Department of Health and Human Services

OFFICE OF

INSPECTOR GENERAL

VULNERABILITIES IN CMS’S 

AND CONTRACTORS’

ACTIVITIES TO DETECT AND 

DETER FRAUD IN

COMMUNITY MENTAL 

HEALTH CENTERS

Daniel R. Levinson 

Inspector General

January 2013

OEI-04-11-00101
 

EXECUTIVE SUMMARY: VULNERABILITIES IN CMS’S AND 

CONTRACTORS’ ACTIVITIES TO DETECT AND DETER FRAUD IN

COMMUNITY MENTAL HEALTH CENTERS

OEI-04-11-00101

WHY WE DID THIS STUDY 

During 2010, 206 community mental health centers (CMHC) received an estimated 

$218.6 million for providing partial hospitalization program services to approximately 

25,000 Medicare beneficiaries. Arrests by Medicare Fraud Strike Forces indicate that 

some parts of the country have a higher prevalence of CMHC fraud, including areas in 

Florida, Louisiana, and Texas. A recent Office of Inspector General (OIG) study found 

that approximately half of CMHCs exhibited questionable billing in 2010, most of which 

were in Florida, Louisiana, and Texas. Other OIG studies have found problems with the 

Centers for Medicare & Medicaid Services’ (CMS) oversight of contractors. 

HOW WE DID THIS STUDY

We collected information and documentation from CMS, Medicare Administrative 

Contractors (MAC), and Zone Program Integrity Contractors (ZPIC) regarding activities

to detect and deter fraudulent CMHC billing in 2010. We also analyzed Medicare claims 

data from the National Claims History Outpatient File to determine the extent to which 

Medicare paid CMHCs subject to payment suspensions, revocations, or selected autodeny 

edits in 2010. 

 

WHAT WE FOUND

One of nine MACs we reviewed performed activities to detect and deter CMHC fraud in 

2010, and most of these were part of a CMS-led special project. Activities to detect and 

deter CMHC fraud varied substantially among ZPICs in 2010, with one ZPIC performing 

almost all such activities. Most of these activities were part of the same CMS-led special 

project. Other MACs and ZPICs performed minimal activities to detect and deter 

fraudulent CMHC billing, despite having jurisdiction over fraud-prone areas. 

Additionally, Medicare paid CMHCs that did not comply with its requirements after their 

revocations were effective and while their revocations were being approved. Medicare

also could have prevented payments to potentially fraudulent CMHCs by consistently 

applying an autodeny edit across Florida CMHCs. 

WHAT WE RECOMMEND

We recommend that CMS (1) implement additional CMHC fraud mitigation activities in 

all fraud-prone areas, (2) develop a system to track revocation recommendations and 

improve revocation communication with contractors, (3) coordinate activities to deter 

CMHC fraud in Florida, and (4) follow up on payments made to CMHCs after the 

effective dates of their billing privilege revocations. CMS concurred with all four 

recommendations.
TABLE OF CONTENTS

Objectives ....................................................................................................1 

Background ..................................................................................................1 

Methodology ..............................................................................................10 

Findings......................................................................................................13 

One of nine MACs we reviewed performed activities to detect 

and deter CMHC fraud in 2010, and most were part of a 

CMS-led special project .................................................................13 

Activities to detect and deter CMHC fraud varied substantially 

among ZPICs in 2010 ....................................................................14 

Medicare paid CMHCs that did not comply with its requirements 

in 2010 and could have prevented payments to potentially 

fraudulent CMHCs .........................................................................18 

Conclusion and Recommendations ............................................................21 

Agency Comments and Office of Inspector General Response .....23 

Appendixes ................................................................................................24 

A: Number of Community Mental Health Centers and Medicare 

Payments by State, 2010 ................................................................24 

B: Medicare Administrative Contractor Jurisdictions...................25 

C: Zone Program Integrity Contractor Zones ...............................26 

D: Medicare Administrative Contractor Activities To Detect and 

Deter Fraud, 2010 ..........................................................................27 

E: Zone Program Integrity Contractor Activities To Detect and 

Deter Fraud, 2010 ..........................................................................28 

F: Agency Comments ....................................................................29 

Acknowledgments......................................................................................32 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

1

OBJECTIVES 

To determine the extent to which: 

1. the Centers for Medicare & Medicaid Services (CMS) and selected

contractors performed activities to detect and deter fraudulent billing 

by community mental health centers (CMHC) in 2010 and

2. Medicare paid CMHCs that were subject to payment suspensions, 

revocations, or selected electronic edits because of suspected fraud. 

BACKGROUND

Medicare Part B covers partial hospitalization programs (PHP) that 

CMHCs provide to Medicare beneficiaries.1 During 2010, 206 CMHCs in 

25 States received approximately $218.6 million for providing PHP 

services to approximately 25,000 beneficiaries.2

 See Appendix A for the 

number of CMHCs and total Medicare payments to CMHCs by State in 

2010. 

PHP Services and Requirements

PHPs are intense, structured outpatient mental health treatment programs.3

They are designed for patients moving from an inpatient level of 

psychiatric care to outpatient care or for patients at risk of relapse or 

hospitalization.4

To qualify for PHPs, Medicare beneficiaries must:

• have a mental disorder that severely interferes with multiple areas of 

their daily lives, including social, vocational, and/or educational 

functioning;5

• be cognitively and emotionally capable of participating in treatment;6

and

• be under an individualized treatment plan established and periodically 

reviewed by a physician.7

1 Social Security Act, § 1832(a)(2)(J), 42 U.S.C. § 1395k(a)(2)(J).

2 In 2010, 24 States and 1 territory had CMHCs that received Medicare reimbursement. 

Hereinafter, we refer to the States and territories as States. 3 Social Security Act, § 1861(ff)(3)(A), 42 U.S.C. § 1395x(ff)(3)(A). 4 CMS, Medicare Benefit Policy Manual, Pub. No. 100-02, ch. 6, § 70.3.B.1. 5 Ibid., ch. 6, § 70.3.

6 Ibid.

7 42 CFR § 424.24(e)(2); CMS, Medicare Benefit Policy Manual, Pub. No. 100-02, ch. 6, 

§ 70.3.B.5.c.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

2

Additionally, PHPs must offer individual, group, family, occupational, and 

activity therapies.8 Beneficiaries must receive a minimum of 20 hours of 

covered services per week.9 

To be eligible for Medicare reimbursement for PHPs, CMHCs must offer 

the following: 

• outpatient services,

• 24-hour emergency services,

• screening services, and 

• PHPs.

10 

Medicare reimburses CMHCs only for PHPs; other payers, including 

Medicaid, may cover the other three types of services.11 

CMHC Medicare Fraud

Findings from an Office of Inspector General (OIG) report and results of 

Federal investigations indicate that CMHCs may be particularly 

vulnerable to fraud, waste, and abuse involving PHP services. They also 

indicate that certain areas are more prone to CMHC fraud than others. For 

example, an OIG report on questionable billing patterns in CMHCs found 

that approximately 82 percent (84 of 102) of CMHCs exhibiting 

questionable billing were located in Florida, Louisiana, and Texas.12 Eight 

cities within those States contained high percentages of CMHCs with 

questionable billing. 

The Medicare Fraud Strike Force (Strike Force) is an essential component 

of the Health Care Fraud Prevention and Enforcement Action Team 

(HEAT), a joint effort between the Department of Health and Human 

Services (HHS) and the Department of Justice (DOJ) to combat health 

care fraud.13 Strike Force teams are designed to identify and investigate 

fraud and prosecute perpetrators quickly. They are composed of Federal 

prosecutors, agents from OIG and the Federal Bureau of Investigation, and 

8 Social Security Act, § 1861(ff)(2), 42 U.S.C. § 1395x(ff)(2); 42 CFR § 410.43(a)(4); 

CMS, Medicare Benefit Policy Manual, Pub. No. 100-02, ch. 6, § 70.3.B.2. 9 CMS, Medicare Benefit Policy Manual, Pub. No. 100-02, ch. 6, § 70.3.B.1. 10 Social Security Act, § 1861(ff)(3)(B)(i)(I), 42 U.S.C. § 1395x(ff)(3)(B)(i)(I); Public 

Health Service Act, § 1913(c)(1), 42 U.S.C. § 300x-2(c)(1); 42 CFR §§ 410.2 and 

410.110.

11 Social Security Act, § 1866(e)(2), 42 U.S.C. § 1395cc(e)(2).

12 OIG, Questionable Billing by Community Mental Health Centers, OEI-04-11-00100, 

August 2012.

13 Medicare Strike Force teams are located in Miami, Tampa, Baton Rouge, Houston, 

Dallas, Los Angeles, Detroit, Brooklyn, and Chicago.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

3

in some cases State and local law enforcement agencies. Strike Force

teams are supported by data analysts and CMS program experts.14 

Strike Force investigations have led to charges against several CMHC 

operators in a few key cities from 2009 to 2012. For example, four 

CMHC owners and managers in Miami pleaded guilty to or were 

convicted of Medicare fraud in 2011. These individuals manipulated 

patients’ charts, diagnoses, and lengths of stay to fraudulently bill 

Medicare approximately $205 million for medically unnecessary PHP 

services from 2003 to 2010.15 In another case, a Strike Force team 

charged seven individuals in Baton Rouge in April 2012 for allegedly 

fraudulently billing Medicare approximately $225 million from 2005 to 

2011.16 In December 2011, Strike Forces arrested three individuals in 

Houston for allegedly participating in a scheme that resulted in more than 

$90 million in fraudulent billing from 2006 to 2011.17 These schemes 

involved fraudulent billing for mental health services, including PHP 

services. 

The previously mentioned OIG report identified eight cities that had high 

percentages of questionable billing CMHCs. Independent of the report, 

Strike Force activities led to CMHC operator arrests in three of these same 

cities (Baton Rouge, Houston, and Miami). We identified these cities as 

prone to CMHC fraud (see Figure 1). 

14 HHS, Strike Force Formed to Target Fraudulent Billing of Medicare Program by 

Health Care Companies. Accessed at 

http://www.hhs.gov/news/press/2007pres/05/20070509c.html on February 24, 2012. 15 DOJ, Owner of Miami-area mental health care corporation convicted on all counts for 

orchestrating $205 million Medicare fraud scheme. Accessed at 

http://www.justice.gov/opa/pr/2011/August/11-crm-1074.html on August 23, 2011. 16 DOJ, Medicare Fraud Strike Force Charges 107 Individuals for Approximately 

$453 Million in False Billing. Accessed at http://www.justice.gov/opa/pr/2012/May/12-

ag-568.html on June 20, 2012. 17 DOJ, Owners of Houston Mental Health Company and Assisted Living Facility 

Indicted for Alleged Roles in $90 Million Medicare Fraud Scheme. Accessed at 

http://www.justice.gov/opa/pr/2011/December/11-crm-1639.html on February 24, 2012.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers 

(OEI-04-11-00101) 

4 

Strike Force City 

Strike Force City With Fraud Cases Against CMHC Operators 

Figure 1: Fraud-Prone Areas 

City Having High Percentage of CMHCs With Questionable Billing 

Source: OIG analysis of HEAT Strike Force Cities, DOJ press releases, and CMHCs with questionable billing. 

CMS and Medicare Contractor Coordination 

CMS contractors assist in the oversight and administration of Medicare. 

Oversight tasks include detecting and deterring fraud; administrative tasks 

include processing Medicare claims. CMS directs contractor activities by 

issuing statements of work, publishing program manuals, and offering 

technical guidance. CMS also may inform contractors of oversight or 

administrative activities that have been successful in other jurisdictions. 

Contractors may consider implementing, but are not required to 

implement, these activities in their own jurisdictions. 

CMS approval is required before certain contractor-initiated sanctions may 

be implemented.18 For example, CMS responds to Zone Program Integrity 

Contractors’ (ZPIC) recommendations to suspend Medicare payments to 

providers.19 Once a suspension has been imposed, Medicare 

Administrative Contractors (MAC) review either 100 percent of claims or 

18 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 3, § 3.9.2.1 

(Rev. 282, January 1, 2009). This provision was moved to CMS, Medicare Program 

Integrity Manual, Pub. No. 100-08, ch. 8, § 8.3.2.1. 19 The initial approval is for a payment suspension period of up to 180 days, with the 

option to extend for an additional 180 days. Providers may not appeal suspensions. 

CMS determines which action, if any, ZPICs should take. CMS, Medicare Program 

Integrity Manual, Pub. No. 100-08, ch. 3, § 3.9.2.4 (Rev. 282, January 1, 2009). This 

provision has been moved to CMS, Medicare Program Integrity Manual, Pub. No. 

100-08, ch. 8, § 8.3.2.4. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

5

providers.19 Once a suspension has been imposed, Medicare 

Administrative Contractors (MAC) review either 100 percent of claims or 

a statistical sample to determine the percentage of suspended claims that 

are payable.20 

In some instances, CMS approval is required to implement revocations of 

providers’ and suppliers’ Medicare billing privileges.21 There is no 

timeframe or requirement for CMS to approve or deny ZPIC 

recommendations for revocation, and providers and suppliers may 

continue to bill Medicare in the intervening time. Provider and supplier 

billing privileges may be revoked for 1 to 3 years, and providers may not 

reenroll in Medicare or receive payment during that time. Once provider 

billing revocations are finalized, MACs are instructed to document these 

providers and suppliers in the Provider Enrollment, Chain and Ownership 

System.

22

MACs 

The Medicare Prescription Drug, Improvement, and Modernization Act of 

2003 mandated that the Secretary of HHS replace current claims payment 

contractors, such as fiscal intermediaries (FI), with MACs.23, 24 CMS 

19 The initial approval is for a payment suspension period of up to 180 days, with the 

option to extend for an additional 180 days. Providers may not appeal suspensions. 

CMS determines which action, if any, ZPICs should take. CMS, Medicare Program 

Integrity Manual, Pub. No. 100-08, ch. 3, § 3.9.2.4 (Rev. 282, January 1, 2009). This 

provision has been moved to CMS, Medicare Program Integrity Manual, Pub. No. 

100-08, ch. 8, § 8.3.2.4. 20 Ibid., ch. 3, § 3.9.2.3.1 (Rev. 282, January 1, 2009). This provision has been moved to 

CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 8, § 8.3.2.3.1. 21 CMS and/or MACs may revoke a provider’s or supplier’s Medicare billing privileges 

for several reasons. MACs must obtain CMS approval to revoke a provider’s or a 

supplier’s billing privileges resulting from instances in which the provider or supplier 

submits a claim for services or supplies that could not have been furnished on the date of 

service. MACs may revoke a provider’s or a supplier’s billing privileges for any of the 

other listed reasons without CMS approval. The length of the revocation depends on the 

type of infraction. Providers and suppliers may appeal revocations. CMS, Medicare 

Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.27.2. 22 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.27.2.D. 23 Medicare Prescription Drug, Improvement, and Modernization Act of 2003, 

P.L. 108-173, § 911; Social Security Act, § 1874A; HHS, Report to Congress, Medicare 

Contracting Reform: A Blueprint for a Better Medicare, February 7, 2005. 24 CMS has contracts with three different types of MACs to process three different types 

of Medicare claims, including (1) durable medical equipment (DME), (2) home health 

and hospice (HH&H), and (3) other Part A and Part B claims (A/B). Four DME MAC 

jurisdictions (which cover the entire country) are responsible for processing all durable 

medical equipment claims. Four HH&H MAC jurisdictions (which also cover the entire 

country) are responsible for processing all home health and hospice claims. Lastly, 15 

A/B MAC jurisdictions (which also cover the entire country) are responsible for 

processing all other Part A and Part B claims. This report covers only A/B MACs, and 

we will refer to these contractors simply as MACs.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

6

established 15 jurisdictions in which MACs operate.25 Each jurisdiction

covers multiple States.26 CMS typically contracts with a different private 

company to serve as a MAC in each jurisdiction. 

As of November 2012, MACs were operational in 12 jurisdictions.

27 

Appendix B provides a map of MACs and the States in each jurisdiction. 

However, not all providers in the States listed in Appendix B are under the 

jurisdiction of the MAC for their States. Some CMHCs in a State with an 

active MAC are still under the jurisdiction of an FI.28

MACs are responsible primarily for processing and paying Medicare 

claims correctly, reliably, and in as timely a fashion as possible.29 To 

accomplish this, MACs process claims and collaborate with CMS and 

other contractors to ensure that claims are paid correctly.30 

MACs also are responsible for preventing Medicare from paying for 

inappropriate services by educating providers on appropriate billing 

methods.31 They also review claims for errors using computer processing 

tools; update coverage determinations; and recoup any overpayments that 

they, or any other contractor, identify.32 MACs are also responsible for 

promoting the fiscal integrity of Medicare by detecting and deterring 

fraud.33 

MACs are expected to perform a number of activities to detect fraud. For 

example, MACs screen beneficiary complaints, perform medical record 

25 Over the next several years, CMS plans to further consolidate the MACs for Parts A 

and B from 15 to 10 jurisdictions. CMS, A/B MAC Jurisdictions. Accessed at 

https://www.cms.gov/MedicareContractingReform/ on November 30, 2011. 26 Jurisdictions also may cover territories.

27 The 12 MACs operational by November 2012 were for jurisdictions 1, 3, 4, 5, 8, 9, 10, 

11, 12, 13, 14, and 15. A contract for jurisdiction 6 was awarded in January 2009 but 

was subject to a bid corrective action and protest; the MAC is expected to be operational 

in January 2013. Also, a contract for jurisdiction 7 was not awarded as of November

2012. Jurisdiction F, which consolidated jurisdictions 2 and 3, became operational in 

February 2012. Jurisdiction H, which consolidated jurisdictions 4 and 7, became 

operational in November 2012. Until consolidation is complete, some FIs and carriers 

continue to process Medicare claims in jurisdiction 6. 28 Until March 2006, CMHCs were allowed to select their own claims payment 

contractors. Some CMHCs continue to use these contractors. CMS, Medicare Claims 

Processing Manual, Pub. No. 100-04, ch. 1 § 20. 

29 CMS, Part A and Part B Medicare Administrative Contractor Statement of Work, 

Attachment J-1, Master, § C.4.4.a, September 2011. 30 This includes preventing improper payments by reviewing claims. CMS, Medicare 

Program Integrity Manual, Pub. No 100-08, ch. 3, § 3.3.1 31 Ibid., ch. 1, § 1.3, and ch. 3, § 3.1. 32 Ibid., ch. 1, § 1.3.1.B; and ch. 3, § 3.8. 33 CMS, Part A and Part B Medicare Administrative Contractor Statement of Work, 

Attachment J-1, Master, §§ C.4.4.a and C.5.13, September 2011.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

7

reviews, conduct site visits to problematic providers when instructed by 

CMS, and refer providers suspected of fraud to ZPICs for investigation.34 

MACs collaborate with CMS and ZPICs to deter fraud.35 In some 

instances, CMS or MAC approval is required to implement ZPIC 

recommendations to revoke the billing privileges of providers and 

suppliers.36 MACs may also independently revoke the billing privileges of 

providers and suppliers.37 MAC approval is also required to implement

ZPIC recommendations to deactivate providers that have not billed 

Medicare in a calendar year.38 Once deactivated, providers must reenroll 

before they may bill Medicare.39 

MACs and ZPICs also work together to create autodeny edits, which are 

electronic payment system controls intended to prevent payment for 

potentially fraudulent claims.40, 41 These edits analyze claims’ attributes 

and automatically prevent Medicare from paying claims based on 

suspicious attributes. For example, some edits prevent payment for all 

services submitted by suspicious providers. Other edits prevent payment 

for certain types of services for beneficiaries identified as part of a fraud 

scheme for specific services. 

Lastly, MACs must ensure that Medicare does not pay sanctioned 

providers (i.e., those with payment suspensions, revoked billing privileges, 

deactivations, or Federal health care program exclusions).42 

ZPICs 

The Medicare Prescription Drug, Improvement, and Modernization Act of 

2003 made a number of changes related to Medicare contractors, including 

authorizing CMS to replace the current Program Safeguard Contractors 

34 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 4, §§ 4.3 and 4.6.2; 

ch. 3, § 3.1; ch. 10, § 22. Accessed at 

http://www.cms.gov/manuals/downloads/pim83c03.pdf on March 23, 2011; CMS, Part A 

and Part B Medicare Administrative Contractor Statement of Work, Attachment J-1, 

Master, § C.5.12.1.5, September 2011. 35 Ibid., § C.1.4.1.1, September 2011. 36 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 15, § 15.27.2. 37 Ibid., ch. 15, § 15.27. 38 Ibid., ch. 15, § 15.27.1. 

39 There is no set amount of time before which these providers may not reenroll. Ibid., 

ch. 15, § 15.27.1. 

40 CMS, ZPIC IDIQ Umbrella Statement of Work, § 2.2, May 2009. 41 ZPICs may also recommend overpayment recoupment and civil monetary penalties to 

deter potential fraud.

42 CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 4, § 4.19.1; ch. 15, 

§ 15.27.1; ch. 3, § 3.9 (Rev. 282, January 1, 2009). This provision has been moved to 

CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 8, § 8.3.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

8

(PSC) with ZPICs.43 CMS established seven zones in which ZPICs 

operate. Each zone covers multiple States.44 A private company serves as

a ZPIC in each zone. 

As of November 2012, ZPICs were operational in six of the seven zones.45 

Appendix C provides a map of ZPICs and the States in each zone. 

However, not all providers in the States listed in Appendix C are under the 

jurisdiction of the ZPIC for their States. Some CMHCs in a State with an 

active ZPIC are still under the jurisdiction of a PSC.

46

ZPICs are responsible primarily for detecting and deterring Medicare 

fraud.47 

Detecting Fraud. ZPICs perform a number of activities to detect fraud. 

For example, ZPICs identify potential fraud through internal sources, such 

as data analysis, and external sources, such as referrals from MACs.48 

ZPICs investigate providers they have identified as potentially

fraudulent.49 ZPICs may conduct a range of activities when investigating 

providers, but their Statement of Work and CMS manuals do not specify 

any required activities. For example, ZPICs may opt to perform 

prepayment and postpayment reviews of claims submitted by providers 

under investigation to determine medical necessity. They also may

conduct onsite audits to examine records and interview providers under 

investigation. 

Deterring Fraud. ZPICs collaborate with law enforcement, CMS, and 

MACs to deter fraudulent provider billing.50 For example, ZPICs refer 

cases of suspected fraud to OIG, DOJ, or other law enforcement agencies 

for criminal investigation.51 ZPICs also may recommend that CMS 

suspend payments to providers because of potential fraud and 

overpayments. They may recommend that CMS or MACs revoke the 

billing privileges of providers and suppliers for noncompliance with 

43 Medicare Prescription Drug, Improvement, and Modernization Act of 2003, 

P.L. 108-173, § 911. 44 Zones also may cover territories.

45 The six ZPICs operational by November 2012 were in zones 1, 2, 3, 4, 5, and 7. The 

contract for zone 6 was awarded in September 2011 and had not become operational as of 

November 2012. 46 This is a holdover from when CMHCs were allowed to select their own contractors. 47 CMS, ZPIC IDIQ Umbrella Statement of Work, § 1.1.4, May 2009; CMS, Medicare 

Program Integrity Manual, Pub. No. 100-08, ch. 4, § 4.2.2. 48 Ibid., ch. 4, § 4.2.2; ch. 2, § 2.2.

49 Ibid., ch. 4, § 4.7.1. 50 Ibid., ch. 4, § 4.2.2. 51 Ibid., ch. 4, § 4.18.1. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

9

Medicare requirements.52 ZPICs also may recommend that MACs 

deactivate providers that have not billed Medicare in over 1 year. Further, 

ZPICs design autodeny edits that MACs implement to prevent Medicare 

from paying potentially fraudulent claims.53

South Florida High-Risk Provider Enrollment Project

CMS periodically undertakes temporary special projects to address 

Medicare fraud, waste, and abuse. For these projects, CMS negotiates 

separate contracts containing requirements and performance metrics that 

differ from the requirements and metrics in the original contracts. In 2009 

and 2010, CMS conducted a special project, the South Florida High-Risk 

Provider Enrollment Project, which targeted fraud among especially 

susceptible provider types, including CMHCs, in South Florida.54 

As part of the above project, CMS contracted with the jurisdiction 9 MAC

and zone 7 ZPIC to conduct specific actions designed to detect and deter 

CMHC fraud in Palm Beach, Broward, and Miami-Dade Counties, Florida

(i.e., South Florida).55 For example, the MAC conducted site visits to all 

South Florida CMHCs in its jurisdiction to verify their existence and 

operations. CMS used the results of these site visits, along with other 

information, to create a fraud-risk score for each of these CMHCs. 

CMHCs with high fraud-risk scores were subject to ZPIC investigation, 

which could result in referrals to law enforcement, payment suspensions, 

or revocations of billing privileges.

As of May 2011, the South Florida High-Risk Provider Enrollment Project 

had resulted in revocations for 239 providers and suspensions for 8.56 It 

also resulted in a cost avoidance of approximately $156 million by using 

edits. 

Related OIG Work

Previous OIG reports have found vulnerabilities in Medicare payments to 

CMHCs. A 2012 report found that about half of CMHCs had questionable 

billing in 2010. Approximately two-thirds of the questionable billing 

52 Ibid., ch. 15, § 15.27.2, and ch. 3, § 3.9 (Rev. 282, January 1, 2009). This provision 

has been moved to CMS, Medicare Program Integrity Manual, Pub. No. 100-08, ch. 8, 

§ 8.3. 53 CMS, ZPIC IDIQ Umbrella Statement of Work, § 2.2, May 2009. 54 The project also targeted fraud among other providers, including Comprehensive 

Outpatient Rehabilitation Facilities and Independent Diagnostic Testing Facilities.

55 First Coast Service Options, Inc., is the MAC for most providers in Florida. SafeGuard 

Services, LLC, is the ZPIC for most providers in Florida. 56 These figures represent all provider types, not just actions performed for CMHCs.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

10

CMHCs were located in eight metropolitan areas, all of which were in 

Florida, Louisiana, and Texas.

57 

Further, two 1998 reports found that Medicare paid $229 million for 

unallowable and questionable PHP services provided by CMHCs in five 

States over a 12-month period.58 Through medical record review, OIG 

found that 91 percent (4,959 of 5,431) of the PHP services reviewed did 

not meet Medicare requirements for reimbursement. Additionally, OIG 

found that 60 percent of States did not require CMHCs to be licensed or 

certified.

59 This creates a vulnerability whereby dishonest individuals 

have an opportunity to establish CMHCs and improperly bill Medicare for 

PHP services. 

Previous OIG reports have also found problems with CMS oversight of 

contractor operations. A 2010 report found that Recovery Audit 

Contractors performed minimal activities to deter fraud, and CMS did not 

provide any formal training to the contractors regarding the identification 

and referral of potential fraud.60 Additionally, a 2007 report found that 

PSCs performed substantially different levels of activities to detect fraud 

across jurisdictions. For example, PSCs investigated between 99 and 

1,266 providers and referred between 4 and 44 cases to OIG for criminal 

or civil investigation in 2005. The variation in activities was not related to 

oversight responsibility or budget.61 

METHODOLOGY

Scope

We limited our review to the activities that CMS and selected MACs and 

ZPICs performed to detect and deter fraud among CMHCs under their 

jurisdictions in 2010. We also reviewed Medicare payments to CMHCs 

that were subject to payment suspensions, revocations, or selected 

autodeny edits by the MACs and ZPICs in our review. 

57 OIG, Questionable Billing by Community Mental Health Centers, OEI-04-11-00100, 

August 2012. 58 These five States are Alabama, Colorado, Florida, Pennsylvania, and Texas. OIG, 

Five-State Review of Partial Hospitalization Programs at Community Mental Health 

Centers, OAS-04-98-02145, October 1998; Review of Partial Hospitalization Services 

Provided Through Community Mental Health Centers, OAS-04-98-02146, October 1998.

59 Ibid.

60 CMS contracts with Recovery Audit Contractors to identify improper payments of 

Medicare Part A and Part B claims. OIG, Recovery Audit Contractors’ Fraud Referrals, 

OEI-03-09-00130, February 2010. 61 OIG, Medicare’s Program Safeguard Contractors: Activities To Detect and Deter 

Fraud and Abuse, OEI-03-06-00010, July 2007.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

11

We selected 2010 because it was the first year that ZPICs were operational 

in three areas prone to CMHC fraud. We defined locations as fraud-prone 

areas if they (1) were Strike Force cities, (2) had cases against CMHC 

operators from 2009 to 2012, and (3) were identified in an OIG report as 

having high percentages of CMHCs with questionable billing.62 Using 

these criteria, we found that the cities prone to CMHC fraud were Miami,

Baton Rouge, and Houston. 

We limited our review to those MACs and ZPICs operational for more 

than 2 months in 2010 to allow contractors sufficient time to perform 

CMHC oversight activities.63 In 2010, Medicare reimbursed $117 million 

to the 123 CMHCs under the jurisdiction of the 9 MACs in our review, 

and $185 million to the 164 CMHCs under the jurisdiction of the 3 ZPICs 

in our review.64

We did not review other activities that CMS and its contractors performed 

to oversee CMHCs.

Data Collection 

In September 2011, we sent information requests to CMS and the 

9 MACs and 3 ZPICs in our review to identify activities they performed to 

detect and deter CMHC fraud in 2010. These requests included multiplechoice options based on expected responses, as well as open-ended 

questions to allow for elaboration. We requested that respondents submit 

documentation to support their responses. 

We also collected Medicare PHP claims submitted by CMHCs using 

100-percent paid claims data from CMS’s National Claims History (NCH) 

Outpatient File from January 1 to December 31, 2010. This included all 

2010 claims data for CMHCs under the jurisdictions of the MACs and 

ZPICs in our review, including those in the fraud-prone areas of Miami,

Baton Rouge, and Houston. 

Data Analysis

We reviewed information and documentation submitted by CMS, MACs, 

and ZPICs to determine the number and identify the type of activities to

detect and deter CMHC fraud each entity performed in 2010. We also 

62 We reviewed DOJ press releases to identify cities where CMHC operators were 

arrested for Medicare fraud from 2009 to 2012. 

63 We reviewed MAC jurisdictions 1, 3, 4, 5, 9, 10, 12, 13, and 14. We reviewed ZPIC 

zones 4, 5, and 7. 

64 Ninety-six of these CMHCs were in both MAC jurisdictions and ZPIC zones. The 

totals under the jurisdictions of the two types of contractors were not the same because 

the MAC jurisdictions and ZPIC zones overlapped only in certain areas of the country. 

The 9 MACs and 3 ZPICs in our review had oversight for a total of 191 unique CMHCs 

to which Medicare reimbursed a total of $191 million in 2010. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

12

reviewed PHP claims data to determine the dollar amount that Medicare

paid CMHCs that were subject to payment suspensions, revocations, or 

selected autodeny edits.

MAC Activities. To determine the extent to which MACs performed 

activities to detect and deter fraud in the 123 CMHCs under their 

jurisdiction, we determined the number and identified the type of such 

activities MACs performed in 2010. We defined MAC activities to detect 

fraud as: (1) conducting site visits, (2) screening beneficiary complaints, 

(3) referring providers to ZPICs for investigation, and (4) performing 

medical record reviews. We defined MAC activities to deter fraud as: 

(1) approving revocations, (2) approving deactivations, (3) implementing 

revocations, (4) implementing suspensions, and (5) implementing

autodeny edits. 

ZPIC Activities. To determine the extent to which ZPICs performed 

activities to detect and deter fraud in the 164 CMHCs under their 

jurisdiction, we determined the number and identified the type of such

activities ZPICs performed in 2010. We defined ZPIC activities to detect 

fraud as: (1) investigating providers for potential fraud, (2) conducting 

prepayment and postpayment review of claims, and (3) performing onsite 

audits. We defined ZPIC activities to deter fraud as: (1) referring 

providers to OIG for criminal investigation, (2) recommending 

suspensions, (3) recommending revocations, (4) recommending 

deactivations, and (5) creating autodeny edits. 

Additionally, we asked ZPICs to estimate the level of potential fraud 

among the CMHCs in their respective jurisdictions.

CMS Activities. We also determined the number of CMHC suspension and 

revocation recommendations that CMS received, approved, and denied. 

Additionally, we determined the extent to which CMS paid CMHCs that 

were subject to payment suspensions, revocations, or selected autodeny 

edits. We identified the dates that ZPICs recommended these activities 

and the dates that CMS and/or MACs performed them. Then we used the 

NCH Outpatient File to determine the dollar amount Medicare paid these 

CMHCs after ZPICs recommended the activities and after they were 

performed. 

Limitations

CMS, MACs, and ZPICs submitted documentation to substantiate their 

responses to our information request; however, these data were 

self-reported. Our findings also cannot be projected to all MACs and 

ZPICs because not all were operational at the time of our review. 

Additionally, the fraud-prone areas identified in this report are not 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

13

intended to be a comprehensive list of areas in which CMHC fraud, waste, 

and abuse may occur.

Standards

This study was conducted in accordance with the Quality Standards for 

Inspection and Evaluation issued by the Council of the Inspectors General 

on Integrity and Efficiency.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

14

FINDINGS

One of nine MACs we reviewed performed activities 

to detect and deter CMHC fraud in 2010, and most of 

these were part of a CMS-led special project 

MACs’ primary responsibility is to process and pay Medicare claims 

submitted by a variety of providers, including CMHCs. MACs are also 

responsible for detecting and deterring Medicare fraud. However, only the 

jurisdiction 9 MAC, which includes the fraud-prone area of Miami,

performed activities to detect and deter CMHC fraud in 2010. Most of 

these activities were part of the South Florida High-Risk Provider 

Enrollment Project. 

For example, as part of the above project, CMS directed the MAC to 

conduct site visits at 57 of the 63 CMHCs under its jurisdiction and assign 

each a fraud-risk score. Because all CMHCs visited had high fraud-risk 

scores, the MAC referred all 57 to ZPICs for investigation. Additionally, 

the jurisdiction 9 MAC screened and followed up on five beneficiary 

complaints against CMHCs in Florida. Table 1 describes the numbers of 

CMHCs that MACs referred to ZPICs for investigation in 2010, and Table 

D-1 in Appendix D describes the other activities that MACs performed to 

detect CMHC fraud in 2010.65 

Table 1: Numbers of CMHCs That MACs Referred to ZPICs for Investigation, 2010 

Jurisdiction

Number 

of 

CMHCs

Medicare 

Payments 

to CMHCs*

Percentage of 

Medicare 

Payments to 

CMHCs*

Number of 

CMHCs Referred

to ZPICs for 

Investigation

Percentage of 

Total CMHCs 

Referred to 

ZPICs for 

Investigation

Fraud-Prone 

Areas**

9 63 $55 million 47% 57 100% Miami

4 22 $49 million 42% 0 0% Houston

Seven 

Others*** 38 $12 million 11% 0 0%

Total 123 $117 million 100% 57 100%

*Figures in column have been rounded. 

**Not all fraud-prone areas were included in our review because the jurisdiction 7 MAC, which includes Baton Rouge, was not operational in 2010.

***This includes MACs for jurisdictions 1, 3, 5, 10, 12, 13, and 14. No other jurisdictions had operational MACs in 2010. 

Source: OIG analysis of MAC activity data and documentation.

65 The jurisdiction 9 MAC performed medical record review on a number of CMHCs in 

2010, but it stopped once it referred the CMHCs to ZPICs for investigation. The MAC 

stated that it did so because medical record review educated the CMHCs on how to hide 

fraudulent billing patterns. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

15

Additionally, the jurisdiction 9 MAC approved revocations for four

CMHCs and a deactivation for one. The jurisdiction 9 MAC also 

implemented these revocations and the deactivation, as well as payment 

suspensions of five CMHCs, preventing Medicare from paying these 

providers. The MAC also implemented an autodeny edit against 965 

beneficiaries that a ZPIC identified as part of a fraud scheme. Table D-2 

in Appendix D describes the activities that the MACs performed to deter 

CMHC fraud in 2010. 

In contrast, the other eight MACs in our review, which include the 

fraud-prone area of Houston, performed no activities to detect or deter

CMHC fraud in 2010. Combined, the CMHCs under these eight MACs 

received more than half of all Medicare payments to CMHCs in 2010 

($62 million of $117 million). However, these eight MACs referred none 

of the 60 CMHCs in their jurisdictions to ZPICs for investigation in 2010. 

They also did not conduct site visits or screen complaints regarding 

CMHCs in 2010. Additionally, the other eight MACs in our review did 

not prevent Medicare payments to CMHCs that were subject to sanctions. 

These eight MACs did not independently revoke the billing privileges of 

any CMHCs, nor did they approve or implement any revocations, 

deactivations, payment suspensions, or autodeny edits concerning 

CMHCs. 

Activities to detect and deter CMHC fraud varied 

substantially among ZPICs in 2010 

ZPICs are responsible for preventing fraud by (1) detecting and 

investigating potential fraud and (2) deterring fraudulent billing by 

referring cases to law enforcement and recommending that CMS or MACs 

sanction providers.66 All three ZPICs we reviewed performed activities to 

detect and deter CMHC fraud in 2010. However, the zone 7 ZPIC was 

responsible for almost all such activities, mostly as part of the South 

Florida High-Risk Provider Enrollment Project. The other two ZPICs we 

reviewed performed far fewer activities to detect and deter fraud among 

the 100 CMHCs under their jurisdiction. The number of these activities 

was not consistent with the estimated level of CMHC fraud in their zones, 

which include the fraud-prone areas of Baton Rouge and Houston. 

66 Sanctioned providers are those with payment suspensions, revoked billing privileges, or 

deactivations. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

16

One ZPIC was responsible for most CMHC investigations and 

almost all other ZPIC activities to detect fraud 

The three ZPICs in our review investigated 55 of the 164 CMHCs under 

their jurisdiction in 2010. The zone 7 ZPIC, which includes the 

fraud-prone area of Miami, investigated 78 percent (50 of 64) of its

CMHCs in 2010. This corresponds to the ZPIC’s estimation that at least 

50 percent of CMHC claims in its zone were potentially fraudulent. Table 

2 describes the number of CMHCs under ZPIC investigation in 2010. 

Table 2: Numbers of CMHCs Under ZPIC Investigation, 2010 

Zone

Number 

of 

CMHCs 

Medicare 

Payments 

to CMHCs* 

Percentage of 

Medicare Payments 

to CMHCs* 

Number of 

CMHCs Under 

Investigation

Percentage of Total 

CMHCs Under 

Investigation

Fraud-Prone

Areas 

7 64 $56 million 30% 50 91% Miami

5 77 $78 million 42% 4 7% Baton Rouge 

4 23 $50 million 27% 1 2% Houston

Total 164 $185 million 100% 55 100%

*Figures in column have been rounded.

Source: OIG analysis of ZPIC activity data and documentation.

Additionally, the zone 7 ZPIC performed almost all other activities to 

detect fraudulent CMHC billing in 2010, largely as part of the South 

Florida High-Risk Provider Enrollment Project.67 For example, CMS 

directed the ZPIC to perform prepayment reviews and conduct onsite 

audits when investigating CMHCs in South Florida. As a result, the ZPIC 

performed prepayment reviews for 44 CMHCs and conducted onsite 

audits for 39 CMHCs in 2010.68 Medicare payments to these CMHCs 

decreased substantially after the ZPIC performed such actions. For 

example, average Medicare payments per day to CMHCs subject to

prepayment review decreased approximately 80 percent after the ZPIC 

began reviewing their claims. Figure 2 describes the average Medicare 

payment per day for CMHCs with prepayment reviews and onsite audits 

in 2010. 

67 The zone 7 ZPIC performed postpayment review of claims for one CMHC in 2010. 

68 Thirty-four of these CMHCs experienced both a prepayment review and an onsite 

audit.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

17

Figure 2: Average Medicare Payment per Day for CMHCs With 

Prepayment Reviews and Onsite Audits, 2010

$6,093 $5,772 

$2,415 

$1,065 

$0

$1,000

$2,000

$3,000

$4,000

$5,000

$6,000

$7,000

Prepayment Review Onsite Audit

 Before Column 1 activity Column 2 After activity

Source: OIG analysis of MAC and ZPIC documentation and 2010 PHP claims.

In contrast, the other two ZPICs in our review, which include the 

fraud-prone areas of Baton Rouge and Houston, investigated 5 percent of 

CMHCs in their zones in 2010. This does not correspond to the ZPICs’ 

estimates that at least 50 percent of the CMHC claims in their zones were 

potentially fraudulent in 2010. For example, the zone 5 ZPIC investigated

5 percent (4 of 77) of the CMHCs in its zone. The zone 5 ZPIC initiated 

investigations into two CMHCs by conducting claims analysis, and it 

initiated investigations into two others by following up on complaints. 

While investigating these four CMHCs, the zone 5 ZPIC performed a 

prepayment review for one CMHC and performed four postpayment

reviews on two CMHCs to determine whether any overpayments had been 

made. The ZPIC also conducted an onsite audit for one CMHC. 

Additionally, the zone 4 ZPIC investigated 4 percent (1 of 23) of CMHCs 

in its zone, initiating the investigation by conducting claims analysis. 

During this investigation, the zone 4 ZPIC performed one onsite audit for 

the CMHC and no prepayment or postpayment reviews. Table E-1 in 

Appendix E describes the activities ZPICs performed to detect fraud 

among CMHCs in 2010. 

One ZPIC was responsible for most CMHC referrals to law 

enforcement and almost all other ZPIC activities to deter fraud

The three ZPICs in our review referred nine CMHCs to law enforcement 

in 2010 for criminal or civil investigation. The zone 7 ZPIC, which 

includes the fraud-prone area of Miami, referred eight of the nine CMHCs 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

18

to law enforcement.

69 These CMHCs allegedly altered patient files, 

altered patient diagnoses, and paid kickbacks to patient recruiters. In 

2010, these eight CMHCs received approximately $5.6 million from 

Medicare (see Table 3). 

Table 3: CMHCs That ZPICs Referred to Law Enforcement for Investigation, 2010

Zone

Number 

of 

CMHCs

Medicare 

Payments to 

CMHCs* 

Percentage of 

Medicare 

Payments to 

CMHCs*

Number of 

CMHCs Referred 

to Law 

Enforcement 

Medicare 

Payments to 

CMHCs Referred to 

Law Enforcement

Fraud-Prone 

Areas 

7 64 $56 million 30% 8 $6 million Miami

5 77 $78 million 42% 0 $0 Baton Rouge

4 23 $50 million 27% 1 $1 million Houston

Total 164 $185 million 100% 9 $7 million

*Figures in column have been rounded. 

Source: OIG analysis of ZPIC activity data and documentation.

Additionally, the zone 7 ZPIC recommended sanctions (payment 

suspensions, billing privilege revocations, or deactivations) for 41 unique 

CMHCs in 2010. CMS and MACs approved sanctions for 32 of the 64 

(50 percent) CMHCs in the ZPIC’s zone.70 In 2010, these CMHCs 

received approximately $28 million from Medicare. Sixteen of these 

CMHCs submitted false information or did not operate at the addresses

listed on their enrollment applications. Five others were suspected of 

billing Medicare fraudulently. The ZPIC also created an autodeny edit 

against 965 beneficiaries identified as part of a fraud scheme. 

In contrast, the other two ZPICs in our review, which include the 

fraud-prone areas of Baton Rouge and Houston, performed far fewer

activities to deter fraudulent CMHC billing in 2010. For example, the 

zone 5 ZPIC referred none of its 77 CMHCs to law enforcement and 

recommended that CMS suspend payments to 1 CMHC in 2010. The 

suspended CMHC was in Baton Rouge, and it inappropriately copied 

patient records. In 2010, this CMHC received approximately $56,000 

from Medicare. 

The zone 4 ZPIC referred only one CMHC to law enforcement in 2010, 

representing 4 percent (1 of 23) of CMHCs in its zone. This CMHC was 

in Houston, and it was suspected of submitting false claims for patients. 

In 2010, this CMHC received approximately $1.3 million from Medicare. 

69 All of the CMHCs that the zone 7 ZPIC referred to law enforcement were in Florida. 70 Three of the five CMHCs for which CMS suspended payments in 2010 also had their 

billing privileges revoked in 2010. The single deactivated CMHC did not bill in 2010, 

and therefore it was not included in the total of 64 CMHCs under the ZPIC.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

19

As of November 2012, this CMHC had not been indicted for fraud. The 

zone 4 ZPIC did not recommend that CMS or MACs sanction any 

CMHCs in its zone. Table E-2 in Appendix E describes the activities 

ZPICs performed to deter CMHC fraud in 2010. 

Medicare paid CMHCs that did not comply with its 

requirements in 2010 and could have prevented 

payments to potentially fraudulent CMHCs

CMS and its contractors did not coordinate activities to deter fraud across 

all Florida CMHCs in 2010. For example, Medicare paid five CMHCs

after the effective dates that their billing privileges were revoked for 

noncompliance with Medicare requirements. Medicare also paid nine 

CMHCs between the time their revocations were recommended and the 

time they were finalized. Additionally, Medicare contractors could have 

prevented payments to seven potentially fraudulent CMHCs if they had 

consistently applied an auto deny edit for all CMHCs in Florida.

MACs paid approximately $640,000 to five noncompliant 

CMHCs in Florida after their revocations were effective 

CMS and the jurisdiction 9 MAC, which includes the fraud-prone area of 

Miami, approved the zone 7 ZPIC’s recommendations that 31 CMHCs 

have their billing privileges revoked in 2010 for noncompliance with 

Medicare requirements. However, Medicare paid a total of approximately 

$640,000 to five of these CMHCs during an average of 18 weeks after the 

effective dates of their billing privilege revocations. Four of these 

CMHCs were not providing core services required for Medicare 

participation, such as screening patients or offering outpatient services. 

The jurisdiction 9 MAC did not implement or finalize the revocations for 

these five CMHCs, allowing them to receive Medicare payments. Either 

CMS or MAC approval is required to revoke providers’ or suppliers’ 

billing privileges. MACs should be able to identify all providers with 

revoked billing privileges because only MACs ensure that Medicare does 

not pay providers with revocations. However, CMS and the MAC 

identified different providers with revoked billing privileges in 2010.71 

For example, eight of the ten CMHCs for which CMS revoked billing 

privileges in 2010 were not documented by the MAC. This includes all 

five CMHCs that were paid after the effective dates that their billing 

privileges were revoked. Table 4 describes CMHC revocations identified

by CMS and its contractors in 2010. 

71 There was an overlap of two CMHCs for which both CMS and the MAC reported 

revocations. CMS and the MAC reported 12 unique CMHCs with revocations in 2010.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

20

Table 4: CMHC Revocations Identified by CMS and Contractors in 2010

Source of Revocation Data Number With Revoked Billing Privileges

Zone 7 ZPIC 22

CMS 10 

Jurisdiction 9 MAC 4 

Total* 1 

Unique CMHCs 31 

*Total reflects the CMHCs that the zone 7 ZPIC, CMS, and the jurisdiction 9 MAC agree had revoked billing 

privileges. 

Source: OIG analysis of CMS, MAC, and ZPIC revocation documentation.

MACs paid approximately $2.5 million to nine CMHCs in 

Florida after they were recommended for revocation

Medicare paid approximately $2.5 million to nine CMHCs between the 

time the ZPIC recommended their billing privileges be revoked and the 

time their revocations were finalized.

72 CMS took an average of 42 weeks 

to finalize these revocations, with a range of 5 to 57 weeks. Medicare paid 

approximately $2.4 million to four of these CMHCs, whose revocations 

were finalized between 39 and 46 weeks after ZPICs recommended their 

revocations. 

Medicare did not pay 18 CMHCs after their revocations were 

recommended or finalized. These 18 CMHCs had their revocations 

reviewed and finalized within an average of 16 weeks. Additionally, 13 of 

these CMHCs had their revocations reviewed and finalized within an 

average of 17 days. 

Medicare contractors did not consistently apply an autodeny 

edit across all Florida CMHCs 

In 2010, Medicare contractors allowed seven CMHCs in Florida to bill for 

beneficiaries identified as part of a fraud scheme. This was, in part, 

because not all CMHCs in Florida were under the oversight of the same 

contractor. Applying an effective autodeny edit across all Florida CMHCs 

could have prevented approximately $520,000 in potentially fraudulent 

billing by CMHCs in 2010. 

Of the 72 CMHCs in Florida that received Medicare payments in 2010, 64 

operated under the oversight of the jurisdiction 9 MAC and/or zone 7 

ZPIC and 8 were under the jurisdiction of a PSC and/or an FI. 

72 Medicare paid one CMHC after the ZPIC recommended its billing privileges be 

revoked and after its revocation was finalized. There is no required timeframe for CMS 

or MACs to approve or deny ZPIC recommendations for revocations, and providers may 

continue to bill Medicare in the intervening time.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

21

The jurisdiction 9 MAC implemented a local autodeny edit in 2010 to 

deter a fraud scheme in which South Florida CMHCs billed for prolonged 

PHP services for beneficiaries. According to the jurisdiction 9 MAC and 

zone 7 ZPIC, CMHCs were billing Medicare for unusually long durations 

of PHP services for beneficiaries, some for almost an entire year 

(362 days).73 The MAC and ZPIC identified 965 beneficiaries who were 

part of this fraud scheme. The MAC implemented an autodeny edit that

prevented the CMHCs under its oversight from providing more than 

60 days of services in a calendar year to those beneficiaries. The zone 7 

ZPIC reported that the autodeny edit saved Medicare approximately 

$370,000 in denied claims from these CMHCs in 2010. 

However, the FI did not implement the same autodeny edit for the CMHCs 

under its oversight. CMHCs under each set of contractors served the same 

population, submitting claims for the same 602 beneficiaries and often 

operating within 5 miles of one another. Seven CMHCs under the 

oversight of the FI billed for 115 of the 965 beneficiaries identified in the 

fraud scheme. Medicare reimbursed these CMHCs approximately 

$520,000 after the MAC implemented the edit to prevent payment for 

additional PHP services provided to the same 115 beneficiaries. These 

seven CMHCs billed Medicare for an average of 149 days of PHP services 

for these beneficiaries. 

73 OIG, Questionable Billing by Community Mental Health Centers, OEI-04-11-00100, 

August 2012. PHPs should closely resemble short-term inpatient programs. They are not 

intended to provide prolonged services. CMS, Medicare Benefit Policy Manual, Pub. 

No. 100-02, ch. 6, § 70.3.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

22

CONCLUSION AND RECOMMENDATIONS

CMS and some of its contractors are responsible for ensuring the integrity 

of the Medicare program, including the prevention of fraudulent billing. 

Strike Force investigations indicate that some parts of the country have a 

higher prevalence of CMHC fraud, including portions of Florida, 

Louisiana, and Texas. Additionally, OIG found that approximately half of 

CMHCs exhibited questionable billing in 2010, most of which were in 

these three States.

74 

In 2010, the 9 MACs and 3 ZPICs in our review oversaw CMHCs in much 

of the country, including fraud-prone areas of Florida, Louisiana, and 

Texas. Almost all MAC and ZPIC activities to detect and deter CMHC 

fraud were performed by the jurisdiction 9 MAC and zone 7 ZPIC, both of 

which include Florida. Most activities performed by these contractors 

were part of the South Florida High-Risk Provider Enrollment Project. 

However, CMS, the jurisdiction 9 MAC, and the zone 7 ZPIC 

demonstrated vulnerabilities while detecting and deterring CMHC fraud. 

Better communication and coordination between CMS and these

contractors could have prevented approximately $3.6 million in Medicare

payments for potentially fraudulent CMHC services. Prior OIG reports 

have found similar vulnerabilities for other providers, such as home health 

agencies and independent diagnostic testing facilities.75 Therefore, the 

vulnerabilities identified in this report may extend to other types of 

providers. 

We recommend that CMS: 

Implement Additional CMHC Fraud Mitigation Activities in All 

Fraud-Prone Areas 

These activities may include aspects of CMS’s South Florida High-Risk 

Provider Enrollment Project, such as coordinating with MACs and ZPICs 

to conduct unannounced postenrollment site visits, subject CMHCs 

suspected of fraud to prepayment review, refer highly suspicious CMHCs 

to law enforcement, sanction noncompliant or potentially fraudulent 

CMHCs, and/or implement edits to mitigate fraud schemes. Specifically, 

CMS should work with MACs and ZPICs covering fraud-prone areas, 

such as parts of Louisiana and Texas, to implement these activities. 

74 OIG, Questionable Billing by Community Mental Health Centers, OEI-04-11-00100, 

August 2012. 75 OIG, Miami Independent Diagnostic Testing Facilities’ Compliance With Medicare 

Standards, OEI-05-09-00560, August 2011; and CMS and Contractor Oversight of Home 

Health Agencies, OEI-04-11-00220, December 2012.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

23

Develop a System To Track Revocation Recommendations and 

Improve Revocation Communication With Contractors

This system should flag recommendations to which CMS or its contractors 

have not responded within a specified timeframe (e.g., within 30 days of 

receipt) and require documentation to justify why any cases exceed this 

timeframe. For cases that exceed this timeframe, CMS should consider 

implementing safeguards (e.g., prepayment reviews and payment 

suspensions) to prevent payments to providers recommended for 

revocation while it determines appropriate action. Doing so could have 

prevented approximately $2.5 million in Medicare payments to nine 

noncompliant CMHCs during the average of 42 weeks between the time 

their revocations were recommended and the time they were finalized.

Additionally, CMS should coordinate with MACs and ZPICs to improve 

its communication concerning revocations. While CMS or MAC approval 

is required to revoke providers’ billing privileges, only MACs document 

revocations in the Provider Enrollment, Chain and Ownership System. 

MACs then use edits to ensure that providers with revocations do not 

receive Medicare payments. CMS should also document providers with 

revocations in the system to ensure that these providers do not 

inappropriately receive Medicare payments. 

Coordinate Activities To Deter CMHC Fraud in Florida

Florida is the only State in our review with CMHCs under both FIs and 

MACs. CMS should coordinate FI and MAC activities to deter fraud in 

Florida so that all CMHCs operating there are subject to the same 

activities. This can prevent the shift of a fraud scheme from a CMHC

under the oversight of one contractor to another. It will also ensure the 

consistency of activities to deter fraud, including edits. Lastly, it would 

help contractors track fraud schemes across all CMHCs in Florida, which 

would allow contractors to more accurately inform CMS of billing 

vulnerabilities. Further, CMS should consider consolidating all CMHCs 

in Florida under the oversight of the same contractors. 

Follow Up on Payments Made to CMHCs After the Effective

Dates of Their Billing Privilege Revocations 

In a separate memorandum, we referred to CMS the CMHCs that 

Medicare paid after having their billing privileges revoked. CMS should 

follow up on payments made to these CMHCs. Such payments should not 

have been made. Additionally, CMS should ensure that edits are in place 

and are functioning properly to prevent payments to CMHCs with revoked 

billing privileges.
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

24

AGENCY COMMENTS AND OFFICE OF INSPECTOR GENERAL 

RESPONSE 

CMS concurred with all four of our recommendations and acknowledged 

that CMHCs’ partial hospitalization program services have historically 

been vulnerable to fraud, waste, and abuse. Therefore, CMS is taking 

additional steps to address potential vulnerabilities in the enrollment and 

claims payment process for CMHCs. These include screening measures, 

such as licensure checks for new enrolling providers and unannounced site 

visits for revalidating providers.

With regard to the first recommendation, CMS stated that it will review 

the work performed by ZPICs and MACs to ensure that they are pursuing 

appropriate additional CMHC fraud mitigation activities using lessons 

learned from the South Florida High-Risk Provider Enrollment Project. 

With regard to our second recommendation, CMS stated that it has 

developed and implemented a tracking system used by the revocation team 

that delineates revocation-specific tasks, status, request dates, contact 

dates, and other applicable information. CMS also stated that it

established a set of guidelines to ensure that revocation recommendations 

are addressed in a timely manner. 

With regard to our third recommendation, CMS stated that it will draft a 

Technical Direction letter to the affected MACs about coordinating 

CMHC edits.

With regard to our final recommendation, CMS will attempt to recover the 

overpayments made to CMHCs with revoked billing privileges consistent 

with the agency’s policies and procedures. CMS also stated that it has 

ensured that properly functioning edits are in place to prevent 

inappropriate Medicare payments to CMHCs with revoked billing 

privileges. 

We support CMS’s efforts to address these issues and encourage it to 

continue making progress. For the full text of CMS’s comments, see 

Appendix F. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

25

APPENDIX A

Number of Community Mental Health Centers (CMHC) and 

Medicare Payments by State, 2010

State

Total Number 

of CMHCs* Total Medicare Payment

Florida 72 $82,389,314

Louisiana 57 $60,725,138

Texas 23 $50,403,363

Mississippi 4 $6,728,693 

Tennessee 4 $4,007,575 

Massachusetts 10 $3,192,482

Georgia 3 $2,153,531

North Carolina 1 $2,135,432

South Carolina 1 $1,630,377 

California 4 $1,614,811

Alabama 6 $841,167

Michigan 1 $748,687

Arizona 1 $541,137 

West Virginia 1 $270,169

Connecticut 2 $259,370

Maryland 1 $250,238

New York 1 $177,722 

Minnesota 3 $121,685

Illinois 2 $113,998

Nebraska 1 $102,492 

Pennsylvania 4 $67,346

Utah 1 $55,915

Iowa 1 $49,584

Missouri 1 $16, 815

Puerto Rico 1 $1,078

Total 206 $218.6 million

 *Not all CMHCs included in this table were included in this study. 

Source: Office of Inspector General analysis of 2010 Medicare Partial Hospitalization Program claims data.
 

 

 

 

 

APPENDIX B 

Medicare Administrative Contractor Jurisdictions 

5

 1 

4

 3 

9 

10 

11* 

12 

13 

14 

15* 

2* 

7* 

6* 8*

Medicare Administrative Contractors and Operational Dates:
 

Jurisdiction 1, Palmetto GBA, LLC, September 2008: American Samoa, California, 

Guam, Hawaii, Nevada, and Northern Mariana Islands. 

Jurisdiction 2,*† not operational: Alaska, Idaho, Oregon, and Washington. 

Jurisdiction 3,†

 Noridian Administrative Services, LLC, March 2007: Arizona, 

Montana, North Dakota, South Dakota, Utah, and Wyoming. 

Jurisdiction 4,‡

 Trailblazer Health Enterprises, LLC, June 2008: Colorado, New 

Mexico, Oklahoma, and Texas. 

Jurisdiction 5, Wisconsin Physicians Service, June 2008: Iowa, Kansas, Missouri, 

and Nebraska. 

Jurisdiction 6,*

 not operational: Illinois, Minnesota, and Wisconsin. 

Jurisdiction 7,*‡ not operational: Arkansas, Louisiana, and Mississippi. 

Jurisdiction 8,* Wisconsin Physicians Service, August 2012: Indiana and Michigan. 

Jurisdiction 9, First Coast Service Options, Inc., March 2009: Florida, Puerto Rico, 

and Virgin Islands. 

Jurisdiction 10, Cahaba Government Benefit Administrators, September 2009: 

Alabama, Georgia, and Tennessee 

Jurisdiction 11,*

 Palmetto Government Benefit Administrators, June 2011: North 

Carolina, South Carolina, Virginia, and West Virginia. 

Jurisdiction 12, Highmark Medicare Services, Inc., December 2008: Delaware, 

Maryland, New Jersey, Pennsylvania, and Washington, D.C. 

Jurisdiction 13, National Government Services, Inc., November 2008: Connecticut 

and New York. 

Jurisdiction 14, National Heritage Insurance Company, June 2009: Maine, 

Massachusetts, New Hampshire, Rhode Island, and Vermont. 

Jurisdiction 15,*

 Cigna Government Services, June 2011: Kentucky and Ohio. 

*

Jurisdiction was not included in our review because it was not operational for more than 2 months in 2010. 

†

Jurisdictions were consolidated into Jurisdiction F under Noridian Administrative Services in February 2012. ‡

Jurisdictions were consolidated into Jurisdiction H under Novitas in November 2012. 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers 25 

(OEI-04-11-00101) 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

27

APPENDIX C

Zone Program Integrity Contractor Zones 

 7 

4 5 

2* 

 1* 

 3* 6*

Zone Program Integrity Contractor Zones and Operational Dates:

Zone 1,

* SafeGuard Services, LLC, December 2010: American Samoa, California, 

Guam, Hawaii, Nevada, and Northern Mariana Islands. 

Zone 2,

*

AdvanceMed Corporation, February 2011: Alaska, Arizona, Idaho, Iowa, 

Kansas, Missouri, Montana, Nebraska, North Dakota, Oregon, South Dakota, Utah, 

Washington, and Wyoming. 

Zone 3,

* Cahaba Safeguard Administrators, LLC, April 2012: Illinois, Indiana, 

Kentucky, Michigan, Minnesota, Ohio, and Wisconsin. 

Zone 4, Health Integrity, LLC, February 2009: Colorado, New Mexico, Oklahoma, and 

Texas. 

Zone 5, AdvanceMed Corporation, December 2009: Alabama, Arkansas, Georgia, 

Louisiana, Mississippi, North Carolina, South Carolina, Tennessee, Virginia, and 

West Virginia. 

Zone 6,

* Cahaba Safeguard Administrators, LLC, not yet operational: Connecticut, 

Delaware, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, New 

York, Pennsylvania, Rhode Island, Vermont, and Washington, D.C. 

Zone 7, SafeGuard Services, LLC, February 2009: Florida, Puerto Rico, and Virgin 

Islands. 

*

Zone was not included in our review because it was not operational for more than 2 months in 2010. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

28

APPENDIX D

Medicare Administrative Contractor Activities To Detect and 

Deter Fraud, 2010

Table D-1: Activities To Detect Community Mental Health Center (CMHC) Fraud

Jurisdiction

Number of 

CMHCs 

Medicare Payments 

to CMHCs* Site Visits

Screened/ 

Followed Up on 

Complaints

Total 

Activities 

Fraud-Prone 

Areas**

9 63 $55 million 57 5 62 Miami

4 22 $49 million 0 0 0 Houston

Seven

Others*** 38 $12 million 0 0 0

 Totals 123 $117 million 57 5 62

*Figures in column have been rounded. 

**Not all fraud-prone areas were included in our review because the jurisdiction 7 Medicare Administrative Contractor (MAC), which includes 

Baton Rouge, was not operational in 2010.

***This includes MACs for jurisdictions 1, 3, 5, 10, 12, 13, and 14. No other jurisdictions had operational MACs in 2010. 

Source: Office of Inspector General (OIG) analysis of MAC activity data and documentation.

Table D-2: Activities To Deter CMHC Fraud

Jurisdiction

Number 

of

CMHCs 

Medicare 

Payments to 

CMHCs* 

Approve 

Revocations

Approve 

Deactivations

Implement 

Autodeny 

Edits

Implement 

Suspensions

Implement 

Revocations

Total 

Activities 

Fraud-Prone 

Areas**

9 63 $55 million 4 1 1*** 5 4 15 Miami

4 22 $49 million 0 0 0 0 0 0 Houston

Seven 

Others† 38 $12 million 0 0 0 0 0 0

 Totals 123 $117 million 4 1 1 5 4 15

*Figures in column have been rounded. 

**Not all fraud-prone areas were included in our review because the jurisdiction 7 MAC, which includes Baton Rouge, was not operational in 2010.

***This autodeny edit included 965 beneficiaries who were part of the same fraud scheme.

†

This includes MACs for jurisdictions 1, 3, 5, 10, 12, 13, and 14. No other jurisdictions had operational MACs in 2010. 

Source: OIG analysis of MAC activity data and documentation. 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

29

APPENDIX E

Zone Program Integrity Contractor Activities To Detect and 

Deter Fraud, 2010

Table E-1: Activities To Detect Community Mental Health Center (CMHC) Fraud

Zone

Number of 

CMHCs 

Medicare 

Payments to 

CMHCs*

Prepayment 

Review

Onsite 

Audits

Postpayment 

Review

Total 

Activities 

Fraud-Prone 

Areas

7 64 $56 million 44 39 1 84 Miami

5 77 $78 million 1 1 4 6 Baton Rouge

4 23 $50 million 0 1 0 1 Houston

 Total 164 $185 million 45 41 5 91

* Figures in column have been rounded. 

Source: Office of Inspector General (OIG) analysis of Zone Program Integrity Contractor (ZPIC) data and documentation.

Table E-2: Activities To Deter CMHC Fraud

Zone

Number 

of 

CMHCs 

Medicare 

Payments to 

CMHCs*

Suspensions 

Recommended

Revocations 

Recommended

Deactivations 

Recommended

Autodeny Edits 

Recommended

Total 

Activities

Fraud-Prone 

Areas

7 64 $56 million 5 40 1 1** 47 Miami

5 77 $78 million 1*** 0 0 0 1 Baton Rouge

4 23 $50 million 0 0 0 0 0 Houston

Total 164 $185 million 6 40 1 1 48

* Figures in column have been rounded. 

**This autodeny edit included 965 beneficiaries who were part of the same fraud scheme.

***This suspension was recommended in Louisiana. Because the Medicare Administrative Contractor for the jurisdiction that included Louisiana was not 

operational during 2010, a fiscal intermediary implemented this suspension.

Source: OIG analysis of ZPIC data and documentation.
APPENDIX F 

Agency Comments 

,~1&,~· , 

( DEPARTMENT OF HEALTH & HUMAN SERVICES Centers for Medocare & Medicaid Services 

<~~ Administrator 

Washington, DC 20201 

DATE: NOV 2 0 2012 

TO: 	 Daniel R. Levinson 

Inspector General 

FROM: 	 I»MilyiTl~ lrne!' 

Actlltg Al!mm istrator 

SUBJECT: 	 Office of Inspector General (OIG) Draft Report: "Vulnerabilities in CMS and 

Contractors' Activities to Detect and Deter Fraud in Community Mental Health 

Centers" (OEI-04-11-00101) 

The Centers for Medicare & Medicaid Services (CMS) appreciates the opportunity to review and 

comment on the HHS OIG's report entitled, ''Vulnerabilities in CMS and Contractors' Activities 

to Detect and Deter Fraud in Community Mental Health Centers." OIG's objectives for this draft 

report were to determine the extent to which: (1) CMS and its selected contractors performed 

activities to detect and deter fraudulent billing by community mental health centers (CMHC) in 

2010; and (2) Medicare paid CMHCs that were subject to payment suspensions, revocations, or 

selected electronic edits because of suspected fraud . 

As stated in OIG's report, CMHCs' partial hospitalization program (PHP) services have 

historically been vulnerable to fraud, waste, and abuse. As such, CMS is taking additional steps 

to address potential vulnerabilities in the enrollment and claims payment process for this supplier 

group using the authorities granted under Section 6401 of the Affordable Care Act. Under the 

new screening regulations (CMS 6028-FC\ newly enrolling CMHCs fit within the moderate 

risk category and are subject to unannounced physical site visits in addition to other screening 

measures such as licensure checks. Those CMHCs already enrolled in Medicare will have to 

revalidate their Medicare enrollment beginning this year and will be subject to an unannounced 

physical site visit as part of the revalidation process. 

In addition, CMS implemented the Fraud Prevention System (FPS) in June of2011, which 

applies predictive analytic technology to claims prior to payment to identify aberrant and 

suspicious billing patterns. CMS uses the FPS to target investigative resources to suspect claims 

and providers, and swiftly imposes administrative action when warranted. The FPS has been 

running predictive algorithms and other sophisticated analytics nationwide against all Medicare 

fcc-for-service claims, including those submitted by CMHCs, home health age.ncics and 

suppliers of durable medical equipment, prosthetics, orthotics, and supplies claims. CMS is 

1 CMS 6028-FC entitled, "Medicare, Medicaid and Children's Health Insurance Programs; Additional Screening 

Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions and Compliance Plans for 

Providers and Suppliers" was published in the Federal Register on February 2, 2011. 

Vulnerabilities in CMS's and Contractors' Activities To Detect and Deter Fraud in Community Mental Health Centers 29 

(OEI-04-11-00101) 
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

31
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

32
 

Vulnerabilities in CMS’s and Contractors’ Activities To Detect and Deter Fraud in Community Mental Health Centers

(OEI-04-11-00101) 

33

ACKNOWLEDGMENTS

This report was prepared under the direction of Dwayne Grant, Regional 

Inspector General for Evaluation and Inspections in the Atlanta regional 

office, and Jaime Durley, Deputy Regional Inspector General. 

Evan Godfrey served as the lead analyst for this study. Other principal 

Office of Evaluation and Inspections staff from the Atlanta regional office 

who contributed to the report include Latrice Rollins; central office staff 

who contributed include Sandy Khoury, Scott Horning, and Debra Roush. 
Office of Inspector General

http://oig.hhs.gov

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human Services 

(HHS) programs, as well as the health and welfare of beneficiaries served by those 

programs. This statutory mission is carried out through a nationwide network of audits, 

investigations, and inspections conducted by the following operating components:

Office of Audit Services

The Office of Audit Services (OAS) provides auditing services for HHS, either by conducting 

audits with its own audit resources or by overseeing audit work done by others. Audits 

examine the performance of HHS programs and/or its grantees and contractors in carrying 

out their respective responsibilities and are intended to provide independent assessments of 

HHS programs and operations. These assessments help reduce waste, abuse, and 

mismanagement and promote economy and efficiency throughout HHS.

Office of Evaluation and Inspections

The Office of Evaluation and Inspections (OEI) conducts national evaluations to provide 

HHS, Congress, and the public with timely, useful, and reliable information on significant 

issues. These evaluations focus on preventing fraud, waste, or abuse and promoting 

economy, efficiency, and effectiveness of departmental programs. To promote impact, OEI 

reports also present practical recommendations for improving program operations. 

Office of Investigations

The Office of Investigations (OI) conducts criminal, civil, and administrative investigations 

of fraud and misconduct related to HHS programs, operations, and beneficiaries. With 

investigators working in all 50 States and the District of Columbia, OI utilizes its resources 

by actively coordinating with the Department of Justice and other Federal, State, and local 

law enforcement authorities. The investigative efforts of OI often lead to criminal 

convictions, administrative sanctions, and/or civil monetary penalties.

Office of Counsel to the Inspector General

The Office of Counsel to the Inspector General (OCIG) provides general legal services to 

OIG, rendering advice and opinions on HHS programs and operations and providing all 

legal support for OIG’s internal operations. OCIG represents OIG in all civil and 

administrative fraud and abuse cases involving HHS programs, including False Claims Act, 

program exclusion, and civil monetary penalty cases. In connection with these cases, OCIG 

also negotiates and monitors corporate integrity agreements. OCIG renders advisory 

opinions, issues compliance program guidance, publishes fraud alerts, and provides other 

guidance to the health care industry concerning the anti-kickback statute and other OIG 

enforcement authorities.