Prov

The Medicaid Management Information System (MMIS)

APPENDIX A 4

der Information Required by :

The State Medicaid Manual P
enrollment and credentialing
entered into MMIS in order t

not obtaining this information.

fart 11, Section 11320, specifies that the following provider
information outlined in the following table must be obtained and
meet Federal Reporting requirements. However, some States are

[ z
5

? z z

$ 3 =

2 = Ei

$ é 5! |g

3 2 s|2 3

5 3 2/5 2

3 Ble a |Z s |

=I 3 é eyes 3

g zig al2\5\/2

5 3 | Ean 5

a Zz < 61g) Els |

3 Big gs 8/2 8ia/% i

Hoge. 2282 Be: |

z BEES E FE le & :

5 elgls 2/42 S/2/ 8/2 /2 :

2 o/s) 2) eiala SiS F/2 8

3 FIS/E FFF sis izis ls

Si/EISi5 |e 8 s)s. BB Fg 3
States SeiZlIZlFl/F Gis |S FP eligig s :
Alabama niviviviviviviviviviviviv |
Alaska RiVviviviviviviviviviviviv i
Arizona ulviVviviviviviviv Viviv
Arkansas RiVvivivivivijviviviviviviv i
California wiv i|viviviviviviv Viviv
Colorado ulviviviviviviviviviv v 4
Connecticut RiViviviviviviviviviviviv q
Delaware wl|Viviviviv Viviviviv |
District of Columbia | 11| V/V |v iv iv i|viviv Viviv |
Florida Riviviviviviviviviviviviv 4
Georgia 9IV Viv iv Viviviviv ,
Hawaii 2i\ViViviviviviviviviviviv ;
Idaho uiviviviviviviviv viviv 4
‘Illinois RiVvViviviviviviviviviviviv 4
Indiana Riv iVviviviviviviviviviviv i
Towa RiVviviviviviviviviviviviv y
Kansas Riv iviviviviviviviviviviv /
Kentucky RiViviviviviviviviviviviv |
Louisiana Riv iviviviviviviviviviviv /
[Maine wiviviviviviviviviviviviv i
Maryland miviviviviviviviviviviviv d
Massachusetts RiViviviviviviviviviviviv

Credentialing of Medicaid Providers: Fe

wo

-For-Service OEI-07-99-00680

) ) osu neammepeaarmmensenn


California obtains the|names of manufacturers and suppliers who have business
relationships with applicants for Medicaid provider numbers. The State Medicaid
Agency then contacts the manufacturers and suppliers to verify application information.
In Florida, the State agency compares information provided to the applicant’s bonding
company with information supplied to them during provider enrollment.

Only two-thirds of|the States make use of information
available from external sources

Only 33 of the 50 States routinely gather information from external sources concerning
past investigations or ~ practice patterns. External entities, such as the Medicare

carriers, private insurers, other Medicaid State Agencies and Medicaid Fraud Control
Units may have important information about providers practicing within the State that
would be useful in the credentialing process. Similarly, for providers moving from out of
State, the corresponding entities from the previous location will have fundamental
historic information : a provider’s qualifications, disciplinary issues, and patterns of
practice that would assist the new State in properly credentialing and establishing
appropriate Medicaid payment utilization controls. Table 2 provides information on the
extent of States’ information sharing.

| Table 2

Medicaid State Agencies Coordination of Information

Coordinating Agencies Number of States’
Medicare Contr; actor (s) within the State 15
Medicaid Fraud Control Unit within the State 31
State Licensing lAgency(s) within the State 25
Private Insurance Companies 2

Other: HCFA, State Offices, Other States, Managed
Care Organizations, State Utilization Review Office 5

' Tennessee did nbt respond to this survey because its Medicaid program is 100 percent
managed care. |
Data Source: Office of Inspector General, Office of Evaluation and Inspections survey.

Most States have not established aggressive post
credentialing procedures

i
Post credentialing includes the re-enrollment and re-credentialing of active providers, the
deactivation of numbers no longer being used, and the reactivation of deactivated
numbers. |

Credentialing of Medicaid Providers: Fet-For-Service 7 ‘OEI-07-99-00680

SEER

t some 7 Hl



Number of States!
Type of information validating the information

Group applications - that all individual
members are not excluded from the

Medicare/Medicaid 13
Provider speciality 8
Provider’s authorized representative 2

Provider’s billing agency/management
service organization address 4

Provider’s change of ownership
information

Provider’s office telephone number

orn AN

Provider’s office FAX number
Provider’s prior practice location 1

Provider’s UPIN physicians only,
(M.D.’s, D.O.’s, D.P.M.’s, D.C.’s, O.D.’s,
and psychologist) ]

Query the National Practitioner Data

Bank to identify any license revocations,

loss of clinical privileges, loss of

professional society memberships, and

malpractice settlements 3

Query to the Healthcare Integrity and

Protection Data Bank (all providers) to

identify civil judgement, Federal or State

criminal convictions, actions by licensing

and certification authorities, and records

of exclusions from Federal and State

health care programs 2

' Tennessee did not respond to this survey because its Medicaid Program is 100 percent

managed care
Data Source: Office of Inspector General, Office of Evaluation and Inspections survey.

Credentialing of Medicaid Providers: Fee-For-Service 17 OEI-07-99-00680



Some States Report The Use of Additional Enrollment And Credentialing
Safeguards

We found that some States have implemented enrollment and credentialing criteria that
exceed the minimum Federal requirements. Many States share information and
coordinate with other insurance payers and investigative entities to obtain any additional
information on the provider. These additional processes afford additional protections for
both Medicaid beneficiaries and program funds. Some examples include:

» Criminal background checks (all providers) 1 State
>» Criminal background checks (some providers) 9 States
» Fingerprinting (all providers) 1 State
» Fingerprinting (some providers) 3 States
> On-site visits to provider office(s) 10 States
> Verification that provider telephone numbers

are working 8 States

RECOMMENDATIONS

We believe HCFA can do more to strengthen enrollment and credentialing requirements
to safeguard’ the Medicaid program, and support States that implement additional
measures to prevent Medicaid provider fraud and abuse.

We recommend HCFA take the following actions to safeguard the Medicaid
program:

Strengthen the Enrollment, Re-enrollment, and Credentialing Requirements of
Medicaid Providers

The HCFA, in conjunction with States, should strengthen the enrollment and
credentialing standards by duplicating or closely paralleling those currently being used
for the Medicare program.

Instruct States to Independently Verify the Provider’s Exclusion Status from All
Federal Programs

States, and third-party enrollment and credentialing organizations, need to determine a
provider’s exclusion status by reviewing both the monthly “Medicare/Medicaid Sanction-
Reinstatement Report” (HCFA Publication 69) and the General Services Administration’s
“List of Parties Excluded from Federal Procurement and Nonprocurement Programs.”

Require States to Obtain Provider Information From Other States and Federal
Entities

The HCFA should require States, as part of credentialing, to contact Medicare carrier(s),
other Medicaid State Agencies, and the Medicaid Fraud Control Units for information

Credentialing of Medicaid Providers: Fee-For-Service iii OEI-07-99-00680



OEI-07-99-00680

AQUINN WORBOINIZUOP] A9PIAOLY 21vdIpoTAl >

daquing Ayanaag [e0g >

7
v
v
v
v
v

daquiny UoHLsyyUapy s19X0;durg +

v
v
vivv

uoHEZIURSIO a1jdeAg JO OdAT,

daplaoig Jo adAy

Viviviviv

v
v
Vv

aaquiny dno,

7
Viviviviviv
Viv iviviviv

7
v

ssaappy dnoayy >

v

amey dnory|

7
Vv

ssoippy Surrey uomAeg +

ViVviviviviviviviv
viviviviv
Viviviviviv

Vv

v
14

saquiny! 4aplAodg preorpay paudissy A[snorAaag|

ssouppy >

amen >

50 | 50 41 50/47 41 | 41 | 50 | 37| 48 | 48 | 48

Viviviviviviviy

v
v

peurejqo sjuswie] gy vjVG JUoWTJoINg [BO 1) 7)

7
wiv Vviviv vivivivivivivev

Hiv viviviviviviviviviv

Riv iviviviviviviviviviviv
whv Viv iviviviviviviviviv
Wiviviviviviviviviviviv

RQihv VvViviviviviviviviviviv
RmihviVvVivivivivivivivjviviv
why Viv iviviviviviviviviv
Rilviviviviviviviviviviviv
wiv i Viviviviv

N/A|N/A| N/A| N/A |N/A) N/A|N/A|N/A| N/A |N/A] N/A N/A! N/A
Wmv Viviv vivivivivivivev
wiv VvVivivviviviviviviviy
Wiviviviviviviviviviviviv

tolv Vviviviv
10/Vv iv
niviviviviv
wiv iviviviv
uiviv
10/V |v
w|Vviviviviviv
Jo/v iv
10| Vv |v
wol|v i viviviv

in

Michigan

States

' Tennessee did not respond to this survey because its Medicaid program is 100 percent

South Carolina
South Dakota
managed care.
Data Source: Office of Inspector General, Office of Evaluation and Inspections survey.

Tennessee *
Texas

‘Utah

Ohio
Oklahoma
Oregon
Pennsylvania
Rhode Island
/Vermont
Virginia
|Washington
West Virginia
Wisconsin
Wyoming
Total

Mississippi
Missouri
Montana
Nebraska
‘Nevada

(New Hampshire
New Jersey
‘New Mexico
‘New York
North Carolina
North Dakota

Minnesota

Credentialing of Medicaid Providers: Fee-For-Service


Agency Comments

APPENDIX E

Credentialing of Medicaid Providers: Fee-For-Service 20

OEI-07-99-00680



APPENDIX C

Independent Validation of
Provider Enrollment
and Credentialing Information

Number of States!
Type of information validating the information

Business Organizations using contractors,
and that the contractor has not been
excluded from other Federal programs 3

Business Organizations using contractors,
and that the contractor has not been
excluded from Medicare/Medicaid

w

Business Organization using Contractor

and that Name, Address, Social Security

number and Employer Identification

Number is correct 2

Contact with the Medicare Carrier for the

provider’s current practice location to

identify current problems, overpayments,

ete. 0

Contact with Medicaid Fraud Control for
the provider’s prior practice location to
identify past problems, overpayment, etc 3

Contact with Medicare Carrier of the

State for the providers’s prior practice

location (if out of State) to identify past

problems, over payments, etc. 0

Contact with Medicaid State Agency for
the provider’s prior practice location to
identify past problems, overpayment, etc 2

Group practices - the legal business name
used to report to the IRS 9

Group applications - that all individuals
members are not excluded from other
Federal program 11

Group applications - that all individual
members are enrolled individually 7

Credentialing of Medicaid Providers: Fee-For-Service 16 ‘OEI-07-99-00680



Require States to obtain provider information from other
States and Federal entities

In line with the future move toward common provider identification numbers, HCFA
should require States, as part of credentialing, to contact Medicare carrier(s), other
Medicaid State Agencies, and the Medicaid Fraud Control Units for information
regarding out-of-State providers and providers that have recently relocated to the State.
These contacts could help identify any past criminal, legal, licensing and utilization
issues, thereby reducing inappropriate payments to the provider. For providers with a
past history of claim abuse, it will allow States to implement appropriate controls (e.g.,
system edits) at the point when the provider is enrolled into the State’s Medicaid
program. In addition, HCFA should require States to maintain ongoing communication
with Medicare carrier(s) and the fraud units in the State to similarly identify providers
with legal or utilization issues. This communication will help all parties obtain an early
alert when aberrant claims, quality of care, utilization, or legal matters are identified and
could help to reduce program losses.

Establish standards and processes for the deactivation and
reactivation of provider identification numbers

The HCFA should establish national standards and protocols for the deactivation and
reactivation of Medicaid provider identification numbers. The current inconsistency in
States’ methods of deactivating and reactivating numbers is no longer acceptable, since it
does not adequately protect Medicaid beneficiaries and program funds from the potential
utilization of inactive numbers by unscrupulous individuals and entities. In contrast, the
Medicare program is addressing this important issue by considering a policy revision to
require the deactivation of inactive provider numbers after 6 months of claims inactivity.
HCFA, in conjunction with States, should similarly address this problem in the Medicaid
program.

AGENCY COMMENTS

The HCFA generally agreed with the underlying intent of our recommendations for
strengthening enrollment and credentialing standards, sharing information among the
States and Federal entities, and deactivating inactive provider identification numbers.
However, they believe such improvements should be made by working with and advising
States rather than adoption of additional stricter Federal requirements. Appendix E
contains the complete text of these comments.

We understand HCFA’s desire to work collaboratively with States to improve and
strengthen Medicaid provider credentialing. However, if this approach is not successful

in achieving the needed improvements, HCFA may want to consider implementing more
prescriptive credentialing policies.

Credentialing of Medicaid Providers: Fee-For-Service ll OEI-07-99-00680



Upon completion of the Medicaid State Agency’s credentialing process, providers are
issued a provider identification number, commonly referred to as a PIN. A valid provider
identification number implies that the individual or entity using that number meets the
legal requirements for participation in the program and that claims submitted by that
individual or entity using the number also meet the legal requirements for program

participation.

Medicaid Re-credentialing and Provider Identification Number Deactivation

While not required, States can re-enroll and re-credential providers to insure they

continue to meet the

legal requirements for participation in the Medicaid program.

Periodically, States can request individuals or entities to resubmit some or all of the
information provided] during the initial enrollment and credentialing process. States can
then re-verify the provider-supplied information and recheck available electronic data
sources. These processes provide additional protections for both Medicaid beneficiaries
and the Medicaid program.

States may deactivate provider identification numbers for various reasons. For example,
States may deactivate these numbers when providers retire, cease business operations,
move their practices or operations, or when they are excluded from Medicare, Medicaid
or other Federal health care programs. This process offers additional protections by
preventing unscrupulous individuals or entities from using valid provider numbers to
imply that they have completed the enrollment and credentialing processes and meet the
legal requirements fot participation in the program.

Medicare Enrollment and Credentialing

In contrast to HCFA’s limited standards for enrollment and credentialing in the Medicaid
program, it has recently implemented uniform and comprehensive standards for these
processes in the Medicare program (see Appendix B).° HCFA requires:

>

initial credentialing, which includes a written application that is signed,
dated, and includes a statement of attestation;

verification of license from primary sources; and

determination of disciplinary status and eligibility of payment under
Medicare.

Further, HCFA is proposing regulations to further strengthen Medicare requirements to

include:

i
Credentialing of Medicaid Providers: Fee-For-Service

site visits to providers’ offices, as appropriate;

re-credentialing at least every 3 years to update the initial credentialing
information;

deactivation of unused provider numbers after 6 months; and

establishing standard procedures for the reactivation of Provider numbers.

w

OEI-07-99-00680



Page 3~June Gibbs Brown.

all required enrollment and credentialing information as specified in the State Medicaid Manual,

Part. The Regional Office Review Guide contains the procedures used to review program

eee ation i States. This addition will become effective with the reviews conducted during
1. "

OIG Recommendation
Instruct States to independently verify the provider's exchision status from all Federal
programs.

HCFA Response

‘We concur that States should independently verify the provider's exclusion status from Federal
programs. The Medicaid Fraud and Abuse Team released two State Medicaid Director letters in
May 2000. The first letter reminded States to-use the HCFA Pub. 69 monthly and OIG sanction
web sites as tools for ascertaining and verifying whether 2 provider is excluded. HCFA Pub. 69 is
available in both electronic format and hard copy. ‘The sevond letter reminded States of their
obligation to notify the O1G when an administrative sanction is imposed against a Medicaid
program provider.

In addition, in response to concems from sonte contractors and States having difficulty using the
OIG exclusion data in enforcirig sanctions, States will soon be given access to the Medicare
Exclusion Database (MED). The MED contains provider information obtained from the O1G.
We are working diligently so States can access the MED database online as soon as possible.

We have heard from States and other Federal programs that using General Services
Administration's (GSA) “List of Parties Excluded from Federal Procurement and
‘Nonprocurement Programs” is cumbersome and time consuming. This is a long-standing
problem. Consequently, it is difficult to do a data match to compare all the names in the GSr‘,
supplier book to a monthly exclusion list.

QIG Recommendation
Require States to obtain provider information from other States and Federal entities,

HCEA Response ,

As discussed in our previous responses, we continue to explore ways to strengthen provider
enroliment in a variety of different ways. Utilizing external information from States end Federal
entities may assist States in validating key information suggested by providers ‘or obtaining new
information relevant to enrollment or disenroliment actions.

Howevet, as we indicated previously, we lack sufficient basis ‘to concur with the recommendation
for new Federal requirements at this time, We beliave ‘continuing to work closely with States

Credentialing of Medicaid Providers: Fee-For-Service 23 OEI-07-99-00680

| —



TABLE OF CONTENTS

PAGE

EXECUTIVE SUMMARY ........ | eee cece eee e cee e eee eee een eee een teee i
INTRODUCTION ............... | Leese cece eee ete ete e eee e eee e eee eee eeeenes 1
FINDINGS ....000.........00., | Loe eeeeeceeeeeeteneeseeseeeneseeeesesuueeens 5
Enrollment and Credentialing Information Lenn eee ener eee een eee 5
Verification of Providers’ Exclusion Status 20.0. cece eee eee 6
Independent Verification of Information De eee eee nee cence nt e tenets 6
Information Available from External SOUMCES 6.6... cece ete eee eee 7

Post Credentialing Procedures | Cnn ee eee ene ene ene e cent tent eee eeee 7

Additional Enrollment and Cre:
RECOMMENDATIONS ........
AGENCY COMMENTS ......... |

ENDNOTES ................... H
APPENDICES

A: Provider Information Required by the Medicaid Management
Information System 2.0.0)... eee eee ee eect eee eet eneetennns 13

B: Medicare Program Provider| Enrollment and Credentialing Requirements ........ 15

C: Independent Validation of Provider Enrollment and Credentialing
Information... 06.2... c cece ete eee en nett n et eeaneeeeens 16

D: States’ Deactivation of Provider Identification Numbers ...............0 0.005 18

E: Agency Comments ....



regarding out-of-State
State. These contacts
utilization issues, the:

Establish Standards and

providers and for providers that have recently relocated to the
could help identify any past criminal, legal, licensing and
‘eby reducing inappropriate payments to the provider.

Processes for the Deactivation and Reactivation of

Provider Identification Numbers

The HCFA should establish national standards and protocols for the deactivation and
reactivation of Medicaid provider identification numbers similar to those policies being
considered for Medicare.

AGENCY COMMENTS

The HCFA generally agreed with the underlying intent of our recommendations for

strengthening enroll
States and Federal en

ent and credentialing standards, sharing information among the
ities, and deactivating inactive provider identification numbers.

However, they believe such improvements should be made by working with and advising
States rather than adoption of additional stricter Federal requirements. Appendix E

contains the complete,

We understand HCFA
strengthen Medicaid p
in achieving the need

text of these comments.

”s desire to work collaboratively with States to improve and
rovider credentialing. However, if this approach is not successful
d improvements, HCFA may want to consider implementing more

prescriptive credentialing policies.

Credentialing of Medicaid Providers: Fe

1e-For-Service iv OFT-07-99-00680



ENDNOTES

. The term States, as used in this report, includes the 50 States and the District of
Columbia.

2. Source: State Medicaid’s Fraud Control Units Annual Report dated June 2000.

3. Source: Health Care Financing Administration, Medicaid Information System (MSIS),
HCFA 2082 report (Table 1) produced on January 27, 2000

4. Source: Health Care Financing Administration Internet Site, Publications and Forms, Medicaid
Information, Actuarial Products, (http://www. hcfa.gov/pubforms/actuary/ormedmed/default4.htm)
January 22, 2001.

5. Source: State Medicaid Manual Part 11 § 11375.

6. Source: Medicare Carriers Manual, Professional Relations, (Pub. 14-4) § 1030.5D.

7. This listing, available through the Internet or by subscription, is a monthly compilation

of individuals and entities that are excluded throughout the U.S. Government from
receiving Federal contracts or funding.

Credentialing of Medicaid Providers: Fee-For-Service 12 OEI-07-99-00680



who are eligible to receive federally assisted income maintenance payments. In Fiscal
Year 1999, the Federal and State Governments jointly expended $180.9 billion to provide
for medical care to Medicaid beneficiaries. These expenditures are projected to increase
to $285 billion by Fiscal Year 2005. The HCFA provides Federal oversight for the

Medicaid Enrollment and

Credentialing of Medicaid Providers: F

Medicaid program.

States are allowed, wi
discretion in the meth

ithin Federal laws, regulations, and program policies, to exercise
ods used to administer, operate, and reimburse services for their

Medicaid programs. (As a result, States utilize diverse procedures including the processes

used to determine if p

roviders are, or continue to be, eligible for participation in the

program. Nonetheless, the Federal Government retains an obligation to ensure that

Medicaid beneficiarie
providers do not rece!

States have more than
providers. Whether

States must ensure thi
States accomplish thi
enrollment form) and
qualifying informatio
provider credentialing

s receive services only from qualified providers and that excluded
ve reimbursement from the Medicaid program.

Credentialing Process Requirements

35 years of experience enrolling and credentialing Medicaid
perating traditional fee-for-service or managed care programs,

it providers are legally authorized to participate in the program.
through enrollment (obtaining information from the provider on an
credentialing (independently verifying the enrollment and other

). Although States may contract with external entities to perform

, they are ultimately responsible for these activities.

The HCFA requires States, as part of the credentialing process, to determine if a provider

applying to participate
certification by specia
provider pertinent op
Information System, i
Identification Numbe:

in the Medicaid program has a valid professional license (and
ty where applicable). HCFA also requires States to obtain from the
rational information for entry into the Medicaid Management
cluding name, address, Social Security number or Employer
, and provider type. (Appendix A contains a list of the enrollment

and credentialing information HCFA requires for the Medicaid Management Information

System).>

The Social Security A
for services furnished
other Federal program
crimes, patient abuse,

ct § 1128 prohibits Federal Medicaid funds from being used to pay
by providers who have been excluded from Medicaid, Medicare, or
s. Providers can be excluded for convictions for program-related
fraud, or license revocation or suspension. The Act provides that

the Secretary is responsible for excluding providers from Federal health care programs,

including Medicaid.
a provider has been e:

In addition to the legi:
enrollment and credei
practices, including b

As part of the credentialing process, States should ascertain whether
cluded to prevent improper payments to them.

lative and HCFA requirements, States can also establish their own
tialing processes. For example, States can utilize a variety of
nding, background checks, and fingerprinting, to insure that

providers are reputable, competent, and accountable.

e-For-Service 2 OEI-07-99-00680



States’ Deactivation of
Provider Identification Numbers

APPENDIX D

No Recent Inactive
Relocated out | Death of Claims Claim Time

‘State Retirement of State Provider |Age |Activity Period
Alabama v v v v 24
Alaska Vv Vv 60
Arizona v Vv ¥ 24
Arkansas ¥v v v 12
California v v wv Vv 18
Colorado v v v v 60
Connecticut v v Vv
Delaware v v v
District of Columbia cA Vv v 24
Florida v Vv Vv Vv 36
Georgia v v v v 2
Hawaii v v v v 60
Idaho Vv v v v 24
Dlinois Vv v v v 18
Indiana _ wv v v
Towa v v v v 24
Kansas v v v v 18
Kentucky v v Vv
Louisiana v Vv Vv v 12
Maine v v v v 24
Maryland v v v
Massachusetts v Vv v
Michigan v v v
Minnesota v v v v 24

Not
Mississippi v v v Established
Missouri v v v 24
Montana Vv Vv v
Nebraska __ v Vv v v 24
‘Nevada v v v v 24
‘New Hampshire ¥ v v v 24
‘New Jersey v v
New Mexico v Vv 24
‘New York v v v 24
North Carolina v v Vv
North Dakota v 24
Ohio v v v ¥v 36
Oklahoma Vv v
Oregon v v v 18
Credentialing of Medicaid Providers: Fee-For-Service 18 OEI-07-99-00680



_ Department of Health and Human Services

OFFICE OF
INSPECTOR GENERAL

Credentialing of Medicaid Providers:
Fee-for Service

FEBRUARY 2001
OEI-07-99-00680



processes for Medicaid providers. These weaknesses may have negatively impact their
on-going program ints grity efforts.
|
States, within Federal Regulations, are allowed to determine how they will credential
their providers. These requirements may be stringent in one State, but less stringent in
another. States with the least stringent requirements risk having unlicensed, unqualified,
or “problem” providers migrating to their States. This could include providers whose
licenses have been revoked, restricted, or whose claims are under medical review.

|
Our study found ia areas of vulnerability in States’ enrollment and credentialing

We also found that most States have either partially or fully contracted out the function of
enrollment and credentialing to a Fiscal Agent in the private sector. However, States
remain ultimately responsible for ensuring providers meet Federal and State program
participation requirements.

Twenty-five States are not collecting all required enrollment
and credentialing information

While all States report they input enrollment information into the Medicaid Management
Information System, 25 States are not obtaining from the provider all pertinent enrollment
and credentialing information (e.g., group name, group address, type of provider, and type
of organization) as required by HCFA for entry into the system (refer to Appendix A).
For example, Alabama collects all of the required data elements, while Oklahoma and
Virginia only collect 7 of these elements. Table 1 shows the variance of information not
obtained by the States for input into the Medicaid Management Information System.

| Table 1

Number of
MMIS required data elements States who do not obtain this data’
Previously Assigned Medicaid Provider
Number | 9
Group Name 3
Group Address| 9
Group Number| 9
Type of Practice Organization 13
Employer Identification Number 2
Social Security number 2
Medicare Provider Identification Number 2

‘ Tennessee did not respond to this survey because its Medicaid program is 100 percent
managed care.
Data Source: Office of Inspector General, Office of Evaluation and Inspections survey.

Credentialing of Medicaid Providers: Fee-For-Service 5 ‘OEI-07-99-00680



ee

Legislative Changes Impacting Provider Enrollment and Credentialing

|
On August 21, 1996, Congress passed “The Health Insurance Portability and
Accountability Act of 1996,” (Public Law 104-191). One aspect of this law calls for the
creation of a standard health care provider identifier for all Federal, State, and private
health insurance programs. Health care providers will only be enumerated once. The
number assigned will be used by all health care payers. In response to this law, HCFA
published a Notice of Proposed Rulemaking in the Federal Register that will establish
such an identifier, At the time of our review, it is unclear what impact the assignment of
common identifiers will have on States’ enrollment and credentialing efforts.

|
METHODOLOGY

We utilized mail surveys to obtain information from the managers of Medicaid provider
enrollment for the 50|States and the District of Columbia. Tennessee is not included in
our calculations, since its Medicaid program is 100 percent managed care. We based our
surveys on:

> document reviews (e.g., Enrollment and Credentialing policies, procedures,
forms, and Pertinent State laws and regulations);

surveys;

discussions with HCFA and Medicaid State agencies staff;

reviews of pertinent Federal laws, regulations, and procedures; and

reviews of Medicaid Management Information System (MMIS) data elements
related to provider enrollment and credentialing.

To provide a more extensive review of States’ Medicaid enrollment and credentialing
efforts, we developed| additional questions based on our review of the Medicare
standards. We received a 100 percent response rate from the mailed surveys.

yvrVy

We encoded the survey responses and the information obtained from the documentation
reviews into a data file and tabulated the results using SAS® software. We performed
cross tabulation analysis to verify the accuracy and consistency of the responses. Using
the survey responses, we compared the States’ policies and procedures.

We conducted this inspection in accordance with the Quality Standards for Inspections
issued by the President's Council on Integrity and Efficiency.

Credentialing of Medicaid Providers: Fee-For-Service 4 OEI-07-99-00680



eption woul ‘better facilitate identifying past criminal, legal, licensing, and
é processes for the deactivation and reactivation of provider

gram integrity reviews indicated that many States ae king more
te and reactivate provider identification numbers. However, we do

inactive provider numbers after a 6-month period. Mote and more are implementing
deactivation standards, but the inactive billing period ranges from 12 months to 24
thonths. ‘While a 6-month deactivation period may be beneficial in some States, it may not be in
others. Nevertheless, the newly formed Federal/State Workgroup on Provider Enrollment will

0 ‘efforts to develop safeguards and strengthen the provider enroliment
processes in both: care und Medicaid.

Credentialing of Medicaid Providers: Fee-For-Service 24

OEI-07-99-00680



TRODUCTION

PURPOSE

To review States’ pro
non-institutional prac!

cesses for enrolling and credentialing Medicaid fee-for-service
titioners and suppliers.

BACKGROUND

Enrollment and crede;
(hereinafter referred t

> protect Medi
who are unq!
State, whose
Medicare,

prevent imp:
Federal and

Provider enrollment ai
identification number,
receive reimbursemen
years, States’! Medica

ntialing processes for Medicaid practitioners and suppliers
0 as providers) are designed to:

caid beneficiaries from receiving care or services from providers
alified (e.g., individuals or entities who are not licensed in the
licenses are limited or restricted, or who are excluded from
edicaid, and other Federal programs); and

‘oper payments for services rendered by providers who do not meet
State requirements for participation in the Medicaid program.

ind credentialing are needed to obtain a Medicaid provider

Providers use these numbers to submit claims for services and
it from the Medicaid program. However, over the past several
tid Fraud Control Units have investigated situations in which

provider identification numbers were associated with efforts to defraud the Medicaid

program.” Therefore,
and credentialing, sin
Medicaid fraud and al

The General Account
enrollment and creden
Representatives, Ove
reported the Health C:
oversee States’ efforts
further reported that H
enrollment processes
program.

The Medicaid Program
Medicaid (Title XIX

program for eligible |
41 million individuals

Credentialing of Medicaid Providers: Fei

we focused our efforts on States’ processes for provider enrollment
ce these efforts serve as first-line defenses in the prevention of
use,

ing Office (GAO) also expressed concerns about Medicaid
tialing requirements. In a hearing before the House of
‘sight and Investigations Subcommittee on July 18, 2000, GAO
are Financing Administration (HCFA) is doing relatively little to
at policing provider integrity in the Medicaid program. The GAO
CFA’s efforts to strengthen the Medicare program’s provider
ay provide HCFA an opportunity to do the same for the Medicaid

f the Social Security Act) is a jointly funded Federal-State health
w-income and needy individuals. It covers approximately
.° including children, the aged, blind, and/or disabled, and people

e-For-Service OEI-07-99-00680



APPENDIX B

Medicare Program Provider Enrollment
and Credentialing Requirements

The Health Care Financing Administration requires its intermediaries and carriers to
obtain a wide range of provider enrollment and credentialing information including:

> acompleted provider enrollment application;

> authenticating their Social Security number;

>» validating their Employer Identification Number;

> establishing if the applicant is properly licensed, certified and registered under
State law;

» Obtaining independent evidence of qualifying course work from educational
institution(s) where the applicant received his medical, professional, or related
training, diplomas, or degrees;

» affirming the applicant’s board certification(s) and speciality(ies);

» determining if the business name listed on the enrollment form is consistent with
the name reported to the Internal Revenue Service;

>» authenticating the legitimacy of the applicant’s business address;

>» determining if there are other business owners;

> establishing that all physicians in group practices are enrolled individually prior
to enrolling the group;

>» verifying the applicant’s listed affiliation with multiple campus units, and off
site units;

>» authenticating that the applicant and associated entities are not excluded from
the Medicare, Medicaid, and other Federal programs;

» determining whether the applicant and associated entities have previously
obtained Medicare Provider Identification Numbers (PINs) from other Medicare
contractors; and

>» establishing whether the applicant has previous overpayments or problems with
other Medicare contractors.

Medicare Carriers Manual, Professional Relations (Pub 14-40 § 1030.5D) provides

further detail concerning the Medicare program's enrollment and credentialing
requirements.

Credentialing of Medicaid Providers: Fee-For-Service 15 OEI-07-99-00680



@ DEPARTMENT OF HEALTICS HUMAN SERVICES: Higa Core Fanerrg Agmumatiation,
eaoty Astoniatotor
Waren,

De. omy

DATE: dAN - 5. 2001

TO: June Gibbs Brown
Inspector General

FROM: Robert A. Berenson, M.D. fdeit ag. Brrrecegis—~ 40
Acting Deputy Administrator .

SUBJECT: Office of the Inspector General (OIG) Draft Report: Credentialing of Medicaid
Providers: Fee-for-Service,” (OE]-07-99-00680)

‘Thank you for the opportunity to-review and comment on the above report.

The Health Care Financing Administration (HCFA) recognizes the importance‘of proper
credentialing of those providing health care services to Medicaid beneficiaries. As guardians of
es iadiclid woman. itis HCFA’s undisputed responsibility to assure that high quality health:
care is provided to Medicaid’s beneficiaries, who, almost by definition, are among the most
vulnerable members of society.

‘Wesco coca i te linge i CG cht cony Bes ate Bho RY
determine the professional status of many providers that apply to participate in the Medicaid
program. We are also troubled by the finding that “inany States accept provider enrollment
statements without independently verifying the information,” and that States need to do @ better
job of determining whether a provider has been excluded from Medicare or Medicaid
participation before issuing a Medicaid provider number,

Because of our high degree of concem, HCFA is already working closely with State Medicaid
programs on strengthening their fraud and abuse control activities. HCFA is taking proactive
measures to increase program safeguard acti by strengthening the provider enrollment
process in the Medicaid program through its National Medicaid Fraud and Abuse (F&A)
Initiative, The Medicaid F&A Initiative concluded program integrity teviews in eight States
during FY 2000 and will be conducting eight more:during FY 2001. One of the main arcas of
focus during these reviews was the provider enrollment process in States. The findings from
these’ reviews indicate that many States have already implemented some of the: recommendations:
provided by OG in this report:

Below are our comments on the report recommendations:

1 .
Strengthen the enrollment, re-enrollment, and credentialing requirements of Medicaid

Credentialing of Medicaid Providers: Fee-For-Service 21 OEI-07-99-00680



nine States do not obtain a previously assigned Medicaid provider number. Others do not
obtain the type of practice organization, or obtain the name, address, and number of group
practices.

States’ Verification of Providers’ Exclusion Status Is Incomplete

All States independently verify exclusion status through review of the Medicare/Medicaid
Sanction-Reinstatement Report, HCFA’s notice of Medicare or Medicaid exclusion
actions. However, only seven States review the General Services Administration’s “List
of Parties Excluded from Federal Procurement and Nonprocurement Programs,” which
should be used in conjunction with HCFA’s notice.

Many States Accept Provider Enrollment Statements Without Independently
Verifying the Information

Nineteen States do not contact co-lateral sources to independently verify provider
enrollment as required by HCFA.

Only Two-thirds of the States Make Use of Information Available from External
Sources

Only 33 of the 50 States routinely gather information from external sources concerning
past investigations or prior practice patterns. External entities, such as the Medicare
carriers, private insurers, other Medicaid State Agencies and Medicaid Fraud Control
Units may have important information about providers practicing within the State that
would be useful in the credentialing process.

Most States Have Not Established Aggressive Post Credentialing Procedures

Re-enrollment and re-credentialing. The HCFA has implemented national standards
for the enrollment and credentialing of Medicare providers and is proposing standards for
periodic re-enrollment and re-credentialing. However, HCFA has not imposed similar
requirements for Medicaid providers. We found 18 States, on their own initiative,
perform some type of provider re-enrollment and re-credentialing; the remaining

32 States do not.

Deactivation of provider numbers. Thirty five States deactivate Medicaid provider
identification numbers with no recent claims activity. This time frame ranges from
12 to 60 months with a median of 24 months.

Reactivation of provider numbers. States use diverse processes for reactivation of
provider identification numbers. Twenty-eight States require a new application and
perform some form of credentialing. The remaining States simply reactivate existing
numbers upon the submission of new claims.

Credentialing of Medicaid Providers: Fee-For-Service ii OEI-07-99-00680



Re-enrollment and re-credentialing

The HCFA has implemented national standards for the enrollment and credentialing of
Medicare providers and is proposing standards for periodic re-enrollment and
re-credentialing. In contrast, HCFA has not imposed similar requirements for Medicaid
providers. On their own initiative, 18 States perform some type of provider re-enrollment
and re-credentialing; the remaining 32 States do not. While States like the concept of
periodic re-enrollment, they cite the lack of staff, resources, and legislative support for
such an undertaking. In support of re-enrollment and re-credentialing, the State of
Florida reports that it has re-enrolled all of its Medicaid providers and, as a result,
reduced the number of active Medicaid provider numbers from nearly 83,000 in 1995 to
about 60,000 in 1999.

Deactivation of provider numbers

We found that 35 States deactivate Medicaid provider identification numbers with no
recent claims activity. This time frame for deactivation due to inactivity ranges from

12 to 60 months, with a median of 24 months. In contrast, HCFA requires its Medicare
contractors to deactivate numbers after 12 months of no claims activity, and is
considering a further reduction to 6 months. Appendix D provides additional details
concerning the States’ criteria and time periods for the deactivation of provider numbers.

Reactivation of Provider Numbers

States use diverse processes for reactivation of provider identification numbers.
Twenty-eight States require a new application and perform some form of credentialing.
Others will reactivate the number upon the submission of a new claim. For example, we
found that:

> five States will reactivate a provider identification number based upon an
abbreviated enrollment application with partial validations of the information.

> five States will reactivate a provider identification number from a new claim that
has not been active within 1-2 years.

> four States will reactivate a provider identification number using other
procedures (i.¢., when providers give a written statement requesting reactivation
of number; depending on the time of the deactivation; or if a number was
deactivated because of a wrong address).

States that do not re-enroll and re-credential prior to reactivating a provider identification

number risk making the Medicaid program accessible to unauthorized persons who could
reactivate a provider’s number without their knowledge.

Credentialing of Medicaid Providers: Fee-For-Service 8 OEI-07-99-00680



RECOMMENDATIONS

We believe HCFA can do more to strengthen enrollment and credentialing requirements to
safeguard the Medicaid program, while supporting those States that implement additional
measures to prevent Medicaid provider fraud and abuse. Current Federal requirements are
insufficient to adequately protect beneficiaries or the Medicaid program.

We recommend HCFA take the following actions to
safeguard the Medicaid program.

Strengthen the enrollment, re-enrollment, and credentialing
requirements of Medicaid providers

The HCFA, in conjunction with States, should strengthen the enrollment and
credentialing standards by duplicating or closely paralleling those currently being used
for the Medicare program. Additionally, when proposed enhancements to Medicare’s
enrollment and credentialing processes are implemented these standards should also be
applied to the Medicaid program. Implementing national standards would not limit States
from imposing additional enrollment and credentialing requirements on its providers.
Rather, they will provide a strong, consistent level of minimum processes for all States.
Further, since HCFA is planning the conversion from a variety of provider identification
numbers to the National Provider Identifier, establishing accurate and consistent
Medicaid enrollment, credentialing, and re-credentialing standards are vital.

Instruct States to independently verify the provider’s
exclusion status from all Federal programs

States, and third-party enrollment and credentialing organizations, need to determine a
provider’s exclusion status by reviewing both the monthly “Medicare/Medicaid Sanction-
Reinstatement Report” (HCFA Publication 69) and the General Services Administration’s
“List of Parties Excluded from Federal Procurement and Nonprocurement Programs.” As
part of a provider’s re-enrollment, and re-credentialing processes, the HCFA

Publication 69 and the GSA listings should also be checked. The HCFA should
encourage the General Services Administration to improve the usability and data
matching capability of their “List of Parties Excluded from Federal Procurement and
Nonprocurement Programs.

Credentialing of Medicaid Providers: Fee-For-Service 10 OEI-07-99-00680



EXE

TIVE MMARY

PURPOSE

To review States’ processes for enrolling and credentialing Medicaid fee-for-service
non-institutional practitioners and suppliers.

BACKGROUND

Enrollment and credentialing processes for Medicaid practitioners and suppliers
(hereinafter referred to as providers) are designed to:

> protect Medicaid beneficiaries from receiving care or services from providers
who are unqualified (e.g., individuals or entities who are not licensed in the
State, whose]licenses are limited or restricted, or who are excluded from
Medicare, Medicaid, and other Federal programs); and

>» prevent improper payments for services rendered by providers who do not meet
Federal and State requirements for participation in the Medicaid program.

Provider enrollment and credentialing are needed to obtain a Medicaid provider
identification number! Providers use these numbers to submit claims for services and
receive reimbursement from the Medicaid program. However, over the past several
years, States’ Medicaid Fraud Control Units have investigated situations in which

provider identification numbers were associated with efforts to defraud the Medicaid
program.

The HCFA requires States, as part of the credentialing process, to determine if a provider
applying to participate in the Medicaid program has a valid professional license (and
certification by specialty where applicable). It also requires States to obtain from the
provider pertinent enrollment and credentialing information for entry into the Medicaid
Management Information System, including name, address, Social Security number or
Employer Identification Number, and provider type.

We focused our efforts on States’ processes for provider enrollment and credentialing,
since these efforts serye as first-line defenses in the protection of beneficiaries and in the
prevention of Medicaid fraud and abuse.

FINDINGS

Twenty-five States Are Not Collecting All Required Enrollment and Credentialing
Information

Twenty five States aré not obtaining from the provider pertinent enrollment and
credentialing information as required by HCFA for entry into the system. For example,

Credentialing of Medicaid Providers: Fee-For-Service i OEI-07-99-00680



INo Recent | Inactive
Relocated out | Death of Claims Claim Time

State Retirement of State Provider [Age |Activity Period
Pennsylvania v v 120
Rhode Island v _ Vv N/A
South Carolina v v v 12
South Dakota Vv v v v 12
Tennessee ! N/A N/A N/A N/A NIA N/A
Texas v v 12
Utah ¥ v v v 4
‘Vermont v v v NA
Virginia iv v v v 36
Washington ; v v v 24
West Virginia v v v v 24
Wisconsin v v Vv N/A
Wyoming v ¥ v 12
State Totals: 46 34 49 0 35

' Tennessee did not respond to this survey because its Medicaid Program is 100 percent managed care.

Data Source: Office of Inspector General, Office of Evaluation and Inspections survey

Credentialing of Medicaid Providers: Fee-For-Service 19 OEI-07-99-00680



OFF

The mission of the Office of
amended by Public Law 100-;
Human Services programs as

This statutory mission is carrie

inspections, sanctions, and fra
and management problems an
to correct them.

Off

The Office of Evaluation and
Inspector General. It conduct;
inspections) that focus on isst
inspection reports provide fint
effectiveness of departmental

OEI's Kansas City office prep:
Regional Inspector General.

REGION

Madeline Carpinelli, Progra
Zula Crutchfield, Project Le
Perry A. Seaton, Team Leade

To obtain copies of this rep
Reports are also av:

FICE OF INSPECTOR GENERAL

nspector General (OIG) mandated by Public Law 95-452, as

504, is to protect the integrity of the Department of Health and
‘well as the health and welfare of beneficiaries served by them.

d out through a nationwide program of audits, investigations,

ud alerts. The Inspector General informs the Secretary of program
id recommends legislative, regulatory, and operational approaches

fice of Evaluation and Inspections

Inspections (OEI) is one of several components of the Office of

's short-term management and program evaluations (called

es of concern to the Department, the Congress, and the public. The
dings and recommendations on the efficiency, vulnerability, and
programs.

ared this report under the direction of Brian T. Pattison, Deputy
Principal OEI staff included:

ARTE

Analyst Linda Frisch, Program Specialist

der

rt, please call the Kansas City Regional Office at (816) 426-3697.
ilable on the World Wide Web at our home page address:

http://www.hhs.gov/oig/oei/



Page 2- June Gibbs Brow
providers.
HCEA Response

‘We agree that effective and appropriate provider enrollment is a critical aspect of protecting the
integrity of the Medicaid program, We iso area withthe O1G's recommendation 19 tominoe

our work to strengthen these fimetions within States. However, we believe that imposing
additional Federal requirements ‘on States may-not be the best way to accomplish this goal.

eee eae yarte, Whale wecheas onset option of coveoptegedtivona

Federal requirements, our approach has focused on a series of steps: disseminating ion on.
promising epproaches; conducting reviews of provider enrollment in States; and carefully
analyzing the possibilities for Medicare-Medicaid interaction on provider enrollment. As the
national provider ‘is developed, additional opportunities may be identified on how the
Federal and State gor its can best work together to avoid duplication of effort, exchange
information, and share nsibilities.

Provider enrollment is sed of three distinct and important parts, for which different

solutions may be appropriate, The first is the collection of information—the decision on what
information to collect, nd the mechanical process of collecting and maintaining the information,

valid the decision on how to ensure that the information provided is

accurate and true, and the mechanical process of onzying out ihe validation. ‘The third area is:

decision:on where to set the bar fur entry into the program, whet triggers

and the mechanical process for making and enforcing those decisions.

We belive that, at this and based on this analysis, it would be premature for us to agree
to new Federal req) ‘on States. With Meditare changes and other Federal activity (such
as the National Provider Identifier) underway, we should carefully assess where and.when to

apply other Federal. es, particularly as they relate to the collection of data from providers

es at the State level.

‘examining the potential benefits of a Medicare “buy-in” for States for
‘enrollment activity. Under this concept, States could take-advantage
of Medicare’s data collection and validation system for providers who do business with both
programs. We believe that this concept holds promise for enhancing the integrity of provider
information, reducing costs for States, and minimizing burden on providers.

In the interim, States continue to collect information from providers as required in existing
regulations. The Medicaid F&A Initiative will take responsibility to incorporate into the Regional
Office Review Guide, 4 new focus on expanding State collection of information of

Credentialing of Medicaid Providers: Fee-For-Service 22 OEI-07-99.00680



States’ verification of providers’ exclusion status is
incomplete

States must determine a provider’s Medicare, Medicaid, and other Federal programs
exclusion status before assigning a Medicaid provider number. We found that all States
independently verify that applicants for Medicaid provider numbers have not been
excluded from either the Medicare or Medicaid programs. States accomplish this
verification primarily through a review of the Medicare/Medicaid Sanction-Reinstatement
Report (HCFA publication 69), HCFA’s official notice of Medicare or Medicaid
exclusion actions. Other sources used include the Inspector General’s Internet site and
the Healthcare Integrity and Protection Data Bank.

However, this verification alone does not protect the Medicaid program from enrolling
providers who have been excluded from all Federal programs, contracts, and funding by
the General Services Administration. We found only seven States reviewed the General
Services Administration’s “List of Parties Excluded from Federal Procurement and
Nonprocurement Programs.” The list, issued monthly in both hard copy and on the
Internet, identifies parties excluded throughout the U.S. Government from receiving
Federal contracts or certain subcontracts and from certain types of Federal financial and
non financial assistance and benefits. Parties found on this list are individuals, entities,
and contractors (e.g., Tri-Care, or VA providers). Information on the list is limited to the
name of the individual or company, address, the type of exclusion code, the government
agency initiating the exclusion, and the time period for the exclusion. It does not contain
unique identifiers normally used for computer matching and comparison, such as Social
Security numbers or Employer Identification Numbers.

The “Federal Acquisition Streamlining Act of 1994” (Public Law 103-355) § 2455 states
“No agency shall allow a party to participate in any procurement or nonprocurement
activity if any agency has been debarred, suspended, or otherwise excluded that party
from participation in a procurement or non procurement activity.” Asa result, States may
be incorrectly using Federal funds to pay for services furnished by a provider who is
debarred from all Federal programs, including Medicaid.

Many States accept provider enrollment statements without
independently verifying the information

The HCFA national standards for Medicare contractors require independent verification
of provider enrollment information. However, we found that 19 States do not contact
independent sources to verify information for Medicaid providers. In addition, only two
States in our survey contact other States’ Medicaid Agencies to identify past practice
problems. (Refer to Appendix C for further detail.)

In contrast, some States have developed creative mechanisms for verifying enrollment

and credentialing information from independent sources, as reported in our inspection
report Medicaid Proactive Safeguards, OEI-05-99-00070, July 2000. For example,

Credentialing of Medicaid Providers: Fee-For-Service 6 OEI-07-99-00680



Some States report the use of additional enrollment and
credentialing safeguards
As shown in Table 3, we found that some States have implemented enrollment and
credentialing criteria that exceed the minimum Federal requirements. These additional
processes afford additional protections for both Medicaid beneficiaries and program
funds.
Table 3
| States’ Enrollment and Credentialing Criteria
that Exceeds Federal Requirements
Enrollment/er¢ edentialing process Number of States!
Criminal background checks (all providers) 1
Criminal background checks (some providers) 9
Fingerprinting (all providers) 1
Fingerprinting (some providers) 3
On-site visits to provider office(s) 10
Verify providers’ telephone numbers are working 8
* Tennessee did not respond to this survey because its Medicaid program is 100 percent
managed care.
Data Source: Office of Inspector General, Office of Evaluation and Inspections survey.
i
|
Credentialing of Medicaid Providers: Fee-For-Service 9 OEI-07-99-00680