assessment standard 

that calls for comprehensively identifying risks. CMS staff analyze 

available data—such as CERT data and data on improper payments 

identified by RACs and other CMS contractors—in order to identify 

potential vulnerabilities and determine whether they are actual 

vulnerabilities. CMS staff then assess the risks posed by these 

vulnerabilities and prioritize them for corrective action based on five 

criteria: (1) the associated CERT error rate; (2) whether the vulnerability 

has been identified by RACs as a “major finding,” meaning a vulnerability 

for which more than $500,000 was identified for recoupment; (3) overall 

financial effect; (4) geographic effect and scope; and (5) political and 

media sensitivity.47

Although the application of criteria to prioritize vulnerabilities is a strength 

of CMS’s process, we found a weakness in how CMS analyzes RAC data 

to identify vulnerabilities to prioritize for correction through edits or other 

actions. When setting the threshold to determine whether a RACidentified vulnerability should be considered a major finding, CMS 

considers only the amount identified by each RAC and does not 

aggregate the amounts across all RACs that have identified similar 

vulnerabilities and may not consider thoroughly the potential national 

 

47CMS officials told us that they prioritize vulnerabilities in order to reduce to a 

manageable number the vulnerabilities to be addressed.

CMS’s Vulnerability 

Tracking Process Lacks 

Time Frames for, and 

Assessment of, Corrective 

Actions 
 

Page 26 GAO-13-102 Medicare Prepayment Edits

scope of vulnerabilities that one or two RACs are pursuing. CMS officials 

told us they do not routinely review information on RAC-identified 

vulnerabilities under the $500,000 threshold. As a result, CMS can leave 

vulnerabilities unaddressed, some of which could be addressed with 

prepayment edits. For example, as of December 2011, the four RACs had 

identified a total of about $503,000 in improper payments for claims for 

the services of clinical social workers provided during inpatient stays. 

Because this amount was not identified by a single RAC, this would not 

meet the definition of a major finding. CMS also does not take into 

account the period over which the RACs identified the improper 

payments.

CMS has designed procedures for determining what actions will be taken 

to address vulnerabilities, including prepayment edits, which is consistent 

with our risk assessment standard that calls for deciding on appropriate 

corrective actions to address risks. The agency has assembled a 

Corrective Action Development Team, which meets weekly to review 

analyses on prioritized vulnerabilities and to propose corrective actions to 

leadership in the CMS Provider Compliance Group, which is responsible 

for vulnerability tracking. The Provider Compliance Group can develop 

edits or take other corrective actions such as publishing provider 

education articles, referring vulnerabilities to other CMS components, or 

referring vulnerabilities to the MACs to be addressed at the local level.48

CMS has not specified time frames for implementing all corrective 

actions, contrary to our monitoring standard that calls for taking corrective 

action within established time frames. CMS officials explained that they 

have not done so because the time involved can vary from a few days to 

several months, depending on the work involved in determining and 

implementing the appropriate action. For example, CMS officials told us 

that staff may conduct research to determine whether local and national 

edits have already been implemented to address the vulnerability in 

question. But CMS has not established planned time frames for 

CMS officials in the Provider Compliance Group told us they had 

developed at least three edits as part of the Vulnerability Tracking 

process to address identified vulnerabilities, and were in the process of 

developing edits to address at least 10 other vulnerabilities identified by 

the RACs.

 

48CMS officials told us that MACs can develop and input local edits more quickly than 

CMS can national edits, so they sometimes prefer to have MACs input edits.
 

Page 27 GAO-13-102 Medicare Prepayment Edits

addressing each vulnerability once the agency has determined the type of 

corrective action needed.49 Also, as recently reported by the HHS Office 

of Inspector General (OIG), the Provider Compliance Group has not 

established procedures or time frames for following up with other CMS 

components to which it has referred vulnerabilities, to ensure that 

vulnerabilities have been resolved.50

CMS has not obtained information to assess whether all of its edits and 

other corrective actions taken through its Vulnerability Tracking Process 

are functioning properly, contrary to our monitoring standard. However, 

CMS does test edits before implementation and has assessed the effects 

of some edits and other corrective actions. According to CMS officials, all 

edits CMS develops centrally are implemented through the change 

management process, which includes testing prior to implementation to 

ensure they are working as intended. With respect to other types of 

corrective actions, CMS officials told us they gathered and analyzed data 

to assess two corrective actions to see if the actions were having the 

intended effects and have plans to conduct similar data analyses to 

assess others 18 to 24 months after implementation, when their effects 

will be more evident. However, CMS officials said they do not have the 

resources to monitor the results of all edits or other corrective actions 

themselves and that, depending on the risk to the program, the agency 

may rely on information from other entities, such as reports from RACs, 

the CERT contractor, or the HHS OIG. While information from these 

entities can be useful, our standard on monitoring calls for routine 

monitoring that assesses the effectiveness of control activities, which 

CMS managers told us they are not doing. CMS officials indicated that 

better data on the effects of edits will be available when the agency 

replaces its PIMR database.

 

49The agency has established time frames for some phases in the implementation of 

corrective actions. For example, once CMS decides that a national edit is the appropriate 

corrective action, it develops a change request, which establishes a timeline for its 

contractors to implement the edit and identifies the entities responsible for key tasks. CMS 

officials told us that developing and implementing an edit through change requests can 

take at least 9 months.

50In its comments on the OIG report, CMS stated that the agency can establish time 

frames for resolution on a case-by-case basis, but that establishing standard time frames 

is difficult. In response, the OIG indicated that the agency could establish standard 

intervals for follow-up with other components. See HHS, Office of Inspector General, 

Addressing Vulnerabilities Reported by Medicare Benefit Integrity Contractors, 

OEI-03-10-00500 (Washington, D.C.: 2011).
 

Page 28 GAO-13-102 Medicare Prepayment Edits

CMS has developed preliminary documentation of the Vulnerability 

Tracking Process, but the documentation is incomplete and therefore 

inconsistent with our control activities standard with respect to 

documentation, which calls for agencies to develop written policies and 

procedures for their activities. CMS’s documentation specifies roles and 

responsibilities for CMS teams, identifies sources of information about 

potential vulnerabilities, specifies criteria for prioritizing vulnerabilities for 

corrective action,51 and lists possible corrective actions. The document 

also lists monitoring of corrective action plans as a responsibility of CMS 

staff and mentions assessing billing and payment trends as a monitoring 

strategy. However, this documentation does not establish time frames for 

monitoring corrective actions, as the HHS OIG also reported. In addition, 

it does not outline required steps to take if the corrective action is not 

working as intended.

According to CMS officials, there are procedures in place for agency staff 

to decide whether to implement an edit based on an NCD. As described 

by CMS officials, this process for determining whether to implement an 

edit based on an NCD is consistent with our risk assessment standard 

that calls for deciding on appropriate corrective actions. CMS develops 

NCDs to describe the circumstances under which Medicare covers 

certain services. CMS officials told us that, when feasible, CMS develops 

and implements edits to enforce the policy behind the NCD to ensure that 

claims that do not follow the policy are not paid. According to CMS 

officials, when the agency develops an NCD, staff in the CMS component 

responsible for policy development consult with staff in the component 

responsible for provider billing to determine whether an automated edit 

can be developed. However, CMS officials could not confirm that such 

consideration was consistently given in the past. Although agency officials 

told us they had separate documentation on each of the edits 

implemented based on an NCD, the agency has not assembled that 

information. Therefore, CMS could not readily provide information about 

all of its edits based on NCDs, or all of the NCDs for which there are 

associated edits. If CMS determines that an automated edit based on the 

NCD is not possible—for example, because certain aspects of the NCD 

are not specific or because the necessary procedure and diagnosis codes 

 

51Two of the criteria have specific dollar amounts to determine whether a vulnerability 

should be categorized as high, medium, or low risk.

CMS’s Process for 

Implementing Edits Based 

on NCDs May Have Led to 

the Inconsistent 

Application of National 

Policies and Lacks 

Assessment and 

Documentation 
 

Page 29 GAO-13-102 Medicare Prepayment Edits

do not exit52—CMS assigns MACs the responsibility of ensuring that they 

process claims in conformance with the policy.53

Some aspects of the agency’s approach to implementing edits based on 

NCDs are consistent with our standard that calls for taking action within 

established time frames, but other aspects have weaknesses. If CMS 

determines that an automated edit based on the NCD is possible, the edit 

is generally implemented through a change request, which calls for 

central implementation and follows documented procedures and specific 

time frames. However, for some edits, CMS has assigned responsibility to 

MACs to independently program and integrate the edits into the shared 

systems. CMS officials told us that they have sometimes assigned 

responsibility to MACs because there is a queue for implementing system 

changes at the national level, and in some cases MACs can implement 

edits more quickly. CMS officials acknowledged that having multiple 

MACs program some edits based on NCDs may have led to inconsistent 

implementation of national coverage policy. CMS officials also noted that 

this approach creates more work than necessary for MACs, particularly 

because each MAC must update the edits regularly to reflect coding 

changes, which can lead to additional inconsistencies. Our claims 

analysis found instances where inconsistent implementation of NCDs 

may have led to improper payments. As we reported earlier, we found 

about $6.1 million in payments in fiscal year 2010 that appeared to be 

inconsistent with three NCDs we selected for analysis.

CMS officials told us that the agency is considering steps to address 

inconsistent implementation of NCD-based edits by assessing whether 

the agency can implement centrally all automated prepayment edits 

based on NCDs. CMS is working with a contractor to update coding for 

NCDs as part of the transition to the International Classification of 

 

52For example, one CMS official told us that CMS had developed an NCD for a certain 

drug but could not develop an edit because the specific diagnosis codes needed to 

describe some of the conditions that the drug was designed to treat did not exist.

53If CMS cannot develop an automated edit, MACs have the authority to ensure 

compliance by manually reviewing selected claims. In other instances, MACs may build on 

the NCD with a more specific LCD on which an automated edit can be based.
 

Page 30 GAO-13-102 Medicare Prepayment Edits

Diseases 10th Edition (ICD-10).54

CMS tests edits based on NCDs before implementation to ensure they 

are working as intended, but the agency does not assess the effects of 

these edits thereafter, contrary to our monitoring standard that calls for 

agencies to assess whether internal controls are functioning properly. 

CMS officials told us the shared systems maintainers test edits prior to 

implementation, and the MACs subsequently test the edits as well. 

However, according to CMS officials in both components responsible for 

NCD-based edits, neither component monitors the effects of these edits 

nor tracks savings information.

As part of this transition, the contractor 

has begun to inventory the edits based on NCDs. The contractor will also 

consider whether automated prepayment edits could be developed and 

implemented centrally for NCDs that do not currently have them. CMS 

officials also told us that centrally coding edits based on NCDs will help 

ease MAC workloads.

CMS officials did not provide any written guidance outlining the decisionmaking process they described to us, contrary to our control activities 

standard that calls for agencies to develop written policies and 

procedures for their activities. They also did not provide documentation 

that the process has been followed for each NCD developed recently.

 

54ICD-10 is a set of codes used for reporting diagnoses in treatment settings and 

procedures in inpatient hospital settings. HHS originally intended to implement ICD-10 

codes in October 2013 to replace ICD-9, which is the current edition. However, the agency 

recently announced it would delay implementation until October 2014 to respond to 

provider concerns about the administrative burden related to the change. According to 

CMS, ICD-10 codes will allow for greater clinical detail and specificity in describing 

diagnoses and procedures. 
 

Page 31 GAO-13-102 Medicare Prepayment Edits

CMS informs MACs about program vulnerabilities that could be 

addressed through local prepayment edits and about the varying 

coverage policies MACs have implemented in their jurisdictions, but the 

agency does not systematically compile and disseminate information 

about effective local edits. To oversee MACs’ efforts to address 

vulnerabilities, which include implementation of edits, CMS requires 

MACs to report on plans to address specific vulnerabilities and examines 

some of these reports as part of performance reviews. In fiscal year 2011, 

CMS increased the funding allocated to MACs for medical review 

activities by 12 percent.55 However, the agency provided relatively small 

financial incentives in the form of award fees to motivate MACs to make 

more effective use of prepayment edits.

CMS provides information to MACs about some program vulnerabilities 

that could be addressed through prepayment edits. The agency also 

provides some information about local coverage policies, but little about 

effective prepayment edits and the policies on which they are based.

Vulnerabilities. CMS disseminates information to MACs about program 

vulnerabilities through several channels. One key channel is the agency’s 

regular reports identifying vulnerabilities. For example, CMS publishes 

midyear and annual reports on improper payments identified by CERT 

and also makes CERT data available to MACs to conduct their own 

analyses. Other data CMS makes available include the Part B National 

Summary Data file, which MACs can use to compare the utilization rates 

of providers in their jurisdiction to national rates, to detect potentially 

aberrant billing patterns. In addition, CMS facilitates regular conference 

calls and meetings with MACs at which vulnerabilities are discussed. For 

example, CMS leads three conference calls per month, each focusing on 

a different type of claim, in which MACs can obtain information from 

RACs about vulnerabilities these other contractors have identified in their 

analyses of paid claims. CMS also sponsors two annual meetings for A/B 

MAC staff—one for medical directors and another for medical review 

managers—and similar meetings for DME MAC staff, at which 

vulnerabilities may be discussed.

 

55The funding increase was for fiscal intermediaries and carriers as well as MACs. As 

noted earlier, we use the term MAC to refer to all claims administration contractors, except 

where specifically noted.

CMS Informs MACs 

about Some 

Vulnerabilities That 

Could Be Addressed 

through Local Edits 

but Provides 

Relatively Small 

Financial Incentives 

to Promote Their Use

CMS Provides Information 

about Some Vulnerabilities 

but Does Not 

Systematically 

Disseminate Information 

about Effective Local Edits
 

Page 32 GAO-13-102 Medicare Prepayment Edits

Local coverage policies. CMS facilitates information sharing about local 

coverage policies through regular conference calls and national meetings 

two to three times per year. CMS also maintains a public web-based 

Medicare Coverage Database that contains detailed information about 

both NCDs and LCDs. MACs considering changes to local coverage 

policy can search the database for information about related NCDs or 

LCDs. Some of the LCD descriptions contain enough information, 

including diagnosis and procedure codes, to give an idea of the edits that 

may have been implemented to enforce them. However, the LCD 

descriptions do not indicate whether those edits have actually been 

implemented or provide any measure of the effectiveness of those that 

have.

Prepayment edits. Although CMS facilitates limited and generally 

informal information sharing among MACs about their prepayment edits, 

the agency does not systematically compile and disseminate information 

about effective edits. Such information would include information about 

the national or local coverage policies on which the edits are based and 

the savings they have generated. CMS requires MACs to analyze the 

effectiveness of each of their edits—quarterly for manual edits and 

annually for automated edits—but does not require MACs to report this 

information to the agency.56

CMS lacks a complete and centralized source of information on the most 

effective local edits that could facilitate information sharing. The PIMR 

database was established by CMS specifically to compile information 

about the edits implemented by claims administration contractors and to 

Although CMS may examine MACs’ 

documentation of these analyses as part of broader reviews, it does not

compile or analyze the data across MACs. Representatives of one of the 

MACs we contacted said that if a vulnerability were widespread, CMS 

might ask a MAC that had successfully addressed it to present 

information about its edit and associated savings to other MACs during a 

regularly scheduled conference call or national meeting. However, 

representatives of another MAC noted that sharing of information about 

edits typically occurred in informal exchanges among MACs at national 

meetings and did not include information about savings.

 

56Depending on the type of edit, CMS instructs MACs to evaluate the effectiveness of their 

edits based on such factors as denial rates; time and staff needed for review, including 

appeals reviews; changes in provider behavior; and the presence of potentially more 

costly vulnerabilities than those addressed by the edit.
 

Page 33 GAO-13-102 Medicare Prepayment Edits

collect savings and cost data to assess the edits’ effectiveness. However, 

CMS officials reported that the database has not served that purpose 

since MACs began processing claims, in part because MACs’ cost data 

are collected in a system that does not link to PIMR. In addition, PIMR 

lacks descriptions of many edits, which MACs must enter manually, and, 

according to CMS officials, it has other flaws that significantly limit its 

usefulness as a tool for identifying effective edits.57 CMS contracted with 

a consultant to evaluate the system and make recommendations for an 

upgrade or replacement. CMS received these recommendations in 

January 2012, but agency officials we interviewed could not say if or 

when HHS would approve the funding for a new system. CMS officials 

said the agency will stop using the PIMR database in July 2012. Until a 

new database is in place, the agency will continue using a manual data 

collection process initiated in September 2011, in which staff compile in a 

spreadsheet information from MACs about the number of claims denied 

and dollars saved each month by different types of edits, including 

automated and manual prepayment edits.

CMS provides oversight of MACs’ use of prepayment edits primarily 

through its review of certain MAC reports, through annual QASP reviews, 

and, most recently, through directives requiring the MACs to explain 

whether and how they have addressed certain vulnerabilities specified by 

CMS.

CMS review of MAC reports. CMS requires MACs to submit several 

types of reports that include partial information about their use of 

prepayment edits. These reports include annual medical review strategies 

and monthly status reports:58

• Medical review strategies

 

57CMS officials reported that some data were duplicated and that codes distinguishing the 

different types of edits and their status, as active or inactive, were unreliable. 

. As directed by CMS, the central element of 

each MAC’s annual medical review strategy is a prioritized list of the 

specific vulnerabilities the MAC has deemed most critical to address 

58MACs are also required to submit midyear updates to their medical review strategies 

describing progress made and any changes in strategy. In addition, MACs are required to 

submit error rate reduction plans and midyear updates, discussing the reasons for the 

errors identified in their jurisdictions in the most recent CERT report and identifying 

processes that could be improved to reduce these errors. 

CMS’s Oversight of Edit 

Use Relies Partly on MACs’ 

Reports on Their Efforts to 

Address Specific 

Vulnerabilities
 

Page 34 GAO-13-102 Medicare Prepayment Edits

and a description of plans to address them, which may include 

implementation of prepayments edits or other efforts, such as provider 

education. The strategy must also indicate the data analyses the MAC 

conducted, describe methods for assessing the effectiveness of 

planned interventions, and explain how the work will be managed, 

staffed, and budgeted. CMS assigns two staff members—one with 

expertise in medical review and another, generally from a CMS 

regional office, with broader responsibility for monitoring a MAC’s 

performance—to review each MAC’s medical review strategy.59 In 

addition, according to CMS officials, the CMS group responsible for 

medical review began in 2011 to conduct what they intend to be 

annual conference calls with each MAC to discuss its medical review 

strategy. Representatives of two MACs we contacted said that CMS 

has sometimes requested revisions to their medical review 

strategies—for example, to provide more detail about certain aspects 

of their plans.

• Monthly status reports. CMS requires MACs to submit monthly status 

reports to inform the agency of problems and risks encountered 

during the review period and actions taken to address them, which 

may include implementation of new local coverage policies or 

prepayment edits.60 These reports are reviewed by multiple CMS staff 

members with expertise in the different functional areas covered by 

the reports and discussed in monthly conference calls with each MAC.

These reports are designed to provide CMS with information about

prepayment edits MACs have implemented to address or explore specific 

vulnerabilities or potential vulnerabilities, but not to provide a 

comprehensive overview of MACs’ use of prepayment edits. For example, 

in their medical review strategies, MACs commonly described plans to 

conduct probe reviews—reviews of a representative sample of claims that 

have been flagged by manual edits—which are designed to determine the 

nature and extent of vulnerabilities in order to develop appropriate 

interventions. Although the protocols for some of these reports call for 

 

59These reviewers advise the CMS contracting officer as to any clarifications needed and 

ultimately whether to accept a report or request revisions. In general, according to CMS’s 

MAC Contract Administration Guide, a report is acceptable if it is submitted in the proper 

format and contains the required information as identified in the MAC statement of work 

and any relevant CMS policy documents.

60LCDs and medical review are 2 of the 14 functional areas that must be addressed in the 

A/B MACs’ monthly status reports and may be discussed in DME MACs’ reports. 
 

Page 35 GAO-13-102 Medicare Prepayment Edits

MACs to describe their active manual edits, they do not call for MACs to 

describe or document the effectiveness of all the edits they have 

implemented or to identify their most effective edits.

QASP reviews. CMS also oversees MACs’ use of prepayment edits 

through QASP reviews, but these reviews include a greater number of 

standards related to other aspects of MACs’ performance, such as 

financial management. CMS selects the standards to include in each 

MAC’s review based in part on areas of concern in each MAC’s 

performance. The number of QASP standards focused on a particular 

performance area is significant because MACs’ eligibility for award fees 

depends partly on the percentage of QASP metrics passed. Specifically, 

for a MAC to be eligible for award fees, it must have a rating of 

satisfactory or better in all categories in which it was rated that year in the 

Contractor Performance Assessment Reporting System.61 Recent QASP 

reviews have included relatively few performance standards related to 

medical review—the one performance area that focuses on prepayment 

edits and associated review of claims—compared with the number related 

to other aspects of MACs’ performance. (See fig. 1.) QASP reviews of 

A/B MACs typically included two standards related to medical review—

one focused on MACs’ strategies for this review and the other on their 

handling of skilled nursing facility demand bills.62

 

61This system is designed to collect information about contractors’ past performance.

CMS assesses a MAC’s performance in the Quality of Product or Service category based 

in part on the percentage of QASP standards passed. 

QASP reviews of DME 

MACs typically included only one standard focused on medical review 

strategies. Although the agency developed a third medical review QASP 

standard, focused on CERT rates, CMS officials told us the agency has 

rarely used it because of recent revisions to the CERT methodology.

62Skilled nursing facility demand bills are bills submitted by a skilled nursing facility at a 

beneficiary’s request because the beneficiary disputes the provider’s opinion that the bill 

will not be paid by Medicare and requests that the bill be submitted for a payment 

determination. MACs are required to review all skilled nursing facility demand bills from 

beneficiaries eligible for these services.
 

Page 36 GAO-13-102 Medicare Prepayment Edits

Figure 1: Average Number of Quality Assurance Surveillance Plan (QASP) 

Standards Used by CMS to Evaluate A/B and DME Medicare Administrative 

Contractors’ (MAC) Performance in Most Recent Reviews

Notes: We defined the fiscal year of the QASP reviews based on the end date of the period under 

review. Depending on the MAC, the most recent review conducted at the time we obtained data from 

CMS was in fiscal year 2010 or 2011.

a

The DME MACs do not conduct activities in this performance area.

The QASP review of MACs’ medical review strategy is extensive, but is 

not designed to evaluate the extent to which MACs are employing 

effective edits. The protocol for this standard calls for reviewers to 

evaluate the medical review strategy and related documentation, 

including sample manual reviews, on more than a dozen dimensions, 

including whether the MAC used the corrective action process specified 

by CMS. However, because the medical review strategy is not intended to 
 

Page 37 GAO-13-102 Medicare Prepayment Edits

provide a comprehensive overview of a MAC’s use of prepayment edits, 

this standard cannot be used to evaluate the extent to which a MAC has 

implemented effective prepayment edits. In addition, while reviewers are 

expected to assess whether the MAC used a variety of data sources, 

including CERT, to support its medical review activities, they are not 

expected to assess whether the MAC’s data analyses were adequate to 

identify the greatest program vulnerabilities.

Review of MACs’ responses to CMS directives regarding specific 

vulnerabilities. In January 2011, CMS began requiring MACs to report 

quarterly on how they had addressed or planned to address certain 

vulnerabilities identified by the agency based on information from RACs, 

CERT, audits by the HHS OIG, and other sources. For at least one

vulnerability, CMS directed MACs to consider implementing an edit, such 

as an edit to address high rates of outpatient therapy services, but did not 

require them to do so. In other cases, MACs reported that they had 

implemented an edit based on the analysis they had conducted at CMS’s 

direction.63 This new oversight represents a positive effort by CMS to 

direct MACs’ attention to vulnerabilities identified as high priority by the 

agency through its synthesis of information from multiple data sources, 

and to gather information from MACs both about the extent of each 

vulnerability in their jurisdictions and about the corrective actions they 

have taken. As of December 2011, CMS had issued four quarterly 

directives, each of which listed one to nine vulnerabilities. The agency 

had not yet established a process to analyze MACs’ responses or to 

disseminate information about corrective actions that appear promising, 

but agency officials indicated that they intend to track MACs’ responses. 

MAC representatives we interviewed in September 2011 said they had 

not yet received any feedback from CMS about the quarterly reports they 

submitted in April and June.

 

63In some cases, MACs reported that they already had a prepayment edit in place to 

address a vulnerability.
 

Page 38 GAO-13-102 Medicare Prepayment Edits

In fiscal year 2011, CMS increased the funding allocated to MACs for 

medical review activities by 12 percent, to $147 million.64

However, CMS provided relatively small financial incentives for MACs to 

exceed contract requirements related to medical review activities, 

including prepayment edits. In the most recent contract periods for which 

we had data, award fees represented 1 to 5 percent of the total value of 

MACs’ contracts.

Overall funding 

for the Medicare Integrity Program (MIP), which supports these activities, 

increased by less (9.3 percent) over this period. CMS officials stated that 

the agency had made a concerted effort to target some of the additional 

MIP funding to contractors’ medical review activities.

65 In fiscal year 2011, award fees allocated to the one 

performance area most directly related to MACs’ use of prepayment edits 

and medical review—the CERT area, which included one performance 

metric focused on payment error rates—accounted for 3 percent or less 

of the award fee pool for any MAC.66 (See table 5.) The CERT metric is 

designed to motivate MACs to meet CMS’s national error rate goal and to 

reduce their error rate from the prior year. One way that MACs can make 

progress toward these goals is through use of effective prepayment edits 

and medical review, although the error rate is also influenced by other 

factors.67

 

64For fiscal years 2008 through 2010, the funding provided by CMS to support medical 

review activities by MACs and other claims administration contractors was fairly flat, at 

about $132 million per year. All funding amounts are in inflation-adjusted 2012 dollars.

65These contract periods, which were almost always 1 year, ranged from a period ending 

July 30, 2010, to one ending March 31, 2011, depending on the time frame for each 

contract. The award fee percentage varied in part because the MAC contracts included 

different allocations between award fees and base fees as a result of contract negotiations 

with different MACs. For the same contract years, tasks directly related to prepayment 

edits and medical review, including development of LCDs, accounted for about 10 percent 

of MACs’ costs.

66Award fee dollars allocated to the CERT metric ranged from about $20,000 to about 

$82,000—out of total award fees ranging from $1 million to $3.2 million—for those MACs 

whose award fee plans included the metric in fiscal year 2011. 

67Among these other factors are how responsive providers are to the CERT contractor’s 

request for medical records supporting the claims selected for review. When medical 

records are not submitted by the provider, the CERT contractor classifies the selected 

claim as a “no documentation claim” and counts it as an error.

CMS Provides Relatively 

Small Financial Incentives 

to Promote Use of 

Effective Prepayment 

Edits 
 

Page 39 GAO-13-102 Medicare Prepayment Edits

Table 5: Percentage of A/B Medicare Administrative Contractor (MAC) Award Fees 

Allocated to Specified Performance Areas, Fiscal Year 2011 

Percentage

Performance area Minimum Maximum

Contract administration 30 41

Appeals 14 18

Provider customer service 14 18

Program integrity support 3 17

Systems security 4 12

Workload processing 0 8 

Beneficiary inquiries 4 5 

Comprehensive Error Rate Testing (CERT) 0 3 

Audit quality 0 1 

Source: GAO analysis of CMS data.

Notes: We defined the fiscal year of the award fee plans based on the end date of the contract year 

under review.

The A/B MAC award fee plans for this year included no more than one metric in some performance 

areas—contract administration, systems security, CERT, and audit quality—but multiple metrics in 

other areas, in some cases because there were separate metrics for Medicare Part A and Part B. 

Specifically, the appeals area included up to five metrics, program integrity support included up to 

three, and provider customer service, workload processing, and beneficiary inquiries each included 

up to two.

None of the DME MAC award fee plans included metrics for audit quality, CERT, or workload 

processing, so the minimum and maximum percentages allocated to the other performance areas 

were generally higher than those for A/B MACs.

CMS officials said that the agency chooses the metrics to include in an 

award fee plan and the amount to allocate to each metric based in part on 

the areas in which the agency particularly wants to see improvement in a 

MAC’s performance. Metrics are removed or made more difficult in 

subsequent years once met. CMS included the CERT metric in award fee 

plans for six of the nine A/B MACs but none of the DME MACs in fiscal 

year 2011, even though the error rate for DME claims has been much 

higher than for other claims.68

 

68Of the three A/B MACs whose award fee plans did not include the CERT metric in fiscal 

year 2011, two were contracted by CMS as MACs only 2 years earlier and evaluated for 

award fees for the first time in fiscal year 2010. Prior to fiscal year 2011, CMS included the 

CERT metric in just one award fee plan, as a pilot in fiscal year 2008.

CMS officials said the agency had intended 

to include this metric in award fee plans earlier, but the agency had 

revised the CERT methodology for measuring payment errors in 2009. As 
 

Page 40 GAO-13-102 Medicare Prepayment Edits

a result, the agency needed to establish a new baseline for each MAC’s 

payment error rate using the new methodology before measuring MAC 

performance with this metric.

CMS intends to provide different financial incentives to RACs to conduct 

prepayment reviews in a 3-year demonstration that is scheduled to begin 

in summer 2012. In the demonstration, RACs, which previously 

conducted only postpayment review of claims, will begin to conduct 

prepayment reviews of certain types of claims that historically have 

resulted in high rates of improper payments.69 Unlike the MACs, RACs 

have been compensated by contingency fees for overpayments collected 

and underpayments refunded and will also be compensated on a 

contingency basis for improper payments prevented through prepayment 

reviews. CMS officials told us that based on the results of that 

demonstration they may adjust which contractors conduct prepayment 

work and the incentives provided to do so.

The application of prepayment edits is an important strategy to help 

ensure that Medicare claims are paid properly the first time. As CMS data 

show, this strategy prevented at least $1.76 billion in improper payments 

in fiscal year 2010 alone. But CMS has opportunities to further reduce 

improper payments by promoting more widespread use of effective 

prepayment edits.

CMS has processes in place to identify the need for and to develop edits 

based on national policies—such as NCDs and MUEs—but these 

processes could be improved. CMS could do more to ensure that edits 

based on NCDs are implemented consistently, such as centralizing the 

process within the agency rather than leaving it up to MACs. Greater 

attention to developing centralized NCD edits whenever possible could 

reduce improper payments. CMS could also do more to ensure that its 

edits are structured to enforce the national policies on which they are 

based. Our findings show that CMS has paid for quantities of service in 

excess of its policies for what would ordinarily be provided to a 

 

69These reviews will focus on 7 states with high populations of fraud- and error-prone 

providers (California, Florida, Illinois, Louisiana, Michigan, New York, and Texas) and 4 

states with high claims volumes of short inpatient hospital stays (Missouri, North Carolina, 

Ohio, and Pennsylvania), for a total of 11 states. Short inpatient stays that should have 

been billed as outpatient services have been a vulnerability leading to improper payments.

Conclusions 
 

Page 41 GAO-13-102 Medicare Prepayment Edits

beneficiary on a single day, because MUEs allow payment for excessive 

quantities of services if those quantities are spread over multiple claim 

lines or multiple claims, even if explanatory modifiers are not included. 

Although CMS has made progress in cataloging and assessing 

vulnerabilities in a structured way, it could do more to improve some of its 

analysis and documentation. Specifically, the agency could improve how 

it prioritizes vulnerabilities identified by RACs in their postpayment 

reviews by compiling the information on these vulnerabilities differently—

for example, by aggregating the overpayments identified by all the RACs 

for a given vulnerability, rather than considering each RAC’s findings in 

isolation. CMS could further strengthen its Vulnerability Tracking process 

and edits based on NCDs by developing written procedures for steps 

where such documentation is currently lacking. This would include 

specifying time frames for taking corrective actions, methods for 

assessing the effects of corrective actions, and procedures to ensure that 

CMS considers and ultimately implements edits for all applicable NCDs, 

including older NCDs that were not previously considered for automated 

edits.

CMS could take several actions to encourage MACs to implement 

effective prepayment edits at the local level by collecting and providing 

information about the underlying coverage policies and savings 

associated with edits that have proved particularly effective in some 

jurisdictions, and, if feasible, by increasing the incentives for edit 

implementation. Currently, CMS lacks the information needed to assess 

how effectively MACs are employing prepayment edits, even in 

comparison with other MACs. The agency has taken steps to improve the 

information it collects about edits by setting new reporting standards and 

pursuing a possible replacement for the PIMR database. Until a new 

database is in place, CMS could facilitate an information exchange about 

edits among MACs through some of its usual channels. Each MAC would 

need to consider local circumstances in deciding whether to implement 

LCDs and related edits similar to those used by another MAC. 

Nevertheless, systematic exchanges of information about policies and 

edits that have proved particularly effective in some jurisdictions would 

highlight for MACs additional ways to help ensure that Medicare pays 

only for reasonable and necessary services. CMS has recently begun 

encouraging MACs to address certain vulnerabilities by requiring them to 

report on what actions, if any, they have taken. This has led to MACs 

reporting on or implementing edits. CMS could also consider encouraging 

MACs to implement prepayment edits by increasing the financial 

incentives for them to do so. Award fees offer a mechanism to provide 

such an incentive, but the share of award fees CMS allocated to the one 
 

Page 42 GAO-13-102 Medicare Prepayment Edits

metric most directly related to prepayment edits and medical review in 

2011 was relatively small.

In order to promote greater use of effective prepayment edits and better 

ensure proper payment, we recommend that the CMS Administrator take 

the following seven actions.

To promote implementation of effective edits based on national policies, 

we recommend that the CMS Administrator:

• centralize within CMS the development and implementation of 

automated edits based on NCDs to ensure greater consistency;

• implement MUEs that assess all quantities provided to the same 

beneficiary by the same provider on the same day, so providers 

cannot avoid claim denials by billing for services on multiple claim 

lines or multiple claims without including modifiers that reflect a 

declaration that quantities above the normal limit are reasonable and 

necessary;

• revise the method for compiling information about RAC-identified 

vulnerabilities to identify their full extent and prioritize them 

accordingly; and

• develop written procedures to provide guidance to agency staff on all 

steps in the processes for developing and implementing edits based 

on national policies, including (1) time frames for taking corrective 

actions, (2) methods for assessing the effects of corrective actions, 

and (3) procedures for ensuring consideration of automated edits 

whenever possible, including for all existing NCDs and other national 

policies. 

To encourage more widespread use of effective local edits by MACs, we 

recommend that the CMS Administrator:

• improve the data collected about local prepayment edits to enable 

CMS to identify the most effective edits and the local coverage 

policies on which they are based and disseminate this information to 

MACs for their consideration; 

Recommendations for 

Executive Action
 

Page 43 GAO-13-102 Medicare Prepayment Edits

• until CMS has a new database in place to collect information about 

edits, require MACs to share information about the underlying policies 

and savings related to their most effective edits; and

• assess the feasibility of providing increased incentives to MACs to 

implement effective prepayment edits.

We provided a draft of this report to HHS for comment and received 

written comments, which are reprinted in appendix III. In its written

comments, HHS generally concurred with our seven recommendations 

and cited actions that CMS plans to take to address them. In addition, we 

had obtained the views of third parties—CMS’s contractors—on specific 

sections of an earlier draft. Both HHS and the contractors provided 

technical comments, which we addressed as appropriate. 

HHS generally agreed with our four recommendations to promote 

implementation of effective edits based on national policies. HHS agreed 

with our recommendation to centralize the development and 

implementation of automated edits. In response to our recommendation 

to implement MUEs that assess all quantities provided to the same 

beneficiary by the same provider on the same date of service, HHS 

agreed to further investigate how to address this recommendation but 

noted that there are numerous clinical situations in which MUEs can 

reasonably be exceeded. The agency commented that our report did not 

identify which services would benefit from improved MUEs without 

causing unreasonable claim denials. However, we believe all claims 

payments we identified could reasonably have been denied because we 

identified only payments for claims without modifier codes, and—as HHS

noted in its comments—providers should include modifier codes when 

billing above the MUE limits. If CMS implemented MUEs as we 

recommended, it could continue to allow providers to use modifiers as 

indicators of medical necessity for exceeding the MUE limits. HHS also 

agreed with our recommendation to revise the method for compiling 

information about vulnerabilities identified by Recovery Audit Contractors. 

Finally, the agency agreed with our recommendation to create written 

procedures for developing and implementing edits based on national 

policies and said CMS would take steps to address this recommendation 

by December 31, 2012.

Agency Comments, 

Third-Party Views, 

and Our Evaluation
 

Page 44 GAO-13-102 Medicare Prepayment Edits

HHS also agreed with our three recommendations to encourage more 

widespread use of effective local edits by MACs. In response to our 

recommendation that CMS improve the data collected about local edits, 

the agency acknowledged that the data-collection process needed 

improvement and said that CMS would explore ways to collect data about 

local edits from MACs. In addition, to address our recommendation that 

CMS require MACs to share information about the local policies and 

savings related to their most effective local edits, the agency said CMS 

would issue a Technical Direction Letter to MACs about collaborating on 

the most effective edits. Finally, HHS agreed with our recommendation to 

assess the feasibility of providing increased incentives to MACs to 

implement effective prepayment edits and said the units within CMS that 

are responsible for overseeing MAC contracts—which CMS calls 

“business owners”—would assess the feasibility and benefits of 

increasing performance incentives. However, the agency noted that any 

changes to a MAC’s award fee plan proposed by CMS during an existing 

evaluation period would need to be agreed to by the MAC.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Health 

and Human Services, the Administrator of CMS, and other interested 

parties. In addition, the report will be available at no charge on the GAO 

website at http://www.gao.gov. 

If you or your staffs have any questions about this report, please contact 

me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff who made major contributions to this report are 

listed in appendix IV.

Kathleen M. King

Director, Health Care
Appendix I: Scope and Methodology

Page 45 GAO-13-102 Medicare Prepayment Edits

We used several methods to assess the extent to which (1) the Centers 

for Medicare & Medicaid Services (CMS) and its contractors employed 

prepayment edits, (2) CMS has designed adequate processes to 

determine the need for prepayment edits and to implement edits based 

on national policies, and (3) CMS provides information, oversight, and 

incentives to Medicare administrative contractors (MAC) to promote use 

of effective prepayment edits. To address these objectives, we reviewed 

data from CMS databases, interviewed CMS officials and MAC 

representatives, conducted an analysis of Medicare claims data, reviewed 

CMS documentation on processes to develop and implement edits to 

assess consistency with our internal control standards, and reviewed 

relevant CMS and MAC documents, such as those that described MAC’s 

medical review activities and CMS’s oversight of those activities.

To assess the extent to which CMS and its contractors employed 

prepayment edits, we reviewed data from two CMS data systems—the 

Program Integrity Management Reports (PIMR) system and the 

Automated Reporting and Tracking System (ARTS)—that contain 

information about the savings and costs associated with prepayment 

edits. We obtained PIMR data reports from CMS for fiscal year 2010 that 

contained information about the savings associated with prepayment 

edits for each claims administration contractor. We also obtained ARTS 

data reports from CMS showing MACs’ task budgets and costs. In the 

ARTS reports, we identified the specific tasks most closely associated 

with prepayment edits and related medical review, including the 

development of underlying local coverage determinations (LCD), and 

confirmed our identification of these tasks with CMS officials. We then 

calculated MACs’ prepayment-edit-related costs for the most recently 

completed contract period—in almost all cases, one year—as of 

August 4, 2011, the date on which CMS provided the data to us. 

Depending on the MAC, these data represented a contract period ending 

in fiscal year 2010 or fiscal year 2011.

To assess whether CMS and its contractors applied prepayment edits to 

the extent possible, we selected a sample of five national and three local 

policies that could be implemented using automated edits and analyzed 

paid Part B claims from fiscal year 2010 to identify payments that 

appeared to be inconsistent with those policies. We selected components 

of policies that could be implemented using automated edits because 

automated edits are less costly for MACs to use than manual edits. For 

national policies, we identified paid claims that appeared to be 

Appendix I: Scope and Methodology

Review of Data from CMS 

Databases

Analysis of Medicare 

Claims Data
Appendix I: Scope and Methodology

Page 46 GAO-13-102 Medicare Prepayment Edits

inconsistent with the policy in all MAC jurisdictions. For local policies, we 

identified paid claims that were inconsistent with the policy in all MAC 

jurisdictions except the jurisdiction that implemented the coverage policy 

and associated edit that we selected for analysis.

We selected national policies for which Recovery Audit Contractors 

(RAC) had identified improper payments in excess of $500,000 through 

fully automated postpayment reviews or national coverage determinations 

(NCD) for which CMS had not initiated a corrective action using a 

quarterly Technical Direction Letter to MACs at the time of our review.1

We also restricted our selection to those policies for which automated 

prepayment edits could be implemented and which could be analyzed 

using data elements in the Carrier Standard Analytic File (SAF), which 

contains claims data about noninstitutional providers of outpatient 

services such as physicians, and the Outpatient SAF, which contains 

claims data about services from institutional outpatient providers such as 

hospital outpatient departments and rural health clinics. (For some 

analyses, we used only the Carrier SAF because the edits on which those 

analyses were based applied only to claims that would appear in this file.) 

We selected LCDs from three MACs that process Part A and Part B 

claims2 whose contracts were in effect at the start of fiscal year 2010 and 

were not scheduled to be recompeted in 2011.3 We selected the three 

MACs to include some that served a high-fraud area, had a high medical 

review savings per beneficiary relative to other MACs, were identified by 

CMS as having an effective medical review strategy, and were 

geographically dispersed.4

 

1

Issues that are identified by any single RAC as having more than $500,000 in improper 

payments are considered “major findings” by CMS.

We asked these three MACs to identify the 

10 automated edits they had in place for Part B services in fiscal years 

2

MACs that process Part A and Part B claims are referred to as “A/B MACs.” CMS also 

contracts with MACs to process durable medical equipment claims.

3

We excluded MACs in jurisdictions where the contract was up for recompetition to avoid 

including in our sample MACs that might lose their contracts before we completed data 

collection. 

4

We identified high-fraud areas based on the location of the operations for the Medicare 

Fraud Strike Force—a joint effort of the U.S. Department of Health and Human Services 

and the U.S. Department of Justice—as of March 11, 2011. The operations were located 

in seven states: California (Los Angeles), Florida (South Florida and Tampa), Illinois 

(Chicago), Louisiana (Baton Rouge), Michigan (Detroit), New York (Brooklyn), and Texas 

(Dallas and Houston).

Selection of National and Local 

Policies on Which Our Analysis 

Was Based 
Appendix I: Scope and Methodology

Page 47 GAO-13-102 Medicare Prepayment Edits

2009 and 2010 that generated the most savings to the Medicare program, 

and to provide information about the savings generated by each of those 

edits and about the LCDs or other local policies on which these edits 

were based. We chose to analyze LCDs for monitored anesthesia care, 

parathormone, and noninvasive cerebrovascular studies because (1) they 

were feasible to analyze using data elements in the Carrier and 

Outpatient SAFs, (2) fewer than half of the other A/B MACs operating at 

the start of fiscal year 2010 had implemented a similar LCD,5

We took steps to confirm that we understood the policies and that our 

analytic approach was appropriate. To confirm our understanding of 

Medically Unlikely Edits (MUE), we discussed our analytic approach with 

the contractor that creates MUEs and reviewed CMS documentation 

about MUEs. To confirm our understanding of other national policies, we 

discussed them with CMS. We discussed the selected LCDs with the 

MACs that issued them to ensure that our interpretation of the LCDs was 

accurate. To further test the validity of our analyses based on LCDs, we 

compared the payments in the jurisdiction of the MAC that had 

implemented the LCD to payments in other MAC jurisdictions. For each of 

our analyses based on LCDs, we found the lowest amount of payments in 

the jurisdiction of the MAC whose LCD we used as the basis for analysis, 

which was consistent with our expectation.

and (3) the 

edits based on these LCDs had generated a relatively high amount of 

overall savings. Our analysis of this selected sample of policies and 

associated edits was intended to allow us to illustrate whether greater 

savings to the Medicare program could be achieved if effective 

prepayment edits—and, in some cases, the underlying LCDs—were 

implemented more widely. Our sample is not an exhaustive list of every 

policy that could be implemented more fully through additional edits.

6

We analyzed a representative 5 percent sample of Medicare claims from 

the Carrier SAF and Outpatient SAF for fiscal year 2010 to calculate 

payments for services that appeared to be inconsistent with the national 

policies and LCDs we selected. We aggregated these data by state, by 

 

5

To identify MACs with similar policies, we used CMS’s web-based Medicare Coverage 

Database. In addition to the MAC from which we obtained the policy, there were eight 

other MACs whose contracts had been implemented by the start of fiscal year 2010. 

Therefore, we selected policies for which four or fewer other MACs had similar policies.

6

Because providers may appeal claims denials based on an LCD, some payments 

inconsistent with the LCD could occur.

Analytic Approach 
Appendix I: Scope and Methodology

Page 48 GAO-13-102 Medicare Prepayment Edits

MAC jurisdiction, and at the national level. We extrapolated our results 

from the 5 percent sample of claims from the Carrier SAF and Outpatient 

SAF to estimate results for the entire fee-for-service Medicare population. 

For our analysis of MUEs, we excluded claims that contained modifiers, 

which are used by providers to indicate potentially legitimate reasons why 

certain procedures were performed. For the MUE analysis, we also 

excluded claims data that appeared multiple times in the SAF. We 

identified these multiple entries by identifying claim lines that matched on 

certain key variables—including the same beneficiary identification 

number, procedure, date of service, and provider. For each set of 

matching entries, we kept the claim line with the latest processing date 

and excluded all matching claim lines.

7

We reviewed several CMS documents that describe processes used to 

determine the need for prepayment edits and to implement edits based 

on national policies. We also interviewed CMS officials to obtain 

additional detail where needed about these processes. In some cases, 

the processes were not documented or not fully documented, and in 

those cases we relied on the officials’ oral descriptions of the processes. 

We compared these process descriptions to our internal control standards 

to assess whether CMS has designed adequate processes. We focused 

our assessment primarily on the design of these processes and did not 

attempt to fully assess whether the processes were operating as 

intended. We identified three internal control standards as relevant to our 

assessment of the design of CMS’s processes: (1) risk assessment, 

(2) monitoring, and (3) appropriate documentation of transactions and 

internal control. Table 6 describes the specific elements of these 

standards that were applicable to our assessment.

 

7

CMS and its contractors explained that data about some claims payments appeared 

multiple times in the SAF because of reprocessing needed to implement new payment 

rates mandated by the Affordable Care Act and for other reasons. Because our MUE 

analysis was designed to identify the quantity of services provided to the same beneficiary 

on the same day, it was necessary to exclude these multiple entries to avoid overstating 

payment for services that exceeded CMS’s quantity limits for certain services.

Assessment of Extent to 

Which CMS’s Edit 

Development Processes 

Comply with Internal 

Control Standards
Appendix I: Scope and Methodology

Page 49 GAO-13-102 Medicare Prepayment Edits

Table 6: Internal Control Standards or Activities That Apply to CMS’s Determination 

of the Need for, and Implementation of, Prepayment Edits Based on National 

Policies

Standard or activity Description of elements applicable to our assessment

Risk assessment Management comprehensively identifies risk using various 

methodologies as appropriate.

A determination is made on how best to manage or mitigate the 

risk and what specific actions should be taken.

Documentation Internal control and all transactions and other significant events 

are clearly documented, and the documentation is readily 

available for examination.

a

The documentation appears in management directives, 

administrative policies, or operating manuals, in either paper or 

electronic form.

All documentation and records are properly managed and 

maintained.

Monitoring Corrective action is taken or improvements made within 

established time frames to resolve the matters brought to 

management’s attention.

Agency personnel obtain information about whether their 

internal control is functioning properly.

Source: GAO.

Notes: Information is from GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999), and Internal Control Management and 

Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001).

a

Documentation is an activity under the standard called Control Activities.

To assess the information CMS provides to MACs to promote use of 

effective local prepayment edits, including information about program 

vulnerabilities and local coverage policies on which effective prepayment 

edits have been based, we examined the web-based Medicare Coverage 

Database and reviewed relevant documents, including documentation for 

the PIMR database. We also interviewed CMS officials and 

representatives of the MACs in our sample to understand how CMS 

facilitates information sharing.

To assess CMS’s oversight of MACs’ use of prepayment edits, we 

reviewed agency documents that specify relevant requirements for MACs, 

including the MAC statement of work, the Program Integrity Manual, the 

Quality Assurance Surveillance Program (QASP) review protocols, and 

the quarterly Technical Direction Letters that required MACs to report how 

they had addressed or planned to address certain vulnerabilities. We also 

examined samples of reports submitted by MACs, including medical 

review strategies and responses to the quarterly Technical Direction 

Information and Oversight 

Provided by CMS
Appendix I: Scope and Methodology

Page 50 GAO-13-102 Medicare Prepayment Edits

Letters. In addition, we analyzed data on the most recent QASP reviews 

conducted as of August 3, 2011, the date on which CMS provided the 

data to us. Depending on the MAC, these data represented a review 

period ending in fiscal year 2010 or fiscal year 2011. We also interviewed 

CMS officials and representatives of MACs in our sample about CMS’s 

oversight.

To assess the financial incentives CMS provides to MACs to promote use 

of effective local prepayment edits, we examined relevant documents, 

including descriptions of award fee metrics and review protocols. We also 

analyzed CMS data on the distribution of award fees for review periods 

ending in fiscal year 2011, as well as ARTS data on the award fees and 

base fees budgeted for MACs in the most recent contract year for which 

we had data—which, as noted above, was either fiscal year 2010 or fiscal 

year 2011, depending on the MAC. In addition, we examined data on 

Medicare Integrity Program funding from fiscal year 2008 through fiscal 

year 2011. We also interviewed CMS officials about how metrics are 

selected for inclusion in award fee plans, how MACs’ fees are divided 

between award fees and base fees, and the RAC prepayment review 

demonstration.

To ensure that the data from PIMR, ARTS, and the Medicare claims 

database used in this report were reliable enough for the purposes used, 

we performed appropriate electronic data checks, examined relevant 

documentation, and interviewed agency officials who were 

knowledgeable about the data. We found the data were sufficiently 

reliable for the purpose of our analyses.

We conducted this performance audit from July 2011 through November

2012 in accordance with generally accepted government auditing 

standards. Those standards require that we plan and perform the audit to 

obtain sufficient, appropriate evidence to provide a reasonable basis for 

our findings and conclusions based on our audit objectives. We believe 

that the evidence obtained provides a reasonable basis for our findings 

and conclusions based on our audit objectives.

MAC Contract Incentives

Data Reliability and Audit 

Standards 
Appendix II: Hypothetical Example of How 

Medicare Claims Can Avoid Triggering 

Medically Unlikely Edits (MUE)

Page 51 GAO-13-102 Medicare Prepayment Edits

Appendix II: Hypothetical Example of How 

Medicare Claims Can Avoid Triggering 

Medically Unlikely Edits (MUE)
Appendix III: Comments from the Department 

of Health and Human Services

Page 52 GAO-13-102 Medicare Prepayment Edits

Appendix III: Comments from the 

Department of Health and Human Services
Appendix III: Comments from the Department 

of Health and Human Services

Page 53 GAO-13-102 Medicare Prepayment Edits
Appendix III: Comments from the Department 

of Health and Human Services

Page 54 GAO-13-102 Medicare Prepayment Edits
Appendix III: Comments from the Department 

of Health and Human Services

Page 55 GAO-13-102 Medicare Prepayment Edits
Appendix III: Comments from the Department 

of Health and Human Services

Page 56 GAO-13-102 Medicare Prepayment Edits
Appendix IV: GAO Contact and Staff 

Acknowledgments

Page 57 GAO-13-102 Medicare Prepayment Edits

Kathleen M. King, (202) 512-7114 or kingk@gao.gov

In addition to the contact named above, Sheila K. Avruch, Assistant 

Director; Zhi Boon; Elizabeth Conklin; Nancy Fasciano; Matthew Gever; 

Richard Lipinski; Roseanne Price; and Steve Robblee made key 

contributions to this report.

Appendix IV: GAO Contact and Staff 

Acknowledgments 

GAO Contact

Staff

Acknowledgments 

(290923)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (www.gao.gov). Each weekday afternoon, 

GAO posts on its website newly released reports, testimony, and 

correspondence. To have GAO e-mail you a list of newly posted products, 

go to www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.