MEDICARE 

PROGRAM 

INTEGRITY

Increasing 

Consistency of 

Contractor 

Requirements May 

Improve 

Administrative 

Efficiency

Report to Congressional Requesters

July 2013

GAO-13-522

United States Government Accountability Office
United States Government Accountability Office

Highlights of GAO-13-522, a report to 

congressional requesters

July 2013

MEDICARE PROGRAM INTEGRITY

Increasing Consistency of Contractor Requirements 

May Improve Administrative Efficiency

Why GAO Did This Study

In fiscal year 2012, CMS estimated 

that $32.4 billion in Medicare FFS 

payments were improper. CMS uses 

several types of contractors to conduct 

postpayment claims reviews to identify 

improper payments. Recently, 

questions have been raised about the 

efficiency and effectiveness of these 

contractors’ efforts and the 

administrative burden on providers. 

This report (1) describes these 

contractors and (2) assesses the 

extent to which requirements for 

postpayment claims reviews differ 

across the contractors and whether 

differences, if any, could impede 

effective and efficient claims reviews. 

GAO reviewed CMS’s requirements for 

claims reviews in manuals and 

contracts, interviewed CMS officials 

and selected provider associations, 

and assessed the requirements 

against internal control standards and 

executive-agency guidance on 

streamlining service delivery. GAO 

also obtained data on numbers of 

claims reviewed, and appealed.

What GAO Recommends

GAO recommends that CMS 

(1) examine all contractor postpayment

review requirements to determine 

those that could be made more 

consistent, (2) communicate its 

findings and time frame for taking 

action, and (3) reduce differences 

where it can be done without impeding 

efforts to reduce improper payments.

In its comments, the Department of 

Health and Human Services concurred 

with these recommendations, agreed 

to reduce differences in postpayment 

review requirements where 

appropriate, and noted that CMS had 

begun examining these requirements.

What GAO Found

The Centers for Medicare & Medicaid Services’ (CMS) contractors that conduct 

postpayment reviews on Medicare fee-for-service (FFS) claims were established 

by different legislative actions; are managed by different offices within CMS; and 

serve different functions in the program. These contractors include (1) Medicare 

Administrative Contractors that process and pay claims and are responsible for 

taking actions to reduce payment errors in their jurisdictions; (2) Zone Program 

Integrity Contractors (ZPIC) that investigate potential fraud, which can result in 

referrals to law enforcement or administrative actions; (3) Recovery Auditors 

(RA) tasked to identify improper payments on a postpayment basis; and (4) the 

Comprehensive Error Rate Testing (CERT) contractor that reviews a sample of 

claims nationwide and related documentation to determine a national Medicare 

FFS improper payment rate. All four types of contractors conduct complex 

reviews, in which the contractor examines medical records and other 

documentation sent by providers to determine if the claims meet Medicare 

coverage and payment requirements. RAs are paid fees contingent on the 

amount of the claims that are found improper and recouped or adjusted, whereas 

the other contractors’ reimbursement is not dependent on the amount of their 

claims reviews. The RAs conducted almost five times as many reviews as the 

other three contractors combined. Overall, compared to over one 1 billion claims 

processed in 2012, all four types of contractors combined reviewed less than one 

1 percent of claims, about 1.4 million reviews, for which providers might be 

contacted to send in medical records or other documentation. 

Although postpayment claims reviews involve the same general process 

regardless of which type of contractor conducts them, CMS has different 

requirements for many aspects of the process across these four contractor types. 

Some of these differences may impede efficiency and effectiveness of claims 

reviews by increasing administrative burden for providers. There are differences 

in oversight of claims selection, time frames for providers to send in 

documentation, communications to providers about the reviews, reviewer 

staffing, and processes to ensure the quality of claims reviews. For example, 

while the CERT contractor must give a provider 75 days to respond to a request 

for documentation before it can find the claim improper due to lack of 

documentation, the ZPIC is only required to give the provider 30 days. CMS 

places more limits on the RAs in its requirements for reviews conducted by them 

than by other contractors. For example, RAs must submit the criteria that they 

will use to determine if a service is paid improperly to CMS for approval. The 

additional requirements for RAs are due in part to CMS’s experience during an 

initial demonstration testing the use of RAs. CMS officials indicated that other 

requirement differences across contractors generally developed due to setting 

requirements at different times by staff in different parts of the agency. Providers 

indicated that some differences hindered their understanding of and compliance 

with the claims review process. Having inefficient processes that complicate 

compliance can reduce effectiveness of claims reviews, and is inconsistent with 

executive-agency guidelines to streamline service delivery and with having a 

strong internal control environment. CMS has begun to examine differences in

requirements across contractors, but did not provide information on any specific 

changes being considered or a time frame for action.

View GAO-13-522. For more information, 

contact Kathleen King at (202) 512-7114 or

kingk@gao.gov.
Page i GAO-13-522 Medicare Contractor Requirements

Letter 1 

Background 4

The Four Medicare FFS Contractor Types Were Established under 

Different Laws and Have Different Primary Functions and 

Characteristics 9

Many CMS Requirements for Postpayment Claims Review Differ 

across Contractor Types, Which Can Impede Effectiveness and 

Efficiency 20

Conclusions 33

Recommendations for Executive Action 33

Agency Comments and Our Evaluation 34

Appendix I List of Provider Associations GAO Interviewed 37

Appendix II Comments from the Department of Health and Human 

Services 38

Related GAO Products 40

Tables

Table 1: Applicable Legislation for Four Contractor Types That 

Conduct Medicare Postpayment Claims Reviews 12

Table 2: Characteristics of the Four Types of Contractors That 

Conduct Medicare Postpayment Claims Reviews 15

Table 3: Volume of Contractors’ Postpayment Claims Reviews, by 

Type of Contractor 2011-2012 20

Table 4: CMS Requirements on Postpayment Reviews Unique to 

Recovery Audtiors, Compared to Other Contractor Types, 

as of May 7, 2013 22

Table 5: Postpayment Claims Review—Requirements for 

Additional Documentation Requests, as of May 7, 2013 25

Table 6: Postpayment Claims Review—Submission Requirements 

by Contractor Type, as of May 7, 2013 26

Table 7: Postpayment Claims Review Staffing Requirements by 

Contractor Type, as of May 7, 2013 28

Contents 
Page ii GAO-13-522 Medicare Contractor Requirements

Table 8: Postpayment Claims Review—Quality Assurance 

Requirements by Contractor Type, as of May 7, 2013 30

Figure

Figure 1: Centers for Medicare & Medicaid Services’ (CMS) 

Organizational Components That Oversee Medicare FeeFor-Service Contractors and Their Activities Related to 

Postpayment Claims Review, as of May 2013 14
Page iii GAO-13-522 Medicare Contractor Requirements

Abbreviations

ADR additional documentation request

CERT Comprehensive Error Rate Testing

CM Center for Medicare

CMS Centers for Medicare & Medicaid Services

CPI Center for Program Integrity

DME durable medical equipment

DVD digital video disc

esMD electronic submission of medical documentation

FFS fee-for-service 

FTE full-time equivalent

HHS Department of Health and Human Services

HIPAA Health Insurance Portability and Accountability Act of 1996

HPMP Hospital Payment Monitoring Program

IPIA Improper Payments Information Act of 2002

LCD local coverage determination

LPN licensed practical nurse

MAC Medicare Administrative Contractor

MIP Medicare Integrity Program

MMA Medicare Prescription Drug, Improvement, and

 Modernization Act of 2003

OFM Office of Financial Management

OMB Office of Management and Budget

PSC program safeguard contractor

PT part-time

QA quality assurance

RA Recovery Auditor

RN registered nurse

ZPIC Zone Program Integrity Contractor

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. The published product may be reproduced and distributed in its entirety 

without further permission from GAO. However, because this work may contain 

copyrighted images or other material, permission from the copyright holder may be 

necessary if you wish to reproduce this material separately.
Page 1 GAO-13-522 Medicare Contractor Requirements

441 G St. N.W.

Washington, DC 20548

July 23, 2013

Congressional Requesters

In 2012, Medicare covered more than 49 million elderly and disabled 

beneficiaries and had estimated outlays of $555 billion.1 Because of its 

size, complexity, and susceptibility to mismanagement and improper 

payments, for 23 years we have designated Medicare as a high-risk 

program.2 Improper Medicare payments include payments made for 

treatments or services that were not covered by program rules, that were 

not medically necessary, or that were not provided to beneficiaries in the 

way that they were billed to Medicare.3 In fiscal year 2012, the 

Department of Health and Human Services (HHS) estimated the Centers 

for Medicare & Medicaid Services (CMS)—the agency that administers 

the Medicare program4

—made improper payments of $32.4 billion in the 

Medicare fee-for-service (FFS) program.5

CMS has a goal to reduce improper payments in the Medicare program 

and conducts a number of activities in order to protect the integrity of the 

program—that is, to ensure that payments are made correctly the first 

time and to identify, investigate, and recoup payments made in error. One 

 

1

Medicare is the federally financed health insurance program for persons aged 65 and 

over, certain individuals with disabilities, and individuals with end-stage renal disease.

2

See GAO, High-Risk Series: An Update, GAO-13-283 (Washington, D.C.: February 

2013). 

3

An improper payment is any payment that should not have been made or that was made 

in an incorrect amount (including overpayments and underpayments) under statutory, 

contractual, administrative, or other legally applicable requirements. This definition 

includes any payment to an ineligible recipient, any payment for an ineligible good or 

service, any duplicate payment, any payment for a good or service not received (except 

where authorized by law), and any payment that does not account for credit for applicable 

discounts. Improper Payments Elimination and Recovery Act of 2010, Pub. L. No. 111-

204, § 2(e), 124 Stat. 2224, 2227 (codified at 31 U.S.C. § 3321 note).

4

The Secretary of Health and Human Services delegated the authority under the Medicare 

provisions of the Social Security Act to the Administrator of CMS.

5

Medicare FFS, or original Medicare, consists of Medicare Parts A and B. Medicare Part A 

covers hospital and other inpatient stays. Medicare Part B is optional insurance, and 

covers physician, outpatient hospital, home health care, certain other services and the 

purchase of durable medical equipment (DME) including prosthetics, orthotics, and 

supplies.

 
 

Page 2 GAO-13-522 Medicare Contractor Requirements

such activity, reviewing claims to ensure that claims are paid properly, 

can be done before payment (prepayment claims reviews) or after 

payment (postpayment claims reviews). Claims reviews may be 

automated, relying on computer programming logic, or they may involve 

manually examining claims and related documentation, including medical 

records, to determine if the claim was billed and paid properly. Currently, 

CMS uses several different types of contractors to conduct claims 

reviews.6 Medicare Administrative Contractors (MAC), the contractors 

that process and pay claims, also conduct pre- and postpayment claims 

reviews and recoup overpayments or remediate underpayments. Zone 

Program Integrity Contractors (ZPIC) perform pre- and postpayment 

claims reviews as a part of investigating potential fraud.7 The 

Comprehensive Error Rate Testing (CERT) contractors estimate the 

Medicare FFS improper payment rate in part by conducting postpayment 

claims reviews on a random sample of claims processed by the MACs. 

Recovery Auditors (RA) conduct data analysis and postpayment claims 

reviews to identify improper payments. These four contractors conduct 

postpayment claims reviews using the same general process to examine 

whether the claims that have been paid adhere to Medicare’s 

requirements and are for medically necessary services and apply the 

same Medicare coverage and payment requirements in their reviews.8

Recently, questions have been raised about whether CMS’s coordination 

and oversight of the different types of Medicare FFS contractors that 

perform postpayment claims reviews are effective and efficient and 

whether the agency is maintaining an appropriate balance between 

detecting improper payments efficiently and adding unnecessary 

 

6

This report discusses the four types of primary contractors that perform claims reviews. 

In addition, in 2012 CMS established the Supplemental Medicare Review Contractor type 

to perform national claims reviews of Medicare Part A, Part B, and DME providers and 

suppliers. This contractor conducts large-volume medical reviews nationwide for specific 

services, such as: Inpatient Psychiatric Facility Interrupted Stays, Epidural Injections, and 

Place-of-Service coding. We excluded this type of contractor from our study because it 

has not been in operation for 1 year.

7

Program Safeguard Contractors conducted activities to investigate fraud prior to the 

establishment of ZPICs, and are still doing so in one zone.

8

CMS and others sometimes refer to the claims reviews after payment as “audits” or 

“medical reviews.” In this report we will use the term “claims review” to distinguish these 

reviews from other types of audits and reviews, such as financial audits of hospital cost 

reports.
 

Page 3 GAO-13-522 Medicare Contractor Requirements

administrative burden to providers.9 You asked us to examine CMS’s use 

of contractors to review Medicare FFS claims. This report (1) describes 

the establishment, functions, and characteristics of four different types of 

contractors that conduct postpayment reviews on Medicare FFS claims 

(MACs, ZPICs, CERT contractors, and RAs), and (2) assesses the extent 

to which CMS’s requirements for postpayment claims reviews differ 

across these four contractor types, and whether any differences could 

impede effective and efficient postpayment claims reviews.10

To describe the contractors’ establishment, functions, and characteristics, 

we reviewed each type of contractor’s applicable authority, their most 

recent statement of work, and reports about each type of contractor 

prepared by CMS, the HHS Office of Inspector General, and others. We 

interviewed CMS officials and also obtained 2011 and 2012 data from 

CMS on the number of reviews done by each of these types of 

contractors. We also obtained data on the RA appeals from CMS. We 

assessed the data for reliability through interviews and found the data to 

be reliable for our purposes.

To assess the extent of the differences in CMS’s requirements for 

contractors’ postpayment reviews and whether any differences could 

impede effective and efficient claims reviews, we examined the most 

recent statements of work for each contractor type and relevant chapters 

from the following CMS Medicare Manuals current as of May 7, 2013: 

General Information, Eligibility, and Entitlement Manual; Benefit Policy 

Manual; Claims Processing Manual; Financial Management Manual; 

Program Integrity Manual; and Contractor Beneficiary and Provider 

Communications Manual; along with other materials. We interviewed 

CMS officials responsible for management and oversight of the four 

contractor types and confirmed our analysis of the differences in 

requirements with agency staff. This included obtaining their opinions on 

the reasons for the differences, when the differences might be 

appropriate, or when they might be reduced. We assessed CMS’s 

requirements using the standards outlined in our internal control 

 

9

In this report, the term provider includes entities such as hospitals or physicians as well 

as entities that supply Medicare beneficiaries with durable medical equipment (DME)—

such items as wheelchairs; diabetic supplies; prosthetics; and orthotics—laboratory, 

ambulance, home health, hospice, therapy, and skilled nursing services.

10We have ongoing work reviewing CMS’s oversight of its contractors that conduct 

postpayment reviews.
 

Page 4 GAO-13-522 Medicare Contractor Requirements

documents, Standards for Internal Control in the Federal Government and 

Internal Control Management and Evaluation Tool.

11 To assess whether 

differences in CMS requirements could impede the efficiency and 

effectiveness of claims reviews, we interviewed associations representing 

Medicare FFS providers who have experienced postpayment claims 

reviews to obtain information on the effect these differences have on 

providers. (See app. I for a list of the provider associations.) In addition, 

we reviewed white papers sent by health care stakeholders in response 

to the Senate Committee on Finance’sMay 2, 2012, letter requesting 

suggestions to improve efforts to address Medicare and Medicaid fraud, 

waste, and abuse. We also interviewed CMS staff working on an internal 

work group charged with reducing provider burden to gain better 

understanding of any proposed changes to the requirements. We 

assessed the requirements, information from provider associations and 

the white papers, and information from CMS’s staff charged with reducing 

provider burden against guidance developed by the Office of 

Management and Budget (OMB) to help agencies implement Executive 

Order 13571—Streamlining Service Delivery and Improving Customer 

Services.

12

We conducted this performance audit from October 2012 to July 2013 in 

accordance with generally accepted government auditing standards. 

Those standards require that we plan and perform the audit to obtain 

sufficient, appropriate evidence to provide a reasonable basis for our 

findings and conclusions based on our audit objectives. We believe that 

the evidence obtained provides a reasonable basis for our findings and 

conclusions based on our audit objectives.

Contractors have a long-standing and essential role in the Medicare 

program. Program integrity activities—particularly postpayment claims 

reviews—have been a core component of contractors’ roles.

 

11See GAO, Standards for Internal Control in the Federal Government, 

GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999); and Internal Control 

Management and Evaluation Tool, GAO-01-1008G (Washington, D.C.: August 2001).

12Office of Management and Budget, Implementing Executive Order 13571 on 

Streamlining Service Delivery and Improving Customer Service, Memorandum M-11-24 

(June 13, 2011). 

Background 
 

Page 5 GAO-13-522 Medicare Contractor Requirements

When conducting postpayment claims reviews, contractors apply the 

same criteria—Medicare regulations, and coverage and coding policies—

to determine whether or not a claim was paid properly. CMS outlines the 

general process and contractor requirements for conducting claims 

review in its manuals and contractor statements of work.

Postpayment claims reviews may be automated, semiautomated, or 

complex.13

• Automated reviews use computer programming logic to check claims 

for evidence of improper coding or other mistakes.14 Contractors can 

use automated postpayment reviews to analyze paid claims and 

identify those that can be determined to be improper without 

examining any additional documentation, such as when a durable 

medical equipment (DME) supplier bills for items that should have 

been included as part of a bundled payment for a skilled nursing 

facility stay.15

• Semiautomated reviews use computer programming logic to check for 

possible improper payments, but allow providers to send in 

information to rebut the claim denial before it is implemented. Only the 

RAs conduct such reviews. If providers send in information, RA staff 

review it before making a final determination.

• Complex reviews are conducted if additional documentation is needed 

to determine whether a payment was made in error. Complex reviews 

involve manual examinations of each claim and any related 

documentation requested and received from the provider, including 

paper files, to determine whether the service was billed properly, and 

was covered, reasonable, and necessary. Licensed clinical 

 

13Contractors can also conduct routine reviews, which involve checking some claims for 

issues such as clerical errors.

14Medicare’s payment system relies on the coding of beneficiaries’ diagnoses or the 

services, procedures, and devices provided to them to determine proper payment. 

Payment may be made on the basis of the diagnosis, or of the services, procedures, and 

devices claimed, depending on the payment method for that type of claim. Because MACs 

pay claims according to the codes assigned; if the code does not accurately reflect the 

diagnosis, service, procedure, or device provided, then the claim is considered improper. 

15If the DME claim is submitted prior to the bundled skilled nursing facility claim, the DME 

claim may not appear to be improper when made.

Postpayment Claims 

Reviews
 

Page 6 GAO-13-522 Medicare Contractor Requirements

professionals, such as licensed practical nurses, and certified coders 

typically perform the reviews. Contractors have physician medical 

directors on staff who provide guidance about making payment 

determinations on the basis of medical records and other 

documentation and who may discuss such determinations with 

providers.

The postpayment claims review process involves selection of the claims 

to be reviewed, the review itself, communicating with providers during and 

about the review, and a process for assuring quality of the contractor’s 

reviews and decisions. Each contractor establishes its own claims 

selection criteria. A contractor may use data analyses, knowledge of 

Medicare billing requirements, and clinical expertise to develop its claims 

selection criteria to focus on claims with a high likelihood of being 

improper. As a part of the review, the contractor may notify the provider 

that a claim is under review, or ask for medical records or other 

documentation to substantiate the claim. The latter is called an additional 

documentation request (ADR).16 If the contractor requires additional 

documentation, the provider must submit the requested documents within 

a specified time frame. If the review has determined that the Medicare 

payment amount was improper, either the contractor or the MAC for that 

jurisdiction will notify the provider that an overpayment was made and will 

need to be recouped, or an underpayment was made and the remainder 

of the remittance will be paid to the provider.17

 

16In many cases, the ADR serves as notification to the provider that a claim is under 

review.

Providers may appeal any 

of the contractors’ decisions. The contractors’ quality assurance (QA) 

processes may include various steps to assure consistency, reliability, 

and quality in claims reviews. The QA process may include some type of 

examination of the work that has been done and may be performed 

internally, by the contractors themselves, or externally, by CMS or an 

independent third party. A contractor’s QA process may include 

comparing multiple reviewers’ decisions about the same claim to 

determine the extent of their agreement (known as interrater reliability 

testing) or reviews to validate the claims review decisions by others who 

are either internal or external to the reviewer’s organization. The QA 

process may also include staff training, to ensure that the reviewers 

17MACs process and pay claims in specific jurisdictions. The MAC for a jurisdiction is 

responsible for recoupment or payment of the proper amount, whether or not it was the 

notifying contractor.
 

Page 7 GAO-13-522 Medicare Contractor Requirements

understand Medicare program and payment rules so that their 

determinations can be consistent. The QA processes followed may also 

be outlined in a QA plan.

The Medicare Prescription Drug, Improvement, and Modernization Act of 

2003 (MMA) directed CMS to establish a demonstration program to test 

the use of RAs on a contingency fee basis in the Medicare program.18

Other contractors that review claims are given a set amount of funding to 

conduct reviews. In the demonstration project, RAs were paid 

contingency fees on claims that were identified as improper, including on 

claims for which the RA determinations were overturned on appeal at the 

second through fifth levels of review.19 Subsequently, the Tax Relief and 

Health Care Act of 2006 required CMS to implement a permanent and 

national Medicare recovery audit contractor program to increase efforts to 

identify and recoup improper payments.20

During the course of the RA demonstration program, providers reported 

several specific problems. In providers’ views, the RA’s contingency fee 

payment structure created an incentive for these contractors to be too 

aggressive in determining that claims were improper. Providers also 

faulted CMS for not penalizing RAs for inaccurate claim determinations, 

noting that contractor determinations resulted in thousands of provider 

appeals that were expensive and burdensome for providers. In addition, 

providers stated that during the demonstration project RAs did not have 

the necessary medical expertise to make their determinations, because 

they were not required to have a physician medical director on staff or 

coding experts conducting the claims reviews.

 

18Recovery auditing has been used in various industries, including health care, to identify 

and collect overpayments for about 40 years. Typically, recovery auditing contractors are 

paid a contingency fee based on a percentage of the overpayments collected. The MMA 

directed CMS to establish the demonstration in at least two states from among the ones 

with the highest per capita Medicare utilization rates and to use at least three contractors. 

Pub. L. No. 108-173, § 306, 117 Stat. 2066, 2256-57. 

19The appeals process under Medicare FFS program includes five levels of review.

20Pub. L. No. 109-432, §302, 120 Stat. 2922, 2991-92 (codified at 42 U.S.C. 

§ 1395ddd(h)).

Providers’ and CMS’s 

Experience with the 

Recovery Audit 

Demonstration Program
 

Page 8 GAO-13-522 Medicare Contractor Requirements

We indicated in a previous report that CMS took a number of steps to 

address issues raised by providers about the RA demonstration program 

when it implemented the RA national program.21 For example, CMS put in 

place more rigorous staffing requirements and eliminated contingency fee 

payments when RAs’ claims determinations are overturned on appeal. In 

addition, CMS took steps to improve oversight of the accuracy of RAs’ 

claims review determinations and the quality of RA service to providers in 

the national program. CMS added processes to review the accuracy of 

RA determinations and established performance metrics to monitor RA 

accuracy and service to providers.

Internal control is the component of an organization’s management that 

provides reasonable assurance that the organization achieves effective 

and efficient operations, reliable financial reporting, and compliance with 

applicable laws and regulations.22

In addition, Executive Order 13571—Streamlining Service Delivery and 

Improving Customer Services—was issued in April 2011 to improve 

government services to individuals and entities by requiring agencies to 

develop customer service plans in consultation with OMB.

Internal controls, in this case 

postpayment claims reviews, should provide reasonable assurance that 

the Medicare program is appropriately reimbursing for services provided 

to beneficiaries, thereby protecting the integrity of the Medicare program. 

Ineffective or inefficient claims reviews present the risk of generating false 

findings of improper payments and an unnecessary administrative and 

financial burden related to provider appeals for Medicare-participating 

providers and the Medicare program. CMS requirements for contractors 

performing postpayment claims reviews help establish the control 

environment and control activities, such as monitoring. The manner in 

which the agency delegates authority and responsibility through these 

requirements establishes part of the control environment. Contractor 

requirements also establish the mechanisms that contractors use to 

communicate and interact with providers.

23

 

21See GAO, Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing 

Vulnerabilities to Improper Payments, Although Improvements Made to Contractor 

Oversight, GAO-10-143 (Washington, D.C.: Mar. 31, 2010).

22See GAO/AIMD-00-21.3.1.

23Exec. Order No. 13571, 76 Red. Reg. 24.399 (May 2, 2011). 

Assessing Efficient and 

Effective Operations
 

Page 9 GAO-13-522 Medicare Contractor Requirements

Subsequently, OMB issued implementation guidance for agencies for 

those services that the agencies plan to focus on improving.24 The 

guidance calls for improving the customer service experience through 

practices such as developing a process for ensuring consistency and 

coordinating with others to identify opportunities to use common 

processes. Among other things, the guidance also suggests analyzing 

customer preferences and redirecting resources from less preferred and 

more costly channels—like printed materials—to preferred, less costly 

and more widely accessible channels (such as internet communications) 

where appropriate.

Over time, Congress provided for CMS to use contractors to carry out 

functions in connection with the FFS program, which has resulted in the 

use of more types of contractors to conduct postpayment claims reviews. 

These contractors also have different primary functions and 

characteristics, which affect their use of postpayment claims reviews.

Although contractors have been used for Medicare since the beginning of 

the program, several statutory changes since the 1990’s increased CMS’s 

resources and authority to use new types of contractors—MACs, RAs, 

ZPICs, and CERT contractors—to conduct postpayment claims reviews in 

order to help detect and recoup overpayments or repay underpayments, 

and to investigate potential fraud.

• In 1965 when Medicare was established, Congress provided for two 

types of contractors that could be used to administer the program.

From then until 1996, responsibility for processing and paying 

Medicare claims, as well as for the program integrity tasks of 

developing potential cases and coordinating with law enforcement 

regarding any investigations of suspected Medicare fraud, resided 

with contractors called fiscal intermediaries and carriers.

 

24Office of Management and Budget, Implementing Executive Order 13571 on 

Streamlining Service Delivery and Improving Customer Service.)

The Four Medicare 

FFS Contractor Types 

Were Established 

under Different Laws 

and Have Different 

Primary Functions 

and Characteristics

Changes in Medicare’s 

Contracting Authority 

Resulted in Four Medicare 

FFS Contractor Types
 

Page 10 GAO-13-522 Medicare Contractor Requirements

• The Health Insurance Portability and Accountability Act of 1996 

(HIPAA) established the Medicare Integrity Program (MIP), which 

authorized CMS to contract separately for program safeguard 

contractors (PSC)—the precursor to the ZPICs—to conduct activities, 

such as identifying and investigating potential fraud, that had 

previously been conducted by fiscal intermediaries and carriers and 

provided funding for MIP.25

• In 2003, the MMA required CMS to replace the fiscal intermediaries 

and carriers with the MACs.26 (See table 1.) During the 

implementation of the MACs, CMS consolidated the number of 

contractors that process and pay Medicare FFS claims, enlarged their 

geographic jurisdictions compared to the previous contractors, and 

combined Part A and Part B claims processing within each 

jurisdiction.27 As part of changes made while implementing MACs, 

CMS also transitioned fraud investigation from PSCs to ZPICs in all 

but one zone.28

• The MMA also directed CMS to establish a demonstration project to 

test the use of recovery audit contractors in the Medicare program.29

 

25Pub. L. No. 104-191, §§ 201, 202, 110 Stat. 1936, 1992-98 (codified at 42 U.S.C. 

§§ 1395j(k)(4), 1395ddd ).

Subsequently, the Tax Relief and Health Care Act of 2006 required 

CMS to implement a permanent and national Medicare recovery audit 

26Pub. L. No. 108-173, § 911, 117 Stat. 2066, 2378-2386 (codified at 42 U.S.C. 

§ 1395kk-1). CMS contracts with two kinds of MACs—A/B MACs and DME MACs. A/B 

MACs process claims for services under Part A and Part B, and a few A/B MACs also 

process home health and hospice claims. As of June 2013, in one jurisdiction, the A/B 

MAC has not replaced the carrier and fiscal intermediary. DME MACs process claims for 

DME, prosthetics, orthotics, and supplies. There are four different geographic jurisdictions 

for the DME MACs. In this report, the term MAC refers to all the MACs unless otherwise 

noted.

27Previously, fiscal intermediaries were responsible for processing and paying claims 

submitted by institutional providers such as hospitals’ Part A claims and any of these 

providers’ Part B claims. Carriers were responsible for Part B claims submitted by 

physicians and other noninstitutional providers.

28HIPAA gave CMS the authority to contract separately for program safeguard contractors 

to perform integrity functions. As part of CMS’s transition to MACs as required by the 

MMA, CMS transitioned the work of investigating potential fraud to ZPICs. This transition 

is planned to be complete in 2013.

29Pub. L. No. 108-173, § 306, 117 Stat. 2066, 2256-57.
 

Page 11 GAO-13-522 Medicare Contractor Requirements

contractor program to increase efforts to identify and recoup improper 

payments.30

• Although HHS had begun estimating the extent of improper payments 

in Medicare FFS claims in 1996, the Improper Payments Information 

Act of 2002 (IPIA) requires executive-branch federal agencies to 

annually review all programs and activities to identify those that are 

susceptible to significant improper payments, estimate the annual 

amount of improper payments for these programs and activities, and 

report these estimates along with actions taken to reduce improper 

payments for programs with estimates that exceed $10 million.31 In 

fiscal year 2003 as part of its IPIA compliance efforts, CMS 

established the CERT program to measure improper payment rates 

for Medicare FFS claims, including one CERT contractor that is 

responsible for reviewing a random sample of claims nationwide, with 

their related medical records and other documentation to determine if 

they are proper.32

 

30Pub. L. No. 109-432, §302, 120 Stat. 2922, 2991-92 (codified at 42 U.S.C. 

§ 1395ddd(h)). 

31Pub. L. No. 107-300, 116 Stat. 2350 (codified at 31 U.S.C. § 3321 note). The IPIA was 

subsequently amended by the Improper Payments Elimination and Recovery Act of 2010, 

Pub. L. No. 111-204, § 2(e), 124 Stat. 2224, 2227 (codified at 31 U.S.C. § 3321 note), and 

the Improper Payments Elimination and Recovery Improvement Act of 2012, Pub. L. 

No. 112-248, 126 Stat. 2390 (2013).

32There are four contractors—statistical, claims review, documentation, and website—that 

support the CERT function and all four CERT contractors perform their tasks for the entire 

nation. In this report, “the CERT contractor” refers to the CERT review contractor 

responsible for conducting the claims reviews.
 

Page 12 GAO-13-522 Medicare Contractor Requirements

Table 1: Applicable Legislation for Four Contractor Types That Conduct Medicare Postpayment Claims Reviews

Medicare Administrative 

Contractors (MAC)

Zone Program Integrity 

Contractors (ZPIC)

Comprehensive 

Error Rate Testing 

(CERT) Contractors Recovery Auditors (RA)

First contract year 2006 2008 a 2003 b 2008

Applicable legislation

c

The Medicare Prescription 

Drug, Improvement, and 

Modernization Act of 2003 

(MMA)

Health Insurance 

Portability and 

Accountability Act of 1996 

(HIPAA) d

The Medicare 

Prescription Drug, 

Improvement, and 

Modernization Act of 

2003 (MMA)

e

Chief Financial Officers 

Act of 1990

d

Government Management 

Reform Act of 1994

f

Improper Payments 

Information Act of 2002 

(IPIA)

g

Improper Payments 

Elimination and Recovery 

Act of 2010

h

Improper Payment 

Elimination and Recovery 

Improvement Act of 2012

i

The Medicare 

Prescription Drug, 

Improvement, and 

Modernization Act of 

2003

j

Tax Relief and Health 

Care Act of 2006

d

Source: GAO analysis of CMS information.

k

a

Prior to 2003, fiscal intermediaries and carriers performed the activities currently conducted by the 

MACs. In 2013, the Centers for Medicare & Medicaid Services (CMS) will complete the transition of 

processing and paying Medicare fee-for-service (FFS) claims from three legacy contractors to the 

MACs.

b

HIPAA gave CMS the authority to contract separately for program safeguard contractors to perform 

integrity functions. CMS transitioned to MACs as required by the Medicare Prescription Drug, 

Improvement, and Modernization Act of 2003. CMS created the ZPICs’ jurisdictions to align with the 

MACs’ jurisdictions.

c

Before the enactment of the Tax Relief and Health Care Act of 2006, CMS began a demonstration of 

recovery audit contracting, which ended in March 2008. The national RA program began in 2008.

d

Pub. L. No. 108-173, § 911, 117 Stat. 2066, 2378-2386 (codified at 42 U.S.C. § 1395kk-1).

e

Pub. L. No. 104-191, § 202, 110 Stat. 1936, 1996-98 (codified at 42 U.S.C. § 1395ddd ).

f

Pub. L. No. 101-576, 104 Stat. 2838.

g

Pub. L. No. 103-356, 108 Stat. 3410.

h

Pub. L. No. 107-300, 116 Stat. 2350 (codified at 31 U.S.C. § 3321 note).

i

Pub. L. No. 111-204, § 2(e), 124 Stat. 2224, 2227 (codified at 31 U.S.C. § 3321 note).

j

Pub. L. No. 112-248, 126 Stat. 2390 (2013).

k

Pub. L. No. 109-432, §302, 120 Stat. 2922, 2991-92 (codified at 42 U.S.C. § 1395ddd(h).
 

Page 13 GAO-13-522 Medicare Contractor Requirements

CMS has established responsibility for overseeing these four types of 

contractors in different parts of its matrixed organization (see fig.1). Three 

different organizational components within CMS—Center for Medicare 

(CM),33 Office of Financial Management (OFM), and Center for Program 

Integrity (CPI)—oversee these four different types of contractors. CM 

oversees the MACs, which conduct several program integrity activities, 

including postpayment claims review.34 CMS’s Provider Compliance 

Group within OFM oversees the RAs and CERT contractors.35 The 

Provider Compliance Group has overall responsibility for the oversight of 

the claims review activity conducted by MACs, RAs, and CERT 

contractors and for measurement of the FFS improper payment rate.36

CPI oversees the ZPICs and has direct responsibility for program 

activities involved in investigating potential fraud.37

 

33The Center for Medicare serves as CMS’s focal point for the formulation, coordination, 

integration, implementation, and evaluation of national Medicare program policies and 

operations. 

34CM also manages provider outreach and education, which informs providers about 

proper billing practices.

35CPI also oversees the PSCs. Another group in OFM manages other integrity activities, 

such as audits of hospitals and other institutional providers and identifying and managing 

situations where Medicare is the secondary, not primary, payer for health care services.

36The FFS Medicare improper payment rate annually estimates the percentage and dollar 

amount of FFS claims paid improperly.

37See GAO, Medicare Integrity Program: CMS Used Increased Funding for New Activities 

but Could Improve Measurement of Program Effectiveness, GAO-11-592 (Washington, 

D.C.: July 29, 2011).
 

Page 14 GAO-13-522 Medicare Contractor Requirements

Figure 1: Centers for Medicare & Medicaid Services’ (CMS) Organizational Components That Oversee Medicare Fee-ForService Contractors and Their Activities Related to Postpayment Claims Review, as of May 2013
 

Page 15 GAO-13-522 Medicare Contractor Requirements

Four types of CMS contractors conducting postpayment reviews have 

different primary functions and characteristics (see table 2.) Postpayment 

claims reviews are the main focus of the RA and CERT contractors’ 

functions, but that is not the case for MACs and ZPICs. The contractors 

also vary in the number of states and size of their geographic jurisdictions 

and the volume of claims they review.38

Table 2: Characteristics of the Four Types of Contractors That Conduct Medicare Postpayment Claims Reviews

Medicare 

Administrative 

Contractors (MAC)

Zone Program 

Integrity 

Contractors (ZPIC)

Comprehensive Error

Rate Testing 

(CERT) Contractors Recovery Auditors (RA)

Number of contractors 16 6 a 4 b 4 c

Primary contractor 

function

Process and pay 

Medicare claims as 

accurately as possible in 

their jurisdiction

Identify and 

investigate potentially 

fraudulent claims and 

providers in their 

geographic 

jurisdiction

Estimate the national 

Medicare fee-for-service 

(FFS) improper payment 

rate and a rate for each 

MAC through postpayment 

claims reviews

Identify Medicare FFS 

claim underpayments and 

overpayments through 

postpayment claims 

reviews

Primary purpose of 

contractor claims 

reviews

To better ensure 

payment accuracy in their 

jurisdictions and better 

ensure that providers 

with a history of a 

sustained or high level of

billing errors are 

compliant with Medicare 

billing requirements

To identify and 

investigate patterns 

of billing that indicate 

potentially fraudulent 

claims and providers

To conduct claims review on 

a sample of claims to 

estimate the national 

Medicare FFS improper 

payment rate and a rate for 

each MAC

To identify Medicare FFS 

claim underpayments and 

overpayments not 

previously identified 

through MAC claims 

processing or other 

contractor reviews

Complex postpayment 

claims reviewsd

conducted in 2012

84,070

e

107,621 f 41,396 g 1,121,509

Automated 

postpayment claims 

reviewsh

n/a

conducted in 

fiscal year 2012

n/a n/a 985,946

Legend: n/a = not applicable.

Source: GAO analysis of CMS information.

a

There are 12 contractors for processing Part A and B claims and 4 contractors for durable medical 

equipment, including prosthetics, orthotics, and suppliers. The total of 16 does not include the two 

legacy fiscal intermediaries and one carrier continuing to provide claims administration services, as of 

June 2013.

b

 

38CMS officials use the terms zones and regions for ZPICs and RAs respectively, to refer 

to the contractors’ geographic jurisdiction. In this report we will use the term geographic 

jurisdiction, regardless of the contractor.

In addition, as of June 2013, CMS holds contracts with four program safeguard contractors.

Four Medicare FFS 

Contractor Types Have 

Different Primary 

Functions and 

Characteristics
 

Page 16 GAO-13-522 Medicare Contractor Requirements

c

There are four CERT contractors. Unless otherwise noted, when used in this report, “the CERT 

contractor” will refer to the CERT review contractor. The other three contractors handle the design 

sampling strategy, manage the documentation provided, and maintain the confidential website.

d

Complex reviews are manual examinations of claim documentation including paper files to determine 

whether the service was billed properly and was covered, reasonable, and necessary. They typically 

are performed by licensed clinical professionals or certified coders.

e

MAC, ZPIC, and CERT contractor complex reviews were conducted in calendar year 2012. RA 

automated and complex reviews were conducted in fiscal year 2012.

f

Reviews completed by MACs do not include the reviews performed by the three legacy contractors 

that continue to provide claims administration services, as of June 2013.

g

Reviews listed in this table as completed by ZPICs also include those performed by the program 

safeguard contractors (PSC) including reviews of potentially abusive physical therapy claims in one 

geographic area.

h

MACs. Our analysis of MACs’ statement of work indicates that MACs 

have primary responsibility for processing and paying Medicare FFS 

claims in their geographic jurisdictions. In addition, MACs conduct several 

program integrity activities, including prepayment and postpayment 

claims review, audits of hospitals and other institutional providers to 

ensure the accuracy of payments paid based on institutions’ reported 

costs and recoupment of overpayments. They also implement local 

coverage determinations (LCD) in their jurisdictions, as long as such 

determinations do not conflict with national coverage policy or other 

Medicare payment requirements.

Automated reviews use computer programming logic to check claims for evidence of improper 

coding or other mistakes. Only the RAs conducted automated postpayment reviews.

39 As of June 2013, there are 12 MACs 

that process part A and part B claims (A/B MAC), one for each of 

12 jurisdictions, and 4 MACs that process DME claims (DME MAC), one 

for each of 4 jurisdictions.40

MACs conduct postpayment reviews to help ensure accurate payment 

and specifically to identify payment errors. This includes identifying ways 

to address future payment errors—for example, through automated 

controls that can be added on a prepayment basis and educating 

providers with a history of a sustained or high level of billing errors to 

ensure that they comply with Medicare billing requirements. In 2012, 

Jurisdictions of other contractors, such as 

ZPICs and RAs, were designed to align with MAC jurisdictions.

 

39LCDs are decisions about coverage and coding in the absence of specific statute, 

regulations, or national policy. They are established by the MACs and applied by MACs 

and other contractors to claims received for the geographic area to which the claims are 

assigned. 

40DME MACs also process claims for prosthetics, orthotics, and supplies, such as diabetic 

test strips.
 

Page 17 GAO-13-522 Medicare Contractor Requirements

MACs performed about 84,000 complex postpayment claims reviews. 

Because each jurisdiction has a MAC responsible for claims 

administration, if another contractor identifies an improper payment, the 

MAC for that jurisdiction is responsible for correcting any underpayments 

and recouping any overpayments, and, in some cases, for corresponding 

with providers whose claims are under review.

ZPICs. The ZPICs’ primary function is to identify and investigate 

potentially fraudulent FFS claims and providers in each of seven 

geographic jurisdictions, which are called zones.41

ZPICs investigate potentially fraudulent claims and providers in various 

ways, including investigating referrals and complaints from other 

Medicare contractors and analyzing claims data. CMS uses its Fraud 

Prevention System to prioritize investigative leads on the basis of analysis 

and development of predictive models, including claims data to identify 

which providers’ billing patterns are most aberrant.

CMS established 

ZPICs in 2008 to investigate potential fraud through a jurisdiction-based 

approach similar to that of the MACs. CMS officials indicated that this 

approach consolidated responsibility with the ZPICs for investigating 

potential fraud for all types of claims and for all parts of Medicare in each 

geographic jurisdiction.

42

 

41CMS is in the process of replacing its legacy PSCs with seven ZPICs; one for each 

geographic jurisdiction. Currently there are only six ZPICs because one geographic 

jurisdiction has not had a contract put in place. The ZPIC geographic jurisdictions are 

designed to include one or more MAC jurisdictions.

The Fraud 

Prevention System identifies suspect providers for the ZPICs to 

investigate before those providers generate large amounts of potentially 

fraudulent claims. ZPICs may also take additional steps beyond analysis 

and reviews of claims, such as investigations of company ownership or 

interviews of beneficiaries, to determine if services were provided as 

claimed in the medical records. ZPICs’ analyses may result in: referrals to 

law enforcement; administrative actions such as recommending payment 

suspension or revocation to CMS; or requiring a provider’s claims to be 

reviewed before payment in the future. ZPICs’ postpayment claims 

42The Fraud Prevention System is intended to analyze Medicare claims, provider, and 

beneficiary data before claims are paid to identify those that are potentially fraudulent. See 

GAO, Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, 

but Needs to Define Measures to Determine Its Effectiveness, GAO-13-104 (Washington, 

D.C.: Oct. 15, 2012).
 

Page 18 GAO-13-522 Medicare Contractor Requirements

reviews generally focus on providers whose billing patterns are unusual 

or aberrant in relation to similar providers in order to identify potential 

fraud or abuse. When ZPICs identify improper payments, they refer these 

to the MACs to be recouped or repaid. ZPICs performed about 108,000 

complex postpayment claims reviews in 2012.

CERT contractor. Our analysis of its statement of work indicates that the 

primary function of the CERT review contractor is to conduct postpayment 

claims reviews used as a basis to estimate the annual FFS Medicare 

improper payment rate—the percentage of claims paid improperly. HHS 

began to estimate the rate of improper payments in Medicare FFS in 

fiscal year 1996. CMS began estimating the FFS Medicare improper 

payment rate in fiscal year 2003.43 Since then, the CERT review 

contractor has had the responsibility of reviewing a sample of claims for 

the entire nation for this estimate.44

To provide a basis for estimating the Medicare FFS improper payment 

rate, the CERT review contractor conducts complex claims reviews on a 

random sample of Medicare FFS claims selected nationwide from those 

that the MACs have processed to determine whether or not the claims 

were processed in error.

As a result, claims reviews are a 

central part of the CERT review contractor function. CERT reviews also 

help identify program integrity vulnerabilities by measuring the payment 

accuracy of each MAC, and the Medicare FFS improper payment rate by 

type of claim and service.

45

 

43CMS originally established two programs to monitor the payment accuracy of the 

Medicare FFS program: the Hospital Payment Monitoring Program (HPMP) and the CERT 

program. The HPMP measured the improper payment rate only for Part A inpatient 

hospital claims, while the CERT program measured the improper payment rate for all 

other Part A and Part B Medicare FFS claim types. Beginning with the 2009 reporting 

period, the HPMP was dissolved and the CERT program became fully responsible for 

sampling and reviewing all Medicare FFS claim types for improper payments.

If documentation is not provided to the CERT 

contractor by providers in the required time frame, the CERT contractor 

determines the claim to be improper. The CERT review contractor does 

44The four CERT contractors do not operate in different geographic jurisdictions; they 

work together to estimate the national error rate. This report focuses on the work of the 

CERT claims review contractor.

45The CERT claims review sample is pulled semimonthly from MAC processed claims and 

encompass those that have been paid, denied, or selected for a MAC claims review. This 

report will refer to the CERT claims reviews as “postpayment;” because all of the claims 

were processed prior to CERT claims review even though not all were paid.
 

Page 19 GAO-13-522 Medicare Contractor Requirements

not make recoupments or repayments. If the CERT contractor determines 

that an improper payment has been made, the CERT contractor is 

required to refer the claim to the appropriate MAC for recoupment of 

overpayments or repayment of underpayments. In fiscal year 2012, the 

CERT review contractor reviewed just over 41,000 postpayment claims.

RAs. Our analysis of the RA statement of work indicates that conducting 

postpayment claims reviews is the RAs’ primary function. Use of RAs was 

designed to be an addition to MACs’ existing claims review processes, 

since the number of postpayment reviews conducted by the MACs and 

other contractors was small relative to the number of claims paid and 

amount of improper payments.

To implement the national recovery audit program, CMS contracted with 

four RAs to conduct postpayment reviews of Medicare FFS claims to 

identify overpayments and underpayments within four geographic 

jurisdictions. In part because of issues that were raised during the RA 

demonstration program, CMS made changes in the RA’s requirements to 

provide more oversight over their activities. As in the demonstration, 

under the national program the RAs are paid on a contingency fee basis, 

but CMS officials indicated that the percentage is smaller. For the national 

program, the fee ranges from 9 to 12.5 percent of the overpayments and 

underpayments collected. In contrast to the MACs, ZPICs, and CERT 

contractor, which are paid on the basis of the contractually negotiated 

costs for the tasks performed, RAs are compensated from the funds that 

are recouped. However, if an RA’s overpayment determination is 

overturned on appeal, the RA is not paid for that claim. The RAs 

conducted nearly five times as many complex reviews in fiscal year 2012 

as the other three contractors combined—over 1.1 million complex 

postpayment claims reviews and nearly 1 million automated review 

denials.

With an increased focus on measuring and reducing Medicare improper 

payments and the implementation of RAs, there has been a significant 

increase in the number of claims being reviewed postpayment (see 

table 3). Our analysis of data from CMS indicates that from 2011 to 2012, 

the RA’s complex postpayment reviews increased 77 percent. Except for 

the CERT contractor, which reviews a randomly selected sample of 

claims each year to estimate the error rates, all contractors increased 

their postpayment claims reviews by 16 percent or more. However, the 

2.3 million reviews performed by these contractors accounted for less 

than 1 percent of the over 1 billion FFS claims paid annually, and about 

1.4 million were complex reviews. 
 

Page 20 GAO-13-522 Medicare Contractor Requirements

Table 3: Volume of Contractors’ Postpayment Claims Reviews, by Type of Contractor 2011-2012

Type of contractor Type of review 2011 2012 Percent change

Medicare Administrative Contractors (MAC) Complex a 10,518 b 84,070 699%

Zone Program Integrity Contractors (ZPIC) Complex c 92,655 107,621 16

Comprehensive Error Rate Test (CERT) contractor Complex 47,877 41,396 -14

Recovery Auditors (RA) Automated d 723,484 e 985,946 36

Complex 634,613 f 1,121,509 77

Total 1,358,097 2,107,455 55

Total 1,509,147 2,340,542 55%

Source: GAO analysis of CMS data.

a

Reviews completed by MACs do not include the reviews performed by the three legacy contractors 

that continue to provide claims administration services, as of June 2013.

b

Complex reviews are manual examinations of claim documentation including paper files, to 

determine whether the service was billed properly and was covered, reasonable, and necessary. 

They typically are performed by licensed clinical professionals or certified coders.

c

Reviews completed by ZPICs include those performed by the program safeguard contractors (PSC) 

and reflect PSCs’ reviews of potentially abusive physical therapy claims in one geographic area.

d

RA data are reported for fiscal years 2011 and 2012, rather than calendar year.

e

Automated reviews use computer programming logic to check claims for evidence of improper 

coding or other mistakes. Only the RAs conducted automated postpayment reviews.

f

RA complex reviews are based on the number of additional documentation requests (ADR) received 

and also include semiautomated reviews.

CMS has different requirements for postpayment claims reviews across 

different contractor types, and some of these differences can sometimes 

impede effectiveness and efficiency by increasing administrative burden 

on providers. Due in part to CMS’s experience with the RA demonstration 

and issues raised by providers during the demonstration, CMS sets more 

limits through claims review requirements on RAs than on other 

contractors. CMS officials generally described some other differences as 

developing when different requirements were set by different groups 

within the agency at different times. CMS has begun an effort to examine 

whether its claims reviews activities add administrative burden for 

providers.

Many CMS 

Requirements for 

Postpayment Claims 

Review Differ across 

Contractor Types, 

Which Can Impede 

Effectiveness and 

Efficiency 
 

Page 21 GAO-13-522 Medicare Contractor Requirements

As a result of lessons learned during the RA demonstration project and to 

establish tighter controls on RAs, CMS imposed certain postpayment 

requirements unique to the RAs when it implemented the national 

program (see table 4). For example, RAs are required to limit the number 

of ADRs made to a single provider during a given period, while the other 

contractors do not have such limits.46

• submitting to CMS for review and approval descriptions of the billing 

issues that they propose to review and the basis for assessing 

whether the claims for those services are proper prior to widespread 

use,

Similarly, unlike the other 

contractors, RAs cannot make claim denials for lapses in documentation 

standards unrelated to reasonableness or medical necessity, such as 

illegible physician signatures or dates. Other requirements unique to the 

RAs include

• posting notice of billing issues targeted for postpayment review on 

their website,

• reimbursing certain providers for the expense entailed in providing 

requested medical records,47

• making claims reviewers’ credentials available upon provider request,

• providing access to RA staff physicians for discussion of claim denials 

upon provider request, and

• giving providers 40 days to request an opportunity to provide 

additional documentation to the contractor and informally discuss any 

revision prior to having to file an appeal.

 

46RAs’ automated reviews do not count for the ADR limits. 

47RAs performing postpayment reviews of hospital inpatient and long-term care facilities’ 

claims are required to reimburse the providers for photocopying and submitting hard-copy 

documents regardless of the method used to submit the documents. 

CMS Sets More Limits on 

RAs through Review 

Requirements Than on 

Other Contractors Due to 

Experience in the 

Demonstration 
 

Page 22 GAO-13-522 Medicare Contractor Requirements

Table 4: CMS Requirements on Postpayment Reviews Unique to Recovery Audtiors, Compared to Other Contractor Types, as 

of May 7, 2013

Contractor type

Requirement

Medicare 

Administrative 

Contractors

(MAC)

Zone Program 

Integrity 

Contractors

(ZPIC) 

Comprehensive 

Error Rate 

Testing (CERT) 

Contractor

Recovery 

Auditors(RA)

Selection of claims for postpayment review

CMS approval of criteria for selecting billing issues 

prior to widespread use

No No n/a Yes a

Provider notice of issues targeted for review

Provider notice (on website) of billing issues 

targeted for postpayment review

No No b n/a Yes a

Additional documentation requests (ADR)

Provider reimbursement for copies of medical 

records 

No No No In some cases

Limits on number of ADRs contractor can request 

from provider

c

No No No Yes

Reviews

Authority to deny claim for minor omissions Yes Yes Yes No

Provider communication

Provider notification regardless of review outcome No No No Yes

Reviewer’s credentials available upon provider 

request

No No No Yes

Access to contractor’s medical director to discuss 

claim denials upon request

No No No Yes

40 days to discuss any revision to initial 

determination informally prior to having to file an 

appeal

No No d No Yes d

Quality assurance

External validation of randomly selected claims by 

independent contractor

No No No Yes

Legend: n/a = Not applicable

Source: GAO analysis of CMS information on contractor requirements.

a

The CERT contractor does not select claims for review on the basis of billing issues but selects 

claims using stratified random sampling.

b

If a billing issue appears to be widespread and is affecting one type of service, the MACs may post a 

review description on its website or notify affected providers individually.

c

RAs performing postpayment reviews of hospital inpatient and long-term care facilities’ claims are 

required to reimburse the providers for photocopying and submitting hard-copy documents regardless 

of the method used to submit the documents.

d

MACs or the CERT contractor may talk with providers following an adverse determination and agree 

to accept additional documentation, but they must determine that the information is new and material 

to the claim before they can revise a redetermination.
 

Page 23 GAO-13-522 Medicare Contractor Requirements

If the contractor sent the provider an ADR, and the claim is found to be 

proper, RAs are the only type of postpayment review contractor required 

to notify the provider. This means that providers who have sent in 

documentation do not routinely get a definitive answer that a MAC, ZPIC, 

or CERT contractor claim review has been concluded—unless an 

improper payment has been detected. Representatives of three provider 

associations indicated that it was important for financial management 

purposes for providers to be informed when a review was concluded and 

whether or not funds would be recouped.

Representatives of three provider associations indicated if certain RA 

requirements were applied to the other contractors, this could reduce 

administrative burden and improve claims reviews efficiency. For 

example, representatives from one provider association indicated that it is 

valuable to discuss informally any revision to the contractor’s initial claims 

determination prior to providers filing an appeal. When such discussion 

results in providers being able to properly explain their billing, it can 

lessen administrative burden by reducing the number of appeals filed. 

However, according to preliminary CMS data, nearly 20 percent of the 

1.4 million RA claim overpayment determinations were appealed to the 

first level in 2012. Among the appealed overpayment determinations 

about 28 percent were overturned at the first level of appeal by MACs, 

which suggests that providers may not be having such discussions or the 

discussions are not succeeding in resolving issues prior to appeal. Three 

provider associations also indicated that having a limit on the number of 

medical records that could be requested in a given time period helped 

manage the burden of responding to the requests. However, adding such 

limits to contractors other than RAs might limit the number of claims 

reviews these other contractors could conduct.

Many of the other requirements CMS developed for postpayment review 

activities, including documentation submission, staffing, and quality 

assurance, vary across the four contractor types. Some of the differences 

in the contractors’ postpayment claims review requirements can impede 

effectiveness and efficiency of the claims reviews by complicating 

providers’ responses to ADRs or their understanding of claims review 

decisions, according to representatives from three provider associations 

with whom we spoke. According to CMS officials, differences in 

requirements generally developed because the contracts or requirements 

were written at different times by staff within different parts of CMS, or the 

contractors’ functions and activities have changed over time. However, 

some differences were due to other factors, such as cost.

Other Differences in CMS 

Requirements across 

Contractors Can Impede 

Effectiveness and 

Efficiency by Complicating 

Providers’ Responses to 

and Understanding of 

Claims Reviews
 

Page 24 GAO-13-522 Medicare Contractor Requirements

Additional Documentation Requests. Differences in contractors’ 

requirements for sending ADRs and timelines for providers’ responses to 

the contractors are illustrated in table 5. In some cases, in addition to 

reviewing documentation from the provider whose claim is under review, 

the contractor will also need to review documentation from a third party—

such as the provider who referred the beneficiary for the service or item to 

the service provider whose claim is being reviewed. For example, while 

reviewing a claim for an X-ray, the contractor might want to review 

additional documentation from the referring physician, in order to 

determine the medical necessity of the X-ray service. The MACs, ZPICs, 

and RAs have the discretion to send a separate ADR to a third-party 

provider (in the example above, the referring physician) for additional 

documentation to support the medical necessity of the service or supply. 

If the service provider cannot obtain the necessary third-party 

documentation or if the contractor decides that the documentation is 

insufficient to support the claim, the claim will be denied, but not the thirdparty’s claim.

48 The CERT contractor is the only one that is required to 

directly contact the third party for an ADR if the provider being reviewed 

requests it and the claim exceeds $40.49 Four provider associations we 

interviewed indicated that it can sometimes be difficult for the providers 

whose claims were being reviewed to obtain the needed documentation 

from third parties in a timely manner. There is no financial incentive for 

the third parties to forward requested documentation to the service 

providers because the third parties’ claims are not denied as improper if 

the documents are not submitted to the contractor. In the view of four 

provider associations, requiring providers to obtain documentation not 

directly under their own control can hinder their compliance with the ADR, 

because they are sometimes unable to provide the documentation.

 

48This is because the third-party’s claim is not under review.

49Because claims with no documentation are considered improper and contribute to the 

Medicare program’s error rate, the CERT program makes efforts to collect complete 

documentation.
 

Page 25 GAO-13-522 Medicare Contractor Requirements

Table 5: Postpayment Claims Review—Requirements for Additional Documentation Requests, as of May 7, 2013

Contractor type

Requirements for additional 

documentation requests (ADR)

Medicare 

Administrative 

Contractors 

(MAC)

Zone Program 

Integrity 

Contractors

(ZPIC) 

Comprehensive 

Error Rate 

Testing (CERT) 

contractor

Recovery 

Auditors (RA)

If applicable, contact third party (provider who 

referred beneficiary for care) to obtain additional 

documentation

Discretionary Discretionary Yes Discretionary a

Minimum number of days contractor must give

provider to respond to ADR before contractor has 

the authority to deny the claim

45 30 75 45

Number of ADR extensions that must be granted 

to provider

Discretionary Discretionary Discretionary 1 

Number of days for contractor to make 

determination after receiving documentation

60 Not specified Not specified 60

Source: GAO analysis of CMS documentation of contractor requirements.

a

Providers have 30 days to respond to an ADR sent by a ZPIC, 45 days to 

respond to an ADR sent by a MAC or RA, and 75 days to respond to an 

ADR sent by the CERT contractor. If the provider does not respond within 

the required time frame, the contractor may find the payment improper 

and refer the claim for recovery. MACs, ZPICs, and the CERT contractor 

also have discretion in setting the number of extensions, if any, whereas 

CMS requires RAs to give providers one extension.

The CERT documentation contractor will send a notice to third parties whenever a claim involving 

third parties is selected for CERT review. At the billing provider’s request, the CERT documentation 

contractor will send an ADR to the referring third party, for claims valued over $40.

50 All of the 

contractors have discretion on setting the length of extensions. 

Representatives from two provider associations stated that having 

different timeframes makes responding to ADRs more challenging. In 

addition, ensuring consistency in common processes is consistent with 

OMB guidance on streamlining service delivery and a strong control 

environment.

 

50CMS officials told us that, in practice, RAs give providers as much time as they need 

and the CERT contractor may also extend the time period so as not to unnecessarily deny 

the claim for lack of documentation. However, the CERT contractor is constrained by its 

schedule to estimate the annual Medicare improper payment rate.
 

Page 26 GAO-13-522 Medicare Contractor Requirements

Submission Requirements. Different types of contractors are subject to 

different requirements regarding the formats in which they will accept 

providers’ documentation, whether paper, fax, or electronic submission 

(see table 6). While RAs and the CERT contractor are required to accept 

submission of files stored electronically on compact discs or digital video 

discs (DVD), the other contractors are not. CMS has developed a system 

called electronic submission of medical documentation (esMD) for 

providers to transmit medical documentation electronically, which began 

to be adopted by contractors in 2011.51 Though its use is discretionary, 

most of the MACs, all of the RAs, the CERT contractor, and about onethird of ZPICs accept electronic submissions through esMD.52

Table 6: Postpayment Claims Review—Submission Requirements by Contractor Type, as of May 7, 2013

One 

provider association indicated that having all contractors accept electronic 

submissions, such as submissions of e-documents on compact discs and 

DVDs could reduce the administrative burden on providers. Further, 

making electronic submission acceptable across all contractors would be 

consistent with OMB guidance on streamlining service delivery.

Contractor type

Requirements and contractor 

options for accepting 

provider-submitted documentation

Medicare 

Administrative 

Contractors (MAC)

Zone Program 

Integrity 

Contractors (ZPIC) 

Comprehensive 

Error Rate Testing 

(CERT) contractor

Recovery 

Auditors (RA)

Paper Time Time Time Time

Fax Discretionary Not specified Yes Yes

Compact disc / digital video disc (DVD) Discretionary Not specified Yes Yes

Electronic submission of medical 

documentation (esMD)

Discretionary Discretionary Discretionary Discretionary

Source: GAO analysis of CMS documentation of contractor requirements.

 

51CMS officials indicated that many of the contractors have web portals, some of which 

allow providers to submit documentation, but having such a portal is not a requirement.

52As of April 17, 2013, the following providers cannot use esMD to respond to requests for 

additional documentation from their MACs or legacy fiscal intermediaries, carrier, or 

regional home health intermediaries: (1) home health agencies and hospice providers in 

all 50 states, and (2) Part A and B providers in California, Hawaii, Illinois, Minnesota, 

Nevada, and Wisconsin. In addition, all Medicare FFS providers in 46 states cannot use 

esMD to respond to requests for additional documentation from their ZPICs or PSCs; the 

exceptions are California, Hawaii, Nevada, and Florida.
 

Page 27 GAO-13-522 Medicare Contractor Requirements

Staffing requirements. CMS requirements for staffing, including claims 

reviewers’ qualifications, vary depending on the type of contractor (see 

table 7). CMS specifies the minimum number of physicians serving as 

medical directors that each contractor must have on staff. The minimum 

number of medical directors and their responsibilities vary for each of the 

four types of contractors. CMS requires that medical directors serve as a 

readily available source of medical expertise to provide guidance on 

claims reviews for all of the contactors, but their scopes of responsibility 

vary across contractors. This could lead to differences in the number of 

medical directors needed. For example, the MAC medical directors are 

also responsible for oversight of prepayment review, providing provider 

outreach and education, developing local coverage policy, and 

representing the contractor in appeals. In contrast, while the RA medical 

directors do not have some of the other responsibilities of the MAC 

medical directors, they have much larger geographic jurisdictions than 

MACs. Requirements for the minimum number of medical directors 

include the following:

• A/B MACs must have at least three full-time equivalent (FTE) medical 

directors on staff,

• RAs are required to have one FTE medical director on staff, 

• ZPICs are required to have at least one part-time medical director, 

and

• the CERT contractor is required to have two FTE medical directors.

Given the variability of the medical directors’ responsibilities and the 

differing sizes of their jurisdictions, direct comparisons cannot be made 

across the contractors to determine the number of medical directors 

needed. CMS officials acknowledged differences in staffing requirements 

across contractor types, and differences in expectations for the roles of 

medical directors. CMS officials also indicated that they have not required 

similar numbers of medical directors or required a certain number of 

medical directors to be responsible for oversight of a specific number of 
 

Page 28 GAO-13-522 Medicare Contractor Requirements

claims reviews because of cost issues.53

Table 7: Postpayment Claims Review Staffing Requirements by Contractor Type, as of May 7, 2013

When asked about the 

differences, CMS officials indicated that they do not want to incur 

additional costs that could be involved in establishing consistent minimum 

staffing requirements for conducting claims reviews, if that would increase 

the number of medical directors that contractors would have to hire.

Contractor type

Staffing requirements

Medicare 

Administrative 

Contractors (MAC)

Zone Program 

Integrity 

Contractors (ZPIC)

Comprehensive 

Error Rate Testing 

(CERT) contractor

Recovery 

Auditors (RA)

Number of medical directors 3 FTE 1 PT a 2 FTE 1 FTE

Minimum qualification to determine medical 

necessity

LPN LPN b LPN RN or therapist

Minimum qualification to determine 

compliance with coding

c

No minimum specified No minimum specified d Certified coder Certified coder

Involvement of medical specialist when 

Medicare policy for a given service is not 

clearly articulated

No

e

Yes No No

Legend: FTE = full-time equivalent; PT = part-time; LPN = licensed practical nurse; RN = registered 

nurse

Source: GAO analysis of CMS documentation of contractor requirements.

a

This requirement applies to A/B MAC medical directors, who also have other responsibilities such as 

establishing local coverage determinations and conducting provider education.

b

A/B MACs may use LPNs, but DME MACs are required to have RNs and therapists.

c

The statement of work does not specify what types of therapists are required.

d

The MACs are encouraged to hire certified coders but are not required to do so.

e

Requirements for other staff conducting claims reviews also differ across 

contractors. Specifically, CMS requires RAs to use registered nurses or 

therapists in making determinations of medical necessity, but the others 

CMS defines such cases as “where coverage of an item or service is provided for specified 

indications or circumstances but is not explicitly excluded for others, or where the item or service is 

not mentioned at all in the CMS Manual System, the Medicare contractor is to make the coverage 

decision, in consultation with its medical staff, and with CMS when appropriate, based on the law, 

regulations, rulings and general program instructions.” 

 

53Prior to transitioning to MACs, carriers and fiscal intermediaries had a physician medical 

director for each state in the jurisdiction. CMS reduced the number of medical directors 

required when it contracted with MACs. Reducing the number of medical directors 

required at MACs allowed CMS to reduce the funding that had to be budgeted for medical 

director positions.
 

Page 29 GAO-13-522 Medicare Contractor Requirements

may use licensed practical nurses.54 CMS also requires RAs and the 

CERT contractor to employ certified coders to determine compliance with 

Medicare coding requirements, but does not require MACs or ZPICs to do 

so.55 CMS has a requirement for ZPICs, that when Medicare policy for a 

given service is not clearly articulated, the ZPICs must involve a medical 

specialist trained and experienced in providing the type of service being 

reviewed.56 There is no similar requirement for the other contractors.57

Quality assurance requirements. While CMS requires QA processes to 

ensure the quality of claims reviews, the requirements differ by contractor 

type (see table 8). GAO’s Internal Control Management and Evaluation 

Tool states that monitoring (such as the monitoring carried out with QA 

processes) should be conducted to assess performance and determine 

whether controls (such as claims reviews) continue to be effective.

CMS officials indicated that making claims reviewers’ staffing 

requirements more consistent could increase the cost of claims reviews—

for example that requiring A/B MACs and ZPICs to hire RNs instead of 

LPNs to conduct claims reviews would likely increase the contract costs. 

Representatives from six provider associations indicated that on the basis 

of some of the claims review results, their members had questioned 

whether some reviewers were qualified to review claims, and several 

associations indicated that erroneous claims reviews led to appeals that 

would not have been needed had the determination been correct.

58

 

54Licensed practical nurses (LPN), sometimes also known as licensed vocational nurses 

have a 1-year degree and are licensed by the state. Registered nurses (RN) have at least 

a 2-year degree and are also licensed by the state. CMS officials stated that MACs and 

ZPICs often use RNs as claims reviewers, even if it is not required.

55CMS officials told us that, in practice, most MACs and ZPICs use RNs certified coders to 

determine compliance with coding. Coders are certified by independent entities that 

designate that these individuals have received training on appropriate use of diagnostic 

and procedure codes.

56CMS defines such cases as “where coverage of an item or service is provided for 

specified indications or circumstances but is not explicitly excluded for others, or where 

the item or service is not mentioned at all in the CMS Manual System, the Medicare 

contractor is to make the coverage decision, in consultation with its medical staff, and with 

CMS when appropriate, based on the law, regulations, rulings and general program 

instructions.” 

57Although not a requirement, CMS officials also stated that MACs and RAs involved 

medical specialists when specialty knowledge is needed for a determination.

58See GAO/AIMD-00-21.3.1 and GAO-01-1008G. 
 

Page 30 GAO-13-522 Medicare Contractor Requirements

Providers have questioned the quality of contractors’ decision making—

specifically that the contractors are not consistently making proper 

determinations that appropriately apply Medicare coverage, coding, and 

payment rules in evaluating the claims. Having effective QA processes 

can help ensure that claims determinations are made properly and 

consistently—which is part of having strong internal controls. When asked 

about the reason for differences among specific requirements for QA 

processes for different contractors, CMS officials responded that different 

offices in CMS were responsible for the contract specifications and 

contractor management and the contracts were written at different times 

and therefore vary.

Table 8: Postpayment Claims Review—Quality Assurance Requirements by Contractor Type, as of May 7, 2013

Contractor type

Quality assurance requirements

Medicare 

Administrative 

Contractors (MAC)

Zone Program 

Integrity 

Contractors (ZPIC)

Comprehensive 

Error Rate Testing 

(CERT) contractor

Recovery 

Auditors (RA)

Interrater reliability testing of claims reviewers Yes Yes Yes No

Annual clinical judgment training Yes Yes Yes No

Internal secondary reviews prior to revising 

determination

No No Yes No

External validation of revised claims No No No Yes

Source: GAO analysis of CMS documentation of contractor requirements.

With regard to internal QA processes, CMS requires that the MACs, 

ZPICs, and CERT contractor conduct interrater reliability testing and 

participate in annual clinical judgment training in support of postpayment 

claims review determinations. CMS also requires that the CERT 

contractor’s QA process include internal secondary reviews of any claim 

that was determined improper and internal interrater reliability testing.

CMS does not require the RAs to conduct interrater reliability testing or 

participate in clinical judgment training. Each contractor type is also 

required to have an internal QA plan, but CMS does not require any 

specific QA steps regarding consistency and quality of postpayment 

claims reviews’ determinations in any of the contractors’ plans.

The different types of contractors also have different requirements for 

external QA review processes. While the RAs are not required to have 

some of the internal QA processes, CMS has established an external 

validation process conducted by a different contractor for the RAs’ 

postpayment claims reviews. To validate the claims review 

determinations for each RA on a monthly basis, the RA validation 
 

Page 31 GAO-13-522 Medicare Contractor Requirements

contractor reviews a random sample of 400 claims proportional to the 

provider types that each RA determined had been paid improperly. Unlike 

the RAs, the MACs, ZPICs, and CERT contractor are not subject to 

external validation reviews of their postpayment claims reviews.59

In 2011, CMS established an internal work group known as the Provider 

Burden Reduction Work Group to inventory CMS and contractor activities 

that may create administrative burden for providers, to assess providers’ 

complaints, and identify areas for improving efficiency of processes. As 

part of this effort, CMS officials indicated that they found differences in 

contractor requirements related to claims reviews. As an example, they 

indicated that contractors’ form letters were not standardized; instead 

different types of contractors were required to include different information 

in their form letters. Representatives of two provider associations had 

indicated that having different contractors send out different versions of 

the same type of form letters seemed to be confusing to providers. As of 

November 2012, CMS officials told us that the work group had briefed 

CMS senior management about its work, but this effort was still in 

progress. CMS has not publicly announced the results of the work group’s 

efforts, whether it would make any requirements more consistent, or a 

time frame for any changes. Having less variation in requirements for 

providers would be consistent with OMB guidance on streamlining service 

delivery. Further, internal control standards indicate the importance of 

deciding on corrective actions when needed and setting time frames for 

completing them.

CMS officials told us that they have taken steps to increase provider 

awareness and reduce confusion about the different review contractors 

and their review processes to help providers in complying with review 

efforts. These steps include the following:

• In July 2012, CMS published a 15-page booklet about Medicare claim 

review programs, including claims reviews by MACs, ZPICs, RAs, and 

 

59However as stated earlier, the CERT program annually measures each MAC’s payment 

accuracy.

CMS Has Begun an Effort 

to Examine Whether Its 

Activities Add 

Administrative Burden for 

Providers
 

Page 32 GAO-13-522 Medicare Contractor Requirements

the CERT review contractor on CMS’s website, and the booklet was 

announced in an e-newsletter that providers can sign up to receive.60

• In August 2012, CMS published an interactive map on its website that 

allows the public and providers to identify the MACs, ZPICs, and RAs 

that perform claims reviews in each state.61

• In September 2012, CMS published an update to a chart, the original 

of which was first published in July 2011, to educate providers about 

the definitions and responsibilities of contractors and other entities 

involved in various aspects of Medicare and Medicaid claims 

determinations. The chart explains why providers may need to 

communicate with multiple entities as well as why multiple entities 

may contact the same provider.62

• In January 2013, CMS published a three-page description about the 

Medicare FFS Recovery Audit Program process that includes 

references to other information, such as appeals.63

In addition, CMS officials reported that they are developing web-based 

training about the audits done by its contractors. 

 

60Centers for Medicare & Medicaid Services, “Medicare Claim Review Programs: MR, 

NCCI Edits, MUEs, CERT, and Recovery Audit Program,” Medicare Learning Network

(July 2012), accessed May 14, 2013, http://cms.hhs.gov/Outreach-andEducation/Medicare-Learning-Network-MLN/MLNProducts/MLN-PublicationsItems/CMS1243290.html. 

61Centers for Medicare & Medicaid Services, Provider Compliance Group Interactive Map, 

accessed May 14, 2013, http://www.cms.gov/Research-Statistics-Data-andSystems/Monitoring-Programs/provider-compliance-interactive-map/index.html. 

62Centers for Medicare & Medicaid Services, “Contractor Entities at a Glance: Who May 

Contact You about Specific Centers for Medicare & Medicaid Services (CMS) Activities,” 

Medicare Learning Network (September 2012), accessed May 14, 2013, 

http://cms.hhs.gov/Outreach-and-Education/Medicare-Learning-NetworkMLN/MLNProducts/Downloads/ContractorEntityGuide_ICN906983.pdf. 

63Centers for Medicare & Medicaid Services, “Medicare Fee-for-Service Recovery Audit 

Program Process,” Medicare Learning Network (January 2013), accessed May 14, 2013, 

http://www.cms.gov/Outreach-and-Education/Medicare-Learning-NetworkMLN/MLNProducts/MLN-Publications-Items/ICN908524.html. 
 

Page 33 GAO-13-522 Medicare Contractor Requirements

Differences in CMS’s postpayment claims review requirements for the 

four types of contractors may reduce the efficiency and effectiveness of 

claims reviews by complicating providers’ compliance with the 

requirements. Some of these differences may be appropriate given the 

different functions and responsibilities of the contractors. However, CMS 

officials explained that differences in some requirements came about 

because the contractors’ requirements were developed at different times 

or the contractors’ activities have changed over time. In addition, some of 

these differences could have come about because different types of 

contractors and associated requirements are managed by different parts 

of CMS.

Greater consistency in the claims review requirements across contractors 

may improve the efficiency of postpayment reviews by strengthening the 

control environment, lessening providers’ confusion, and reducing 

administrative burdens. In addition, improving consistency across the 

contractors would be consistent with the Executive Order 13571 on 

Streamlining Service Delivery and Improving Customer Services and 

OMB guidelines for implementing it. Greater consistency could make it 

easier for providers to comply with ADR requests and claims 

requirements. It could also help reduce claims payment error 

determinations based on providers’ inability or failure to provide 

documentation in a timely manner. It might also reduce any 

inconsistencies in making determinations, which can lead to unneeded 

appeals, and might increase providers’ confidence that reviews will also 

be consistent and correct.

In order to improve the efficiency and effectiveness of Medicare program 

integrity efforts and simplify compliance for providers, we are making 

three recommendations. We recommend that the Administrator of CMS:

1. examine all postpayment review requirements for contractors to 

determine those that could be made more consistent without negative 

effects on program integrity,

2. communicate publicly CMS’s findings and its time frame for taking 

further action, and

3. reduce differences in postpayment review requirements where it can 

be done without impeding the efficiency of its efforts to reduce 

improper payments.

Conclusions 

Recommendations for 

Executive Action
 

Page 34 GAO-13-522 Medicare Contractor Requirements

We provided a draft of this report to HHS for comment, and received 

written comments, which are reprinted in appendix II. In its comments, 

HHS concurred with our three recommendations and agreed to take steps 

to reduce differences in postpayment review requirements where 

appropriate. HHS noted that CMS had begun to examine its requirements 

for postpayment claims reviews as discussed in our report.HHS stated 

that it is currently examining requirements related to ADRs to see if the 

requirements could be standardized across contractor types. HHS 

indicated that standardizing the minimum number of days a contractor 

must give a provider to respond to an ADR before the contractor has the 

authority to deny the claim could help minimize provider confusion. HHS 

also agreed to publicly communicate its findings from the review of the 

requirements on CMS’s website and include a timeframe for 

implementing agreed-upon changes in procedures.

As agreed with your offices, unless you publicly announce the contents of 

this report earlier, we plan no further distribution until 30 days from the 

report date. At that time, we will send copies to the Secretary of Health 

and Human Services, the Acting Administrator of CMS, appropriate 

congressional committees, and other interested parties. In addition, the 

report will be available at no charge on the GAO website at 

http://www.gao.gov.

If you or your staff has any questions about this report, please contact me 

at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. GAO staff that made key contributions to this report were: 

Sheila K. Avruch, Assistant Director; Carrie Davidson; Leslie V. Gordon; 

and Laurie Pachter.

Kathleen M. King

Director, Health Care

Agency Comments 

and Our Evaluation
Page 35 GAO-13-522 Medicare Contractor Requirements

List of Requesters

The Honorable Max Baucus

Chairman

The Honorable Orrin G. Hatch

Ranking Member

Committee on Finance

United States Senate

The Honorable Tom Carper

Chairman

The Honorable Tom Coburn, M.D.

Ranking Member

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Chuck Grassley

Ranking Member

Committee on the Judiciary

United States Senate

The Honorable Claire McCaskill

Chairman

Subcommittee on Financial and Contracting Oversight

Committee on Homeland Security and Governmental Affairs

United States Senate

The Honorable Bob Corker

United States Senate

The Honorable Fred Upton

Chairman

The Honorable Henry Waxman

Ranking Member

Committee on Energy and Commerce

House of Representatives
Page 36 GAO-13-522 Medicare Contractor Requirements

The Honorable Charles Boustany, M.D.

Chairman

The Honorable John Lewis

Ranking Member

Subcommittee on Oversight

Committee on Ways and Means

House of Representatives

The Honorable Diana DeGette

Ranking Member 

Subcommittee on Oversight and Investigations

Committee on Energy and Commerce

House of Representatives
Appendix I: List of Provider Associations GAO 

Interviewed

Page 37 GAO-13-522 Medicare Contractor Requirements

American Association for Homecare

American College of Radiology and Radiology Business 

 Management Association

American Health Care Association

American Hospital Association

American Medical Association

Association of Academic Health Centers

Association of American Medical Colleges

LeadingAge

Medical Group Management Association

National Association for Home Care & Hospice

National Association for Medical Direction of Respiratory Care

Orthotics and Prosthetics Alliance

Visiting Nurse Associations of America

Appendix I: List of Provider Associations 

GAO Interviewed
Appendix II: Comments from the Department 

of Health and Human Services

Page 38 GAO-13-522 Medicare Contractor Requirements

Appendix II: Comments from the Department 

of Health and Human Services
Appendix II: Comments from the Department 

of Health and Human Services

Page 39 GAO-13-522 Medicare Contractor Requirements
Related GAO Products

Page 40 GAO-13-522 Medicare Contractor Requirements

GAO’s 2013 High-Risk Update: Medicare and Medicaid. GAO-13-433T. 

Washington, D.C.: February 27, 2013.

Medicare Program Integrity: Greater Prepayment Control Efforts Could 

Increase Savings and Better Ensure Proper Payment. GAO-13-102. 

Washington, D.C.: November 13, 2012.

Medicare Fraud Prevention: CMS Has Implemented a Predictive 

Analytics System, but Needs to Define Measures to Determine Its 

Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012.

Program Integrity: Further Action Needed to Address Vulnerabilities in 

Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.: 

June 7, 2012.

Medicare Integrity Program: CMS Used Increased Funding for New 

Activities but Could Improve Measurement of Program Effectiveness. 

GAO-11-592. Washington, D.C.: July 29, 2011.

Improper Payments: Reported Medicare Estimates and Key Remediation 

Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011.

Fraud Detection Systems: Centers for Medicare and Medicaid Services 

Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: 

June 30, 2011.

Improper Payments: Recent Efforts to Address Improper Payments and 

Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.

Status of Fiscal Year 2010 Federal Improper Payments Reporting. 

GAO-11-443R. Washington, D.C.: March 25, 2011.

Medicare and Medicaid Fraud, Waste, and Abuse: Effective 

Implementation of Recent Laws and Agency Actions Could Help Reduce 

Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.

Medicare: Program Remains at High Risk Because of Continuing 

Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 

2011.

Related GAO Products
Related GAO Products

Page 41 GAO-13-522 Medicare Contractor Requirements

Medicare Recovery Audit Contracting: Weaknesses Remain in 

Addressing Vulnerabilities to Improper Payments, Although 

Improvements Made to Contractor Oversight. GAO-10-143. 

Washington, D.C.: March 31, 2010.

Medicare Contracting Reform: Agency Has Made Progress with 

Implementation, but Contractors Have Not Met All Performance 

Standards. GAO-10-71. Washington, D.C.: March 25, 2010.

(291074)
The Government Accountability Office, the audit, evaluation, and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and 

policies; and provides analyses, recommendations, and other assistance 

to help Congress make informed oversight, policy, and funding decisions. 

GAO’s commitment to good government is reflected in its core values of 

accountability, integrity, and reliability.

The fastest and easiest way to obtain copies of GAO documents at no 

cost is through GAO’s website (http://www.gao.gov). Each weekday 

afternoon, GAO posts on its website newly released reports, testimony, 

and correspondence. To have GAO e-mail you a list of newly posted 

products, go to http://www.gao.gov and select “E-mail Updates.”

The price of each GAO publication reflects GAO’s actual cost of 

production and distribution and depends on the number of pages in the 

publication and whether the publication is printed in color or black and 

white. Pricing and ordering information is posted on GAO’s website, 

http://www.gao.gov/ordering.htm. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 

TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 

MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO on Facebook, Flickr, Twitter, and YouTube. 

Subscribe to our RSS Feeds or E-mail Updates. Listen to our Podcasts. 

Visit GAO on the web at www.gao.gov. 

Contact:

Website: http://www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470

Katherine Siggerud, Managing Director, siggerudk@gao.gov, (202) 512-

4400, U.S. Government Accountability Office, 441 G Street NW, Room 

7125, Washington, DC 20548

Chuck Young, Managing Director, youngc1@gao.gov, (202) 512-4800

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, DC 20548

GAO’s Mission

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Phone

Connect with GAO

To Report Fraud, 

Waste, and Abuse in 

Federal Programs

Congressional 

Relations 

Public Affairs

Please Print on Recycled Paper.