Depktment of Health and Human Services 

OFFICE OF 

INSPECTOR GENERAL 

CARRIER MAINTENANCE OF 

MEDICARE PROVIDER NUMBERS 

Richard P. Kusserow 

INSPECTOR GENERAL 

OEI-06-89-00870 
.. 

EXECUTIVE SUMMARY 

PURPOSE 

This report describesmaintenanceefforts by Medicare carriers to I) ensurethe accuracy of 

provider information and 2) identify and restrict payments to providers who have lost the legal 

authority to practice. 

BACKGROUND 

Medicare carriers assignprovider numhcrs to q&cd providers of Part B sewices who furnish 

servicesor supplies to Medicare beneficiaries. The numbers arc usedfor processing both 

assignedand nonassignedclaims. Additionally, the numbers are usedin establishing Medicare 

pricing and utikation profiles. If the provider of servicesdoes not have a provider number, 

payment may not bc madc.for services. To obtain a provider number from a caxzier,providers 

need to complete the carrier’s application form and met criteria specified by Medicare 

mgulations. 

METHODOLOGY 

This inspection consisted of three phasesin addition to a review of relevant Health Care 

Fiiancing Administration (HCFA) policies and Medicare laws and discussionswith HCFA staff. 

Fit, we contacted 38 car&s to discussmabtcnance issues. Carriers completed mailout 

questionnaires followed by telephone or onsitc interviews. Second,we mailed questionnairesto 

professional licensing authorities in each Statewhich am responsible for licensing physicians 

(121 respondents). Finally, we conducted computer matchesbetweencarriers and licensing 

authorities at four carriers to determine how well carriers deactivate numbers belonging to 

providers not legally authorized to pm&c. The selection of the four carriers for computer 

matching was purposive. We s~lcctcdfour carriers in Stateswith large physician populations 

and whose professional licensing authority for physicians agrcui to produce a computer file of 

providers who wcrc no longer legally authorized to practice their profession. 

FINDINGS 

HCFA's &&on to carriers is inadequate. 

> We bciicve inadequate direction by HCFA hasrtsuitcd in weaknessesin carrier controls to 

maintain the integrity of Medicam carrier provider numbers. We beiieve this constitutes a 

rnatmial internal control wcakncss within the meaning of the Federal Managers’ Fiiancial 

Integrity Act and should be reported to the Sccrntary along with plans for corrective action. 

i 
Weaknessesexist in canier contds to maintain Medkareprovider numbers. 

> Most cankrs‘donot systematically updateprovider Eles. 

> Communications benvetn carriers and professional licensing authorities are weak. 

l Many carriers do not haveadequatecontrols to identify and deactivate provider numbers 

belonging to providers who have lost the legal authority to practice. 

l Many providers who have lost the legal authority to practice still have active provider 

numbers which they may use and, in somecasts, are using to bill Medicare services. 

> Inaccurate or missing information in somecarrier ffies may hamper effective useof State 

Iicensing authority information. 

Improvemhs through various ruiminisbrrtivc actions orpmgrams are possible. 

> Carriers can reduce the number of active provider numbers,reduce Medicam’s 

vulnerability to abuse,and saveadnk&mdve costsby periodically deactivating provider 

numbers with no billing history. 

> Computer matching with licensing authorities could help many carriers identify providers 

not legally authorized to practice. 

Carrier efforts under HCFA’s physician identification and registration program (UPIN) 

have improved the accuracyof provider number records of physicians. 

RECOMMENDATIONS 

The HCFA should require carriers to: 

> update plwidcrrccoKls pcliodically. 

l deactivate aUprovider numberswithout current billing history. 

l estabiish adequatecontrols to ensureproviders not legaily authorized to practice are 

identified and their provider numbersdeactivated. As a part of thesecontrols, carriers 

should: 

negotiate with State licensing authorities to obtain license and registration 

information at a minimum cost to the Medicare program. 

ii 
assessthe feasibility of computer matcheswith Statelicensing authorities and 

perform suchmatchesroutinely, if practicaL 

maintain the license or certification number of providers in its provider file. 

develop computer data entry edits for license numbersto ensureuniformity and 

consistencywith the licensing authority’s method of recording license numbers. 

The HCFA should: 

> evaluatecarrier provider number controls establishedaboveasa part of its regular carrier 

Contractor PerformanceEvaluation Program 

negotiate with Statelicensing authorities, which carriers report to be uncooperative,to 

obtain license and registration information at a minimum cost to the Medicare program. 

HCF’A COMMENTS AND OIG RESPONSE 

The HCFA acknowledgesthe needto improve its instructions to Medicare carriers regarding the 

maintenanceof provider numbers. However, HCFA doesnot concur with all OIG 

recommendations. Additionally, HCFA doesnot believe our fmdings constitute a material 

internal control weakness. 

. 

The OIG continues to believe a material internal control weakxess exists and 

each recommendationshould be implemented. IdentQied weaknessesin carrier 

maintenance efforts and HCFA’s direction meet several of the criteria upon 

which a materiai weakness designation is determined. In accoraknce with the 

Fe&& Managers’ Financial Integrity Act, the HCFA should report this as a 

tnaterial internal con& weakness through the SecreraTyto the President 

and Congress. A detailed discussion of the material weakness riesignation can 

be found in Appendix B. (SeeAppendix B also for a more complete discussion 

of HCFA’s comments and the OIG’s response. Appendix C includes the@1 text 

of HCFA’s comments.) 

. . . ul 

l 
TABLE OF CONTENTS 

EXECUTIVESUMMARY 

INTRODUCTION .....................................................................................*................1 

Purpose ................................................................................................................ 1 

Background .........................................................................................................1 

Methodology ................................................................................................-......4 

FINDINGS .................................................................................................................. 8

HCFA’s direction to cad&s is inadequate ........................................................8 

Weaknessesexist in cakier contds to main&in 

Medicam pmvidkr numbers ................................................................................8 

Lack of f?le updating ................................................................................8 

Weak communication with State licensing authorities.............................9 

Inadequatecontrols to identify unautbrid providczs.........................12 

UnauthM providers with active numbers.........................................14 

In&curate or missing information in carrier records .....I......................15 

Improvements thmugh va&ws administrative actions 

orpmgmms m possible .................................................................................. 17 

Deactivating providers with no billing history .......................................17 

Computer matching with Statelicensing authoxities.............................. 18 

Carrier efforts and UPIN ........................................................................20 

RECOMMENDATIONS ......................................................................................... 22

ENDNOTES .................................................................................................-..-.....---.24 
-- 

APPENDIX A: Carrier Survey Respondents........................................................ A-l 

APPENDIX B: Summary of HCFA’s Commentsand OIG’s Response.................B-l 

APPENDIX C: HCFA Commentsto the Draft Report..........................................C-l 
INTRODUC’iION 

PURPOSE 

This report describesmaintenanceefforts by Medicare carriers to 1) ensurethe accuracyof 

provider information and 2) identify and restrict paymentsto providers who have lost the legal 

authority to practice. 

Specific objectives were to: 

1) describe how carriers maintain the accuracyof provider information, 

2) determine whether Part B providers who lose legal authority to practice are identified by 

carriers, and 

3) determine the feasibility of routine computer matchesbetweenState licensing authorities 

and carriers to identify providers having no legal author@ to practice. 

An upcoming report entitled “Carrier Assignment of Medicare Provider Numbers,” preparedin 

conjunction with this inspection, describesand assesseshow carriers assignprovider numbers. 

BACKGROUND 

Medicare is a Federal program authorized by title XVIII of the Social Security Act (42 U.S.C. 

1395). The program pays for much of the health care costsfat eligible personsage 65 or older 

and certain individuals under 65 who are disabled or have chronic kidney disease. The Health 

CareFinancing Administration (HCFA) administers the program through a network of 

conuactors which processclaims, make payments,and provide various other servicesto 

beneficiaries and providers. 

Medicare consistsof two types of insurance,Part A and Part B. Part A covers servicesfurnished 

primarily by hospitals, home health agencies,and skilled nursing facilities. Medicare Part B 

typically coversphysicians’ care and various other medical servicesand supplies. Contractors 

under Part A am referred to asintermediaries; those under Part B are called cambers. 

Under Part B, cIaims are assignedor nonassigned. If a claim is assigned,the provider submits it 

to the contractor for payment and agreesto acceptthe contractor’s determination of the allowed 

charge. The beneficiary remains responsible for any coinsurance,which is the percentageof the 

allowed charge for covered medical expensesa beneficiary pays, and the deductible, which is the 

covered medical expensesa benefichry must pay before Medicare pays. If the claim is 

nonassigned,the provider is required to submit the claim to the contractor, which pays the 

btntfkary. The beneficiary then pays the provider and is responsible for the coinsurance 

1 . 
amount, any unmet deductible, noncoveredcharges,and any difference betweenthe provider’s 

actual charge (up to the maximum allowable actual charge)and the Medicare-allowed charge. 

Carrier Prvvidkr Numbers 

Under most situations, carriers require providers of Medicare servicesto submit information 

sufficient for the carrier to assignthe provider a unique carrier identification number (hereafter 

referred to as a provider number). &ricrs assignprovider numbersto qualified providers of 

Medicare Part B reimbursablesetices or supplies.(SeeFigure 1.) 

FIGURE 1 

Provider Types 

Physkians 

Doctors of Medicine Doctors of Osteopathy 

Chiropractors optometrists -

Suppliers and Nonphysician Pmctitlonen 

Physician Assistants Certified Nurse Anesthetists 

Xnical Psychologists Nurse Practitioners 

Jccupational Therapists Speech Therapists 

‘linical Social Workers Durable Mediil Equipment 

nbulatofy Surgery Centers Rehabilitation Centers 

agnostic Testing Centers Independent Physiobgical Labs 

Dentists 

Podiatrists 

Nurse Midwives 

Physical Therapists 

Audiologists 

Clinical Labs 

Ambulance 

kkr numbersare usedfor processingboth assignedand nonassignedclaims. The number is 

. . usedin establishing Medicaxepricing and utihition profiles. If the provider of services 

dti::; not have a provider number, payment may not be madefor services. To obtain a provider 

number tirn a carrier, providers need to complete the carrier’s application form and meet 

critezia specified by Medicare regulations. 

Through the provider number application processand maintenancepractices,carriers must 

ensureproviders meet qualikadons specified by Medicare. Federal laws and regulations 

governing the Medim program acknowledge the States’primary role in regulating many 

prov ders. For example, the Medicare law requirescoveredphysician servicesbe renderedby 

licenxd physi&ns who are legally authorized to practice” (Social Security Act, Section 1861) 

by the State in which the servicesare rendered. 

Although qualifications for other Medicare provider types (Figure 1) may include Stateliccnsure 

or cetication, someproviders are required to meet additional education, work experience,staff, 

or equipment needsin order to participate in the Medicare program (e.g., ambulancecompanies). 

Additionally, someproviders require HCFA approval However, this is not to say every provider 

type must meet specified criteria. Someproviders, such asdurable medical equipment @ME) 

suppliers, generally do not have to meet any criteria except to possessa Social Security number 

or an employer identification number. a.-

2 
A provider may legitimately have more than one provider number. Somecarriers give a 

physician who practices in both a group and a so10practice a number for each. If a provider has 

a practice in more than one reasonablechargelocality, carriers may assignthe provider different 

numbersor mod&u-s to an existing number. Also, providers receive Werent numbersor 

modifiers if practicing under different specialties. . 

Groups or clinics composedof multiple physicians require special processing. Most carriers 

assigngroups or clinics a provider number. Additionally, the cti(rr must be able to identify 

eachphysician in the practice. Carriers accomplish this by assigning a number or modifier to 

each physician regardlessof any other number(s) the physician may have. In the group practice 

setting, the physician should list this number on the HCFA 1500claim form to show who 

performed the service. 

Federal Interest in Provider Quaiifications 

The Federal governmentcontinues to show an interest in ensuring providers have adequate 

qualifications. The Consolidated Omnibus Budget Reconciliation Act of 1985 mandateda 

registry of physicians and the useof a unique practitioner identifier number (UPIN) to prevent 

duplicate paymentsfor hospital-basedphysicians and interns under the Medicare program and to 

more accurately track federally sanctionedpractitioners. This registry is monitored by HCFA. 

Another database,the National Practitioner Data Bank, has beenfunded and recently began 

o-on to monitor State licensed health practitioners. This data bank maintains records of all 

adverseactions (e.g., license revocation, malpractice) taken against medical providers and 

entitimafter the opening of the databank. The databank was authorized by the Health Care 

Quw Improvement Act of 1986 (P.L. 99460, title IV) and the Medicare and Medicaid Patient 

and Program Protection Act of 1987 (P.L. 100-93, sectior~5). This databankis monitored by the 

Public Health Service (PHS). 

These two databasesprovide the Federal governmentwith addedtools to monitor providers. 

However, the responsibility for ensuring Medicare providers meet licensing arid other 

requirements specified by StateandFederal law rests ultimately with catriers. 

State Licenszm and Ce@ication 

Licensing and certifying providers axeprimarily Statefunctions. Individuals or entities must 

meet Statecriteria to obtain and maintain a license or cert%cation. The Statesare responsible 

for regulating the practice of those they have licensedor c&f&xi. They PIEalso responsible for 

ensuring all providers meet standardsof professional competenceand personalintegrity 

considered necessaryto protect the public. 

The State license or ccrdficate demonstratesthe provider satisfiesthe State’sestablished 

standardsin such areasaseducation, experience,and ethics. Once licensed or certified, the 

provider must then comply with the State’sprescribedstandardsfor the practice of the profession 

and any other specified criteria for maintaining a license or certification. Failure to meet these 

kquirements may result in the Statesuspendingor restricting the license or certificate to provide 

3 
semices. When a provider losesthe legal authority to practice, no servicesof the provider art 

covered by Medicare. 

Prior OIG Study 

An audit (A-04-87-02011) of physicians by the Office of Inspector Generalin 1987 found 

managementcontrols at the Florida carrier were inadequateto prevent continued participation by 

and reimbursementto physicians who had lost their authority to practice asa result of State 

actions. Becauseof this inadequacy.the Medicare carrier and Stak agencyallowed chargesin 

excessof $15.8 million to 463 physicians who continued to practice afkr losing legal authority 

to practice. Further, an additional 789 physiciansmaintained Medicare and/or Medicaid 

provider numbers under which they could havepotentially billed the programsafter losing legal 

authority to pm&cc. 

METHODOLOGY 

This inspection con&cd of three phasesin addition to a review of relevant HCFA policies and 

Medicare laws, discussionswith HCFA staff, and review of the above audit findings. 

Reviewing Caker iUai&nance Procedurts 

We visikd three caniers and mailed surveys,with klephone followup, to 35 other carriers. (See 

Appendix A for a complek list of carrier respondentsand Stak jurisdictions.) Questions 

addressedprovider number maintenanceproctdurts carriers follow and were directed to the 

departmentwhich is responsiblefor assigningnumbersto Medicare providers. 

hrveying State Licensing Authorities 

Many (121) Stak authorities responsiblefor licensing one or more typts of medical providers 

who can receive reimbursementunder Medicare Part B respondedto our survey. The number of 

licensing authority respondentsranged from a high of 28.Staks for dentiststo a low of 15 States 

for psychologists. (SeeFigure 2.) 
State Licen$ing 

I TLpe of Licensing Authotity 

Dentists 

Doctors of Osteopathy 

Optometrists 

Doctors of Medicine 

Chiropractors 

Podiatrists 

Physicii Assistants 

Psychologists 

flGURE 2 

Authority Respondents 

Number of States Responding 

28 

25 

25 

24 

21 

18 

18 

15 

Note: Someof the stak licensing authorities monitored licensing of severalor all of the types 

of providers listed (e.g., a single agencyin Nebraskamonitors all providers hkd, while in Texas 

separateboardsrepresenteachprovider type, with the exception of the TexasMedical Board 

which monitors medical and osteopathicphysicians and physician assistants). 

Computer Matching 

We conducted computer matchesbetweenlicensing authorities and carkrs responsible for three 

Statejurisdictions (New York, Pennsylvania,and Texas). The carriers involved were Empire 

Blue Crossand Blue Shield, Blue Shield of WesternNew York, PennsylvaniaBlue Shield, and 

TexasBlue Cross and Blue Shield. Thesecarriers were selectedbecauseof 1) the high number 

bf providers within the Stateand 2) the capacity and willingness to provide us with a computer 

file of all licenseeswho have lost the legal author@ to practice in the Stak. The computer 

matcheswere conducted to determine the number of active provider numbersin carrier files 

belonging to providers not 1egaUyauthorized to practice according to the applicable State 

licensing authority. 

In order to limit the scopeof this study, we limited our review of providers to physicians and 

severalnonphysician practitioners. Entities such as labs, diagnostic testing centers,ambulatory 

surgery centers,etc. were not reviewed. 

Each canier provided a copy of its provider Ne on computer tape. The file contained all 

provider num&rs in its computer systemwhich are approved to bill Medicare. Each stak 

licensing authority provided a computer fde listing all providers who have lost the legal 

authority to practice in their State. Pigure 3 indicates the types of licensed providers supplied on 

the computer tape by the specified Statelicensing authority. 

5 
FIGURE 3 

- Types of Medical Providers on Licensing Tape 

Doctors of Medicine 

Doctors of Ostetrpathy 

Dentists 

Podiatrists 

Chiropractors 

Optometrists 

Psychologists 

Audiologists 

Physical Therapists 

Occupational Therapists 

Texas Pennsylvania 

n m 

n m 

m 

m 

n 

m 

m 

l 

m 

n 

The Stak licensing authority dekrmined loss of legal authority. The following are typical 

actions resulting in loss of legal authority to practke: 

Discipiinq Actions 

Revocation or suspensionof license or certificate 

Negotiated surrenderof license 

Other Actions 

Failm-eto renew the license or ccnificate 

Retirement or death 

Failure to complete continuing education 

Afkr the license is issued, Statesrequire licenseesto maintain a current rtgisuation to be legally 

authorized to prxfice. This generally involves payment of a registration fee at intervals 

determined by the Staot. Additionally, it might involve presentingevidenceof completing State 

approved continuing education. Failure to maintain a current regisuation may lead, in some 

staks,to canceling the license (e.g., TexasMedical Board). In other Staks, the license is simply 

recorded as inactive (e.g., Florida and New York). SeveralStak laws provide penalties for 

pracricing without a valid license and registration. For example, North Carolina’s law governing 

the practice of medicine staks: 

“any person [who] shall practice medicine or surgery without being duly licensed and 

registered . . . shall not be allowed to maintain any action to collect any fee for such 

6 
services. The person so practicing without Licenseshall be guilty of a misdemeanor, and 

upon comktion thereof shall befined hot lessthanfifry dolkzrs ($50.00) nor more than one 

hundred dollars ($1OO.OO), or imprisoned at the discretion of the court for each and every 

offense.” (Section 90-18, North Carolina Medical Practice Act) 

. . 
FINDINGS . 

~aistoricaUy, management has not recognized the importance of 

maintaining accurate and up-to-date information on providers in our 

corporate file. ” 

- A Carrier Provider Number Dept. Manager 

HCFA’S DIRECTION TO CARRIERS IS INADEQUATE. . 

Although Medicare regulations specify qutications a provider must meet before being 

reimbursed by Medicare, HCFA hasissuedno directives concerning a carrier’s responsibility to 

ensurewhether a provider is still qualified at somelater date after an initial provider number is 

issued. Additionally, little guidance hasbeengiven conckrning how and at what frequency 

carriers should determine the accuracyof provider-supplied information (e.g., practice location). -

In f?e absenceof suchrcqiremcnrs, the extent of updating, if done, varies from one carrier fo 

the 12xt. For example, Nationwide Insuranceof Ohio updatesphysician assistantrecordsevery 

ye: . :exti&d nurse anesthetistsand nursemidwives every 2 years,and ambulancecompanies 

e\ 1 3 years. On the other hand, Empire Blue Crossand Blue Shield updatesDME suppliers 

are-. .y. 

WC :. I eve inadequatedirection by HCFA hasresulted in weaknessesin carrier controls to 

miz- .1z1the integrity of Medicare carrier provider numbers. We believe this constitutesa 

ma:. .-al internal control weaknesswithin the meaning of the Federal Managers*Financial 

Ihi rity Act and should be reported to the Secretaryalong with plans for conective action. 

WEAKNESSES EXIST IN CARRIER CONTROLS TO MAINTAIN ME?XARE 

PROVIDER NUMBERS. 

Although virtdy all caxrkn report the ptwider number assignmentprocessis Very important” 

to the integrity of the Medicare program, we found little carrier effort to ensurethe information 

maintained OQprovidu~ is accurateand up-to-date. 

b Most canicrs do not systematically up&z& providerfle~ 

Many carriers (22) repott little effott to updateprovider files except in responseto changes 

submitted by the provider, to returned mail, or aspart of group mcmbershipvalidation. Most of 

the rexnining cakrs (17) which do report periodically seeking updateinfotmation generally do 

SOonly on an asrequired basis and only in responseto a perceivedproblem or need. 

8 
Typically, carriers reported the following reasonsfor not routinely updating or recertifying 

providers after a number hasbeenissued: 

lack of staffing, 

lack of funding, 

no perceived need for Ne review, or 

no HCFA requirement to do so. 

An Effective Practice 

One practice involves routinely sending out b$ormation vetificafion leners to 

providers. As an example, Montana Blue Shield set& out an infotmation 

gathering lener each year w all providers except durable medical equipment 

suppliers and hospital based physicians. Providers are required to firr out the form 

‘and return it. Providers not responding ore called by carrier stq@ The answers 

given on the ques&tnai~s are ver@ed again &a already on file for 

&crepancies. 

Physician Group/Clinic Membership Updating .. ;.. ,L 

One of th6few provider types for which carriers do conduct some typt of routine updating 

involves physician groups and clinics. In connection with the physician identification and 

registration program (UPIN), HCFA requires catriers to maintain accurategroup membership 

information. Specii?cally,carriers arc required to 1) inform groups of their obligation to report 

any group member additions or deletions and 2) perform an annual survey of groups to detect 

any chm not reported by the group during the yeaz 

Carriers typicaily noti@ groups to report membershipchanges,both at the time numbersare 

given out and periodically in cazricr newsietters. S&I, a-hers teport such changesare not 

always qorted. Six of 38 carriers surveyedreport membersjoining a group or clinic are only 

sometimesrepor%& while 19 report Embers leaving ate only sometimesrqorted. 

> Communications betweencarriers andprofessiond kensing authorities are weak 

Lack of Reporting 

Many of the licensing authorities we contacteddo not routinely shareinformation with carriers 

when a provider losesthe legal authority to practice. However, medical and osteopathic 

licensing authorities routinely report more often than any other (SeeFigure 4.) 

Lack of reporting is especially notable with regard to nondiscipiikuy actions. Of the authorities 

who reported routinely sharing information with the hkdicare carrier, less than 24 percent (12 of 

51) report nondiscipiinary actions as weiL 

9 
24 

FIGURE 4 

Many Ucensing Authorities Do Not Share Information 

With Carriers 

Licsnslng AuthoHty States Surveyed . Do Not Sham 

Doctors of Mediiine 23 26% 

pot; Osteopathy optofnetrists 

17 

14 

2 

74% 

Chiropractors

Dentists 2 

74% 

78% 

Psychologists 14 88% 

Share 

74% 

71% 

35% 

28% 

26% 

24% 

14% 

Somepossible reasonswhy licensing authorities do not routinely report actions to Medicart 

carriers include a lack of staff or resources,not being awareMedicare needsthe information, and 

privacy considerations. However, according to the Federationof StateMedical Boards.’ only 

four medical boards (Connecticut, New Hampshire, South Dakota, and Wyoming) do not 

consider formal board actions or agreementsa matter of public record. 

Organizational Differences 

Each Stateis different in the way it has setup authoritieszesponsiblefor licensing medical 

professionals. At one exmme, WCfound Stateswhere one agencymaintains information on 

actions taken by severalboards (hezeafterreferred to asan umbrella agency). In somecases, 

boardsact only as advisory bodies to the umbrella agency. At the other extreme, we found States 

where individual boardsare completely independentfrom other boards,and no central authority 

rphkors board actions tie&g a licensee’sauthority to practice. 

The Federation of Medical Boards classifies Statemedical boardsinto four broad categories 

which describe board suucture and operation (seeFigure 5): 

l Independent The board exercisesall licensing and discipiinaq powers, 

though someclerical seniccs may be provided by 

an umbrcila agency. 

l Se~4aubnomous The board exercisesmost key powers; an umbrella agency 

provides most clerical and administrative services 

and makessomedecisions. 

l Subordinate The board exe&es few key powers; an umbrella agency 

pm&s semicesand’makesmost decisions. 

> Advisory The board actsin a purely advisory role to the unibrcila agency. 
FIGURE5 

- Most State Medical Boards are Independent 

Board Structure 

0 Independent 

w Subordinate 

EZlSemi-iutonomous 

I Advisory Body 

Source: Federation of State Medical Boards’ 1989-90 Exchange 

As illustrated in Figure 5, most medical physician licensing boards are independent. However, at 

least 15 of the 38 independent boardsrely on other Stateagenciesfor most administrative 

functions (e.g., maintaining computer systems~collecting renewal fees,etc.). This meansat least 

54 percent of all Statesand the District of Columbia are monitored by umbrella agencies. 

These umbrella agenciescan greatly assist a carrier in obtaining complete licensing information. 

Although the boards often must be consulted for specifk &tails about discipiinaxy actions, the 

umbrella agency maintains adequateinformation in its computer systemto provide information 

on the legal statusof a licensed professional. Carriers needonly contact the umbmlla agency to 

coordinate any exchangeof information. 

On the other hand, autonomousboardslacking an umbrella agencyrequire the carrier to contact 

each individual board for information. Since autonomousboards are generally small and 

burdened with many aspectsof licensing (e.g., administering examinations and collecting license 

renewal fees), they are less likely to have the resources(e.g., staRand degreeof automation) to 

respond to carrier requestsfar information. In such situations, it may be more feasible to contact 

providers directly to submit proof of cutrent licensurc or certification. 

11 
-. 

Automated Record Keeping 

Responsesti completed surveysby 121 licensing authorities indicate Statelicensing 

authorities have the capacity to generatelistings of providers who are actively registeredin a 

profession. Nearly 90 percent of respondentsrepcxt’lictnscc information is maintained in a 

computer system Only one licensing authority for medical physicians,WestVirginia, reported 

no computer. (However, they indicated a micro computer would be purchasedby the end of the 

year.) Boards with a small licenseepopuiation (e.g., psychologists) were least !;keiy to keep 

records in an automatedsystem 

Many State licensing authorities keep recordsin a mair&ame or mini computer. However, 

licensing authorities which do not shareresourceswith other Statelicensing authorities 

(e.g., smalI autonomousboards) typically keep information in a personalcomputer. Of the 73 

licensing authorities which provided information on the type of computer systemused,71 

percent use a mai&ame or mini computec others usepersonalcomputers. 

Whether computerized ornot, eachlicensing authority hasthe ability to provide listings of 

providers who have the authority to practice. Such listings take the form of periodic publications 

or computer listings generatedat the time of the request Virtually all authorities we contacted 

produce such listings at no or minimal cost ($10 to $100). WCcontacteda few of the licensing 

authorities reporting higher costs($200 or more) to discusswhether the cost could be lowered 

for a Federal Medicare contractor since its usewould be to monitor providers the board reports 

to be not legally author&d to practice. As an example, Colorado’s quote of $320 for a complete 

listing would be lowered at least by half to the cost other Stateentities are paying. 

Many can&m do twt have adhquute contds to icient@ and deactivate provider 

. numbers belonging to providers who have los! the Legala&on*@ to practice. 

Many carriers do not have arrangementswith Licensingauthorities to receive notice of all actions 

(ciisciplin&y or other) affecting the legal authorization of providers to practice. Failure to 

receive this information and take appropriate action leavesthe carrier vulnerable to making 

paymentsfor serviceswhich are noncoveredby Medicare. 

Discipiinary Actions 

While many canicrs report they haveestablishedcommunication with licensing authorities to 

receive discip%rary actions, somehave not. (SeeFigure 6.) Generally, licensing authorities 

report disciplinary actions in the form of a board order. The order statesthe type of action taken 

and its duration. For most carriers who report receiving actions, the board order is sentto the 

medical review or program integrity deparrmcntwhere a decision is made on whether the 

provider’s number should be deactivatedor flagged for postpay or prepay review. 

12 

l 
FIGURE 6 

Not-All Carriers 

T’s of Ptvviders 

Doctors of Medicine 

Doctors of Osteopathy 

Chiropractors 

Optometrists 

Podiatrists 

Dentists 

Psychologists 

Physical Therapists 

Occupational Therapists 

Ambulance Companies 

Certified Nurse Midwives 

and Anesthetists 

Source: Survey of 38 Carriers 

Other Actions 

Receive Notices of Disciplinary Actions 

Number and Penzent of Cafriem Receiving Notice 

30 79% 

74% 

:: 53% 

19 50% 

19 50% 

19 50% 

19 50% 

18 47% 

17 45% 

15 39% 

13 34% 

Although loss of authority to practice for nondisciplinary reasons@onpaymentof renewal fees, 

death, retkment, voluntary surrenderof license,etc.) causea provider’s servicesto be 

noncoveredby Medicare, many carriers do not identify such providers. (SeeFigure 7.) 

FIGURE 7 

Even Fewer Carriers Receive NOtic8S of Nondiscipiinary Actions 

TLpes of Providers Ntamber and Perc8m uf Carrbm Recek’ving Notice 

Doctors of Mediine 

Doctors of Osteopathy 

Chiropractors 

Optometrists 

Podiitrists 

Dentists 

PSY~WPhysical Thmpbts 

OccupatbnalThera@sts 

AmbulanceCompanies 

Certlfled Nurse Michnives 

and Anesthetists 

Source: Survey of 38 Camws 

25 66% 

23 61% 

14 37% 

13 34% 

14 . 37% 

13 34% 

14 37% 

13 34% 

12 32% 

11 29% 

11 29% 

Our review af four carriers revealed vulnerabilities in this area. Although each canier reported 

receiving nondisciplinary actions from licensing authorities, we found many active provider 

numbers belonging to providers not legally authorized to practice for other than disciplinary 

13 

L 
reasaIS. None of the carriers had askedfor or receivedcomplete listings of providers adequate 

to ide ltify all providers not legally authorized to practice. 

As w: tl our computer match States,caxricrswho rtport receiving notice of nondisciplinary 

actionI may not usethe information or may receiveincomplete or untimely infotmation. This is 

evidecced by many carxiersreporting they deactivatevery few, if any, providers who lose State 

legal authority to practice for other than disciplinary actions. 

An Effective Practice 

A formal agreement with licensing authorities prescribing exactly what actions 

will be commuru‘cated to the carrier, at what times, and to whom the infomtion 

will be sent is a good practice. Such an agreement adds confidence that all 

actions affecting a licemee’s legal author@ to practice will be commuu ‘cared in 

atimelymanner. 

\ 

-

* i ’ ny providers wit0 have lost the &gal autiwdty to practke still have adve provider 

.-tiers which they may use and, in somecases,are using to bill Medicare services. 

Throc i x computer matches,we identified 4,770 active carrier provider numbersbelonging 

to prc : s who had lost the legal authority to pracrice. (SeeFigure 8.) 

-. 

h ..ry Providers 

Carriers 

Empire Blue Shield 

31~0 Shield of 

Nester-n New York 

aennsylvania Blue 

shield 

Texas Blue Shield 

Total 

FIGURE 6 

Not Legally Authorized to Practice Have Active Numbers 

Wts - Provider Numbem BelongIng to Pfov 

P8re8nt of. M8wlYa!38mpl8dfor 

An Allowd ClutQu whlk 

Numkn -bY NotAtiM 

QJqoct to mrlpunvr ’ 

Ymcil COUtIt PerCent 

5% I 2.5% I 160 1 11% 

2.5% j 2.0%/ 104 / 47.9% 

&XI j 1.1% / 121 / 7.6Yo 

I 849I 

lers Not Author&d 

s8mpld Provldw 

NumbamWithAllowed 

chug88 

Count Allowed 

21 $132,567 

19 $81 ,160 

9 $78,416 

39 $12,311 

88 $304,454 

1,426 

217 

1,590 

1,537 

4,no 

14 

L 
Approximately 10 percent (88 of 849) of sampledprovider numbers had allowed charges2while 

the provider was not legally authorized to practice. This percentagevaried slightly at each 

canicr. For examplk, at the 95 percent confidence level as few as 8.1 percentor as many as 18.1 

percent of the 1,426 provider numbersidentified at Empire Blue Shield had allowed charges. 

When a 95 percent confidence level was computed for Blue Shield of WesternNew York, the 

estimatedpercentageof provider numberswith allowed chargeswas within the interval of 

12624.0 percent 

We found over $300,000 in allowed chargesto the provider numberssampledat the four 

carriers. These allowed chargesranged from $18.30 for one ScrYiceby one provider to over 

$100,000 for 3.018 servicesby another. Becauseof this extreme variability and the small 

number of provider numberswith allowed chargeswhile the provider was not legally authorized 

to practice, any resulting projections will be very imprecise. This does not mean any projections 

of the allowed chargesto the unsampledpopulation would be inaccurate. However, it does mean 

with the sample data we do not have sufficient power to provide a preciseestimateof the 

allowed chargesto providers not legally authorized to practice. 

Still, theseresults r&for& past OIG findings. The review of Florida physicians between 1980 

and 1985 showed carrier allowed chargesin excessof $15 million for sckccs renderedby 439 

providers after they had lost legal authority to practice. 

> Inaccurate or missing information in somecanierj?les may hamper effective use of 

State licensing authori~ information 

Esp+lly in the caseof computer matches,certain carrier records must be maintained 

accurately. Two fields are especially important - provider name and license number. Theseare 

the &ly’two fields we arc certain both licensing authoritiesand carriers COkL 

Missing Carrier License Numbers 

While few carriers do not record provider license numbers,a considaable number of carriers 

have only recently begun to enter thi license number in a computer file. As a consequence,in 

many older provider records set up previously, the license number fields arc empty. Records 

were missing license numbers in eachof the carrkrs where we conductedcomputer matches. 

Figure 9 ilIustratcs the degreeof missing license numbersat Empire Blue Shield and Blue Shield 

of WesternNew York 

As indicated in Figure 9, the percentageof license numbersdifkrcd markedly depending on the 

type of provider For example, physicians had the highest rate of license numbers while 

practitioners such asphysical therapistshad the lowest This may be an indication of the impact 

of HCFA’s UPIN project The license number hasbeen termed a critical element to be collected 

by carriers when setting up a physician number. However, HCFA does not require the license 

number in order to issue a UPIN. 

15 
FIGURE a 

Missing License Numbers 

Numbers RevIewed Percent Missing Number 

Donors of Medicine and Osteopathy 32,446 29% 

ggwa~P= 2,337 14% 

774 17% 

Podiatrists 1,712 18% 

Psychologists 2,641 93% 

Audiibgists 141 9% 

Physical Therapists 377 99% 

Dentists 226 3% 

Total w= 

- Blue Shield of Western New York 

Numbem Reviewed Percent Missing Number 

Doctors of Medicine and Osteopathy 

Chiropradbrs 

optometrists 

Podiatrists 

12,162 

577 

501 

354 

38% 

77% 

42% 

3% 

Psychobgists 

Audiologists 

Physical Therapists 

Dentists 

246 

2:: 

262 

44% 

20”/9 

53% 

63% 

. Total 14,351 

Soutce: Review of Cam’er Pfvvklef Files 

Inaccurate Carrier License Numbers 

Even if the license number is entered,carriers may not be ensuring the accuracyof the number or 

may not be entering the number in a form which will correspondto the licensing authority’s 

number. To illustrate, we encounteredErrol and inconsistencyin the way our samplecarriers had 

entertd license numbers. Transposingdigits in the number was the most fkquently encountered 

error. To a lesserextent, somelicense numberswere incomplete, had too many digits, or 

included inappropriate prefixes. 

Provider Name Irregularities 

Review of car&r files in which we conductedcomputer matchesrevealedcarriers enter the 

nameas given by the provider on the application. For example, one provider might be listed as 

Robert Stanley Smith, Jr. on the licensing authority’s file, while the ctier might haveentered 

16 
the name as Bob Smith or R Smith on the carrier’s file. This createsan unwarrantedpotential 

for confusion. Carriers could easily ask providers for complete legal namesand verify the name 

spelling with that of the licensing authority when the provider’s qualifications are verified (i.e., 

license number is checked). 

IMPROVEMENTS THROUGH VARIOUS ADMINISTRATIVE ACTIONS OR 

PROGRAMS ARE POSSIBLE. 

Many types of caxrieractivity can improve the accuracyand reliability of information 

maintained in provider records. Often, suchactivities can be accomplishedat little cost to the 

Medicare program through largely automatedrather than manual verification procedures. The 

following are a few examplesof specific maintenanceactivities. Also, we include a short 

discussionof the actual beneficial effects to physician provider records obtained by carriers 

during UPIN associatedactivity. 

w Carriers can reduce the number of active provider numbers, reduce Medicare’s 

vulnerabili@ to abuse, and saveadministrative costsby periodcally deactivating 

provider numbers with no billing history. 

One simple and cost effective method for updating provider files, followed by nearly two-thirds 

of carriers surveyed,is to deactivatethe numberswhich belong to providers without recent 

billing. The effects of removing inactive providers could be significant 

*Atone carrier not routinely deactivating provider numberswith no billing history, nearly 30 

percent of “active” provider numbers belonged to inactive providers. (SeeFigure 10:) 

(Ipactive providers were &f&d asprovider records with no Medicare billing for the past 27 

months.) titters were sent to providers to determine if they still wished to participate in the 

Medicare program. Almost 78 percent of theseproviders failed to respond or requested 

termination of their number. Ultimately, 15,215or 76.6 percent of provider numberswith no 

billing history were canceledbecauseof this project Not only doesthis reduction in provider 

numbersincreasethe manageability of the carrier’s provider file, it translatesto an administrative 

cost savingsto the Medicare program. Such activities as yearly profile calculations, file 

maintenanceactivity, and routine mailings will not be required. 

17 
FIGURE 10 

Many Provider Numbers With NO Billing Could be Canceled 

Texas Blue Cross and Blue Shield’s Experience 

Numbers Wlth No Blllina Cancelled Provider Numbers 

Active 

Type of Provider Percent of Percent of Percent of Provider Numbers Numbers Active NUtllbMS No Bllllng all Numbers Numbers 

Doctor of 

Medicine 42,932 11,842 27.6Or6 9,819 82.9% 22.9% 

Drug and 

Medical 6,348 2,013 31.7% 1,752 87.0% 27.6% 

SUPPlY 

Dentist 6,123 3,250 53.1% 2,274 70.0% 37.1% 

Doctor of 3steopathy 2,646. 672 25.4% * 567 64.4% 21.4% 

Zertified 

Uurse 1,960 617 31.5% 300 48.6% 15.3% 

Anesthetist 

ZhiropraAor 1,750 203 11.6% 130 64.0% 7.4% 

‘sychologist 1,236 688 55.7% 312 45.3% 25.2% 

‘odiatrist 624 75 12.0?& 60 80.0% 9.6% 

Therapist kcupational 7 1 14.3% 1 100.0% 14.3% 

Total 63,626 19,361 30.4% 15215 76.6% 23.9% 

Computer matching with licensing authorities could help many cawiers identifi 

ptvvi&rs not legally authorired to practice. 

Our experiencewith computer matching to identify providers not legally authorized to practice 

hasproven such activity is an effective tool to maintain the integrity of provider records and 

reduce Medicare’s vulnerability to l&d and abuse. Additionally, suchfries can have other uses. 

Not only could the file be used to conduct computer matching, lists of authorized providers 

could be produced for departmnts responsiblefor assigningprovider numbers. In fact, carriers 

could incorporate the licensing authority’s file into a canier computer program screensuchthat 

all carrier departmentswould not have to manually look up licensing information on providers, 

but could query the computer instead 

18 

l 
. . 

All of the licensing authorities which indicated having a computer systemalso teported they 

could generatea computer file of all licensedproviders. Of these,over 50 percent also have the 

capacity to generatelistings only of providers who have lost the legal authority to practice. 

Apparently, somelicensing authorities keep only recordsof actively registeredproviders. Any 

licenseefailing to renew a license is purged from its system 

Medical physician licensing authorities teported chargesfor such files ranged from no charge to 

a government agency to severalcentsper record. Somt of the estimatedcosts were asfollows: 

Medicai Physician Licensing costof File 

Rhode Island 

Nevada 

oklahoma 

Idaho 

TCxaS 

Alabama 

Ohio 

N&&ii 

North Carolina 

FlOrida 

COMCCtiCUt 

Vermont 

North Dakota 

Missouli 

New York 

. California 

$50 

$50 

$75-150 

$100 

$100 

$150 

$150 

$175 

$250 

$260 

$65 pcr’profession plus $25 for a tape 

$5 processingfee plus five centsper record 

$0.05 per physician record 

No chargeto Federal government agency 

No chargeto Federal government agency 

No chargeto Federal government agency 

Costsfor smaller boardssuch as chiropractic or optometry were generally between $25 and $50. 

It should also be noted Statelicensing authorities may lower processingcosts,if they realize the 

purpose of Medicare’s requestfor the information and that the carrier is a Medicare contractor. 

As an example, Ohio sells a computer tape of licensedphysicians for $1,500 to private entities. 

However, certain Stateand Federal agencies(including Medicare) can receive the tape for as 

little as $150. 

19 
An Effective Practice 

Carriers fo; 3 States (Flonkia, Missouri and Tkxas) reported obtaining a computer 

file from a licensing board in order to i&nrifL providers not legally awhon’zed to 

Each carrier teports use of such a computer file to be an inexgenrive, yet 

effective, method to aktect providers not legally authorized to practice. 

In 1989, Florid0 reported the deactimtion of appro.xkztely 300physician 

provider numbers for failure to renew their license. In 1990, Texar deactivated 

nearly 1,500 provider numbers for physicians not legally authorized to practice. 

I iow costly are computer matches? 

1he effectivenessand cost of computer matching dependsupon stverai factors. Someof these 

fi ctors are: 

the ctier’s.computer capabilities, 

Wrier programming costs* 

licensing authority ability to produce a useableftie at a reasonablecost, 

adequateidentifiers for matching (license number, name,birth date, etc.), and 

sufficient integrity of the carrier’s and licensing authority’s provider file (e.g., if 

matchedon the license number, all carrier recordsmust have iicense numbers). 

practical example of the cost of computer matching, Florida Blue Crossand Blue Shield 

ratedits match cost for start-up and yearly follow-up: 

$1,120 Initial developmentfor first match 

$ 260 Computer tape purchasecost f%omStatelicensing authority 

$ 200 Adminisuativt coststo run match (e.g., computer CPU time, 

letter generationto providers without a valid License,staff time 

to receive and file provider responses) 

$ 250 Maintenance (activity associatedwith updating match programs) 

$lW Total Cost for Initial Match 

$ 710 Cost for Subsequent Matches (the $1,120 initial 

development is no longer required) 

> Cam’er e#orts under HCFA’s physician identip&*on and registration program (UPIN) 

have improved the accuracy of provider number mcordr of physicians. 

St:venty percent of caniers responding to our survey statedthat, in the courseof fulfilling 

re ;1’kementsfor HCFA’s physician identification and registration program (WIN), it 

substantially cleanedup physician records. In total, 18 carriersreported the identication of 

20 

i 
approximately 11,500physicians whose numbersneededto be canceledor deactivated. Some 

other cakcrs respondedon a percentagebasis;from 10 to 20 percent of physicians in its system 

had their numbersd&activatedor canceled. The primary reasonsfor deactivation were death, 

rekxnent, or no longer practicing in the State. 

r Matetial Weakness 

Inadequate HCFA oversight and direction of the provider number process is a 

basic systemic weakness that compromises the integrity of the trurtfud and could 

remit in significant losses. In accordnnce with the Federal Managers’ Financial 

Integrity Act, the HCFA should repon this as a material internal control weakness 

through the Secremy to the President and Congress. A detailed discussion of the 

material weakness designation can be found in Appendix B. 

21 
.. 

RECOMMENDATIONS 

The HCFA should &rim carriers to: 

l updateprovider recordsperiodically. ’ 

l deactivateall provider numberswithout current billing history. 

l establish adequatecontrols to ensuit providers not legally authorized to practice are 

identified and their provider numbersdeactivated As a part of thesecontrols, carriers 

should: 

- negotiate with Statelicensing authorities to obtain license and 

registration information at a minimum cost to the Medicare program. 

- assessthe feasibility of computer matcheswith Statelicensing authorities 

and perform suchmatchesroutinely, if practicai. 

- maintain the licenseor certifkation number of providers in its provider 

file. 

- &velop computer data entry edits for license numbersto ensure 

uniformity and consistencywith the licensing authority’s method of 

recording license numbers. 

Tie HCFA should: 

l evaluatecarrier provider number controls establishedaboveas a part of its regular 

carrier Contractor PerformanceEvaluation Program. 

l negotiate with Statelicensing authorities, which carriers report to be uncooperative,to 

obtain license and registration information at a minimum cost to the Medicare 

HCFA COMMENTS AND OIG RESPONSE 

The HCFA achowledges the needfor improvement in its instructions given to Medicare carriers 

regarding the maintenanceof provider numbers,but does not believe our fmdings constitute a 

material intcmal control weakness. The HCPA maintains that UPKNrequirements “firmly 

establishedboth a meansand a HCPA commitment to maintaining accurateprovider number 

information.” 

22 . 
TheHCFA concurswithourrecommendations topcddically updateproviderecords and 

conditionally concurswithourrecommendation to deactivate numberswith no recent billing 

activity. The HCFA doesnot concur with recommendations requiringca&rs to implement 

conaols which are adequateto ensureproviders notlegallyauthorizedtopractice are identified 

and their provider numbersdeactivated..The HCFA citesthe OIG’s sanctionrole and several 

impediments precluding the implementation of computer matching. Additionally, HCFA does 

not believe a CFZP standardis warranted to ensureand evaluatecarrier maintenanceactivity. 

The HCFA incorrectiy argues the resporrsibility for ensuring providers losing legal 

authority to practice are idennified rests with the OIG. The OIG’s sanction role is 

timiled and does not take away the responsibility of cam’ers to ensure payments 

are not made to unqualified providers. The Physician Registry does not ensure 

maintenance of the accuraq of provider nwnber infomation as indicated by 

HCFA, exceptfor detecting sanctioned physicians. Finally, carrier effons to 

maintain the integrity of provider numbers warrants evaluation during HCFA’s 

annual cam’er smey process. 

The OIG continues w believe a materiai internal control weakness txists. 

The HCFA’s l&k of direction has resulted in vuinerabiiities which meet several 

of the criterb upon which a mate&l weakness designation is detemined. 

SeeAppendix B for a summary of HCFA’s commentsto ;he draft report and a complete 

discussion of the OIG’s response. Also, this discussionincludes factors consideredin

determining a material weakness3designation exists (Appendix B, pages4-S). Appendix C 

includes the full text of HCFA’s comments. 

23 
ENDNOTES 

1. According to information in the Federation’s 1989-W Exchange,Section 3: 

Physician Licensing Boards and Physician Discipline. 

2. Allowed chargesrepresentthoseamountsdetemined by the carrier basedon the lower of 

the USLU&customary,or prevailing chargesfor the service. 

3. Material weaknesscriteria are specfied in OMB Circular A-123. 
APPENDIX A 

CARRIER RESPONDENTS ad STATE JURBDKTIONS 

381 

Blue Crossand Blue Shield tf Alabama ’ 

Aema Life and Casualty 

Arkansas Blue Crossand Blue Shield, Inc. 

Blue Shield of California 

TransamericaOccidental Life Insurance 

Travelers Insurance 

Blue Crossand Blue Shield of Plorida, Inc. 

Aetna Life and Casualty 

Aetna Life and Casualty 

Equicor 

Health Care Service Corporation 

Associated Insurance 

Blue Shield of-Iowa 

Blue Crossand Blue Shield of Kentucky 

Blue Crossand Blue Shield of Maryland 

Blue Crossand Blue Shield of Michigan 

General American Life 

Blue Crossand Blue Shield of KansasCity 

Travelers Insurance 

Travelers Insurance 

Blue Crossand Blue Shield of Montana, Inc. 

Blue Shield of WesternNew York 

Empire Blue Crossand Blue Shield 

Group Heahh Incorporattd 

E4uicor 

Blue Crossand Blue Shield of North Dakota 

Nationwide Mutual 

Aema Life and Casualty 

Aetna Lift and Casualty 

PennsylvaniaBlue Shield 

Blue Crossand Clue Shield of Rhode Island 

Blue Crossand Blue Shield of South Carolina 

Blue Crossand Blue Shield of Texas,Inc. 

Equicor 

Blue Crossand Blue Shield of Utah 

Travelers Insurance 

Washington Physicians Service 

Wisconsin Physicians Service 

Alabama 

Arizona, Nevada 

Arkansas,Louisiana 

California 

California 

Connecticut 

FlOlidil 

Georgia 

Hawaii 

Idaho 

Illinois 

Indiana 

Iowa 

Kentucky 

Maryland 

Michigan 

MissoLlIi 

Missouri, Kansas(Johnsonand 

Wyandotte Counties] 

Minnesota 

Mississippi 

Montana 

New York 

New York 

New York 

NorthCarolina 

North Dakota, South Dakota, 

Wyoming 

Ohio, WestVirginia 

Oklahoma, New Mexico 

Gregon, Alaska 

Pennsylvania,Maryland (Prince 

Georges& Montgomery Counties), 

Delaware, District of Columbia, 

New Jersey 

Rhode Island 

South Carolina 

Texas 

Tennessee 

Utah 

Virginia 

Washington 

Wisconsin 

A-l 
_. 

APPENDIX B 

SUMMARY OF HCFA’S COMMENTS TO SPECIFIC RECOMMENDATIONS 

AND OIG’S RESPONSE 

RECOMMENDATION 1: HCFA should require carriers to update provider records 

periodically. 

HCFA Comments 

The HCFA concurs with this recommendation. 

0 IG Response 

The OIG is pleasedHCFA acknowledgescarrier responsibility to ensurethe accuracyof provider 

records through periodic updating. 

ECOMMENDATION 2: HCFA should sequin can$ers to deactivateall provider numbers 

without current billing histov. 

ZFA Comments 

e HCFA concurs with this recommendationand further proposesimplementing carrier 

xtivation asan annual activity to be implemented by carriers when funds becomeavailable. 

IG Response 

TheOIG does not believe deactivating inactive provider numbersshould be delayed This 

-ctivity is important to maintaining the integrity of carrier provider flies and may also result in 

n administrative cost savingsto the carrier. Additionally, requiring carriers to perform this 

ctivity will only affect about a third of the carriers. As referred to in the repor& the other 

I tiers already pcrfom this function. 

I?ECOMMENDATION 3: HCFA should require Carrie= to estiiish adequate controls to 

ensure providers not leg&y authorized to practice are identified 

and their provider numbers deactivated 

L’;‘CFAComments 

7 1eHCFA does not concur with this recommendation. The HCFA believesproblems exist 

w lich limit or prohibit implementation of computermatching. Primarily, HCFA believesthe 

k~nefit to the integrity of the Medicare program is too small to justify the cost However, HCFA 

B-l 
will encouragethosecarriers which canestablishdata exchangeswith Statelicensing authorities 

without charge and with minimal administrative coststo conduct computer matches. Finally, 

HCFA believes UPIN establishes“both a meansand a HCFA commitment to maintaining 

accurateprovider number information.” 

0 IG Response 

Medicare law does not allow carriers to make payment to providers not legally authorized to 

practice in tire State where servicesate rendered. Consequently,HCFA cannot permit carriers to 

ignore a State’slegal authorization requirements. 

We acknowledge the existing differencesamong Statesconcerning Statelicensing authorities’ 

ability to provide computerized registration information. Also, we understandcanier differences 

which may impact on the cost and effectivenessof implementing this recommendation. 

However, we do not suggestthat computer matching with licensing agenciesis the only means 

available to carriers. We suggestonly that carriers study the feasibility of conducting computer 

matching. Manual procedurescan be effectively and cffL5ently usedwhen computer matching 

is infeasible or not cost effective. 

Proceduresmust be tailored to fit the carrier and State. Somecarriers will encounter less success 

or more cost in meeting this requirement. However, this does not justify not requiring catxiersto 

implement proceduresto deactivateall providers not legally authorized according to State law. 

If excessiveor unsurmountableproblems exist in achieving the integrity of provider ncords, 

HCFA should seeklegislative relief. 

The HCFA arguesour report does not indicate they can expect a significant return on its 

investment Specifically, HCFA believesdetermining legal authorization is not cost effective. 

Becausecarriers have not yet studied the feasibility of conducting suchmatches,we question 

HCFA’s estimate that coststo implement computer matching may exceedone million dollars. 

While an exact cost estimateof Medicare overpaymentsis not determinable, we believe our 

repon shows a sign&ant vulnerability which warrantscarrier action. 

We agreeUPIN activity hasimproved the accuracyof physicians records and can be usedto 

effectively detect sanctionedphysicians. However, improvements to physician records were due 

primarily to carrier review and contact with licensing boardsand/or physicians to develop for 

missing data or nonassignmentof a UPIN. The UPIN databasehas little real impact on 

maintaining the accumcy of provider records beyond detecting sanctionedphysicians. Carrier 

action is required to identify thoseproviders losing legal authorization to practice who are not 

subject to sanction under Medicare law or are nonphysiciansexcluded from UPIN. 

B-i 
RECOMMENDATION 4: HCFA should evaluateprovi&r number controls established 

above as a part of its regular carrier Contractor Pevormance 

Evaluation Program (CPEP). 

HCFA Comments 

The HCFA doesnot concur with the establishmentof a CPEPstandard(s)for provider number 

maintenance. HCFA refers to deactivation of inactive provider numbersasa “small area” of 

claims processing. The HCFA arguesthat c&ing CPEPstandardsusedto measureadherenceto 

HCFA’s policies will evaluatecompliance with our recommendationto deactivateprovider 

numberswith no billing activity. 

OIG Response 

Carrier maintenanceis not a relatively small areaasimplied by HCFA; rather, it warrants serious 

HCFA review. Establishing a specific standard(s)for provider number maintenancewould be 

critical to ensurecarriers implement controls recommendedin this report -

CPEPcontains 10 functional criteria which contain a total of 79 standardsplus two test 

standards. Four of thesestandardsalone involve the Physician Registry (UPIN). Certainly, 

carrier maintenancewarrantsadequatereview as well 

The OIG does not agreecarrier deactivation of inactive provider numberswould be adequately 

evaluatedby any existing CPEPstandard. Adequateevaluation under existing standardscould 

only be accomplishedby altering HCFA’s method of evaluating a standardto include specifically 

assessingcarrier deactivation policies. 

RECOMMENDATION 5: HCFA should negotiate with State licensing authorities, which 

can-&s report to be uncooperative, to obtain license and 

regism*on infonntrtion at a minimum cost to the Medicare 

pwmm 

HCFA Comments 

The HCFA doesnot concur with our recommendationto negotiate with Statelicensing 

authorities to obtain license and registration information at a minimum cost to the Medicare 

PWmmOIG Response 

The OIG continues to believe intervening on behalf of carriers could be critical The OIG does 

not fully understandthe reasonsfor HCFA’s nonconcurrencewith this recommendation. 

The HCFA believescarriers should updateprovider recordsperiodicdly and acknowledges 

verifying provider statuswith licensing authorities “has merit” Further, HCFA proposesto 

.. 

B-3 
encouragecarriers to establish data exchangeswith licensing authorities. However, HCFA is 

unwilling to negotdc with Statelicensing authorities on behalf of carriers wishing to obtain 

licensing information (computer or hardcopy). 

Additionally, if carriers arerequired by HCFA to deactivateproviders losing legal authority, 

HCFA’s intervention to assistcarriers in negotiating with licensing agenciescould be critical. 

MATERIAL WEAKNESS 

DESIGNATION: The OIG believesina&quate direction by HCFA has resulted in 

weaknessesin carrier controls to maintain the integrio of 

Medicare carrier provider numbers. The OIG believesthis 

constitutes a material intemal control weaknesswithin the 

meaning of the Fe&ml Managers’ Financial Integri’ly Act and 

should be reported to the SecrerpIy along with plans for 

corrective action. 

HCFAComments -

The HCFA does not believe a material internal control weaknessexists in HCFA’s direction to 

carriers or in provider number controls. The HCFA believes the material weaknessdesignation 

“does not meet the Office of Managementand Budget’s or the Department’sdefinition of a 

materiai weakness.” However, HCFA doesagreeproblems exist with timely carrier 

identification and restriction of paymentsto providers losing’legal authority to practice. Yet, 

.HCFA believes the solution to the problem is more involvement by OIG’s sanction staff, rather 

than more carrier effort 

OIG Response 

The OIG continuesto believe a material internal control weaknessexists. The material weakness 

designation is basedon inadequateHCFA direction and carrier efforts to maintain the integrity of 

Medicare provider numbers. 

The HCFA incorrectly arguesthat OIG, through its sanctionrole, is responsiblefor ensuring 

providers losing the legal authority to practice arc identified. The resportsibiliry for the integrity 

of Medicare pmvider murders rests with takers. 

The OIG sanction processapplies only to thoseproviders committing actions sanctionableunder 

Section 1128of the Social Security Act. Yet, severalStateactions can causea provider to lose 

Statelegal authtity to practice without necessarily justifying program exclusion. Additionally, 

the sanction processcan be lengthy. 

Carriers are responsible for understandingState-imposedpxacticerequirements,maintaining 

adequatecommunication with licensing agencies,and administering provider files; consequently, 

carriers can most effectively and effkicntly establishproceduresto identify test&ted providers. 

B-4 
Material WeaknessCriteria 

The Office of Managementand Budget (OMB) hasspecified many criteria upon which a 

material weaknessdecision should be based. Findings meeting any single criterion constitute 

noncompliance with the Integrity Act and thus, should be classified as a material weakness. The 

following examplesillustrate how our fmdings meet severalcriteria substantiatinga material 

weaknessdesignation: 

l Does the weakxess violate statutory or regulatory requirements? 

As a result of inadequatecontrols, carriersfail to identify and deactivateall provider 

numbersbelonging to providers no longer legally authorized to provide servicesin 

the carrier’s jurisdiction. This violates Medicare law which does not allow payment 

to providers not in compliance with local, State,or Federalrequirements. 

l Does the weakxess significantly impact on the safeguards against waste, loss, 

unauthotized use offundr, property, or other resources? 

While we were unable to determine a precisefinancial vulnerability, the potential for 

abuseis high. In Florida, from 1980 to 1985,the carrier allowed chargesof over 15 

million dollars for physicians not legally authorized to practice. Carriers do not have 

controls in place to identify loss of legal authorization except for thoseproviders 

excluded from program participation (sanctioned). 

l Is the weakness of high political sensitivity such that it would resuLt in embarrassmenr 

to the Department? 

Beneficiaries trust the Medicare program to ensureproviders are in compliance with 

Federal, State,and local rquirements. The HCFA, through carriers, is responsible 

for assuringthis ttust is not betrayed. However, report findings raise concernsthat 

carrier maintenanceactivity doesnot adequatelyscrutinize providers once provider 

numbershave beenissuedto ensurethe provider is still qualified and that payment 

variables are correctly determined. Substanti Medicare paymentsto providers not 

legally authorized to practice would, indeed, be politically sensitive and embarrassing 

to the Department 

l Is the weakness a crosscutting weakness which indicates major systemic problems? 

Inadequateprovider number maintenanceis a major systemicproblem within 

Medicare. Errors in the provider number affect 

the ability to detect@ud and abuse, 

coverage and pricing of Medicare services, and 

- investigations of particular individuais or business. 

While this inspection involved only Medicare carriers, the OIG believes vulnerabilities identified 

in this report may exist in other programswhich assignprovider numbersto providers 

(e.g., Medicaid). 
APPENDIX C 

HEALTH CARE FINANCING ADMINISTRATION COMMENTS 

C-l 
MemorG 

F&i 28199l 

Gail R Wensky, PbD. e 

Administrator 

OIG Draft Report -. “Carrier Maintenance of Medicare Provider Numbers,” 

OEI-06-89-00870 

The Inspector General 

office of the Secretary 

We have reviewed the subject draft report which concernsMedicare carriers’ 

efforts to ensure the accuracyof provider numbers and to identify and restrict 

paymentsto providers who have lost their legal authority to practice. -

The report found that some Medicare carriers are not periodically updating 

provider records. OIG recommendsthat HCF’A improve the maintenance of 

provider numbers by requiring carriers to periodically update provider records, and 

suggestsspecific requirements for these updates. 

HCPA acknowledgesthe need for improvement in the instructions given to 

Medicare carriers regarding the maintenanceof provider numbers. However, we 

believe that this situation clearly does not constitute a material internal control 

weakness. Our specific commentson the report’s recommendationsare attached 

for your consideration. 

Thank you for the opportunity to review and comment on this draft report. 

Pleaseadviseus whether you agree with our position on the report’s 

recommendationsat your earliest convenience. 

Attachment 
Commentsof the Health Care Financinp Administration 

(HCFA\ on the OTG Draft Report - “Carrier Maintenance of 

Medicare Provider Numbers.” OEI-06-89-00870 

Recommendation 1 

HCFA should require carriers to update provider records periodically. 

. Resnonse 

HCFA concurs with this recommendation. 

> . Recommendation 2 

HCFA should require carriers to deactivate all provider numbers without current 

billing history. 

Resnonse 

HCFA concurs with this recommendation. We propose that this be an annual 

activity. The national start-up cost has been estimated to be approximateiy 

%200,000and the annual cost for all carriers to conduct the purge would be 

approximately %26,ooO.This requirement will be incorporated into the Medicare 

. Carriers Manual. When the funds necessaryto start this project are available, 

HCFA will instruct the carriers to implement this recommendation. 

Recommendation 3 

HCFA should require carriers to establish adequate controls to assurethat 

providers not legally authorized to practice are identified and their provider 

numbers deadted. As part of these controls, carriers should: 

m negotiate with State licensing authorities to obtain license and registration 

information at a minimum cost to the Medicare program. 

assessthe feasibility of computer matcheswith State licensing authorities 

and perform such matches routinely, if practical. 

maintain the license or certification number of providers in their provider 

file. 
Page 2 

m develop computer data entry edits for license numbers to assure 

uniformity and consistencywith the licensing authority’s method of 

recording license numbers. 

Recommendation5 

HCFA should negotiate with State licensing authorities, that carriers report to be 

uncooperative,to obtain license and registration information at a minimum cost to 

the Medicare program. 

Resnonseto Recommendation3 and 5 

HCF’A does not concur with these recommendations. While the recommendation 

that carriers should use State licensing authorities when verifying the Iicensingstatus 

of providers has merit, we anticipate problems that will preclude its implementation. 

Some States have privacy laws which prohrbit or limit the release of license and 

registration information. Some States do not have automated files, which eliminates 

the possibility of a computer match. Also, there is no legislative authority for 

requiring States to cooperate with a computer match. Any one of these problems 

could severelyrestrict carriers’ successin accessingthe information maintained by 

State authorities. 

. Our primary concern with the computer match proposal, however, is the return for 

the cost of such an operation. We project costs of over $1 million nationally to 

implement such a data exchangeat all carrier sites and over $250,000annually for 

ongoing activities. The data included in the OIG’s report does not indicate that we 

can expect a significant return on our investment. Becauseof the severebudget 

restrictions under which we operate, we do not believe that this data match wiil be 

cost effective. However, if carriers can establishdata exchangeswith State licensing 

authorities without charge and with minimal administrative costs,we will certainly 

encouragethem. 

We believe that the Unique PhysicianIdentification Number (UPIN) requirements 

firmly establishedboth a means and a HCFA commitment to maintaining accurate 

provider number information. The physicianscovered by the UPIN requirements 

(medical doctors, doctors of osteopathy,dentists, optometrists, chiropractors and 

podiatrists) make up the majority of the Medicare providers subject to license 

requirements. In the future, the UPIN may include additional limited license 

practitioners, such as clinical psychologists,clinical social workers and certified 

registered nurse anesthetists. 
Page3 

The UPIN processrequires the following from carriers when a LlPIN is established: 

0 verification of State licensure to practice, 

0 verification that a physician is not sanctioned,and 

0 information about prior out-of-State practice, if any. 

After establishinga record on the UPIN Registry, which servesas a national 

clearinghouse,carriers.receive physician-specificsanction information from the 

Registry on a quarterly basis. This data is taken from OIG’s report on Medicare 

fraud and abuse and other sanctions. Caniers use this data to ensure that 

sanctioned physiciansdo not have active status in the provider Gles. 

In addition to the UPIN system,HCFA’s Health Standardsand Quality Bureau 

(HSQB) maintains a.certification processwhich requires State licensure for 

Medicare participation by ceti other providers and suppliers. Included in 

HSQB’s certification processare physical therapists, occupational therapists, 

independent laboratories, ambulatory surgical centers and cardiac rehabilitation . 

centers. 

Recommendation 4 

HCFA should evaluate provider number controls establishedabove as a part of its 

regular carrier Contractor Performance Evaluation Program (CPEP). 

Resnonse 

HCFA does not concur with this recommendation. With the issuanceof the carrier 

manual revision proposed in responseto the second recommendation,the existing 

CPEP standard used to measure carrier adherenceto HCFA’s policies will evaluate 

compliance with this new requirement. Establishing a specific standard for provider 

number control would create problems associatedwith the measurementof a 

relatively small area of carrier claims processingresponsibility. : 

Allegation of the Existence of a Material Weakness 

HCFA does not agree that a material internal control weaknesserdstsin HCFA’s 

direction to carriers, or in the provider number carrier controls. This situation 

clearly does not meet the Office of Management and Budget’s or the Department’s 

definition of a material weakness. 
Page 4. 

HCFA believes that OIG did not consider the integral part that sanctionsunder 

Section 1128(b)(4) of the Social Security Act (the Act) play in maintaining the 

integrity of provider numbers. 

Traditionally, HCFA’s sanction staff collected information from Medical Licensing 

Boards and imposed sanctionsprohibiting those providers who had lost their legal 

authority to practice from participating in the Medicare and Medicaid programs 

under Section 1128(b)(4) of the Act. Medicare carriers were informed of the 

Licensing Board adverseactions during the development of the sanction .case,and 

when the sanction itself was imposed. HCFA relied on the sanctionsprocessto 

ensure that all Medicare carriers were informed of Medical Licensing Board adverse 

actions. However, a number of years ago, HCFA’s Program Integrity function was 

transferred permanently to OIG, along with the staff and budget for that function. 

Sanctioning of Medicare providers then became the responsibility of OIG. We 

believe that a continuation of this effort is essentialin maintaining the integrity of 

provider numbers. 

OIG’s rationale for determining that a material internal control weaknessexists, 

appears to be based on OIG’s findings that HCFA’s carriers are unable to timely . 

identify and restrict paymentsto providers who have lost their legal authority to 

practice becauseof adverseactions by Medical Licensing Boards. HCFA agrees 

this problem exists and believes that the solution to the problem will require more 

involvement by OIG’s sanction staff.