Department of Health and Human Sewices 

OFFICE OF


INSPECTOR GENERAL


ELECTRONIC DATA INTERCHANGE


AND PAPERLESS PROCESSING:


ISSUES AND CHALLENGES


f,* SERVICE$ 

& “Lfa 

$ 7 

JUNE GIBBS BROWN g

< Inspector General

# 

2

‘3

%#-2 MARCH 1994 %d~~ oEI-12-93-Oooso 
OFFICE OF INSPECTOR GENERAL 

The mission of the Office of Inspector General (OIG), as mandated by Public Law 95-452, as 

amended, is to protect the integrity of the Department of Health and Human SeMces’ (HHS) 

programs as well as the health and welfare of beneficiaries served by those programs. This 

statutory mission is carried out through a nationwide network of audits, investigations, and 

inspections conducted by three OIG operating components: the Office of Audit SeMces, the 

Office of Investigations, and the Office of Evaluation and Inspections. The OIG also informs 

the Secretary of HHS of program and management problems and recommends courses to 

correct them. 

OFFICE OF AUDIT SERVICES 

The OIGS Office of Audit Services (OAS) provides all auditing services for HHS, either by 

conducting audits with its own audit resources or by overseeing audit work done by others. 

Audits examine the performance of HHS programs and/or its grantees and contractors in 

carrying out their respective responsibilities and are intended to provide independent 

assessments of HHS programs and operations in order to reduce waste, abuse, and 

mismanagement and to promote economy and efficiency throughout the Department. 

OFFICE OF INVESTIGATIONS 

The OIGS Office of Investigations (01) conducts criminal, civil, and administrative 

investigations of allegations of wrongdoing in HHS programs or to HHS beneficiaries and of 

unjust enrichment by providers. The investigative efforts of 01 lead to criminal convictions, 

administrative sanctions, or civil money penalties. The 01 also oversees State Medicaid fraud 

control units which investigate and prosecute fraud and patient abuse in the Medicaid program. 

OFFICE OF EVALUATION AND INSPECI’IONS 

The OIGS Office of Evaluation and Inspections (OEI) conducts short-term management and


program evaluations (called inspections) that focus on issues of concern to the Department,


the Congress, and the public. The findings and recommendations contained in these inspection


reports generate rapid, accurate, and up-todate information on the efficiency, vulnerability,


and effectiveness of departmental programs. This report was prepared under the direction of


Penny Thompson, Chief, Health Care Branch, Office of Evaluation and Inspections.


Participating in this project were the following primary authors:


Thomas A. Noplock, Office of Evaluation and Inspections


Stephen W. Greenfield, Office of Audit SeMces


Thomas R. Hoffman, Office of General Counsel, Inspector General Division


Thomas J. Elliott, Office of Audit Services


For additional copies of this report, please contact Thomas A. Noplock at (410) 966-3144.

Department of Health and Human Services 

OFFICE OF


NSPECTOR GENERAL


ELECTRONIC DATA INTERCHANGE


AND PAPERLESS PROCESSING:


ISSUES AND CHALLENGES


MARCH 1994 OEI-12-93-00080

EXECUTIVE SUMMARY


PURPOSE 

The purpose of this document is to (1) identi~ emerging issues in the expansion of the 

Health Care Financing Administration’s (HCFA) use of electronic data interchange 

(EDI) and related technology to achieve paperless processing, and (2) discuss the 

Office of Inspector General’s (OIG) current plans to provide oversight of HCFA’S 

strategy to implement a paperless environment. We have developed it through a 

review of literature and consultation within the OIG, and with HCFA and others. 

BACKGROUND 

Electronic Data Interchange is the electronic transfer of information, such as 

electronic media claims, in a standard format between trading partners. As it relates 

to health care, this new technology will allow entities within the health care system, 

connected by an integrated system of electronic communication networks, to exchange 

medical, billing, and other information and process transactions in a manner which is 

fast and cost effective. Most of these improvements are likely to result from the 

significant reduction or elimination of paper transactions. 

ISSUES 

The HCFAS far-reaching implementation of EDI and paperless processing contains 

many parts which all relate to the larger strategy and goals of this initiative. Among 

the significant issues affecting this strategy are the following: 

F	 Systems--such as the Medicare Transaction System (MTS), Medicaid 

Management Information Systems (MMIS), and point-of-service claims 

management systems under Medicaid--to process electronically submitted claims 

and manage data more efficiently. 

� Standardization, to facilitate the electronic flow of claims, patient, and 

reimbursement data between providers, payers, and quality-of-care reviewers. 

� Incentives and barriers, to encourage providers to submit claims and patient data 

electronically. 

�	 Companion technologies, such as smart cards for computerized patient 

identification and medical records, and national data communications networks 

for transmission of health care data to complete the electronic cycle. 

We discuss the need for a cohesive strategic systems plan covering EDI and paperless 

processing, to encourage HCFAS information resources management program to 

address Medicare contractor systems and Federal Medicaid initiatives. 
The implementation of these new systems, in particular, carries with it myriad 

questions regarding trustworthiness and reliability of data as it moves from one partner 

in electronic commerce to another and from one process to another. Specific issues 

raised with regard to electronic submission and processing of claims include: 

F	 Confidentiality and privacy of patient records, to ensure that the confidentiality of 

personally-identifiable health insurance data be strictly maintained and 

the privacy of patients be maintained. 

�	 Internal controls, to address the adequacy of management controls over 

operations and specific requirements for controls to safeguard assets 

against waste, fraud, and abuse. 

�	 Audits and certification, to place more focus on systems at the provider 

level and to ensure that all EDI and paperless processing systems are 

trustworthy and reliable. 

�	 Contractor con.ict of interest, to pursue the Medicare contractor conflict 

of interest issue as it relates to proprietary EDI and paperless processing 

market-driven ventures. 

F� Valid contracts, to determine the degree of compliance of current and 

planned Medicare contract requirements with the National Institute of 

Standards and Technology standards. 

�	 Legal use of information submitted, to ensure the integrity of information 

through the use of provider agreements, a valid chain of custody, 

attestation and originator authentication, and the need for audit trails. 

CONCLUSION 

This document, prepared in response to HCFAS briefing for OIG personnel on EDI 

and paperless processing issues and its request for more information on the OIG’S 

concerns and plans, has identified numerous issues and goals related to HCFA’S use of 

EDI and paperless processing technology. Issues related to the overall strategy of this 

initiative concern the development of various systems which will allow HCFA to 

process electronically submitted claims more efficiently. Other broad issues are 

standardization, incentives, companion technologies, Medicare contractor systems, and 

Federal Medicaid initiatives. 

This document also raises issues regarding the trustworthiness and reliability of data as 

it moves from one partner in electronic commerce to another and from one process to 

another. These issues include confidentiality and privacy, management controls over 

operations, internal controls, audits and systems certifications, Medicare contractor 

conflict of interest, validity of contracts, and the integrity of information. Besides 

having a significant impact on HHS and HCFA’S ability to manage the Medicare and 

Medicaid programs, these issues are critical to the detection of fraud and abuse. We 

plan to analyze many of these issues for the purpose of preparing our workplan over 

the next few years. 

ii 
AGENCY COMMENTS 

The Health Care Financing Administration (HCFA) commented on a draft version of 

this report. The HCFA suggested changes in the report to better reflect its activities 

and those of the Department with respect to EDI and paperless processing, made 

suggestions about the focus of OIG’S work in this area, and gave us technical 

comments. We have revised our report to address many of HCFA’S comments and 

also provide additional comments on HCFA’S response in Appendix B. The full text 

of HCFA’S comments can be found in Appendix A. 

... 111 
TABLE OF CONTENTS


EXECUTIVE SUMMARY


INTRODUCTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..1


ISSUES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...3


POLICY DIRECTION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...3


SYSTEMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...3


STANDARDIZATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...6


INCENTIVES AND B~RIERS . . . . . . . . . . . . . . . . . . . . . . . . . . ...7


COMPANION TECHNOLOGIES . . . . . . . . . . . . . . . . . . . . . . . . . ...10


COHESIVE STRATEGIC SYSTEMPL~ . . . . . . . . . . . . . . . . . . . . 12


POLICY IMPLEMENTATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...14


CONFIDENTIALITY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...14


INTERNAL CONTROL . . . . . . . . . . . . ., . . . . . . . . . . . . . . . . . ...15


AUDITS AND CERTIFICATION . . . . . . . . . . . . . . . . . . . . . . . . . ...16


CONTRACTOR CONFLICT OF INTEREST . . . . . . . . . . . . . . . . . . . 19


VALID CONTRACTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...20


LEGAL USE OF INFORMATION . . . . . . . . . . . . . . . . . . . . . . . . ...21


CONCLUSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ...25


APPENDIX A - AGENCY COMMENTS . . . . . . . . . . . . . . . . . . . . . . . . . . . .. A-l


APPENDIX B - OIG RESPONSE TO AGENCY COMMENTS . . . . . . . . . . . . . B-1


APPENDIX C - ACRONYMS USED IN THIS REPORT . . . . . . . . . . . . . . . . . C-1

INTRODUCTION 

PURPOSE 

The purpose of this document is to (1) identify emerging issues in the expansion of the 

Health Care Financing Administration’s (HCFA) use of electronic data interchange 

(EDI) and related technology to achieve paperless processing, and (2) discuss the 

Office of Inspector General’s (OIG) plans to provide oversight of HCFAS strategy to 

implement a paperless environmental We have developed it through a review of 

literature and consultation within the OIG, and with HCFA and others. 

BACKGROUND 

Electronic Data Interchange is the electronic transfer of information, such as 

electronic media claims, in a standard format between trading partners. As it relates 

to health care, this new technology will allow entities within the health care system, 

connected by an integrated system of electronic communication networks, to exchange 

medical, billing and other information and process transactions in a manner which is 

fast and cost effective. Most of these improvements are likely to result from the 

significant reduction or elimination of paper transactions. 

Electronic Billing 

The HCFA has encouraged electronic submission of claims under Medicare for 

some time, and has recently stepped up its efforts to lead increased electronic 

billing under the Medicaid program. New incentives for the use of electronic 

billing are now in place. Providers submitting claims electronically are paid 

faster than providers submitting paper claims. The HCFA also has taken steps 

to move towards adoption of nationwide standardized electronic billing formats 

for both Part A and Part B. 

lThis document describes OIG projects which are either in progress or planned for 

completion by the end of FY 1995. These projects are subject to change depending 

on our availability of resources, continuing review of priorities, and assessment of new 

research in the field. 
Electronic Adjudication and Payment 

All payers, including the Medicare and Medicaid programs, are moving towards 

paperless billing and adjudication and payment of claims. HCFA plans to have 

the Medicare Transaction System (MTS) in place by 1998. This system, which 

will combine Part A and Part B of the Medicare program for the purposes of 

claims submission, adjudication and payment, will replace the 14 software 

processing programs used by the 48 fiscal intermediaries and 34 carriers that 

currently process Medicare claims. 

Furthermore, most of the health care reform bills now being considered include 

provisions for simplification in the administration of health care benefits 

through the use of standardized electronic billing and payment procedures. 

Several of the reform bills also call for use of an electronically readable card to 

be used to verify eligibility for benefits. 

Beyond the Cliiims Environment 

Other initiatives will also use technology to improve the health care information 

system. The Computer-Based Patient Record Institute (CPRI) is the 

organization that has been given the responsibility to initiate and coordinate all 

activities which will establish the routine use of computer-based patient records 

in all health care settings by the year 2001. Its mission is to support the 

effective and efficient use of computer-based patient information and to foster 

the computer-based patient record (CPR) as the primay vehicle for collecting 

patient data. 

These initiatives are important ones for the entire health care system, and for the 

Medicare and Medicaid programs in particular. They hold out the promise of more 

efficient administration of program benefits, faster claims processing, reduced 

administrative costs and hassle for both providers and program administrators, and 

more effective coordination of benefits and care for patients. Yet, they also hold risks, 

As with any implementation of major new initiatives, thoughtful and careful planning is 

essential. Coordination among groups within and outside the Department of Health 

and Human Services must take place to avoid stumbling blocks. Goals, objectives and 

timetables must be set. All tasks must work together to form a coherent strategy. 

New vulnerabilities and problems which might be introduced by new systems and 

strategies must be anticipated and overcome. 

2

ISSUES


Major issues relating to HCFA’S EDI and paperless processing initiatives can be 

grouped into two major categories: (l)policy direction; and(2) policy 

implementation, including trustworthiness and reliability of systems. 

POLICY DIRECTION 

The HCFAS far-reaching EDI and paperless processing initiative, in both the 

Medicare and Medicaid programs, contains many parts. Each of these parts is worthy 

of examination in its own right and as it relates to the larger strategy and goals of this 

initiative. Among the significant elements of this strategy are the following: 

�	 Systems--such as the Medicare Transaction System (MTS), Medicaid 

Management Information Systems (MMIS), and point-of-service claims 

management systems under Medicaid--to more efficiently process 

electronically submitted claims and manage data. 

E Standardization, to facilitate the electronic flow of claims, patient, and 

reimbursement data between providers, payers, and quality-of-care reviewers. 

F Incentives, to encourage providers to submit claims and patient data 

electronically. 

�	 Companion technolo~”es, such as smart cards for computerized patient 

identification and medical records, and national data communications networks 

for transmission of health care data to complete the electronic cycle. 

We also discuss the need for a cohesive strategic systems plan covering EDI and 

paperless processing, to encourage HCFA’S information resources management 

program to address Medicare contractor systems and Federal Medicaid initiatives. 

SYSTEMS 

M2dicare ~ansaction $ystern (MIX) 

The HCFAS 48 fiscal intermediaries and 34 carriers currently use 14 shared software 

systems to process bilk and pay claims. Under MTS, HCFA plans to replace the 

current Part A and Part B systems with one unified system. This new system will 

consolidate the claims-processing function into anywhere from 1 to 10 contractors. 

Current contractors would continue to handle beneficiary inquires and payment 

safeguard functions, and would input paper claims to electronic format before sending 

them to the processing centers. The MTS is projected to be in place by 1998 and is 

expected to make it easier for HCFA to make the system changes required to put new 

Medicare regulations and payment policies into effect. The MTS is also expected to 

make it easier for providers to inquire about the status of their outstanding claims. 

3

The HCFA feels that MTS is necessary to help control the rise in Medicare processing 

costs since it projects a 50 percent increase in claims volume by 1997. 

Recently, HCFA awarded a $19 million, six-year contract for MTS design and 

development support services to GTE Government Systems Corporation. The 

General Accounting Office (GAO) was asked by Congress to review the MTS 

procurement. The GAO final report, transmitted to HHS on March 1, 1994, 

recommended that the Secretary ensure continuous involvement in MTS by HCFA top 

management, participation by Department information resources management officials 

and other experts, and reporting on progress and project status each January to 

congressional appropriations and oversight committees. 

The OIG has previously recommended that HCFA undertake a strategic planning 

initiative to streamline, consolidate, and integrate Medicare claims processing. The 

HCFA has indicated that MTS addresses this recommendation. Thus, OIG plans to 

review?’the MTS systems design process, with particular emphasis on how HCFA 

plans to improve payment safeguards, provider accountability, internal systems 

controls, and financial management through implementation of the system. The 

results of this review should clari~ issues raised by GAO and should be of use to 

HCFA as specifications are developed for the new MTS, particularly with respect to 

the sufficiency of HCFA’S safeguards designed to ensure proper payment. 

Medicaid Management Infomuition $wtems (MUIS) 

Each of the jurisdictions (State or territory) operating a Medicaid program is entitled 

to enhanced Federal financial participation for the development and operation of a 

Medicaid claims processing system--referred to by HCFA as a Medicaid Management 

Information System--in accordance with minimum Federal standards. All but one of 

the Medicaid jurisdictions have either implemented such a system or are in the process 

of doing so. 

A number of these systems have either been installed initially or have been replaced 

within the last 5 years. Many of these newer MMIS incorporate in their design 

features (such as State-wide data communications networks) to facilitate electronic 

billing, adjudication, and payment of Medicaid claims. And, a number of these 

systems are integrated with State Family Assistance Management Information Systems 

(FAMIS) and State-wide data communications networks to facilitate EDI and 

paperless processing in both the Medicaid and Aid for Families with Dependent 

Children programs. 

“’Review of Medicare Bill and Claim Processing: Opportunities for Long Term 

Improvement,” A-14-91-02532, August 1992. 

3As Part of “Electronic Claims Processing - Medicare,” planned for completion at 

the end of FY 1995. 

4 
The OIG plans to review recent State efforts to implement MMIS and integrated 

FAMIS/MMISto determine the adequacy of the planning process, the thoroughness of 

the risk analysis, and the degree of success in meeting system goals. 

MedicaidPoi ntofServt”ce (POS) Claims ManagementSystems 

The OIG will review the States’ use of MMIS data in conducting utilization review and


analysis as part of our planned work in assessing innovative approaches to Medicaid


utilization review.


Point of Service claims management systems use computers and telecommunications


networks to perform one or more of four related but distinct claims management


functions. These are eligibility verification, claims submission, claims adjudication, and


utilization review. POS systems allow all of these functions to be performed in a


matter of seconds, before or while the services are being dispensed. Most existing


POS systems are in the private sector and are used primarily for the management of


prescription drug claims.


The Secretary of Health and Human Services (HHS), in response to requirements


included on OBRA 1990 and in conjunction with the MMIS program, has encouraged


State Medicaid programs to implement POS systems for managing prescription drug


claims. The Federal Government provides up to 90 percent Federal financial


participation for the development of these systems and has authorized the Secreta~ to


waive certain paperwork requirements.


The OIG has performed a study of Medicaid POS systems.4 In this study, the OIG


found that POS systems, in the two States that have used them, have saved money and


have enhanced program administration. It also found that few States plan to acquire


POS systems. This is due primarily to the barriers that have limited States’


implementation of POS systems and the inadequate and confusing information that


many States have received about POS systems. We plan to examine these issues


further in our upcoming MMIS review and to conduct a further study of States’


implementation of the drug utilization review (DUR) requirements of OBRA 1990.


Since the OIG study on Medicaid POS systems, 8 State Medicaid agencies (SMA)


have reported implementation systems for pharmacies (including 6 systems with


utilization review capability). Ten additional SMAS indicated that they were


developing POS modules for implementation by the end of calendar year 1993, and 21


of the remaining 33 SMAS noted that they were considering the development and


implementation of POS modules for completion by late 1994.


4 “Point-Of-Service Claims Management Systems For Medicaid,” OEI-01-91-00820, 

May 1992. 

5 
STANDARDIZATION 

When encouraging the development anduseof anynew emerging technology, the 

establishment of standards becomes a critical issue which can “make or break” the 

technology. Take the example, from a few years ago, of quad-stereo. The fate of this 

superior sound technology was in the hands of a few manufacturers who could not 

agree on a standardized equipment format. Because of the lack of standardization, the 

technology never made the market penetration it was expected to achieve. While 

EDI, unlike quad-stereo, is here to stay, the fate of its universal acceptance does lie in 

the hands of those groups which are in the position to mandate equipment and 

software standards. 

Currently, there is no national group which is responsible for the establishment of a 

uniform data set and uniform data element definitions with respect to health care 

transactions. Informational standard setting organizations, such as the National 

Uniform Billing Committee and the Uniform Claim Form Task Force, have not been 

given a clear role in defining data element definitions and reporting requirements. 

Also, compliance with the recommendations made by these groups is generally 

voluntary. There is an additional problem caused by the lack of coordination between 

the groups that develop the electronic formats (e.g. the American National Standards 

Institute or ANSI) and the standard setting groups. The standard setting groups are 

not always allowed to review the new EDI transaction data sets developed by ANSI 

and others. 

The Federal Government has the opportunity to take the lead in encouraging (if 

necessary mandating) and guiding the development of EDI standards. But, if EDI is 

to be standardized throughout the entire health care community, the Federal 

Government must be prepared to modify substantially, if necessary, the current 

systems utilized by Medicare, State Medicaid programs, the Department of Veteran 

Affairs, Civilian Health and Medical Program of the Uniform Services (CHAMPUS), 

and the Indian Health Service. 

In the previous administration, Secretary Sullivan of HHS established the Workgroup 

for Electronic Data Interchange (WEDI) to work with the insurance industry on 

standardizing electronic billing, remittance advice and banking formats, and moving 

towards an all-electronic environment for processing of health insurance claims in the 

public and private sectors. The impetus for this effort was a generally-accepted 

premise that costs of administering Medicare, Medicaid, and private health insurance 

plans and the paperwork burden imposed on providers by the insurance industry are 

inordinately high without significantly constraining health care costs. 

Under this effort, some progress in standardization was made. The HCFA began 

active participation in the ANSI committee establishing standardized electronic 

formats for the health insurance industry. The HCFA then issued regulations calling 

for the use of ANSI standard transactions for electronic remittance notices and 

6

payments by both the Medicare and Medicaid programs. The HCFA is planning to 

implement a standard uniform institutional billing form for Medicare and Medicaid 

over the next year. Legislation, which would have empowered national standards 

organizations to establish mandatory standards for electronic submission and payment 

of claims, facilitated establishment of a national telecommunications network for 

health care administrative data, and promoted the clearinghouse concept to improve 

the coordination of benefits between various public and private payers, was not passed 

in the last session of Congress. However, the Clinton Administration has recognized 

the importance of standards and integrated health information systems and 

communications networks as a way to promote administrative simplification in health 

care. It has included establishment of such standards and networks under the auspices 

of a National Health Board as part of its health care reform proposal. 

We plan to track and analyze progress by the Department and HCFA in fostering 

standardization as part of our ongoing assessment of HCFA’S ability to move to 

paperless processing in the age of EDI and electronic commerce. 

INCENTIVES AND BARRIERS 

?%ehxfidkm’ Pmpective 

An obvious obstacle to getting providers to “buy into” an EDI and paperless


processing system is simply the resistance to change to a new method of doing


business. Then there are more substantiated reasons for not wanting to use EDI and


paperless processing. One example is that some provider types, especially DME


suppliers, have refrained from using EDI and paperless processing because there are


no electronic methods for submitting attachments. Another reason for not using EDI


is the lack of standard data sets. This forces many providers to adopt an electronic


format which is compatible with the payer to whom the provider submits the majority


of their bills. Finally, there are the additional costs incurred by a provider who wishes


to convert to EDI and paperless processing.


Issues which may need to be addressed include:


b	 What education programs can be put in place to help overcome provider 

resistance to change? 

b Should HCFA create EDI and paperless processing benefit models based on 

provider size, geographic location, and patient mix, in order show providers 

how the benefits of EDI and paperless processing relate to them? 

�	 What incentives are needed to bring providers into the EDI and paperless 

processing environment? What about tax incentives, low or no-cost software, or 

the elimination of the Medicare floor used to pay claims? 

7

�	 What needs to be done to ensure that providers adopt a uniform EDI and 

paperless processing environment? 

The HCFA Bureau of Program Operations (BPO) is currently studying those 

attachments to bills, such as Certificate of Medical Necessity (CMN) forms, that can 

be standardized, automated or eliminated. The BPO is also enlisting the support of 

national provider organizations and has developed a publicity campaign to promote 

the adoption of EDI technology. The BPO has two point-of-service pilot projects 

underway and has evaluated a number of innovative proposals for EDI and paperless 

processing projects. 

Providers who decide to implement new EDI and paperless processing technology will 

be faced with incurring four types of costs. These costs are for hardware, software 

purchasing or leasing, installation and training, and telecommunication charges. Since 

most of these costs are relatively fixed (they exist whether the provider submits one 

claim, one hundred claims, or one million claims) and the gross savings accrue on a 

per claim or electronic transaction basis (the more claims or electronic transactions 

the more savings), overcoming these fixed costs is the principal factor that prevents 

low-volume providers from acquiring EDI and paperless processing technology. This 

problem is compounded by the fact that a significant number of small providers, 

especially rural providers, lack computerized offices. For these providers, investing in 

the required costs listed above would probably not be cost effective. 

Issues with regard to small providers include the following: 

�	 Will small providers, especially rural providers with small Medicare patient 

loads, be required to invest in EDI and paperless processing technology? 

�	 What are the costs associated with conversion, installation, and maintenance of 

these systems and can small providers justify these costs? Can small providers 

pool operational costs? 

F What alternatives exist for small providers? 

The HCFA BPO is currently taking inventory of all of the low cost software that 

Medicare contractors are required to make available to providers. The HCFA 

Regional Offices will then determine contractor compliance. The BPO is also in the 

process of evaluating a number of pilot projects which are using emerging technologies 

in the payment area. Some of these, one example being fax imaging technology, may 

be feasible for small providers to use as a cost effective substitute for a complete EDI 

and paperless processing system. 

The OIG plans to assess how different providers can be brought into the EDI and 

paperless processing environment, what barriers exist for providers, and whether 

HCFA’S efforts address those barriers and provide proper incentives for providers. 

8�
l%e HCFAk Peiqxctive 

For the short term, some of the key issues of concern to the OIG are as follows: 

�	 What changes have been made in Medicare claims processing as a result of the 

implementation of Medicare national claims formats and electronic funds 

transfer (EFT)? 

F	 Have these changes been implemented successfully, i.e., is there a probability of 

payment errors or fraud? 

The HCFA has identified increased electronic media claims (EMC) and EFT as the 

primary means for effecting short term reductions in Medicare claims-processing unit 

costs.s And, by the end of Fiscal Year 1993, HCFA will have invested over 

$21 million in EMC/EFT improvements at the Medicare contractors. 

The HCFA as established the following goals for EMC: 

F	 Increase the rate of EMC to 100 percent for hospitals and 75 percent for all 

other providers within 3 years. 

F	 Increase the rate of EFT for Medicare payment to hospitals to 100 percent 

within 3 years. 

F Increase the overall cost effectiveness of EMC. 

These are challenging goals, and we are concerned that, with limited resources and 

many other operational issues that had to be dealt with at the same time, HCFA’S 

planning and execution to reach these goals may not have been adequate. To address 

these concerns, we have initiated a reviewG during which we will determine if HCFA: 

F	 Adequately assessed benefits and costs. (The HCFA believes that it will realize 

significant cost savings from full EFT implementation.) 

‘Based on experience of the health insurance industry as a whole, HCFA believes 

that it is $0.50 per claim cheaper to process an electronically submitted claim than a 

hard-copy claim. This difference results primarily from data entry of hard-copy claims 

into electronic claims processing systems. 

The HCFA believes that even more savings may accrue from EFT and 

electronic notice of remittance, rather than payment by check and paper remittance 

advice. These savings result primarily from reduced mail room and postage costs. 

“’Electronic Claims Processing - Medicare,” which is currently in the survey phase. 

9 
F	 Adequately assessed potential risks and vulnerabilities inherent in EMC, EIW, 

and paperless processing. (For example, HCFA does not believe that benefit 

payments made under EFT will be vulnerable to errors and/or fraud because 

the involved EFT parties of the contractors, Medicare banks, and the 

Automated Clearing House operators are bound by strict operating guidelines 

and Federal regulations concerning the initiation, transmission, and receipt of 

EFTs.) 

�	 Provided adequate instructions, lead time, and resources to the Medicare 

contractors. (The HCFA has been providing technical specifications, 

procedural guidance, and appropriate funding since 1990.) 

F	 Sufficiently track progress during implementation in a timely and effective 

manner to identify problems and resolve them. (The HCFA believes that it has 

been diligent in tracking the progress of contractors, providers, and SMAS in 

implementing EFT.) 

We will also determine the degree of success that the Medicare contractors are having 

in implementing the changes called for, and reaching the EMC~FT targets set by, 

HCFA. 

COMPANION TECHNOLOGIES 

Smart Cards 

Smart cards are wallet-sized, machine-readable cards that contain an integrated chip 

(its own computer) which can store an individual’s medical history and other forms of 

data. In its simplest form these cards allow access to a health care plan database. 

The health care industry continues to rely on identification cards to recognize plan 

members. Because of their extensive use, cards in one form or another are here to 

stay. As these identification cards become more sophisticated and become smart 

cards, the OIG should be concerned about two main issues. These issues are the cost 

of the cards and standardization. 

The cost of machine-readable cards (equipment and installation) and the necessary 

infrastructure (training) to support the cards are certainly major drawbacks to a smart 

card system. A smart card system according to WEDI could cost hundreds of millions 

of dollars. Should smart cards be used when the less expensive magnetic strip or 

swipe card (credit card or ATM model) may contain all the information required? 

Smart cards must contain a standard set of information. The issue is the amount of 

information required. In order to allow for an efficient electronic access to 

information, and the transfer of information between payers and providers, at a 

minimum this information must be able to identify the payor and the plan member. 

The decision must also be made as to the amount of patient clinical information that 

should be put on the smart card. Should patients be required to carry data bases 

10

around in their pockets when central computer and communication networks are a 

capable alternative? 

Currently, there are several ongoing experiments on the application of card technology 

for the health care industry. The States of New York and Massachusetts use the 

magnetic strip card with an on-line communications network to monitor eligibility and 

utilization for their Medicaid populations. Smart cards are being used to monitor Aid 

to Families with Dependent Children, food stamp, and Medicaid populations in 

various States. 

Even though WEDI does not recommend the use of the smart cards because of its 

expense, we still recommend that HCFA look at smart cards (e.g. for use in verifying 

electronic signatures) and that HCFA study the results of the above experiments, and 

review the experience of States that have used various types of cards in the design of 

MTS and the implementation of the computerized patient record. 

Computerized Patient Records 

In order to be able to make informed health care decisions, policy decisions as well as 

clinical, the U.S. health care system needs better access to the information contain in 

patient records. This information, now contained in paper-based systems, is often 

fragmented, irretrievable, and illegible. The Institute of Medicine (IOM), after 

studying this issue for 18 months, has recommended that patient records be computer 

based. In addition, the IOM has endorsed the establishment of a private/public 

initiative which is to now called the CPRI. The CPRI, formed during the summer of 

1991, will be responsible for the initiation and coordination of all work that will 

eventually establish the routine use of CPRS in all U.S. health care settings. The 

CPRI has formed five committees, and these committees will perform much of the 

work which is yet to be done. 

HHS involvement in this area to date has consisted primarily of the establishment of 

an HHS computerized Patient Records Council to promote and coordinate various 

Departmental activities; partial funding of the American National Standards Institute’s 

Health Informatics Planning Panel; participation in the deliberations leading to the 

formation of the CPRI; participation in the American Hospital Association’s 

Workgroup on Computerization of Patient Records and the WEDI; and the 

establishment of the HCFA Electronic Environment Steering Committee. 

Because the establishment of the use of CPRS is still in its conceptual phase, various 

issues face the OIG: 

�	 What are the benefits and the costs of the computerized patient record? The 

OIG should determine if a proper cost/benefit analysis has been performed to 

ensure, as best as possible, that CPRS will not only be useful and accessible, but 

also not so prohibitive that providers will not be able to afford their installation. 

11

F	 What is required to guide the development of electronic clinical information or 

CPRS? What is needed to insure a uniform standard data set, definitions, and 

format? What needs to be included in patient records and which models of 

CPRS should be adapted? Will HCFA rely entirely on the CPRI to develop 

the standards? The OIG should be concerned that the Department have a 

place in the CPRI and that the Department give input at the early stages of the 

development of the CPR. 

Leadership by HHS in the area of CPRS is particularly important because of the 

implications for: 

�	 The Peer Review Organization (PRO) and SuperPRO activities relating to 

hospital utilization in Medicare. 

� Utilization review activities of Medicare carriers. 

� Utilization review activities of the States in their MMIS. 

F	 Provider level interface with future health information systems at the State and 

Federal level. 

In the future, the OIG will monitor the results from the work that is being performed


by the five committees. In the mean time, we plan to address the issue of


computerized patient records in the context of our ongoing review of MTS, upcoming


review of MMIS, and a planned review of internal systems controls at the PROS.


THE NEED FOR A COHESIVE STRATEGIC SYSTEMS PLAN COVERING EDI


In a prior report7, we indicated that Medicare contractor systems and Federal


Medicaid data initiatives were not being addressed in HCFA’S information resources


management (IRM) program; HCFA had not sufficiently assigned duties to, or assured


the independence of, its Principal IRM Official; and the Department had not


sufficiently monitored HCFA’S IRM activities. Furthermore, neither we nor GAO


have been able to discern any comprehensive strategy on HCFAS part related to how


Medicare and Medicaid will move into an all-electronic environment.


7“Review of the Health Care Financing Administration’s Implementation of the 

Project to Redesign Information Systems Management,” A-14-91-02533. At that time, 

HCFA had elected to move forward with a strategic planning initiative to streamline, 

consolidate, and integrate Medicare and Medicaid claims processing, including EDI. 

This initiative had critical goals and objectives to standardize systems, provide 

appropriate incentives, and utilize companion technologies. 

12 
Meanwhile, however, private sector initiatives in the area of EDI standards and 

investment in private sector EDI networks and systems continues at an accelerating 

pace. These efforts are, in large measure, being driven by the Blue Cross/Blue Shield 

Association and its member plans, large commercial insurance companies, and 

commercial clearinghouses and data processors. Each of these parties is pursuing an 

EDI strategy based primarily on business concerns, and particularly market share. At 

the same time, numerous legislative proposals are being offered in conjunction with 

health care reform that would dramatically affect how EDI for health insurance 

information would be structured and operate in the future. 

Without a viable Departmental strategy for channeling future EDI developments, we 

are concerned that: 

�	 Medicare and Medicaid may not be able to make the most effective use of 

emerging EDI technology. 

�	 The proliferation of EDI systems in the public and private sectors may 

accelerate. 

�	 Reductions in administrative costs per claim may not be achieved to the degree 

now anticipated. And, issues similar to that of conflict of interest now faced in 

dealing with Medicare and Medicaid secondary payer issues will remain 

unresolved. 

We plan to address some of these issues in our ongoing review of MTS and related 

HCFA EDI initiatives. And, we plan to re-examine the efficacy of HCFAS strategic 

systems planning process as one of a series of reviews of HCFA’S IRM programs 

8“Review of General Systems Controls at HCFA - Phase I“ planned for completion 

by the end of FY 1995. 

13 
POLICY IMPLEMEhYATION 

The implementation of new EDI and paperless processing systems, in particular, 

carries with it questions regarding trustworthiness and reliability of data as they moves 

from one partner in electronic commerce to another and from one process to another. 

Specific questions raised with regard to electronic submission and processing of claims 

include: 

F Confidentiality and privacy of patient records. 

F Internal controls. 

� Audits and certification. 

F Contractor conflict of interest. 

F Valid contracts. 

�	 Legal use of information submitted, stored and processed by new systems, 

including provider agreements, chain of custody, attestation and originator 

authentication, and the need for paper trails. 

CONFIDENTIALITY AND PRIVACY OF PATIENT RECORDS 

Any EDI and paperless processing system will need to ensure that the confidentiality 

of personally identifiable health insurance data be strictly maintained and the privacy 

of patients be maintained. This area is made complex because traditionally the legal 

requirements covering privacy have been addressed on the State level with each State 

being unique. This is further complicated because providers and payers are subject to 

different sets of rules, with additional variation among types of providers. 

The obligation that a provider must maintain the confidentiality of a patient’s health 

insurance data is defined by statue, common law, and professional ethics. It is the 

same whether the transmission and storage of this data is paper or electronic. The 

very reason that providers changed from the more cumbersome paper records to the 

more efficient EDI and paperless processing systems is the same reason that makes 

these systems more vulnerable. While EDI and paperless processing allows for more 

sophisticated security protocols, once these protocols are breached, it allows for a very 

efficient method of conducting an unauthorized transmission and review of 

confidential health insurance data. 

Because payers are required to release health insurance data to various sources, 

especially medical information, they must follow many conflicting legal requirements 

covering disclosure. This disclosure may be for claims adjudication and payment, 

14 
research, third party administration and utilization review, and audits. EDI and 

paperless processing must allow for these myriad of disclosures while protecting the 

privacy of the patients. 

Two issues before HCFA in the areas of confidentiality and privacy are: 

�	 What is required to ensure that all electronic health information remains at the 

required level of confidentiality? 

F	 Have standards been established and have these standards been incorporated 

into legislation and systems development? 

Although HCFA feels that the system security technology available at this time is 

more than adequate, we have little information to prove that this will be true into the 

future. The Privacy Act of 1974, 5 U.S.C. Section 552a, is the primary provision 

governing HCFA on the release of confidential health insurance data. On the 

provider side, the American Medical Association’s Principles of Medical Ethics 

requires that physicians safeguard confidential patient information within the 

constraints of the law. 

Confidentiality and the Privacy Act will be areas that HCFA must address in the 

concept development and design phases of MTS and other EDI and paperless 

processing systems. We will be looking at HCFA’S treatment of the issues of privacy 

and confidentiality as part of our ongoing reviews of EMC/EFT implementation and 

MTS and in our future reviews of MMIS and PRO systems internal controls. 

INTERNAL CONTROLS 

Section 2 of the Federal Managers’ Financial Integrity Act (FMFIA), among other 

things, addresses the adequacy of management controls over operations and specific 

requirements for controls to safeguard assets against waste, fraud, and abuse. The 

OMB Circular A-123, “Internal Control Systems,” prescribes policies and standards for 

executive departments to implement Section 2 of the FMFIA by setting up, 

maintaining, testing, improving, and reporting on internal controls in their program 

and administrative activities. Also, each agency is required to report any material 

weaknesses in the agency’s systems of internal controls and the planned actions for 

correcting such weaknesses. 

We have had concerns with HCFAS application of FMFIA with respect to Medicare 

contractors because it has not performed reviews sufficient to assure itself that the 

Medicare contractors have adequate internal control systems. Our position has been 

and continues to be that we are concerned with the lack of review of contractor 

controls under the FMFIA and in the future this could impact on the positive 

assurance with respect to FMFIA that HCFA is expressing to the Secretary of HHS. 

Furthermore, various Medicare contractors have previously taken the position that 

their EMC departments are proprietary and should not be the subject of audits. 

15 
The HCFA acknowledges that the adequacy of HCFA’S management controls over 

operations is an ongoing issue between HCFA and OIG and is the subject of extensive 

reviews by OIG. We believe that this issue exists due to HCFA and OIG having 

different philosophy and ways of performing internal control reviews. However, 

HCFA is aware of the importance of internal controls and evaluation activities in the 

area of EDI and welcomes the OIG’S additional thoughts or recommendations that 

would strengthen its operations. Furthermore, HCFA is currently developing a plan 

to review the internal controls and systems of contractors for compliance with the 

FMFIA. Because these reviews have not taken place, it is unknown whether adequate 

controls do exist. Absent reviews of internal controls, no material internal control 

weaknesses have yet been reported. Consequently, the degree of trustworthiness and 

reliability of Medicare contractor systems in general, and especially their EMC/EFT 

systems, is a significant concern. 

During the course of our ongoing review of HCFA’S implementation to date of EMC 

and EFT in Medicare, we will evaluate the sufficiency of internal controls over 

Medicare EMC/EFT processing. Our objective is to determine the level of reliability 

of claims data and accountability of providers. We will obtain and analyze all Federal 

policy requirements relating to HCFAS application controls over Medicare electronic 

billing and payment. We will identify any deviations between HCFA’S current set of 

controls and these Federal requirements. And, we will develop and analyze an 

applications controls matrix to identi~ high risk areas. Then, we will use the results of 

this analysis to determine if HCFA has noted any deficiencies and taken action to 

address them. 

AUDITS AND CERTIFICATION 

In the past, most audit interest has been focused on the main line processing systems 

at the Medicare contractors where most of the claims were received in paper form, 

keyed into electronic formats, edited, and processed through payment. With Medicare 

EMC being used for claims submission of an ever increasing percentage of claims and 

with increased use of EFT and electronic remittance notices (ERN) for payment, 

greater focus must be placed on systems at the provider level. Also, intermediaries 

and carriers typically use the same departments for Medicare EMC/EFT/ERN as they 

do for support of their “private side” operations. While these departments may not 

have been the focus of prior audit work because of the proprietary nature of their 

activities, they must be included in future work because their activities are integral to 

Medicare claims processing. 

16

Contractor Audi& 

The Medicare contractors are responsible for assuring that claims submitted from 

providers areaccurate and justified. This responsibility extends to insuring that 

provider-based systems used to submit claims electronically operate in a manner 

consistent with HCFA policies and instructions and in accordance with any additional 

requirements established by the servicing Medicare contractor. 

In the claims processing market today, there are a variety of provider-based systems 

and external clearinghouses that may be used for EMC. Installation and operation of 

these systems at the provider level, however, is the responsibility of the individual 

provider. To fulfill their responsibilities, therefore, Medicare contractors need to 

ensure that provider-based systems not only operate as intended, but also are 

governed by sufficient internal controls to assure adequate system and data security, 

system backup, and availability of supporting documentation. 

Because of the large number of low-volume Medicare providers (e.g., individual 

physician practices), the wide range of systems that providers may use and the variety 

of environments in which the providers operate these systems, the resources needed by 

the Medicare contractors to audit provider-based EDI and paperless processing 

systems on a 100 percent basis are likely to be prohibitive. Furthermore, our ongoing 

reviews of Medicare contractors suggest that funding for basic payment safeguard 

activities is so limited that the adequacy of selective audits of provider systems by their 

servicing Medicare contractors is problematic. 

Our primary concern, therefore, is the appropriateness of the criteria used by the 

Medicare contractors to select specific provider systems for audit and how well such 

audits are coordinated with other contractor activities requiring on-site reviews at 

provider locations. 

This issue is not being addressed specifically as an objective in our ongoing review of 

EMC/EFT implementation in Medicare. Rather, it will be addressed in the context of 

the compliance by the Medicare contractors with HCFAS requirements affecting 

EMC/EFT in the areas of 

F The solicitation and maintenance of provider attestations and certifications. 

F	 The issuance of instructions to providers on record keeping in support of claims 

submitted. 

F The establishment and maintenance of Medicare fraud and abuse programs. 

17

Interim Certification 

As noted above, the resource requirements to audit provider-based systems are likely 

to be so substantial that any audits of these systems by the Medicare contractors is 

problematic. The issue of systems certification, therefore, increases in importance. 

Systems certification is recognized in HCFA’S EMC strategy as a tool for providing 

some assurance that electronic billing systems used by providers meet basic industry 

and government standards. The HCFA has already established a two-tier list of 

sources for EMC packages: one list for sources meeting basic requirements; the 

other, a “select” list meeting more stringent requirements. There is no requirement, 

however, that providers use only those sources on the “selected” list. 

Furthermore, many providers use external billing services and/or claims clearinghouses, 

either in conjunction with, or instead of, provider-based EDI and paperless processing 

systems. The HCFA does not appear to have addressed how such sources should be 

certified, either individually or in conjunction with any systems which the providers 

may use in conjunction with them. 

As part of our ongoing review, we will obtain and analyze sufficient information to 

determine whether the maintainers and operators of EMC/EFT systems used in 

Medicare are in compliance with HCFAS requirements for systems certifications and 

testing. 

Bogram Safeguarh 

As Peter Weiss, a governmental expert on EDI, noted in a recent paper,9 

trustworthiness and reliability of EDI systems are criteria critical to ensuring the 

suitability of electronic data as evidence in a court of law. Also, conformance with 

Federal requirements for systems security (including the Computer Security Act, 

Privacy Act, and OMB Circular A-130 systems security requirements) with respect to 

data and access security is essential if EDI systems are to be certified as “trustworthy 

and reliable.” 

This issue is being addressed as a specific objective of our ongoing review of 

EMC/EFT in Medicare. We will determine whether the EMC/EFT systems 

maintainers and operators are in compliance with HCFAS requirements in the areas 

of access and data security as well as the system. We will also review HCFAS 

requirements for, and contractor’s compliance with procedures to identi& those who 

9 “Security Requirements and Evidentiary Issues in the Interchange of Electronic 

Documents: Steps Toward Developing a Security Policy” presented at the Workshop 

on Security Procedures for the Interchange of Electronic Documents, National 

Institute of Standards and Technology, November 12-13, 1992. 

18 
input data, as well as those who use the data. We will likewise determine if HCFA’S 

requirements are adequate and are being complied with for periodic certifications and 

maintenance of a chain of custody as the data move from user to user are adequate. 

Compliance w“th C&u.lar A-127 

The OMB Circular A-127 addresses compliance with Section 4 of the FMFIA and 

includes requirements for reviews of systems which collect, process, and use financial 

data. Recently, this circular has assumed greater importance because it is one of the 

primary sources of criteria for determining whether an agency’s financial systems can 

provide reliable data for use in preparation of financial statements, as called for under 

the Chief Financial Officer’s Act. 

In Medicare, among the data most critical to financial management are claims and 

claims payments; however, HCFA, to date, has not included Medicare contractor 

systems in the scope of their financial systems reviews program because these systems 

do not feed data directly into HCFA’S general ledger accounts. Thus, the extent of 

compliance of EMC/EFT systems at the Medicare contractors and EDI and paperless 

processing systems at participating providers with the criteria for reliability of financial 

data established under A-127 is uncertain, at best. 

This issue is being covered in part by our ongoing review of MTS and related EDI and 

paperless processing initiatives. This review will address whether the HCFA has an 

overall strategic plan for the development and implementation of the proposed MTS 

and the migration to increased use of EDI and paperless processing. And, if HCFA 

does have such a strategy, we will determine the degree to which this strategy is based 

on analyses called for under OMB Circular A-127 (financial management), as well as 

under OMB Circular A-123 (internal controls) and A-130 (IRM/systems security). 

CONTRACTOR CONFLICI’ OF INTEREST 

The HCFA and the OIG have become aware of allegations that certain contractors 

refuse to cooperate with some billing services which wish to submit Medicare claims 

electronically. The HCFA has forwarded instructions to the contractors requiring that 

third party software be made available to the providers. Compliance with these 

instructions still needs to be tested. 

Even though this area was studied in an OIG Management Advisory Report dated 

July 1992, the following issues will need further review: 

�	 Are Medicare contractors selling EDI and paperless processing systems 

(hardware and software) with an unfair competitive advantage and therefore in 

violation of antitrust law? 

19

F	 Is there a conflict of interest with the contractor marketing EDI and paperless 

processing systems to providers and then being requiredto audit and look for 

problems in these systems? 

The OIG has performed alimited reviewof four Medicare contractors (three


intermediaries and one carrier).l” This review found that the four contractors


appearedto comply with the requirements of Transmittal 1507 regarding the


timeliness with which contractors fill requests for lists of edits. It found that the three


intermediaries refused to accept direct computer-to-computer EMC submissions for


their private line of business unless the provider uses their subsidiary’s software for the


transaction. Finally, it found that the practice of requiring billing services and health


care providers to use the contractors’ for-profit subsidiaries may violate Federal


antitrust laws.


Because the growth in the use of EDI and paperless processing, its emergence as a


major issue in health care reform, and the involvement of Medicare contractors in


proprietary market-driven ventures, the OIG needs to pursue the conflict-of-interest


issue. We will address Medicare contractor compliance with HCFA’S current EMC


instructions as part of our ongoing review of EMC/EFT implementation in the


Medicare program. We plan to address the longer term issue of contractor conflict of


interest in our review of MTS and related EDI and paperless processing initiatives,


and as part of our continuing work in the area of Medicare secondary payer,


VALID CONTRACT’S


In order to be able to create valid contracts under EDI systems, payers (including


HCFA) and providers must recognize that information that is created, transmitted, or


stored in electronic form does satis~ the legal requirements regarding a written


signature the same as information that is recorded on paper. But, they must also


recognize that appropriate security techniques, practices and procedures must


incorporated into EDI systems before electronic contracts can be considered valid.


The GAO has addressed this issue in their December 13, 1991 decision memorandum,


“National Institute of Standards and Technology -- Use of Electronic Interchange


Technology to Create Valid Obligations.” The GAO prepared this memo in response


to a request by the Computer Systems Laboratory, National Institute of Standards and


Technology (NIST). The NIST asked GAO if Federal agencies can use EDI


technologies, such as message authentication codes and digital signatures, to create


valid contracts consistent with 31 U.S.C. Section 1501. Section 1501 establishes the


criteria for recording obligations against the government. The GAO concluded that


government agencies can create valid obligations by using EDI systems which meet


NIST standards for security and privacy.


10Management Advisory Report, “Electronic Media Claims and Contractors’ For 

Profit Subsidiaries,” OEI-12-91-O141O, July 1992. 

20 
A remaining question in this area is whether EDI systems being used by the Medicare


contractors and the providers meet the NIST standards for security and privacy. We


will determine the degree of compliance of current and planned Medicare


requirements with NIST standards as part of our ongoing reviews of EMC/EFT and of


MTS and related EDI initiatives.


LEGAL USE OF INFORMATION SUBMITI’ED


l+ovider Agreernen& 

The integrity of the Medicare and Medicaid programs depend upon monitoring the 

submission of claims and ensuring provider accountability. Consequently, this issue 

affects OIG investigations and prosecutions of suspected fraudulent or abusive 

providers. Clear and uniformly enforceable provider agreements are necessary in 

order to hold providers personally responsible for every claim submitted and to 

provide sufficient evidence for prosecution of fraud. 

Two recent court cases provide evidence that provider agreements may well become 

an issue in future court proceedings. In United States v. Mostaan, the defense 

claimed that the computerized claims lacked proper certification that the provider 

submitted claims only for services actually rendered by provider or an employee under 

the provider’s supervision. The Government survived a defense motion for acquittal. 

In United States v. Lofton, the Government could not introduce medical records 

because of another certification problem. The case was eventually dismissed by the 

Court on other grounds. 

The volume of claims involved in EDI applications such as Medicare EMC means that 

there may not be any certification by a provider that he or she has rendered services 

submitted for reimbursement. If provider agreements do not have uniform form and 

content, program integrity will be jeopardized and cases will be difficult to prosecute. 

According to a HCFA memorandum on EMC (written in July or August 1992), in 

order to submit claims via electronic media, a provider must first receive Automated 

Claims Input Authorization. This requires the provider to sign an agreement with the 

contractor. Any agreement signed between the provider and the contractor must 

establish clear guidelines for the handling of claims, as well as the assumption of 

responsibility for the completeness, accuracy and truthfulness of all claims submitted 

via electronic media. 

The memo indicated that HCFA has not yet standardized provider agreements, but 

has established guidelines which have “standard key elements” for agreements (Blue 

Cross/Blue Shield Medicare Agreement was attached as a model, but is a 1984 form). 

No certification of accuracy or statement of liability is required. 
The HCFA memo stated that most agreements require the provider to maintain all 

original source documents and medical records pertaining to any particular Medicare 

claim for at least 6 years following the month of payment. 

The HCFA welcomes the OIG’S review of the standard EMC agreement currently 

being developed by HCFA. The OIG plans to review provider agreements and 

determine if they are adequate for ensuring accountability. This includes the 

responsibilities of all parties in the EDI environment and the ownership of and 

responsibility for Medicare and Medicaid data at each point in the data flow. 

chain of Cl@@ 

Prosecutors must prove who had custody and control of claim documentation at each 

step of the billing process in order to successfully prosecute providers for fraudulent or 

abusive claims. A valid “chain of custody” will establish who was responsible for 

generating and storing electronic records. Record custodians must be able to account 

for each link in the chain of events involved in producing the records. Should the 

Government fail to meet this challenge, it likely will be unable to introduce critical 

evidence. 

According to the HCFA memo, no audit requirements exist for reviewing 

documentation, validation, or electronic transmission flows; nor for reviewing screens, 

edits, or internal controls. No requirements exist for assessing system securi~, nor for 

reviewing cases for semice appropriateness, or for analyzing charges and costs for 

services provided. 

The memo indicated that (at least as of mid-1992) audits are not conducted for bills 

submitted electronically. The HCFA requires an annual “verification” for Medicare 

Part B EMC. However, with approved plans, contractors may extend the annual cycle 

for verification of provider records. The standards require that the contractor review 

a random sample of one percent of provider-submitted EMC. The verification is 

narrow in focus. The purpose of the review is to establish that documentation for 

EMC is on file and is equivalent to that provided on a hard copy claim (a patient 

record exists, patient and physician signatures are on file, and other support 

documentation is available). 

Based on the above information, the audit requirements do not ensure that a valid 

chain of custody has been maintained at each step in the system. 

As the HCFA paper recommended, some procedures should be developed to identify 

each individual systems operator to avoid diffusion of responsibility, thereby making it 

easier to hold a particular provider accountable. Furthermore, stringent audit 

requirements should be developed to mandate review of internal controls and systems 

security. 

22

Adequate systems safeguards are necessary to ensure that data is not misused or lost, 

and that unauthorized persons cannot access it. Since the sensitive information 

involved in EDI and paperless processing is subject to considerable fraud and abuse, it 

must be properly protected to ensure provider accountability and thus be useful to 

investigations and prosecutions. 

Attestation and &“ginator Authentication 

Attestation and originator authentication must be established to show provider 

accountability and thus are important evidentiary items in investigations and 

prosecutions of suspected fraudulent or abusive providers. Technological advances 

may create new efficiencies in this. Among the issues of interest to the OIG are: 

F	 Are there better methods to verify “attestation” (i.e., acknowledgment of a 

submission by a provider) or “originator authentication” (i.e., assurance that the 

source of the message is the named originator and not some other entity) when 

using personal identification numbers (PIN)? 

�	 Has EDI technology advanced far enough to allow HCFA to consider 

fingerprinting (electronically read thumb prints) and retina scanning as forms of 

electronic signatures? 

As part of its review of provider accountability, the OIG will assess whether Medicare 

and Medicaid systems allow for proper attestation and originator authentication. 

Maintaining Audit Zlaih 

Lack of hard copy Medicare claims may adversely affect OIG’S ability to establish


provider accountability (i.e., who submitted what claim and when, who received the


claim, and whether the claims accuracy can be verified). Without the necessary


documentation, the Government will be unable to prove fraud or abuse since a


provider may contend that “I never reviewed the claim data.” Unless providers are


required to retain hard copy of claims,


meaningful review which ensures provider accountability may not be possible. On the


other hand, retention of hard copies of claims may negate or reduce some of the


benefits of moving to electronic submission of claims.


A regulation issued by the National Archives and Records Administration,


“Requirements for the Management of Electronic Records,” 36 CFR Part 1234, states


that electronic records may be admitted in Federal court proceedings if trustworthiness


is established. Some of these requirements should be incorporated by HCFA to help


ensure that EMC data will be admissible in Federal Court.


Further, it is generally recognized that the need for accounts reconciliation, periodic


audits, and recovery from emergency/disaster situations in an EDI and paperless


processing environment, where no paper records maybe generated, necessitates the


23 
establishment of a suitable electronic audit trail. With respect to Medicare 

EMC/EFT/ERN, specific requirements for this audit trail should be based on 

considerations of legality (e.g., covering time frames consistent with the statue of 

limitations), audit cycles, structure of the overall Medicare claims process (i.e., 

consideration of the number of separate internal control areas), and technology (e.g., 

electronic media can experience degradation of data quality after no more than 2-3 

years of storage without use). 

In the course of our work in reviewing implementation of EMC/EFT in Medicare, we 

will determine whether the EMC/EFT maintainers and operators are in compliance 

with HCFA’S requirements for audit trails and related processing controls, as well as 

with requirements covering instructions to providers on record keeping to support 

claims submitted. 

24

CONCLUSIONS


BASIS FOR REPORT 

This report is in response to the Health Care Financing Administration’s (HCFA) 

briefing for the Office of Inspector General (OIG) personnel on electronic data 

interchange (EDI) and paperless processing issues and its request for more 

information on the OIG’S concerns and plans. 

ISSUES 

This document has identified numerous issues and goals related to HCFAS use of 

EDI and paperless processing technology. Issues related to the overall strategy of the 

EDI and paperless processing initiative concern the development of systems such as 

the Medicare Transaction System, and the further development and use the Medicaid 

Management Information Systems, and the point-of-service claims management 

systems under Medicaid. These systems will allow HCFA to process electronically 

submitted claims and manage information more efficiently. In order to facilitate the 

electronic flow of claims, patient, and reimbursement data between providers, payers, 

and quality-of-care reviewers, HCFA must require standardization. To encourage 

providers to submit claims and patient data electronically, HCFA must eliminate not 

only barriers to provider participation, but also develop incentives. Various 

companion technologies, such as smart cards for computerized patient identification 

and medical records, and national data communications networks for transmission of 

health care data, will need further development. Additionally, HCFAS overall strategy 

must encourage HCFA’S information resources management program to address 

Medicare contractor systems and Federal Medicaid initiatives. 

This document also raises issues regarding the trustworthiness and reliability of data as 

it moves from one partner in electronic commerce to another and from one process to 

another. Issues raised with regard to electronic submission and processing of claims 

include the requirement that the confidentiality of personally-identifiable health 

insurance data be strictly maintained and the privacy of patients be protected. In 

order to address the adequacy of management controls over operations and specific 

requirements for controls to safeguard assets against waste, fraud, and abuse, internal 

controls must be reviewed. Audits and the systems certifications must be performed 

to ensure that all EDI and paperless processing systems are trustworthy and reliable, 

and that there is no Medicare contractor conflict of interest. For electronic contracts 

to be valid, they must be in compliance with the contract requirements of the NIST. 

Finally, HCFA must ensure the integrity of information, through the use of provider 

agreements, a valid chain of custody, attestation and originator authentication, and 

proper audit trails. 

25

FUTURE ACTION 

Because of the large number of issues and the our limited resources, we cannot 

possibly examine nor audit all of the issues related to EDI and paperless processing. 

As part of our oversight function, we plan to analyze all of the various issues listed 

above for the purpose of preparing our workplan over the next few years. We also 

recognize that HCFA has particular concerns about making its systems environment 

less susceptible to fraud and abuse and about the development of approaches for 

increasing small provider participation in the EDI and paperless processing 

environment. With respect to fraud and abuse, we are currently in the survey phase 

of reviewing electronic controls in the Medicare program and with respect to small 

providers, we are planning to study incentives for and barriers to small provider 

participation in EDI and paperless processing. 

AGENCY COMMENTS 

The Health Care Financing Administration (HCFA) commented on a draft version of 

this report. The HCFA suggested changes in the report to better reflect its activities 

and those of the Department with respect to EDI and paperless processing, made 

suggestions about the focus of OIG’S work in this area, and gave us technical 

comments. We have revised our report to address many of HCFA’S comments and 

also provide additional comments on HCFA’S response in Appendix B. The full text 

of HCFA’S comments can be found in Appendix A. 

26

APPENDIX A 

HEALTH CARE FINANCING ADMINISTRATION COMMENTS 
Health Care /’- “, � I) APARTMENT OF HEALTH & HUMAN SERVICES . 

< & Finarwng Adm:ntatrMemorandum


DEC29* 

Bruce C. Vlade~ 

Administrator ~l&@+ 

Subject	 Office of Inspector Generai (OIG) Draft Repo~ “Electronic Data Interchange: 

Issues and Challenges” (OEI-12-93-OO080) 

To 

June Gibbs Brown 

Inspector General 

We reviewed the subject draft report on electronic data interchange (EDI) issues. 

OIG does a credible job in identifying the enormous number of issues, potentia.i 

problems and tasks confronting the Federal governrnen~ and the Health Care 

Financing Administration (HCFA) in particular, in moving to a more fully automated 

environment. We are well aware of the monumental task facing HCFA with the 

implementation of ED I. We appreciate and share OIG’S concerns regarding EDI and 

believe OIG has an important role in its development and implementation. We l~k 

fortvard to working with OIG in this process. Our comments are attached for your 

review. 

Thank you for the opportunity to review and comment on this draft report Please 

advise us if you wish to discuss our response. 

Attachment 
Comments of the Health Care Financin~ Administration (HCFA~ 

on the Office of Inmector General (OIGl Draft Reoox-c 

. . “Electronic Data Interchange: Issues and Challenges” 

(OEI-12-93-00080\ 

General Comments 

OIG clearly demonstrates that it understands our goal of evolving Medicare and 

Medicaid into an all-electronic environrnen~ our pktns for achieving this goal, and the 

barriers that must be crossed before this goal can be realized. However$ the report 

implies that the Department of Health and Human Services (HHS) has not taken a 

leadership role in the development of computetid patient records. On page 2 of the 

Introduction and page 10 of the Companion Technologies section, for example, the 

report does not fully acknowledge HI-M’ leadership in this area. We think that the 

report should be revised to reflect the following: 

Establishment of an HHS computerized Patient Records Council to coordinate 

various Departmental activities and promote HHS leadership in the 

development of computer-based patient records systems. The council has met 

twice and wiil presumably be the focus of HHS activities in this area in the 

future. 

- Partial funding, through the Agency for Health Care Poliq and Research, of 

the activities of the American National Standards tititute’s Health Informatics 

Planning Panel (HISPP). The HISPP is coordinating various standard setting 

efforts in the area of health informatics. SUChcoordination is essential to the 

development of useful computerized patient records. 

Participation in the deliberations leading to the formation of the Computerized 

Patient Records Institute. 

- Participation in the American Hospital Association’s Work Group on 

Computerization of Patient Records. The work group was formed at the 

request of former Secretary Sullivan and recently released its draft report to 

Secretary Shalala. 

. Establishment of a HCFA Electronic Environment Steering Committee and 

participation in the Work Group for Electronic Data Interchange (WEDI) and 

the American National Standards Institute (NSI), to develop and implement 

standardization not oniy between Medicaid and Medicare, but between these 

programs and all other health care insurers. 
Page 2 

We believe.~e definition of electronic dam ~terchange (EDI) is not fully set forth in 

the report. AS sated in the introduction, EDI is the electronic transfer of data, in a 

standard fol-ma~ between trading partners. It should be made clear that EDI relates 

only to the data that are output from an applications system, e.g., a provider’s billing 

system, and how those data are transported to another applications system, e.g., a 

contractor’s claim payment system. ED1 does not apply to how that applications 

system actually processes the data. 

h addition, we believe OIG would be far more effective and helpful to HCFA by 

focusing its resources on those issues impacting most directly on the potential for 

fraud and abuse in the Medicare and Medicaid progrms (i.e., certifications, 

accountability, controls, integrity, confict of interes~ contracts, legal use of 

information, audit trails, and audits). We would we]come OIG’S recommendations 

relative to potential fraud and abuse issues. 

Also, we believe O IG has an important role to play in reviewing the sufficiency of our 

safeguards designed to ensure proper paymen~ We weicome OIG’S review of the 

standard Electronic Media Claim (EMC) agreement currently being developed. This 

standard agreement will detail the responsibilities of all parties in the EDI 

environmen~ and specify the ownership of and responsibility for Medicare and 

Medicaid data at each point in the data flow. 

Finally, we suggest that OIG, in a separate repo~ develop tie issue of small provider 

conversion to EMC/electronic funds transfer (ET. Once EDI reaches a “criticd 

mass,” the continued use of manual paper data systems will become increasingly 

inefficient. In developing incentive or cost-subsidtition programs for small providers, 

consideration shouid be given to the burden and cost they will create for HCFA if 

they do not interface with HCFA’S electronic system. 

The following comments are being offered under the designated headings reflected in 

the Issues section of the repow. 

POLICY DIRECTION 

Medicare Transaction Svstem (MTS): At the present the, MTS has not addressed 

the issue of smart card technology. The basic methods of a~ess and entitlement 

verification are still being reviewed. Medicare and Medicaid program staff have 

attended the technical advisory group (TAG) meetings of WEDI. WEDI 

recommended moving away from expensive smart card technology to the use of the 

data base. This recommendation did not require that users opt for a plastic card for 

identification. This TAG suggested that we study the use of computerized patient 

records in our medical review activities. 
Page 3


Medicaid P6iht of Service (POS~ Claims Management Smtems: As noted in our


comments on a prwicms OIG repo~ (Point-Of-Service Claims Management Systems


for Medicai& OEI-01-91-00820, May 1992), we are fully committed to improving the


efficiency of the State Medicaid Agency (SMA) Medicaid Management information


Systems operations through standardization and tie use of electronic technology.


Since this OIG report was issue~ eight SNIAs have reported implementation of POS


systems for pharmacies (including six systems with utilization review capability) MM


three of these systems being expanded and made available to providers other than


pharmacies. Ten additional SNlk are currently developing POS modules for


implementation by the end of calendar year 1993, and21 of the remaining 33 SW


are considering the development and implementation of POS modules for completion


by late 1994.


THE NEED FOR A COHESIVE STRATEGIC SYSTEMS PLAN COVERING EDI


HCFA is moving forward with a strategic planning initiative to streamline, consolidate,


and integrate Medicare and Medicaid claims processing, including EDI. Stidiirbg


of systems, providing appropriate incentives, and utitig companion technologies are


critical goals and objectives of this initiative.


POLICY IMPLEMENTATION


Internal Controls on EDI: This is an ongoing issue between HCFA and OIG


regarding the adequacy of HCFA’S management controls over operations and the


subject of extensive reviews by OIG. We perfo~ reviews deemed sufficient to ensure


that the Medicare contractors and SMAS have adequate internal controls. In the


course of our oversight activities, we review many of the procedures and processes


(i.e., internal controls) followed by the contractors. These oversight activities are


performed by both central office and regional office staffs. We perform reviews that


are formal and repetitive in nature, and which are used to evaluate performance.


There are many other reviews and contacts that are less formal which arise to address


specific issues. In both cases, HCFA is aware of the importance of internal controls


and evaluation activities in the area of EDI.


Data Safeguards: Any electronic data exchange system must safeguard access to the


system itself in order to protect the data within. This requires us to identify those who


input da@ as well as those who use the da~ and it also requires periodic


certifications and maintenance of a change of custody as the data move from user to


user.

Page 4 

In both of the above area% HCFA is aware of the importance of internal controls and 

evaluation ~ckvities in the area of EDI. We welcome OIG’S additional thoughts or 

recommendations that would strengthen our operations. 

Electronic Funds Transfer (EF17 : On page 8, The HCFA Perspective, OIG expresses 

concern about the changes that have been made in Medicare claims processing as a 

result of the implementation of Medicare nation~ claims formats and EFT. The EFI’ 

systems modifications were made by HCFA’S standard system maintainers and 

consisted primarily of installing the capability to initiate EFI’ with the Medicare bank. 

This function required system programming and liaison activities with the Medicare 

bank to ensure the establishment of proper Em transmission protocols. 

Since contractors initiate 13Ts and send these transmissions through the Medicare 

bank (the Automated Clearing House (ACH)), and ultimately to the provider’s bank 

evexy precaution has been taken to ensure the accuracy and integrity of each 

electronic payment transaction. The contracto~ Medicare ban~ and ACH operators 

are bound by strict operating guidelines and Federai regulations concerning the 

initiation, transmission, and receipt of EFI’s. The benefits accounting and reporting 

functions that occur with E17 transactions mirror those that currently exist under the 

checks paid method of advancing funds under the Letter of Credit system. Therefore, 

we do not anticipate that benefit payments made under EF’I’ will be vulnerable to 

errors and/or fraud. 

Suecific Comments 

Page 9, second bullet point: 

HCFA’S goal is to increase the rate of Em for Medicare payments made to 

hospitals to 100 percent within 3 years. 

HCFA is currently reviewing public comments received in response to BPO-104-PN 

which was published on January 1S. This notice proposes to require hospitals to 

submit all inpatient and outpatient bills electronically and to receive payments and 

remittance advices electronically. In response to the many comments urging HCFA 

extend the implementation timeframe for BP()-1()4.PIN, we anticipate that hospitals 

to 

will be given at least 6 months from the date of publication of tii final notice in which 

to comply with its requirements. We anticipate that the final version of this notice will 

be published no sooner than early in fiscai year 1994. 
Page 5 

Page 9, fourth-bullet point: 

OIG will determine if HCFA adequately assessed benefits and costs. 

The full benefits of EMC and EFl” are to be actieved in an integrated anti fully 

interactive claims submission and payment entionmen~ Our estimates of the benefits 

and costs of En have always been wn~rvatie and are predicated on the fact that 

EIW among physicians and suppliers will be implemented at a much slower rate than 

with institutional providers. Because of the relatively low volume of payments made 

to institutional providers we have yet to realize si~fiat cost savings from EFT 

usage. We anticipate that as the technology spreads throughout the entire provider 

community, cost savings will increase dramatically. 

In a recent OIG repo~ Electronic Funds Transfer for Medicaid Providers, 

OEI-01-91-00821, OIG recommended that HCFA ~ist States in developing billing 

agreements for providers who use electronic c1aimq remimce advisorie$ and funds 

transfers; and to develop guidelines for provider participation in Em. OIG agreed to 

consider conducting an inspection or audit on tie benefits and costs of EFI’ to help 

HCFA develop guidelines for States. 

Page 9, fifth builet point 

OIG will determine if HCFA provided adequate i.nstruction~ lead time, and 

resources to the Medicare contractors. 

In early 1990, HCFA began exploring Em technology for tie Medicare program. 

Em soon became a critical component of HCFA’S co~itrnent to establishing a 

totally electronic billing and payment environment for all Medicare contractors and 

providers. HCFA provided technical specification% procedural guidance, and 

appropriate funding throughout the implementation of ~. T& SUpport continues 

as increasing numbers of Medicare providers elect to receive payments via EITI’. 

Page 9, sixth bullet point: 

OIG will determine if HCFA is tracking progress during implementation 

sufficiently to identify problems and resolve them effectively and in a timely 

manner. 

HCFA has been quite diligent in tracking the progress of contractors, providers, and 

SMAS in implementing EFT. Staff has worked in conjunction with the contractor 

community throughout the implementation process. HCFA circulated draft contractor 

instructions for several months prior to their effective date to ensure that all concerns 

were taken into consideration in the final product. All problems identified by 

contractors were addressed in a timely and professional manner. 
Page 6 

Technicai Comments . . 

Page 3, last paragraph, fourth line from bottom - replace “transcribe” with


“input.”


Page 6, first full paragraph, third line from bottom - remove the word


“processing” from the sentence. ANSI fo~at,s are for ~smission of da~ not


processing. The “they” used in the be@ing of the last sentence needs to be


identified.


Page 6, third paragraph, third line from bottom - it is not clear what is meant


It

. . . that recordkeeping requirements in the insurance industxy as a whole


increase papenvork burden . . . .“ Doctors need to keep records so that they


know what procedures they have performed on patien~ and to whom they have


referred the patiens etc.


Page 6, fouti paragraph, fourth sentence - HCFA is not planning to implement


an ANSI standard uniform billing form. ANSI is a data transmission standar~


not a billing form.


Page 6, last paragraph, fifth sentence - OIG references specific legislation which


would empower national standards organizations to establish mandatoxy


standards for electronic transmission and payment of claims please provide the


bill number and the session of Congress.


page 17, Program Safeguard~ first paragraph - OIG cites a paper written by


Peter Weiss on EDI. Please provide a citation for this paper.

APPENDIX B


OIG RESPONSE TO AGENCY COMMENTS 

The Health Care Financing Administration (HCFA) commented on a draft version of 

this report. The HCFA suggested changes in the report to better reflect its activities 

and those of the Department with respect to EDI and paperless processing, made 

suggestions about the focus of OIG’S work in this area, and gave us technical 

comments. We have revised our report to address many of HCFAS comments and 

also provide additional comments on HCFAS response below. 

GENERAL COMMENTS 

HCFA Comments 

The HCFA believes that the OIG would be more effective and helpful to focus its 

resources on those issues impacting most directly on the potential for fraud and abuse 

in the Medicare and Medicaid programs (i.e., certifications, accountability, controls, 

integrity, conflict of interests, contracts, legal use of information, audit trails, and 

audits). 

OIG Res~onse 

The OIG recognizes that these areas are critically important and does plan to address 

them in our current and upcoming reviews. The OIG believes, however, that the 

other areas identified in this report also will have a direct bearing on Medicare and 

Medicaid operational efficiency, controls, and economy, as well as on financial 

management and reporting. Thus, OIG sees a need to address a broad range of EDI 

and paperless processing issues in its current and future work plans. 

HCFA Comments 

Because the continued use of manual paper data systems will become increasingly 

inefficient, the HCFA has suggested that the OIG, in a separate report, develop the 

issue of small provider conversion to electronic media claims and electronic funds 

transfer. 

OIG Response 

The OIG has developed a workplan item, “Adding Incentives and Removing Barriers 

to Provider Participation in EDI and Paperless Processing.” The purpose of this study 

is to assess how different providers can be brought into the EDI and paperless 

processing environment, what barriers exist for providers, and whether HCFAS efforts 

address those barriers and provide proper incentives for providers. 

B-1

INCENTIVES AND BARRIERS 

HCFA Comments 

In response to this report on the issue of HCFA’S goal to increase the rate of EFT for 

Medicare payments made to hospital to 100 percent within 3 years, HCFA indicated 

that it was reviewing public comments received in a response to its proposed notice 

published January 15, 1993. This notice was intended to promote the use of 

standardized electronic billing and payment by hospitals. Since then, HCFA concluded 

that it had no legal authority to penalize hospitals that fail to comply with the notice. 

When HCFA withdrew this notice on January 24, 1994, HCFA stated that the hospital 

electronic media claims submission rates exceeded 90 percent. 

OIG Resuonse 

The OIG is pleased to see that HCFA has achieved a rate of EFT for Medicare 

payments made to hospitals exceeding 90 percent, but OIG is concerned about the 

remaining hospitals that do not participate in the use of standardized electronic billing 

and payment mechanisms. As we have indicated in this report, we plan to look at 

provider participation in EFT as part of our review of Medicare claims processing. 
APPENDIX C


ACRONYMS USED IN THIS REPORT 

ANSI American National Standards Institute 

ATM automatic teller machine 

BPO Bureau of Program Operations 

CHAMPUS	 Civilian Health and Medical Program of the 

Uniform Services 

CMN Certificate of Medical Necessity 

CPR computer-based patient record 

CPRI Computer-Based Patient Record Institute 

DME durable medical equipment 

DUR drug utilization review 

EDI electronic data interchange 

EFT electronic funds transfer 

EMC electronic media claims 

ERN electronic remittance notices 

FAMIS� Family Assistance Management Information 

Systems 

FMFIA Federal Managers’ Financial Integrity Act 

GAO General Accounting Office 

HCFA Health Care Financing Administration 

HHS Health and Human Se~ices 

IOM Institute of Medicine 

IRM information resources management 

c-l

MMIS 

MTS 

NIST 

OBRA 

OIG 

PIN 

Pos


PRO 

SMA


WEDI 

Medicaid Management Information Systems 

Medicare Transaction System 

National Institute of Standards and 

Technology 

Omnibus Budget Reconciliation Act 

Office of Inspector General 

personal identification numbers 

point of service 

Peer Review Organization 

State Medicaid agencies 

Workgroup for Electronic Data Interchange 

c-2