GAO-01-114R Provider Enrollment Process

United States General Accounting Office

Washington, DC 20548

November 2, 2000

The Honorable Pete Stark

Ranking Minority Member

Subcommittee on Health

Committee on Ways and Means

House of Representatives

Subject: Medicare: HCFA to Strengthen Medicare Provider Enrollment

Significantly, but Implementation Behind Schedule

Dear Mr. Stark:

Medicare has long been the target of fraud and abuse. One of the first defenses

against improper Medicare billings is the screening of applications from providers to

participate in the program. All providers1including physicians, hospitals, suppliers,

and others who wish to provide goods or services to Medicare beneficiariesmust

first enroll in the Medicare program. Denying enrollment to providers who are not

qualified, or who might be suspected to bill the program improperly in the future, can

reduce the risk of fraud and abuse.

The Health Care Financing Administration (HCFA), with the assistance of

approximately 60 insurance companies, operates and manages the Medicare program.

These insurance companies—or contractors—process claims and assist HCFA in

ensuring the program’s financial integrity. Their responsibilities include reviewing

provider applications to determine whether providers meet Medicare requirements

and if there is reason to suspect that providers’ future Medicare billings would be

improper.

Concerned that HCFA and its contractors should be doing more to identify dishonest

providers before they are enrolled in Medicare, you asked that we (1) identify

weaknesses in HCFA‘s current enrollment process, (2) assess HCFA’s plans to

strengthen this process, and (3) determine whether HCFA’s enrollment of Medicare

providers could be better performed by a smaller number of contractors.

To do this work, we interviewed HCFA officials and reviewed documentation related

to provider enrollment requirements and practices. We interviewed representatives

1

The Medicare program distinguishes between “providers,” including hospitals, nursing facilities, and

other institutions or agencies, and “suppliers,” which include physicians, laboratories, and other

sources of medical supplies and services. For simplicity, we will use the term “providers” to refer to

both providers and suppliers of medical services and supplies.
2 GAO-01-114R Provider Enrollment Process

from two of the largest Medicare contractors responsible for processing provider

enrollment applications to discuss their processing methods. We also conducted

telephone surveys with 10 additional Medicare contractors to determine the

procedures and resources they used to verify provider enrollment data. Our work

was performed between February and September 2000 in accordance with generally

accepted government auditing standards.

In summary, we found that HCFA’s current provider enrollment process does not

completely ensure that dishonest and unqualified providers are prevented from

obtaining Medicare billing privileges. In some instances, contractors do not

independently verify critical information contained on enrollment applications or do

not perform key verification tasks. Recognizing these weaknesses, HCFA has

initiated improvements. It plans to revalidate provider enrollment information

periodically and expand the criteria used to reject enrollment applications. It has

also developed a new data system that will help ensure that only qualified providers

enroll in Medicare. However, plans for the data system are behind schedule, and

additional delays may slow implementation further. Finally, HCFA is considering

reducing the number of contractors responsible for enrolling providers in Medicare.

We believe that consolidating provider enrollment tasks with fewer contractors could

strengthen HCFA’s ability to oversee these contractors and enhance the efficiency of

the enrollment process. HCFA is in general agreement with our assessment that

more needs to be done to establish standards and improve the process for provider

enrollment.

BACKGROUND

Medicare provides health insurance coverage to about 39 million elderly and disabled

Americans. Before 1996, Medicare’s provider enrollment process consisted of

contractors’ obtaining the names and billing addresses of applicant providers. In

1996, HCFA introduced its first standard provider enrollment applications and began

collecting more detailed information such as medical education and practice location

on its newly enrolled providers. However, with the exception of suppliers of durable

medical equipment, prostheses, orthotics, and supplies (DMEPOS), HCFA did not

solicit updated information from providers who had enrolled in the program before

1996. Consequently, HCFA and its contractors have only limited information for the

estimated 85 percent of Medicare providers who enrolled in the program before the

introduction of the standardized enrollment forms.

HCFA provides general guidance on processing provider enrollments to its

contractors and requires them to review applications for completeness. To help

assess whether applicants are qualified, HCFA requires applicants to submit certain

documentation—such as copies of medical licenses—to its contractors, who also

verify the accuracy of information presented on providers’ applications. In addition,

contractors must determine whether providers are ineligible to receive Medicare

reimbursements. Providers may be excluded from participation in Medicare or other

federal programs because of prior unethical or illegal activities. For example,

contractors are required to compare provider names to those on the Department of

Health and Human Services Office of Inspector General (OIG) list of excluded
3 GAO-01-114R Provider Enrollment Process

providers2

and the General Services Administration (GSA) debarment list.3Excluded

providers cannot enroll in Medicare.

Contractors are also expected to perform additional verification tasks if providers

indicate on their applications that they were previously enrolled in Medicare. In

these instances, HCFA requires that the new contractor processing the enrollment

application contact a provider’s prior Medicare contractor to learn more about the

provider’s previous billing patterns. This gives HCFA the opportunity to have

overpayments identified and recovered. If a provider has a history of questionable

claims, the provider’s enrollment application might not be denied. However, the

provider’s new claims may be subjected to intense scrutiny.

Medicare claims processing contractors, however, do not process the enrollment of

DMEPOS suppliers. Instead, the National Supplier Clearinghouse (NSC) manages

this process and maintains a national database of DMEPOS provider information.

HCFA requires the NSC to contact these providers periodically to revalidate their

enrollment information.

HCFA’s CURRENT PROVIDER ENROLLMENT PROCESS

DOES NOT ADEQUATELY SCREEN POTENTIAL PROVIDERS

HCFA and its contractors do not consistently and rigorously verify information on

provider applications. HCFA cannot, therefore, completely ensure that the integrity

of the Medicare program is adequately protected. A lack of clear guidance has

weakened the enrollment process. For example, HCFA has instructed contractors to

validate information on provider applications, such as practice locations and social

security numbers, by using the “most reliable, readily available, and cost-effective

means.” We found that some contractors contact applicants by telephone and ask

them to confirm verbally the information contained on their applications. While not

costly, this approach does not provide an independent means of verification.

In addition, contractors do not always complete critical verification tasks. In 1999,

HCFA identified deficiencies in the enrollment activities of 6 of the 15 contractors

evaluated during its routine assessments of contractors’ performance. Specifically,

HCFA found that some contractors did not compare applicant names to the OIG

exclusion list. Others had not obtained necessary documentation to verify that

providers had fulfilled mandatory licensing and education requirements. HCFA also

found that one contractor neglected to investigate the billing histories of providers

whose applications indicated that they had previously enrolled in Medicare.

2

The Office of Inspector General’s List of Excluded Individuals/Entities provides information on health

care providers that are excluded from participation in Medicare, Medicaid, and other federal health

care programs. These exclusions are based on criminal convictions related to Medicare or state health

programs, patient abuse or neglect, felony convictions related to controlled substances, or other health

care fraud. More than 15,000 individuals and entities are currently excluded from program

participation.

3

The U.S. General Services Administration provides information on those firms and individuals that

have been suspended, debarred, or otherwise excluded from federal procurement and

nonprocurement programs because of illegal or unethical behavior.
4 GAO-01-114R Provider Enrollment Process

PROVIDER ENROLLMENT IMPROVEMENTS

FACE SLOW IMPLEMENTATION

HCFA officials recognize the existence of shortcomings in the provider enrollment

process and are taking steps to strengthen the process. However, HCFA’s progress in

implementing improvements has been slow, and its plans are not finalized. Given the

uncertainty of these plans, additional delays are likely.

Delays Hinder Enrollment Revalidation

and Data Systems Enhancements

To improve the enrollment process, on October 18, 2000, HCFA submitted to the

Office of Management and Budget draft proposed regulations that would initiate

several changes. The cornerstone of these improvements is the requirement that all

Medicare providers periodically review and certify the accuracy of their enrollment

information. This would enable HCFA to ensure that providers are still eligible to

participate in Medicare and to collect important information on the 85 percent of

providers who enrolled before 1996. At present, only DMEPOS suppliers go through

periodic revalidation of their enrollment information. Enclosure I contains the

problems and results of DMEPOS revalidation.

HCFA’s revalidation of provider enrollment is behind schedule. Implementation was

originally planned to have begun in 2001, but this will depend upon the issuance of

the provider enrollment regulation and other actions. In addition, many decisions

regarding implementation must be made. Although HCFA officials recently told us

that they have made some preliminary decisions about conducting the revalidation,

additional issues need to be addressed. For example, in late October 2000, HCFA

advised us that it would use a specialized revalidation contractor to conduct the

initial revalidation cycle, rather than having this work performed by current

contractors. During this process, all currently enrolled providers that have not

completed an enrollment form will be required to do so. However, the time frame for

selecting this specialized contractor and beginning the revalidation process has not

been determined.

HCFA officials told us they would not make final decisions about how to conduct the

revalidation process until they have had an opportunity to consider anticipated

comments on the draft proposed regulations, which may take until next year. HCFA

officials anticipate that the initial revalidation cycle will be the most challenging

because they will be collecting, reviewing, and verifying data on providers for whom

they have little information on file. Subsequent revalidations will focus on verifying

changes submitted by providers. Given the decisions to be made once the comments

are received, the awarding of the initial revalidation contract, and the considerable

work that will be involved in establishing the process, it is likely to be some time

before the revalidation process is underway.

In addition to revalidating provider enrollments, HCFA’s draft proposed regulations

would also expand the criteria for rejecting enrollments. This provision would give
5 GAO-01-114R Provider Enrollment Process

HCFA and its contractors expanded authority to deny enrollment to applicants with

criminal records and to those who have submitted false information on their

applications. It would impose penalties on providers, such as deactivation or

revocation of Medicare billing privileges, if they do not advise HCFA of changes to

their enrollment information within 30 days of such a change. The draft proposed

regulations would also change the agency’s policy regarding inactive providers and

would require contractors to deactivate providers’ billing numbers if they do not bill

Medicare within 6 months. This should help prevent the billing numbers of inactive

providers from being obtained and used by fraudulent entities. Moreover, the draft

proposed regulation gives contractors the authority to deny or revoke enrollment if

there are payment suspensions or overpayments that have not been recouped and no

repayment plan is in place.

Although not part of HCFA’s draft proposed regulations, another key component of

its strategy includes development of a new centralized data storage and retrieval

system to help ensure that only qualified providers enroll in Medicare. The Provider

Enrollment, Chain and Ownership System (PECOS) will contain most of the

information collected from provider enrollment forms4and will also facilitate HCFA’s

planned revalidation process. PECOS will enable contractors reviewing enrollment

applications to determine if an applicant was previously enrolled in Medicare through

another contractor and to identify all of the applicant’s affiliations with other

Medicare enrolled providers. The system will also aid contractor verification

procedures by interfacing with the Social Security Administration’s computer system

to confirm the accuracy of numbers supplied. In addition, HCFA is working toward

establishing an interface with the Internal Revenue Service’s computer system as

early as January 2002, which would enable Medicare contractors to verify providers’

tax identification numbers.

Like provider revalidation, HCFA’s introduction of PECOS is behind schedule.

Originally, implementation of PECOS was planned to begin February 2000. HCFA

now intends to phase in PECOS gradually between November 2000 and 2003. This

delay may set back HCFA’s revalidation plans even further because the revalidation

of providers is dependent upon the implementation of PECOS.

Costly Background Checks

Provide Limited Information

Given the threat that fraud and abuse poses to the Medicare program, one option

would be to conduct criminal background checks on providers before their

enrollment in Medicare. HCFA officials told us that these checks have not been

required in the past because they are expensive and provide limited results. HCFA

and contractor officials estimate that these checks could range from $10 to $100 per

individual listed in the application. Because provider applications may include the

names of numerous owners and managing directors, routinely requiring background

checks could become prohibitively expensive.

4

The National Supplier Clearinghouse has a similar database devoted solely to the enrollment data

submitted by suppliers of durable medical equipment.
6 GAO-01-114R Provider Enrollment Process

Despite their expense, background checks often generate information from public

databases that may be inaccurate or incomplete. Although more extensive

information is available to the law enforcement community, it is typically not

accessible to the contractors who perform these checks for HCFA. Private companies

may also perform background checks, and some may be able to obtain some criminal

conviction records. However, these records must often be obtained at the county

level and require a manual search of courthouse records.

The contractors we spoke with told us that they rarely, if ever, conduct background

checks. Contractors told us that they could only deny enrollment if a provider’s name

appears on the OIG exclusion or GSA debarment lists. Until recently, HCFA has had

limited authority to take action if a criminal history exists for an applicant. 5

However, the draft proposed regulations would give HCFA contractors expanded

authority to deny enrollment to providers with criminal histories. HCFA is

reconsidering the priority that Medicare contractors should give to performing

background checks if they suspect a provider is not qualified or eligible to participate

in the program.

CONSOLIDATING PROVIDER ENROLLMENT

WITH FEWER CONTRACTORS COULD HOLD PROMISE

HCFA officials told us they are considering concentrating the provider enrollment

function by using fewer contractors. We believe that this approach holds promise.

Consolidation could result in more consistent application of HCFA’s provider

enrollment guidance and in more efficient enrollment processing.

HCFA officials also told us that contractors currently processing a relatively small

number of applications may have only one or two staff who devote only part of their

time to enrollment activities. Staff thus do not process enough applications to

develop expertise in enrollment processing. They said that consolidation could result

in provider enrollment contractors developing greater expertise in application review

and data verification, as the process would be carried out at fewer sites by more

specialized staff. It could also strengthen HCFA’s oversight and simplify program

administration because HCFA would be working with fewer contractors doing

provider enrollment.

HCFA and contractor officials also cited potential drawbacks to consolidating

provider enrollment activities from 60 contractors to a smaller number. Some noted

that, under consolidation, provider enrollment staff serving a large multistate area

might not have as clear an understanding of varying state education or licensing

requirements for different provider types as current contractors typically serving only

one or a small number of states. Other contractor officials told us that consolidation

would require the few contractors processing enrollments to coordinate closely with

the Medicare contractors that will continue to process claims.

5

The Balanced Budget Act of 1997 (P.L. 105-33), amended the Social Security Act, extended HCFA the

authority to deny enrollment to providers convicted of felonies under federal or state law for offenses

which the Secretary of HHS determines are detrimental to the best interests of the program or its

beneficiaries.
7 GAO-01-114R Provider Enrollment Process

If HCFA decides to move forward with consolidating provider enrollment activities

with a smaller number of contractors, we believe that these problems can be

managed. Provider enrollment staff could be trained in state requirements for an

expanded geographic area. Additionally, the need for Medicare contractors to

coordinate with other contractors is not new. HCFA already requires Medicare

contractors to coordinate with its new program safeguard contractors, who perform

various tasks supporting program integrity, including fraud detection and conducting

site visits to certain types of providers.6Finally, the eventual implementation of

PECOS should give both enrollment contractors and claims processing contractors

access to national enrollment data, reducing the need for these contractors to

coordinate data sharing.

CONCLUSIONS

Weaknesses in HCFA’s current enrollment provider process have made Medicare

more vulnerable to dishonest providers. To protect the integrity of Medicare, HCFA

and its contractors must have effective practices for reviewing applicants to verify

that they are eligible for enrollment in the program, as well as the authority to deny

enrollment to those that are not.

HCFA is implementing a number of promising changes to its provider enrollment

processes that may make it more difficult for dishonest providers to enroll in

Medicare. However, delays in implementing these initiatives will also postpone their

benefits. HCFA’s draft proposed regulations should strengthen its guidance to

contractors, while giving contractors more authority to deny enrollment to applicants

with criminal histories. Periodic revalidation of provider enrollment data should be a

valuable means of ensuring that HCFA has current, useful data on active providers

and that providers no longer eligible to participate in Medicare are dropped from the

program. Also, HCFA’s plan for a new centralized database of provider enrollment

information could considerably improve Medicare contractors’ ability to screen out

questionable applicants. The enrollment process may be further enhanced if HCFA

decides to concentrate responsibility for this function with fewer contractors.

AGENCY COMMENTS AND OUR EVALUATION

We provided HCFA a draft of this letter. In written comments, HCFA emphasized

that it is committed to preventing unscrupulous providers from participating in

Medicare (see enclosure II). HCFA also agreed with our assessment that more needs

to be done to improve the provider enrollment process. In addition, HCFA’s

comments addressed two other issues. First, HCFA highlighted its recent initiatives

to improve the provider enrollment process. Second, HCFA pointed out that our

evaluation did not show or measure the extent that unqualified or illegitimate

providers were denied enrollment in Medicare.

6

The Health Insurance Portability and Accountability Act of 1996 authorized HCFA to contract with

entities other than Medicare carriers and fiscal intermediaries to perform specific program safeguard

functions. Under this authority, HCFA has awarded contracts to 12 prime contractors to perform this

functions.
8 GAO-01-114R Provider Enrollment Process

Concerning its recent initiatives, HCFA described a number of actions it has taken to

enhance the provider enrollment process. HCFA noted that an important part of its

strategy is the issuance of a rule to institute a process to revalidate provider

enrollment. HCFA stated that the draft proposed rule was transmitted to OMB on

October 18, 2000. HCFA said it is taking steps to ensure that, once its rule is

promulgated, it will be able to implement the revalidation process immediately.

However, HCFA officials have also told us that many decisions regarding this

implementation have not yet been made because it wants to consider issues raised

during the public comment period. In addition, ongoing delays in implementing

PECOS, HCFA’s new centralized data storage and retrieval system, may further

hinder implementation of the revalidation process.

HCFA also noted several other steps it has taken to improve the provider enrollment

process. For example, HCFA said it has strengthened its process for evaluating

contractor performance, revised its provider enrollment manual, improved its

communications with HCFA regional staff, contractors, and the provider community,

designed a new set of provider enrollment forms, and intensified enrollment

procedures for certain types of providers. We recognize that HCFA has been taking

such steps and agree that they have the potential to strengthen the enrollment

process. However, to date, these efforts have not been fully implemented. While

HCFA has designed a new set of provider enrollment forms, these are not in use and

are dependent upon implementation of the new provider enrollment regulation.

Concerning the issue that we did not measure the number of unqualified or

unscrupulous providers that were denied enrollment, HCFA stated that its goal is to

ensure that providers do not apply because they know they will be rejected. HCFA

indicated that there have been few instances of providers that should have been

denied enrollment in Medicare. We agree that we did not measure the percentage of

providers who were denied enrollment in Medicare. Instead, we focused on

identifying weaknesses in the current enrollment process, assessing HCFA’s plans for

improving this process, and evaluating whether the process could be successfully

conducted by a smaller number of contractors.

HCFA also offered technical comments on the contents of this correspondence,

which we have incorporated as appropriate.

-----
9 GAO-01-114R Provider Enrollment Process

Please contact me at (312) 220-7600 if you or your staff have questions about this

correspondence. Shaunessye D. Curry and Donald Kittler prepared this report under

the direction of Geraldine Redican-Bigott.

Sincerely yours,

Leslie G. Aronovitz

Director, Health Care

Program Administration and Integrity Issues

Enclosures − 2
10 GAO-01-114R Provider Enrollment Process

ENCLOSURE I ENCLOSURE I

REVALIDATION OF DMEPOS PROVIDER ENROLLMENT

Suppliers of durable medical equipment, prosthetics, orthotics, and supplies

(DMEPOS) are enrolled in Medicare by the National Supplier Clearinghouse (NSC),

which is administered by a single Medicare contractor. NSC also conducts a

revalidation of DMEPOS suppliers’ enrollment information. Every 3 years, these

suppliers are required to review the information submitted on their original Medicare

application and certify that it is still correct or submit updated information to NSC.

Revoking billing numbers of unqualified providers prevents them and others from

potentially misusing the numbers to submit fraudulent claims. HCFA’s recent

revalidation of DMEPOS suppliersthe only group of providers currently required to

review periodically and certify their Medicare enrollment informationshowed that

revalidation helps ensure that only active and viable providers participate in

Medicare. NSC reported revoking the billing numbers of 1,300 DMEPOS suppliers,

out of 21,700 suppliers subject to the revalidation process between October 1998 and

March 2000. These billing numbers were revoked because the suppliers no longer

met one or more of the requirements necessary to participate in Medicare as a

DMEPOS supplier, such as maintaining a physical facility, complying with regulatory

or local licensing requirements, or having proof of liability insurance.

In the first years that DMEPOS supplier revalidation was performed, NSC intended to

randomly select one-third of the approximately 100,000 suppliers for revalidation in

each year. However, NSC’s initial selection process was flawed. Some suppliers that

should have been included in the first year’s revalidation process were inadvertently

omitted. For fiscal year 1999, HCFA directed NSC to begin revalidating suppliers

based on the year they originally enrolled in Medicare. However, for many suppliers,

NSC did not possess accurate information and relied on the year 1993 as an artificial

enrollment date, the year that the NSC’s database was established. The result was

the selection of more than 60,000 suppliers in 1 year, a number that overwhelmed

NSC and created a backlog that is expected to be eliminated by the end of this year.
11 GAO-01-114R Provider Enrollment Process

ENCLOSURE II ENCLOSURE II

COMMENTS FROM THE HEALTH CARE FINANCING ADMINISTRATION
12 GAO-01-114R Provider Enrollment Process

ENCLOSURE II ENCLOSURE II

(201028)