GAO-01-275R Medicare Post-Hearing Questions

United States General Accounting Office

Washington, DC 20548

December 21, 2000

The Honorable Stephen Horn

Chairman, Subcommittee on Government Management,

Information and Technology

Committee on Government Reform

House of Representatives

Subject: Medicare: Post-Hearing Questions Related to Financial and Information

Technology Management

Dear Mr. Chairman:

On July 11, 2000, we testified before your Subcommittee on H.R. 4401, the Health Care

Infrastructure Investment Act of 2000, which calls for the establishment of an advanced

informational infrastructure to immediately process certain health benefits claims.1 In that

testimony, we provided our perspectives on (1) the current Medicare part B claims process,

(2) the development of an immediate claim, administration, payment resolution, and data

collection system and its applications for processing these claims, (3) the application of this

system to the Federal Employees Health Benefits Program, (4) the role and composition of a

proposed Health Care Infrastructure Commission, and (5) lessons drawn from a failed Health

Care Financing Administration (HCFA) information technology (IT) project in the mid1990s.

This letter responds to your October 10, 2000 request that we provide answers to posthearing questions related to our July 11 testimony. In performing our work, we provided a

draft of this letter to HCFA for technical review. HCFA officials, including those from the

Office of Information Services and the Office of Financial Management, orally provided

technical clarifications, which we incorporated in this letter, as appropriate. Your questions,

along with our responses, follow.

1. Have Medicare trustees considered improvements in information technology

infrastructure that relate to providing accurate epidemiological data and timely

payment to providers?

2. What specific information technology infrastructure improvements have the

trustees considered?

3. Aside from the MTS [Medicare Transaction System] failure, what are the trustees

doing to ensure that the IT infrastructure meets the needs of Medicare beneficiaries

and health care providers?

1

Federal Health Care: Comments on H.R. 4401, the Health Care Infrastructure Investment Act of 2000

(GAO/T-AIMD-00-240, July 11, 2000).
Page 2 GAO-01-275R Medicare Post-Hearing Questions

The Social Security Act2 created the Boards of Trustees for the Medicare Hospital Insurance

and Supplementary Medical Insurance Trust Funds (collectively, the Trustees) to carry out

fiduciary responsibilities for the funds. Thus, the act requires the Trustees to (1) report to the

Congress not later than the first day of April of each year on the operation and status of the

Trust Funds during the preceding fiscal year and on their expected operation and status

during the current fiscal year and the next 2 fiscal years, (2) report immediately to the

Congress whenever the Trustees are of the opinion that the amounts of the Trust Funds are

unduly small, and (3) review the general policies for managing the Trust Funds and

recommend changes in such policies, including necessary changes in the provisions of law

that govern the way in which the Trust Funds are to be managed. The act does not assign the

Trustees responsibilities with regard to the operations of the Medicare program, or

specifically to the Medicare IT operations or related improvement efforts. According to

HCFA officials, the Trustees met 10 times during the 5-year period from 1995 to 1999. The

minutes for these meetings indicate that operational issues, such as the development, design,

and implementation of Medicare IT systems, were not discussed.

As the HCFA Chief Information Officer (CIO) described in testimony before your

Subcommittee, oversight responsibility of HCFA’s IT investment and planning processes

rests with the HCFA CIO, working in close conjunction with the Department of Health and

Human Services’ (HHS) CIO and other HCFA senior managers. In his testimony, HCFA’s

CIO also outlined the agency’s efforts toward developing a comprehensive plan for

modernizing its systems architecture to meet these needs, such as developing innovative

ways to manage data and supporting efforts to improve health outcomes for beneficiaries.

4. The Board of Trustees has the responsibility of overseeing the successful operation

of Medicare in its entirety; why would it be beneficial to create a commission

specifically to oversee the successful operation of Medicare’s IT processing systems?

As discussed above, the duties of the Trustees do not extend to the oversight of Medicare’s

IT processing systems. Nonetheless, the complex, technical nature of Medicare’s IT

processing systems warrants continuous, effective planning and evaluation to ensure their

ongoing successful operation. Determining the most appropriate methods and persons for

carrying out these efforts requires careful consideration. In this regard, as discussed in our

testimony, it is important to consider whether adding another organization to the already

complicated Medicare process would add to the complexity or confuse accountability for

essential planning, monitoring, and evaluation efforts. Nevertheless, if a separate

commission were to be created to perform these functions, one possible advantage would be

that, unlike the Trustees whose responsibilities focus primarily on long-term funding issues,

the commission could focus solely on this extremely critical aspect of administering the

Medicare program. In addition, although HCFA devotes significant resources to its IT

operations, assigning specific oversight and monitoring responsibilities to a commission of

IT, health care, and financial management experts could provide for a more robust,

independent evaluation of existing and planned Medicare IT efforts. If such a commission is

created, however, care should be taken in determining its specific role to avoid unintended

2

Sections 1817(b) and 1841(b) of the Social Security Act, 42 U.S.C. § 1395i and § 1395t.
Page 3 GAO-01-275R Medicare Post-Hearing Questions

consequences, such as confusion over its authority and responsibilities or duplication of

effort.

5. How many claims processing systems exist, and how old are these systems?

As of December 2000, Medicare carriers and fiscal intermediaries use six standard claims

processing systems to process Medicare part A and B claims.3 Each contractor relies on one

of these standard systems to process its claims, and adds its own front-end and back-end

processing systems. Table 1 provides the name of each standard system, the type of

Medicare claims it processes, and the date the system was implemented.

Table 1: HCFA Claims Standard Processing Systems

Name of system

Type of Medicare claim

processed Date of implementation

Arkansas Part A Standard

System part A

1982 – major upgrade in

1994

Fiscal Intermediary Standard

System part A 1990

Multi-Carrier System part B 1987

Verizon Medicare System part B 1988

HCFA Part B Standard

System part B 1987

VIPS Medicare System

part B (including durable

medical equipment) 1985

Source: HCFA.

6. Are there processing systems in the health care industry or other industries that are

analogous in design and purpose to the melded processing systems used by

Medicare and its contractors and carriers? If yes, please specify; if no, please

explain how HMOs [health maintenance organizations] handle the processing issue

for multiple contracts. In particular, please explain how the Federal Employee

Health Benefits Program (FEHBP) successfully offers a wide array of health

insurance plans without the apparent difficulties that exist within the Medicare

claims processing system.

According to the Association For Electronic Health Care Transactions (AFEHCT),4 the

general structure of claims processing systems in the health care industry is similar to the

claims processing systems used by Medicare contractors. Namely, in both cases, providers

submit claims either directly or through third-party billing systems to the insurance carrier’s

system, which adjudicates the claims and makes payments through other systems, such as

bank systems. According to AFEHCT, processing claims in the private sector health care

industry is complex because a provider has to deal with many different benefits contracts and

3

HCFA is planning to reduce the number of standard processing systems so that there will be only one standard

processing system for Medicare part A claims, one for Medicare part B claims, and one for Medicare part B

durable medical equipment claims.

4

AFEHCT is a trade association that addresses technical and policy issues. Its membership includes health

claims clearinghouses, health insurers, value-added networks, software vendors, health care data processing

companies, practice management companies, data communications systems operators, and credit card issuers.
Page 4 GAO-01-275R Medicare Post-Hearing Questions

many different insurance carriers. In the case of Medicare, a provider deals with only a

limited number of contractors, and traditional Medicare covers the same standard package of

services and requires the same deductibles, coinsurance, and copayment requirements for all

beneficiaries.

In the case of FEHBP, the government does not process claims, instead the government

contracts with private health care organizations that offer several hundred fee-for-service and

health maintenance organization benefit plans to nearly 9 million federal employees, retirees,

spouses, and dependents. FEHBP administrators negotiate premiums and benefits with

participating health plans, but reimbursing claims is the responsibility of the health care plan

organization.

7. Mr. Sparks testified that in some cases one Medicare carrier covers a given

procedure while another carrier might not cover the identical procedure at all. How

extensive is this problem? Do you have any examples? If so, what should be done to

correct it?

Medicare’s coverage decisions are based on broad statutory authority given to the Secretary

of HHS, which requires that payment be made for items or services that are “reasonable and

necessary” for the diagnosis and treatment provided to Medicare beneficiaries. National

coverage decisions are issued by HCFA after a thorough assessment of the clinical issues and

available data. These decisions are binding on Medicare contractors. In the absence of

national decisions for particular services, contractors have the discretion to issue local

coverage policies. Specifically, these contractors develop a set of criteria to determine which

claims to pay, guided by laws, regulations, Medicare policy manuals, and periodic agency

directives. This has resulted in different interpretations of medical necessity in different parts

of the country for some services.5

We have not performed sufficient work to assess the extent to which variations in local

coverage policies among contractors are problematic or simply reflect the complex nature of

administering a nationwide program across multiple regions, states, and localities. However,

our work has identified specific instances in which different carriers treated similar claims

differently. Specifically, in July 2000 we reported that similar claims submitted by

ambulance providers could receive different treatment across carriers.6 To illustrate, in 1998

in New Jersey and Pennsylvania, where local ordinances mandated advanced life support

services as the minimum standard of care for all transports regardless of the patient’s

condition, the carrier reimbursed ambulance providers at that level for all transports. In

contrast, in Fargo, North Dakota, which had a similar local ordinance, the carrier paid only

5

According to HCFA, there are legitimate regional differences in the practice of medicine that can make a

national rule inappropriate.

6

Rural Ambulances: Medicare Fee Schedule Payments Could Be Better Targeted (GAO/HEHS-00-115,

July 17, 2000).
Page 5 GAO-01-275R Medicare Post-Hearing Questions

for basic life support when the patient’s condition did not require advanced life support.7

In late 1998, HCFA established a new mechanism, the Medicare Coverage Advisory

Committee, to provide for public participation in the process of establishing national

coverage decisions. HCFA has issued a number of new medical policy decisions, based upon

this new mechanism, and posts these policies on its web site. In the absence of national

decisions for particular services, however, Medicare contractors continue to have the

discretion to issue local coverage policies.

8. Why does Medicare still use more than one format for submitting electronic claims?

According to a HCFA official, HCFA implemented a standard electronic format for part A

claims in 1983 and 1984 and for Medicare part B claims in 1991. The American National

Standards Institute (ANSI)8 subsequently published an electronic national health care

standard, and HCFA directed its carriers and fiscal intermediaries to accept claims in this

format as well as in the HCFA format. However, according to a HCFA official, most

providers continued to use the HCFA format only, because they were more familiar with it

and/or they did not want to incur the cost of upgrading their claims submission software.

By October 2002, providers will be required to use a single electronic format to submit health

care claims. The Health Insurance Portability and Accountability Act of 1996 requires the

Secretary of HHS to adopt standards for financial and administrative transactions, and data

elements for those transactions, to enable health information to be exchanged electronically.

In August 2000, HHS promulgated the electronic health care claims standard called for by

this law. The health care industry, including HCFA, is required to implement this standard,

which largely follows the current ANSI health care claim standard, by the October 2002

deadline.

9. In the case of a rejected claim, at what point does the waste, fraud, and abuse

statute come into effect?

The False Claims Act9 is the federal government's primary civil remedy for improper or

fraudulent claims. It applies to all federal programs, from military procurement contracts to

health care and welfare benefits. People who “knowingly” submit false claims to the federal

government may be found liable under the act for penalties of between $5,000 and $10,000

for each false claim, plus up to three times the amount of the damages caused to the federal

program. The act defines “knowingly” to mean that a person (1) has actual knowledge of the

7

On June 17, 1997, HCFA published a notice of proposed rule-making that would, among other issues, define as

national policy that ambulance payment be linked to the level of services to treat the beneficiary’s condition.

Because a new ambulance fee schedule was to be negotiated that would define future ambulance payment

amounts, HCFA delayed implementation of that policy, but intends to issue a final rule on it shortly.

8

ANSI serves as administrator and coordinator of the United States private sector voluntary standardization

system. ANSI does not develop American National Standards; instead it facilitates their development by

establishing a consensus among qualified groups. The Institute represents the interests of about 1,000 company,

organization, government agency, institutional, and international members.

9

31 U.S.C. sec 3729(a) to 3733.
Page 6 GAO-01-275R Medicare Post-Hearing Questions

false claim, (2) acts in deliberate ignorance of the truth or falsity of the information, or

(3) acts in reckless disregard of the truth or falsity of the information. Even if the

government rejected a claim, a violation of the act may have occurred at the point that the

false claim was presented. As with most other civil actions, the government can establish its

case by presenting a preponderance of the evidence rather than by meeting the higher burden

of proof that applies in criminal cases. The act has been applied to cases of improper billing

practices, claims for services not rendered, billing of medically unnecessary services,

misrepresenting eligibility or credentials, and substandard quality of care.

Although less commonly used in this context, the Civil Monetary Penalties Law and the

Program Fraud Civil Remedies Act also provide civil and administrative sanctions against

the submission of false claims under Medicare, as well as other programs. Both of these laws

prohibit the presentation of false claims and do not require payment by the government for

sanctions to be imposed.

10. Does the complexity of the processing system contribute to the difficulty providers

experience in getting claims paid? Does the complexity of the system contribute to

the difficulty providers have in submitting clean claims?

According to HCFA data on claims processed during fiscal year 1999, about 81 percent of

Medicare part A and part B claims processed were paid and, of those paid, over 99 percent

were processed as “clean” claims.10 Clean claims were paid on average within 17 days.

Much of this time is due to the mandatory claim payment delay provisions contained in the

Social Security Act, which prohibits the payment of Medicare claims until after 13 calendar

days from the date received if electronically submitted or until after 26 calendar days if

manually submitted.11 A HCFA official estimated that, on average, clean part A and part B

claims could be processed and paid or rejected within 3 to 5 business days after the receipt

date without this mandatory payment delay.

We could not determine the extent to which the complexity of Medicare’s claims processing

systems contributes to claims being denied. However, HCFA’s analysis of part B denied

claims indicates that other problems can cause such claims to be denied. For example,

according to HCFA data, over 70 percent of denied part B claims in fiscal year 1999 were

attributed to duplicate claims, claims for services that are not medically necessary or covered

by Medicare, and incomplete claims. Furthermore, based on our review of claims data for

ambulance services provided in calendar year 1998, rates of payment denial varied widely

among carriers.12 We concluded that different practices among carriers, including increased

attention to potential fraud, differences in local coverage policies, contractors’ inappropriate

10In obtaining performance information from its contractors, HCFA defines a clean claim as one that did not

require the contractor to investigate or develop outside the contractor’s Medicare operation (e.g., requesting

additional information from providers) on a prepayment basis.

11Sections 1816(c)(3) and 1842(c)(3) of the Social Security Act (42 U.S.C. 1395h(c)(3) and 1395u(c)(3)).

12GAO/HEHS-00-115, July 17, 2000.
Page 7 GAO-01-275R Medicare Post-Hearing Questions

application of Medicare criteria, and providers’ lack of information about how to fill out

claims, contribute to variations among their rates of denied claims.

11. Is the coding system difficult to use? Please rate the complexity of Level I codes

versus Level II codes versus Level III codes. Does the “carrier discretion” allowed

for Level II codes cause unequal treatment of claims by different carriers? How

often do the code systems for medical procedures change? Why do the codes change

on this schedule? Who makes the final decision to change or not change the codes?

As described in our July 11, 2000, testimony, HCFA’s Common Procedure Coding System

uses three levels of codes:

• Level I codes are the American Medical Association’s Physician’s Current Procedural

Terminology, which consists of a list of 5-digit codes for most of the services performed

by physicians. These codes are used to bill for most procedures and services but have

limited selections for describing supplies, materials, and injections.

• Level II are HCFA national codes that supplement the level I codes and are used to bill

for a range of services and supplies, such as vision services and surgical supplies. These

codes have a uniform description nationwide, but due to what is known as “carrier

discretion,” their processing and reimbursement are not necessarily uniform.

• Level III are local codes developed by individual Medicare carriers. The codes are often

used to describe new services, supplies, and materials (which may be included as level I

or II codes in future years), as well as to report procedures and services that have been

deleted from Current Procedural Terminology codes but are still recognized and

reimbursed by the carrier.

Reflecting the complexities of, and variations in, providing the multitude of health care

services to Medicare beneficiaries, the coding system is inherently difficult to use because it

(1) attempts to identify codes for all accepted medical procedures, including codes to

describe minor procedures that are components of more comprehensive procedures, and

(2) changes every year to reflect refinements or advances in technologies and practices.

Regarding the comparative complexity of the different code levels and the extent of the use

of “carrier discretion,” we have not performed work to address these questions. However,

conducting such reviews could provide insights into the fundamental characteristics

associated with how medical treatment codes and coding systems are established, revised,

implemented, and monitored.

12. What is the status of HCFA's effort to reduce its four standard Medicare part B

systems to two? Will HCFA meet its 2003 deadline?

As previously discussed, carriers currently use one of four standard systems to process

Medicare part B claims. Of the four systems, HCFA selected the Multi-Carrier System to

serve as the standard part B claims processing system for nondurable medical equipment

claims. HCFA had placed a moratorium on this transition effort because of the Year 2000
Page 8 GAO-01-275R Medicare Post-Hearing Questions

problem. Since this problem has been addressed, HCFA’s transition of carriers using the

Verizon standard system to the Multi-Carrier System has begun and is due to be completed

by February 2002. The carriers that use the other two standard part B systems are currently

due to transition to the Multi-Carrier System by August 2003 and March 2004, respectively.

However, according to HCFA, funding issues may cause delays in transitioning these two

systems. With respect to part B claims for durable medical equipment, in 1998, HCFA

transitioned all durable medical equipment regional carriers systems to a single standard

system (VIPS Medicare System).13

13. Was the MTS system mandated by Congress? Who received the $80 million for the

work that was done? Who had direct oversight responsibility for the work?

MTS was not specifically mandated by law, although HCFA provided Congressional staff

with information on the status of the initiative. MTS was HCFA’s vision for a single, unified

system to replace its existing standard systems. This single system would have integrated

data from Medicare part A and part B and managed care and provided a comprehensive view

of billing practices. The goals of MTS were to protect program funds from waste, fraud, and

abuse; allow better oversight of Medicare contractor operations; improve service to

beneficiaries and providers; and reduce administrative expenses. Primary oversight for MTS

rested with the Director of HCFA’s Bureau of Program Operations. In HCFA’s last

reorganization, this position was abolished.

HCFA terminated the primary MTS contract in August l997. In September l997, we

reported that, at that time, HCFA had spent about $80 million--$50 million for software

development and $30 million for internal HCFA costs. Table 2 provides the most recent

reported information on what HFCA has paid thus far to MTS contractors.

Table 2: HCFA Payments to MTS Contractors as of Early November 2000

Contractor Type of work performed Amount paid

Verizon (formerly GTE) Design, develop, and implement system $48,611,360

Coopers & Lybrand

Plan, track, monitor, control and report

progress 795,433

SETA Corporation Independent testing support 1,141,049

Averstar (formerly

Intermetrics) Independent validation and verification 3,866,140

Total $54,413,982

Source: Health Care Financing Administration, Office of Internal Customer Support, Acquisition and Grants Group. These

amounts were not verified by GAO.

The SETA Corporation contract amount is final. The other contracts are still open, so these

amounts may change. For example, in May 1998 Verizon submitted to HCFA a proposal to

close out the contract, which stated its final cost as $51,216,433. As of mid-December 2000,

HCFA had not agreed on the final cost included in this proposal. According to a HCFA

13The part of the VIPS Medicare System used to process part B claims other than durable medical equipment

claims will not be used once the transition to the Multi-Carrier System is completed. When the standard system

transitions are completed, HCFA expects to have one standard processing system for Medicare part A claims,

one for Medicare part B claims, and one for Medicare part B durable medical equipment claims.
Page 9 GAO-01-275R Medicare Post-Hearing Questions

contracting official, HCFA recently received requested documentation supporting the

proposal amounts from Verizon and plans to begin final negotiations shortly.

14. Is HCFA able to divine medical data from the Common Working File (CWF)? Does

a system exist outside of HCFA that allows the divining of statistical data?

Medicare carriers and fiscal intermediaries systems’ interface with HCFA’s CWF—a set of

nine databases containing beneficiary information for specific geographic regions—to

authorize claims payments and determine beneficiary eligibility. CWF maintains beneficiary

information, such as entitlement and utilization data and specific claims history that includes

medical data.14 The medical data maintained in CWF are used in editing claims, for

example, to determine whether a claim is a duplicate. According to HCFA, CWF data are

not organized to support statistical analysis.

CWF provides individual beneficiary claims data to HCFA’s National Claims History file,

which is used as the source of statistical information on Medicare medical data. HCFA

officials were not aware of any system outside HCFA where this type of data could be

obtained.

15. Are the options available to FEHBP subscribers more or less complex than the

beneficiary options in the Medicare program?

Traditional Medicare covers the same standard package of services and has the same

deductibles, coinsurance, and copayment requirements for all beneficiaries although it has

two distinct parts (part A and part B) that cover complementary sets of benefits. Medicare

managed care providers must cover at least the same services as traditional Medicare. Many

Medicare managed care providers offer additional benefits, such as prescription drugs. In

contrast, FEHBP does not require uniform benefits. Although all plans offer inpatient

hospital and outpatient medical coverage as well as certain services required by the Office of

Personnel Management, specific benefits vary. As a result, coverage can vary substantially

depending on the plan.

16. Would it be feasible to replace the existing Medicare program with a FEHBP-style

of insurance program?

The two defining elements of an FEHBP-type premium support system are the establishment

of premium levels for plans through negotiations between the program and plans and the

linking of beneficiaries’ contributions to the premiums of the plans they join. In May l999,

we testified on a report by the National Bipartisan Commission on the Future of Medicare

that discussed incorporating Medicare as another plan under the FEHBP-type premium

support system.15 Under this scenario, traditional Medicare would propose and negotiate

14Certain claims data are periodically purged from CWF. Requirements to purge CWF data vary by type of

claim. For example, outpatient, durable medical equipment, prosthetics, and physician claims are normally

purged every six months. Inpatient, hospice, and home health claims are not purged. According to HCFA, it

approves all purge requests.

15Medicare: Options for Reform (GAO/T-HEHS-99-130, May 26, 1999).
Page 10 GAO-01-275R Medicare Post-Hearing Questions

premiums like any other plan and would be expected to be self-financing and self-sustaining.

Recognizing the challenge the latter requirement creates, the commission would also provide

traditional Medicare more flexibility to manage costs using tools similar to those proposed

for fee-for-service modernization.16

Incorporating traditional Medicare as another plan in an FEHPB-type premium support

system would put all plans on an equal footing and maximize beneficiary awareness of costs.

However, the sheer size of the traditional Medicare program would create questions,

including those concerning plan flexibility and fund solvency. Moreover, it would be

necessary to address the dilemma of how to guarantee traditional Medicare’s solvency in the

context of an FEHBP-type premium support system.

An FEHBP-type premium support system increases the importance of effective program

management and design. In particular, the ability to adjust premiums based on risk to reflect

variation in the health status of beneficiaries joining different plans becomes paramount.

Participating plans that attract a disproportionate number of more seriously ill and costly

beneficiaries would be at a competitive disadvantage if their premium revenues were not

adjusted adequately. In turn, enrollees in those plans may find services compromised by the

plans’ financial situation. Inadequate risk adjustment may be a particular problem for the

traditional Medicare plan, which may function as a refuge for many chronically ill persons

who find selecting among plans challenging and opt for something familiar.

Another serious management and design issue for a premium support system would be how

to adjust for differences in local medical prices and geographic differences in the use of

services. Without such adjustments, beneficiary premiums in high-price areas will tend to be

above the national average. Adjusting the government contributions for input price

differences can help ensure fair price compensation between local and national plans and

avoid having beneficiaries pay a higher premium or higher share of a premium simply

because they live in a high-price area. Similarly, because use of medical services varies

dramatically among communities due to local medical practices, under a premium support

approach plan, premiums in high-use areas will likely exceed the national average. Whether,

or to what extent, to adjust the government contribution for this outcome is a matter of policy

choice. Without an adjustment, beneficiaries living in high-use areas who join local private

plans could face substantial out-of-pocket costs. Consequently, private plans in such areas

might have difficulty competing with a traditional Medicare plan that charged a fixed

national premium.

17. Mr. Willemssen’s testimony states that the Medicare Trust Fund earns 7 percent

interest on Medicare funds that are held in the Treasury. How does that rate

compare to the rate of interest earned by the Social Security Trust Fund?

16Proposals to modernize fee-for-service Medicare aim at providing HCFA flexibility to take advantage of

market prices and introduce some management of service utilization. This concept was tested under HCFA’s

Centers for Excellence demonstrations, in which hospitals and physicians agreed to provide certain procedures

for negotiated all-inclusive fees.
Page 11 GAO-01-275R Medicare Post-Hearing Questions

As the Managing Trustee of each fund, the Secretary of the Treasury sets the interest rate on

investments held in the Social Security trust funds (the Federal Old-Age and Survivors

Insurance and Federal Disability Insurance Trust Funds) and the Hospital Insurance and

Supplementary Medical Insurance Trust Funds. Generally, the Secretary is required by law

to set the interest rate at a rate equal to the average market yield for the preceding month on

all marketable interest-bearing obligations of the United States then outstanding that are not

due or callable within 4 years. The maturities of the obligations are determined by the

Secretary with due regard for the needs of each fund. Accordingly, although interest rates

are established consistently for these trust funds, the Secretary’s discretion as to determining

the needs of each fund as well as the amounts available to invest may result in variations in

the amount of investments held at various interest rates.

The interest rate on investments held in the Federal Old-Age and Survivors Insurance and

Hospital Insurance Trust Funds, as of September 30, 1999, ranged from 5.875 to 10.375

percent per annum. The interest rate on investments held in the Federal Disability Insurance

and Supplementary Medical Insurance Trust Funds, as of September 30, 1999, ranged from

5.875 to 8.75 percent per annum. The combined weighted average annual interest rates for

the Social Security and Medicare trust fund investments held, as of September 30, 1999,

were 6.78 and 7.17 percent, respectively. Differences in these weighted average annual

interest rates reflect the variation in the relative proportions of investments held in each trust

fund as of September 30, 1999, at the various rates of interest within the ranges indicated

above.

18. Did the recent I LOVE YOU, Melissa, etc., viruses get into HCFA’s computers?

In May 2000, we testified on the impact of the “ILOVEYOU” virus on federal agencies.17

This virus was the latest in a series of Internet-based episodes that had caused serious

disruptions to computer-based operations at both private businesses and government

agencies. We testified that HHS was inundated with about 3 million malicious messages.

The departmental components experienced disruptions in e-mail service ranging from a few

hours to as many as 6 days, and departmentwide e-mail communication capability was not

fully restored until after May 9.

With respect to HCFA, an IT security official told us that the “ILOVEYOU” virus did not

contaminate its systems. The official said the virus had no adverse effects on any of the

workstations, because the e-mail application used at HCFA was not capable of executing the

Visual Basic Script file, which is how the “ILOVEYOU” virus was executed.18 The official

also said that the Melissa virus was detected and there were no incidents.

17Information Security: “ILOVEYOU” Computer Virus Emphasizes Critical Need for Agency and

Governmentwide Improvements (GAO/AIMD-00-171, May 10, 2000) and Critical Infrastructure Protection:

“ILOVEYOU” Computer Virus Highlights Need for Improved Alert and Coordination Capabilities (GAO/TAIMD-00-181, May 18, 2000).

18Visual Basic Script is a subset of Microsoft’s Visual Basic program language intended for use in World Wide

Web browsers and certain other applications.
Page 12 GAO-01-275R Medicare Post-Hearing Questions

19. Have there been many unauthorized releases of personal medical information from

HCFA’s computers? Are such releases against the law? Were any such releases

prosecuted?

Unauthorized releases of personal medical data are normally identified as a result of

complaints or other activities that raise questions leading to an investigation of whether an

improper release of information has occurred. Since some unauthorized releases may have

occurred that have not led to complaints or raised such questions, the extent of this problem

is unknown.

Unauthorized releases of personally identifiable health information by federal agencies or

their employees are a violation of the Privacy Act of 1974. HCFA officials clarified,

however, that secondary releases19 are not punishable under the Privacy Act unless such acts

are committed under false pretenses. State laws also protect the privacy of certain personally

identifiable medical information, but these laws vary significantly in their scope and the

specific protections they afford.

Recognizing the need to prevent unauthorized releases of medical information, the Congress

passed the Health Insurance Portability and Accountability Act of 1996, which called for the

establishment of a uniform set of protections that all users of confidential medical

information must abide by and for substantial fines and up to 10 years in prison for the

misuse or improper disclosure of identifiable health information. On December 20, HHS

issued the final privacy regulation called for by this act, which will become fully effective in

2 years. The regulation (1) limits the non-consensual release and use of identifiable private

health information, (2) gives patients new rights to access their medical records and to know

who has accessed them, (3) restricts disclosures of health information, (4) establishes

criminal and civil sanctions for improper use or disclosure, and (5) establishes new

requirements for access to records by researchers and others.

HCFA officials recently told us that there have been no prosecutions for unauthorized

releases of personal medical information from HCFA’s computers. Further, HCFA officials

told us that their investigations of known cases have found no secondary releases involving

false pretenses. Rather, HCFA found that secondary releases of data had resulted from

misunderstandings of permissible disclosures.

In July 1999, we reported20 that HCFA’s policies and practices regarding disclosure of

personally identifiable health information were generally consistent with the provisions of

the Privacy Act and that there had been few complaints about Privacy Act violations

concerning personal medical information. However, we concluded that weaknesses in the

implementation of HCFA's policies could potentially compromise the confidentiality of

health information on Medicare beneficiaries. Further, because HCFA did not routinely

monitor contractors and others, such as researchers, who use personally identifiable Medicare

19Secondary releases refer to instances in which persons not employed by the federal government who are

authorized to have data under a HCFA agreement misuse or re-release such data.

20Medicare: Improvements Needed to Enhance Protection of Confidential Health Information (GAO/HEHS-99-

140, July 20, 1999).
Page 13 GAO-01-275R Medicare Post-Hearing Questions

information, its ability to prevent unauthorized disclosures or uses and to provide timely

corrective action for those that might occur was not assured.

HHS’ Office of the Inspector General continues to report vulnerabilities in HCFA’s and its

contractors’ management of electronic information that could lead to unauthorized

individuals reading, disclosing, or tampering with confidential information. Further, HHS

acknowledged Medicare electronic data processing control weaknesses in its fiscal year 1999

Accountability and Federal Managers’ Financial Integrity Act Reports and outlined plans to

correct these weaknesses during fiscal year 2000. Results from reviews of Medicare systems

performed in conjunction with the audit of HCFA’s fiscal year 2000 financial statements

currently under way will provide insights regarding the extent to which these weaknesses

have been addressed.

20. In your testimony, you mentioned that removing the 14-day mandatory delay in

Medicare reimbursements would result in an ongoing cost to the U.S. Treasury. Dr.

Christoph, however, contended that removing the mandatory delay in payments

would create a substantial "one-time" charge to the Treasury. Please explain the

basis for your conclusion.

Eliminating the mandatory payment delays would lead to a reduction in trust fund balances

resulting from (1) the one-time liquidation of trust fund investments to facilitate the transition

to a new “no payment delay” environment and (2) an ongoing reduction in interest earnings

due to the reduced level of funds available for investment that would result from this

transition. Because the balance of trust fund investments would remain at this reduced level,

future earnings would be correspondingly reduced. The ongoing nature of this cost

represents the amount of interest lost on those investments that continue to be no longer

available to earn interest. This cost would continue in perpetuity as long as payments were

not being retained to meet a mandatory delay.

21. The "payment floor" or "payment legs" were established by OBRA [Omnibus

Budget Reconciliation Act] 1987, and amended by OBRA of 1993. Looking back

through Senate Finance Committee hearing testimony, committee discussions and

the committee reports regarding the purpose of the legs, at no point was "fraud

prevention" or "prepayment medical review" or any such concept discussed as

motivation for implementation. While there was some discussion between Dr.

Desmarais and Senator Proxmire of moving to standards established by the Prompt

Payments Act, in the end, the legs were implemented as a budgetary consideration

to "save" the government money. The savings amounted to approximately

$323 million in FY 1988. So, if we repealed the payment legs, how fast could HCFA

pay clean claims (assuming time for edits, batch processing, etc.)? How about all

claims? In other words, what would be the self-imposed payment floors? If we

were to amend the payment legs gradually over the course of the legislation as the

infrastructure was gradually improved/put into place, what recommendations

would you make? Would [it] be helpful to use the 5-, 7- and 10-year timetable that

the bill lays out already for claims processing.
Page 14 GAO-01-275R Medicare Post-Hearing Questions

A HCFA official estimates that, given current operational processes, on average, clean part A

and part B claims would be processed and paid or rejected within 3 to 5 business days of the

receipt date if the mandatory payment delays were eliminated. Further, this official estimates

that, on average, all claims (which include clean and other paid claims and denied claims)

would be processed within 10 business days if the mandatory payment delays were

eliminated.

Because of the significant volume and dollar value of Medicare claim payments, a decision

to change the current provisions establishing a mandatory delay of claim payments should

involve a careful evaluation of the potential costs associated with such a change. Two

significant factors to consider, as described in our testimony, are (1) direct costs (such as lost

interest earnings) and (2) possibly more importantly the risk of losses in the form of improper

payments that may occur due to a reduction in time for performing program safeguard

activities.21 In addition, further evaluation should be performed to consider other possible

costs and risks of amending current claim payment delay provisions; if such amendments are

made, various implementation and monitoring alternatives should be carefully considered.

For example, since risks of improper payments may vary among various types of claims and

providers, efforts to pay claims more quickly may need to be coordinated with efforts to

strengthen program safeguards. In addition, conducting pilot tests at selected contractors or

for selected types of claims could provide useful insights and a basis for more effective

evaluation and implementation, including the most appropriate timetable for implementing

changes.

22. Senator Lugar spoke in his testimony about "spurring private sector investment"

and "creating a system of systems" similar to ATM networks. Can you comment on

that briefly from your perspective? I am interested also to hear what you think

about the role of private companies, such as RealMed or SpiderMed.Com.

As we noted in July 2000,22 the Automated Teller Machine (ATM) network is indeed a

“system of systems” in which multiple computer systems owned by card-issuing banks,

ATM owners, ATM networks, and third-party processors work together over a network to

allow customers to withdraw cash from their accounts. Most cardholders conduct

transactions at terminals owned by their card-issuing bank (referred to as on-us transactions).

When the cardholder requests the transaction, the terminal driving processor transmits the

message through the bank's network to the authorization processor. The authorization

processor checks the cardholder's account and concurrently provides authorization and

settlement of the transaction. The authorization message is then transmitted to the ATM.

The transaction flow is a bit more complicated when a cardholder performs an electronic

fund transfer at an ATM that is not owned by the card-issuing bank (referred to as a foreign

ATM transaction). The cardholder requests the transaction, and the terminal driving

21Our recent report, Financial Management: Billions in Improper Payments Continue to Require Attention

(GAO-01-44, October 27, 2000), highlights the risks associated with expediting payments and the importance

of strengthening controls and implementing state-of-the-art information management systems.

22Automated Teller Machines: Issues Related to Real-time Fee Disclosure (GAO/GGD/AIMD-00-224, July 11,

2000).
Page 15 GAO-01-275R Medicare Post-Hearing Questions

processor routes the message through the ATM owner's network to a regional or national

network. The message is then routed through the internal network of the cardholder's bank to

the authorization processor. The authorization processor checks the cardholder's account,

authorizes the transaction, and provides settlement of the account. The authorization

message is then transmitted to the ATM via the bank's network, a regional or national

network, the owner's network, and the terminal driving processor.

The kind of processing that an ATM network performs is simpler than medical claims

processing. ATM processing involves relatively simple business rules such as checking

account balances and authorizing payment. In contrast, medical claims processing requires

addressing, for example, a claimant’s eligibility, benefits, deductibles, and copayments, and

the consistency of the claim with the patient’s past history, age, or gender.

As we testified in July, although it might be feasible to develop an immediate claim,

administration, payment resolution, and data collection system to be used by the Medicare

part B program, such a system would significantly change the government’s current

processes, because it would require the real-time processing of certain elements of the claims

process that are currently performed in batch mode or manually.23 In the abstract, a real-time

Medicare part B claims process could be achievable if appropriate systems development

policies and techniques are used. Although more beneficiaries might have to pay their

copayments immediately, such a process could provide health care providers and

beneficiaries with several benefits—primarily the immediate notification of approved or

denied claims. However, without appropriate safeguards, a real-time claims processing

system could involve serious risks, because it opens the process to a possible rise in the

number of improper Medicare payments.24 Accordingly, any real-time processing system

would have to ensure that current program safeguards are not compromised, which could be

problematic since some of these safeguards hinge on manual reviews performed by claims

examiners. In addition, the technical and cost risks associated with developing a real-time

claims processing system could be considerable.

With respect to the question related to the private sector, private companies play a large role

in various aspects of medical practice. For example, private companies provide systems that

physicians use to manage their day-to-day activities by doing paperless transactions, such as

checking eligibility and referral authorizations, referring patients to specialists,

and sending secure electronic prescriptions. The private sector also plays a major role in the

Medicare program. For example, title XVIII of the Social Security Act required HCFA to

contract with the private sector for claims processing and payment functions. This

requirement has led to a large contractor network comprised of insurance companies

responsible for processing Medicare claims in given states.

-----

23Real-time mode relates to processing that responds to an external event within a short and predictable time

frame. Batch mode relates to processing application programs and their data individually, with one being

completed before the next is started.

24HHS’ Office of the Inspector General estimated improper Medicare fee-for-service payments at

$13.5 billion for fiscal year 1999.
Page 16 GAO-01-275R Medicare Post-Hearing Questions

We are sending copies of this letter to Senator Richard Lugar and to Representatives Jim

Turner and Douglas Ose, Ranking Minority Member and Member, respectively, of the

Subcommittee on Government Management, Information, and Technology, Committee on

Government Reform. This letter is also available on GAO’s home page at

http://www.gao.gov.

If you or your staff have any questions regarding this letter, you can contact Joel Willemssen

at (202) 512-6253 or by e-mail at willemssenj@gao.gov or Gloria Jarmon at (202) 512-4476

or by e-mail at jarmong@gao.gov. Staff who assisted in gathering this information include

Aditi Archer, Nabajyoti Barkakati, Johnny Clark, Kay Daly, James Douglas, James Kernen,

Linda Lambert, and Cynthia Scott.

Sincerely yours,

Joel C. Willemssen

Managing Director,

Information Technology Issues

Gloria L. Jarmon

Managing Director,

External Liaison

(310401)