Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies
Published: 2007-01-31T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Centers for Medicare & Medicaid Services (CMS)--the agency that administers Medicare--estimated that the program made about $700 million in improper payments for durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) from April 1, 2005, through March 31, 2006. To protect Medicare from improper DMEPOS payments, CMS relies on three Program Safeguard Contractors (PSC), and four contractors that process Medicare claims, to conduct critical program integrity activities. GAO was requested to examine CMS's and CMS's contractors' activities to prevent and minimize improper payments for DMEPOS, and describe CMS's oversight of PSC program integrity activities. To do this, GAO analyzed DMEPOS claims data by supplier and item to identify atypical, or large, increases in billing; reviewed CMS documents; and conducted interviews with CMS and contractor officials. GAO focused its work on contractors' automated prepayment controls and described related claims analysis functions.
section_title: What GAO Found
paragraphs: To prevent and minimize improper DMEPOS payments, CMS's contractors conduct program integrity activities, which include performing medical reviews of certain claims before they are paid to determine whether the items meet criteria for Medicare coverage. As part of their efforts, CMS's contractors responsible for medical review use automated prepayment controls to deny claims that should not be paid or identify claims that should be reviewed. However, GAO found three shortfalls in these automated prepayment controls that make the Medicare program vulnerable to improper payments. (1) Contractors responsible for medical review did not have automated prepayment controls in place to identify questionable claims that are part of an atypically rapid increase in billing. (2) In some instances, these contractors did not have automated prepayment controls in place to identify claims for items unlikely to be prescribed in the course of routine quality medical care. CMS has recently begun an initiative to add controls of this kind for some DMEPOS items. (3) CMS does not require these contractors to share information on the most effective automated prepayment controls of the other contractors or consider adopting them. For example, Medicare might have saved almost $71 million in less than 2 years if one effective automated prepayment control designed to prevent Medicare from paying for more than one home-use hospital bed per month for a beneficiary, which was used by one of these contractors, had been used by the others. CMS oversees the PSCs' program integrity activities by providing written manuals and contracts to guide their work. As part of its oversight, CMS is implementing an annual contractor performance evaluation process, based on three evaluation tools, to assess each PSC's performance. CMS officials said that the agency will use the results of these evaluations to determine two things: whether to renew a PSC's contract, and whether a PSC may earn award fees--a monetary reward for good performance--in addition to the regular payments it receives under its contract.

section_title: Letter
paragraphs: According to the most recent estimate from the Centers for Medicare &  According to the most recent estimate from the Centers for Medicare &  Medicaid Services (CMS), from April 1, 2005, through March 31, 2006,  Medicaid Services (CMS), from April 1, 2005, through March 31, 2006,  Medicare made about $700 million in improper payments for durable  Medicare made about $700 million in improper payments for durable  medical equipment, prosthetics, orthotics, and supplies (DMEPOS). This  medical equipment, prosthetics, orthotics, and supplies (DMEPOS). Improper Medicare payments drain vital program  in unnecessary cost.designated it as a high-risk program since 1990.
Medicare defines durable medical equipment (DME) as equipment that serves a medical  purpose, can withstand repeated use, is generally not useful in the absence of an illness or  injury, and is appropriate for use in the home. DME includes items such as wheelchairs,  hospital beds, and walkers. Medicare defines prosthetic devices (other than dental) as  devices that are needed to replace a body part or function. Prosthetic devices include  artificial limbs and eyes and cardiac pacemakers. Medicare defines orthotic devices to  include leg, arm, back, and neck braces that provide rigid or semirigid support to weak or  deformed body parts or restrict or eliminate motion in a diseased or injured part of the  body. Medicare-reimbursed supplies are items that are used in conjunction with DME and  are consumed during the use of the equipment—such as drugs used for inhalation  therapy—or items that need to be replaced on a frequent, usually daily, basis—such as  surgical dressings.  42 C.F.R. § 433.304 (2005).
GAO, High-Risk Series: An Update, GAO-05-207 (Washington, D.C.: Jan. 2005).
To prevent or minimize improper payments for DMEPOS, CMS relies on  contractors to conduct program integrity activities in four DMEPOS  regions. CMS has entered into new contracts with three Program  Safeguard Contractors (PSC) to conduct these activities, as of March 1,  2006. The PSCs’ program integrity activities include analyzing data on  submitted and paid claims to identify patterns of improper or atypical  billing; establishing automated prepayment controls to deny claims that  should not be paid or route them for further review; conducting medical  reviews of specific claims to determine if they should be, or should have  been, paid; and carrying out benefit integrity activities—such as  identifying, investigating, and referring to law enforcement any DMEPOS  supplier suspected of submitting fraudulent claims for Medicare payment.  CMS also relies on the efforts of a Durable Medical Equipment Regional  Carrier (DMERC) and Durable Medical Equipment Medicare  Administrative Contractors (DME MAC) to ensure that all needed  information is included on a claim and to collect overpayments.
You asked us to review CMS and its contractors’ activities to address  improper DMEPOS payments. In this report, we (1) discuss CMS’s and its  contractors’ program integrity activities intended to prevent and minimize  improper payments for DMEPOS and (2) describe CMS’s oversight of PSC  program integrity efforts.
To discuss the program integrity activities of CMS and its contractors to  prevent and minimize improper payments for DMEPOS, we reviewed the  automated prepayment controls—also referred to as edits—which  contractors introduce into their payment systems to deny claims or flag  them for medical review, and contractors’ benefit integrity activities. At  the beginning of our review, three DMERCs and a PSC performed these  functions and after March 1, 2006, three PSCs performed them. We  included automated prepayment controls because they are generally the  contractors’ first line of defense for avoiding payment of improper claims,  and we included benefit integrity activities because they allow contractors  to enlist federal law enforcement agencies to act against suppliers who  have defrauded Medicare. We did not evaluate other aspects of medical  review, which can include analysis or examination of claims after  payment, but we discuss these functions in relation to automated  prepayment controls and benefit integrity activities. To review the  adequacy of automated prepayment controls, we analyzed national  Medicare DMEPOS claims data on atypical billing trends—particularly  large increases in billing—by supplier and by item for the first quarter of  2003 through the first quarter of 2005. These data were provided to us by  CMS’s Statistical Analysis Durable Medical Equipment Regional Carrier  (SADMERC)—which is responsible for performing statistical analyses on  DMEPOS billing data to identify potential fraud. We further analyzed  Medicare DMEPOS claims data from five states—California, Florida,  Illinois, New York, and Texas—and examined national claims data for  suppliers and items with atypical billing trends. We assessed the reliability  of the data sets used for these analyses and determined that each one was  sufficiently reliable for the purposes of this report. Further, we  interviewed CMS officials responsible for safeguarding the program, and  contractor staff responsible for conducting program integrity activities in  Regions A, C, and D, including the outgoing DMERCs for Regions C and  D, and the PSCs for Regions A, C, and D. To learn more about the  contractor transitions, we interviewed staff at the DME MAC for Region A,  whose contract was the only DME MAC contract awarded within our  chosen regions at the time of our interviews. We also interviewed officials  from SADMERC, and law enforcement officials—from the Department of  Health and Human Services (HHS) Office of Inspector General (OIG), the  Federal Bureau of Investigation (FBI), and U.S. Attorney’s Offices—that  are responsible for investigating and prosecuting Medicare fraud and  abuse cases. We reviewed relevant CMS documents, such as CMS’s  Medicare Program Integrity Manual (PIM), which provides guidance for  Medicare contractors.
To describe CMS’s oversight of PSC program integrity efforts, we reviewed  the PSCs’ statement of work and task orders outlining their duties, the  PIM, and the evaluation tools that CMS will use to assess PSC  performance. We also interviewed CMS officials about their oversight  activities and efforts to minimize DMEPOS improper payments.   Appendix II includes a more detailed discussion of our scope and  methodology. We performed our work from June 2005 through January  2007 in accordance with generally accepted government auditing  standards.
subsections: section_title: Background
paragraphs: Medicare, which is administered by CMS—an agency within HHS—is the  federal program that helps pay for a variety of health care services and  items on behalf of about 42 million elderly and certain disabled  beneficiaries. Most Medicare beneficiaries participate in Part B, which  helps pay for certain physician, outpatient hospital, laboratory, and other  services; DMEPOS (such as oxygen, wheelchairs, hospital beds, walkers,  orthotics, prosthetics, and surgical dressings); and certain outpatient  drugs. Medicare pays 80 percent of the cost of services and items covered  under Part B, and the beneficiary pays the balance. Beneficiaries typically  obtain DMEPOS items from suppliers, who submit claims to Medicare on  the beneficiaries’ behalf. Suppliers include medical equipment retail  establishments, and also can include outpatient providers, such as  physicians and physical therapists.
DMEPOS suppliers are required by CMS to meet certain standards before  they are authorized to bill Medicare. These standards are intended to  ensure that suppliers engage in legitimate business practices and are  licensed and qualified to provide DMEPOS items and services in the states  in which they operate. CMS contracts with the National Supplier  Clearinghouse (NSC) to screen potential suppliers and enroll those that  comply with CMS standards into the Medicare program. In a previous  report, we found that NSC’s efforts to verify compliance with the  standards were insufficient to ensure that only legitimate and qualified  suppliers could bill Medicare.
subsections: section_title: DMEPOS Claims Processing
paragraphs: DMEPOS claims are handled by CMS contractors who are responsible for  processing and paying claims submitted to Medicare. To do this, they  ensure that all necessary information is included on a claim. Claims  processing contractors are responsible for paying DMEPOS claims and  recouping any payments that have been made in error. Prior to January  2006, CMS contracted with four DMERCs to handle DMEPOS claims  processing activities. Each DMERC was assigned to one of four  geographic regions—Region A, B, C, or D—and was responsible for  processing the DMEPOS claims of Medicare beneficiaries residing within  its region. The Medicare Prescription Drug, Improvement, and  Modernization Act of 2003 included provisions that required CMS to  implement competitive procedures to replace DMERCs with DME MACs.  In January 2006, CMS competitively selected four DME MACs from a pool  of applicants and began to transition DMEPOS claims administration  activities from the DMERCs to DME MACs. In Regions A and B, the  transition of these claims processing activities was completed by July 1,  2006, but bid protests against the selection of the Region C and D DME  MACs delayed transitions in these regions. As a result, claims processing  activities did not transition in Region D until September 30, 2006, and, as  of January 2007, the DMERC in Region C was continuing to process  claims.
section_title: DMEPOS Program Integrity
paragraphs: DMEPOS program integrity activities are designed to protect the Medicare  program from improper payments. These program integrity activities  include medical reviews of claims and benefit integrity efforts.
subsections: section_title: Medical Review
paragraphs: Medical review is the examination of information on a DMEPOS claim, as  well as the examination of any supporting documentation associated with  the claim, to determine if a beneficiary’s medical condition meets  Medicare’s coverage criteria. Medical review can also include data  analyses of submitted and paid DMEPOS claims to identify billing patterns  that may be associated with improper Medicare payments. If medical  review reveals that an overpayment was made to a supplier, the claims  processing contractor that paid the claim is responsible for collecting the  overpayment from the supplier. Medical review findings also help CMS  contractors determine what instruction they may need to provide to  DMEPOS suppliers to inform them about Medicare program rules and  proper DMEPOS billing. Medical review often results from contractors’  use of edits to identify claims that require scrutiny, and it can be  performed before or after payment.
section_title: Benefit Integrity
paragraphs: Benefit integrity is the investigation of suspected fraud and the referral of  suppliers to law enforcement for further investigation and prosecution. In  addition, benefit integrity activities include data analysis of DMEPOS  claims to identify improper billing that may indicate fraud.
Prior to March 1, 2006, all medical review and benefit integrity activities  within Regions B, C, and D were conducted by each region’s DMERC. In  Region A, these activities were conducted by a PSC. As of March 1, 2006,  the PSC in Region A also became responsible for conducting the medical  review and benefit integrity activities for Region B. In Regions C and D,  CMS selected two other PSCs—one for each region—to conduct the  medical review and benefit integrity activities in each respective region.  The PSC for each region is responsible for partnering with its region’s  claims processing contractor when conducting medical review and benefit  integrity activities. By March 1, 2006, the transition of medical review and  benefit integrity activities from the DMERCs to the PSCs was completed.
Table 1 provides a summary of DMEPOS claims processing and program  integrity activities and the associated contractor types for these activities,  as of January 2007.
In addition to the contractors mentioned above, the SADMERC performs  analyses of national data on paid Medicare DMEPOS claims. The  SADMERC develops reports for CMS, CMS contractors, and law  enforcement to identify trends in payment and potential fraud. It often  focuses its analyses by examining a particular DMEPOS item, supplier, or  referring physician, or by analyzing claims in a specific region or other  geographic area.
section_title: CMS’s Program Integrity Activities Could Be Enhanced
paragraphs: Under CMS’s direction, its contractors conduct program integrity  activities, such as developing the automated prepayment controls known  as edits that check claims before payment, and performing benefit  integrity tasks. However, the contractors’ edits fell short in preventing  improper payments from being made. Specifically, the contractors did not  have edits that flagged atypical billing or consistently identified claims that  were medically improbable, and the contractors also did not routinely  share their successful edits with the other contractors. Further, as a key  aspect of the benefit integrity activities, contractors provided case  referrals about suppliers to help law enforcement agencies investigate and  prosecute Medicare fraud. However, law enforcement officials stated that  case referrals would be more useful if they were based on more recent  information.
subsections: section_title: PSCs Identify Atypical Billing Patterns and Use Edits to Address Improper Payments
paragraphs: PSCs in each region analyze data on claims that have been paid in order to  identify potentially improper ones, which can be evidenced by atypical  billing patterns—such as a rapid growth in payments for a particular  DMEPOS item or provider. They also use results from CMS’s annual study  of improperly paid claims to identify items at risk of improper payment in  their respective regions. The PSCs decide on their approach to addressing  potentially improper claims based on the level of their resources and the  scope of the identified problems in their regions. Each PSC’s approach is  detailed in its annual “medical review strategy,” submitted to CMS for  approval. Due to the specific problems identified in each region, the PSCs’  medical review strategies can differ. As part of its strategy, each PSC is  required to design a comprehensive plan detailing how it will address each  problem it identifies, and reduce the rate of errors in claims payment.  PSCs continuously update their strategy as improper payment problems  are resolved and new ones are discovered.
To prevent and minimize improper payments for DMEPOS, PSCs rely on  automated prepayment controls—called edits. Edits automatically check  claims before payment to make sure that they appear to be valid. PSCs are  responsible for developing and implementing a specific type of edit, called  a medical review edit. Medical review edits specifically allow a PSC to  check that an item on a claim appears medically necessary for the  beneficiary under Medicare’s coverage criteria. Medical review edits can  either lead to the automatic denial of an improper claim, or subject a claim  to a manual review. For example, a medical review edit could be  established to automatically deny any claim submitted for specific items  for a beneficiary if it had been determined that the beneficiary’s Medicare  number was used repeatedly on claims from different suppliers for  DMEPOS items that the beneficiary did not need. Alternatively, medical  review edits can flag claims for manual medical review before payment,  which requires that a PSC reviewer examine data on the claim, along with  any related supporting documentation. The reviewer determines whether  to allow the claim to continue through the payment process, obtain more  documentation, or deny the claim.
section_title: Gaps with Medical Review Edits Can Lead to Improper Payments
paragraphs: We identified three gaps in medical review edits that could lead to  improper payments. First, DMERCs and the Region A PSC generally did  not have medical review edits in place to identify claims associated with  atypical billing patterns. Such billing patterns involve rapid or dramatic  increases in the billed amounts of claims. Atypical billing patterns can  involve legitimate claims, when, for example, CMS expands the coverage  rules for an item or service. However, atypical billing patterns have often  been associated with improper claims and payments. Atypical billing  patterns can appear with claims (1) submitted by a particular supplier,   (2) covering a particular DMEPOS item, (3) based on referrals from the  same prescribing physician, (4) submitted on behalf of a particular  beneficiary, or (5) associated with atypical billing that is clustered in a  particular geographic area. The DMERC and PSC officials we interviewed  told us that they did not use medical review edits that would routinely flag  claims that had reached predesignated thresholds—such as ones that  would signal an unusually large increase in payment to a supplier. One  contractor indicated that, depending on the threshold set, introducing  these types of edits could allow too many claims to be flagged for medical  review.
In the absence of threshold edits to avoid paying improper claims  associated with atypical billing patterns, the DMERCs paid claims that  represented large increases over historical billing amounts submitted. For  example, we found that from the first quarter of 2003 through the first  quarter of 2005, 225 suppliers increased their billing to Medicare by  $500,000 and 50 percent from at least one 3-month period to the next. At  least 38 of the 225 suppliers were under criminal investigation during 2004.  In November 2004, the U.S. government won a default civil judgment of  $366 million against 16 of these suppliers. These suppliers had billed for  services not rendered and committed other offenses, and they had been  paid almost $40 million from January 2003 through September 2004. As of  December 2006, DOJ had collected about $738,000 from suppliers involved  in the case. HHS OIG investigators in Miami told us that it was not  uncommon for fraudulent suppliers to close up their businesses at the first  sign of an investigation or to quickly move their Medicare payments out of  their accounts in ways that are difficult to track. By the time law  enforcement can act against fraudulent suppliers, much of the money  gained from Medicare has disappeared and cannot be recouped.
We found that contractors paid claims that were medically improbable  because they did not have edits to flag them. Such claims represent items  unlikely to be prescribed, or unlikely to be prescribed in the quantity  billed, for a beneficiary as part of routine quality care. In conjunction with  the SADMERC, we identified three instances where medically improbable  claims were routinely being paid by Medicare for more than a year. For  example, if a Medicare beneficiary has a foot amputated, that person  would usually need a prosthetic foot for that limb. As a result, the  beneficiary should not also need a brace for a limb that no longer exists.  From October 2002 through March 2005, Medicare paid over $2 million for  beneficiaries’ braces after the program had paid for prosthetics within the  last year for the same beneficiaries’ legs, feet or ankles. (See table 2 for  two other examples.) A SADMERC official told us that the contractors  could develop edits for medically improbable circumstances that could  avoid improper payments.
In recognition of the value of edits to detect medically improbable claims,  CMS has begun a process to have its contractors implement such edits. In  January 2007, the agency plans to introduce 19 edits for DMEPOS items,  albeit not for the items described in table 2. These 19 edits will deny  claims for DMEPOS items if a medically improbable quantity of the item is  listed on the claim for a single beneficiary in one day. The agency plans to  introduce additional edits for more DMEPOS items and other services  later in 2007.
Finally, CMS does not require its contractors to share information on their  edits with contractors in other regions or adopt edits that have been  effective in other contractors’ regions. CMS requires each of its  contractors to develop and maintain its own edits. Contractors are free to  adopt or eliminate edits at their discretion based on such factors as the  effectiveness of an edit in reducing improper payments, the added cost of  implementing and maintaining an edit, and the presence or absence of  other, more costly, improper payments. CMS officials we spoke with told  us that CMS expects contractors to add edits at their own discretion,  based on their resources. CMS maintains a database through which  contractors provide information to the agency on the effectiveness of their  edits. At present, contractors do not have access to other contractors’  information in the database.
Our analysis found that if contractors were to adopt edits that have been  effective in other contractors’ regions, they could likely reduce their  improper payments. For example, in 2005, the DMERC in Region C had an  edit in place to restrict payment for the same or similar types of home-use  hospital beds to one item per month per beneficiary, by automatically  denying any additional claims submitted for these items. Our analysis  identified a potential savings within Region C of $50.7 million from  January 1, 2003, through June 30, 2005. Based on the claims submitted  over this time period in the other three regions, we found that this edit  could have generated an additional savings of up to $70.6 million if it had  been implemented in the other three regions. Overall, our analysis of a  sample of seven edits—selected from a list of automated edits that was  provided in response to our request and included edits estimated to be the  most effective by the contractors that developed them—found that each  contractor had edits that could have denied up to an additional   $74.1 million in claims from January 2003 through June 2005, had all seven  edits been used by each contractor.
section_title: PSC Case Referrals to Law Enforcement Are a Key Aspect of Benefit Integrity Activities
paragraphs: Under their benefit integrity responsibilities, PSCs are expected to identify  and investigate cases of suspected fraud within their regions and refer  these cases to law enforcement for further investigation and prosecution.  A PSC’s investigation can include examining medical and other records  associated with a particular claim or claims, questioning beneficiaries  about whether they received items that were billed, and conducting site  visits to suppliers’ facilities. PSCs also use analysis of claims data to look  for atypical billing patterns and other factors that may indicate fraud, such  as the number of complaints against, or prior investigations of, a supplier.
PSCs are required by CMS to refer cases of suspected fraud to the HHS  OIG for further investigation. PSCs are also required to support law  enforcement’s investigation and prosecution of fraud by providing supplier  and beneficiary information and other relevant case-related data, as  requested by law enforcement entities. Along with these tasks, the PSC  statements of work outline other required activities, including  participating in regular case-related contact with law enforcement,  coordinating and participating in antifraud conferences and related  gatherings, updating a national database maintained by CMS that tracks  Medicare fraud, and providing educational programs for law enforcement  on contractor operations and Medicare issues. Prior to the transfer of  benefit integrity activities to PSCs on March 1, 2006, DMERCs were  responsible for these activities in three of the four regions. In the fourth  region—Region A—a PSC was responsible for these activities prior to this  date.
Our analysis of CMS contractor benefit integrity performance evaluations  from 2001 through 2005—the most recent years for which these  evaluations were available—generally found few serious problems.  According to these evaluations, the PSC in Region A and the DMERCs in  Regions B and C met most or all of CMS’s benefit integrity requirements in  all years, with any problems identified by these evaluations labeled as  “minor.” The DMERC in Region D—which no longer holds this contract— met all benefit integrity requirements in two recent evaluation periods  (which covered October 1, 2003, through May 31, 2004, and October 1,  2004, through April 15, 2005). However, in three earlier evaluation periods  preceding October 1, 2003, CMS found “major” problems relating to the  DMERC’s case referral activities, such as less than timely development of  cases and lack of documentation to support case files.
Despite the PSC’s and DMERCs’ positive evaluations by CMS in recent  years, law enforcement officials we spoke with stated that the contractors  could have done more to support law enforcement activities. For example,  law enforcement officials we interviewed in Miami and Southern  California told us that, while they were satisfied with the quality of  information presented in the case referrals, the case files often pertained  to fraud that had occurred too far in the past to be effectively investigated  by the time the referral was received. The Los Angeles FBI office as well  as the U.S. Attorney’s office responsible for prosecuting Medicare fraud in  the Los Angeles area (Region D) told us that the typical case referral  submitted to the office for prosecution in 2005 related to suspect suppliers  whose peak billing activity occurred during 2003. The Miami FBI office  and the U.S. Attorney’s office responsible for prosecuting Medicare fraud  in the Miami area expressed similar concerns on the timeliness of case  referrals.
Law enforcement officials explained that when case referrals are made  after a supplier is no longer in business, investigating and prosecuting the  suspected fraud is difficult or even impossible because law enforcement  may not be able to locate the company’s owners, its records, or the  Medicare funds it received. Law enforcement officials we interviewed did  not cite a single cause for the delays in contractor referrals. Officials in  Los Angeles attributed the delays to a lack of on-site contractor presence  in the Los Angeles area and on contractor over-emphasis on producing  polished referrals. Officials in Miami attributed the delays to the referral  process itself, citing too many steps in the process, and some officials  were uncertain as to the cause. When we discussed these issues with CMS  officials, however, they did not raise concerns about the DMERCs’ and  PSC’s effectiveness in supporting law enforcement with comprehensive  and timely referrals. On the contrary, the officials we interviewed  expressed satisfaction with the DMERCs’ and PSC’s past performance.
section_title: CMS Oversees PSCs through Various Means, and Is Implementing Annual Evaluations of Program Integrity Activities
paragraphs: CMS has various means of overseeing PSCs’ program integrity efforts. To  establish expectations and guidelines for the PSCs, and to monitor their  program integrity efforts, CMS relies on PSC statements of work, the PIM,  and PSCs’ reports on their activities. The PSC statements of work contain  general information about the agency’s expectations for the PSCs,  including a list of deliverables that each one is required to provide to CMS.  The PIM establishes the requirements and guidance that the PSCs must  follow when conducting their program integrity activities. In addition,  CMS staff monitor the PSCs’ reports about their activities. Examples of  these reports include updated medical review strategies and updates about  the types of information requested by law enforcement for its use in  investigating and prosecuting suppliers. After reviewing a contractor’s  reports, CMS may suggest changes to a PSC, such as adjustments to its  medical review strategy.
In addition, CMS has developed plans for annually evaluating the PSCs’  program integrity activities and is in the process of implementing these  evaluations. CMS has developed three evaluation tools to assess each  PSC’s (1) general performance, (2) performance in conducting medical  review, and (3) performance in conducting benefit integrity activities. The  criteria used in each of the three evaluation tools reflect the  responsibilities described in the PIM and the PSCs’ statements of work. In  May and June of 2006, CMS conducted an initial evaluation of the first  several months of the three PSCs’ work, using the general performance  evaluation tool. In May and June of 2007, CMS will conduct the first of a  planned annual, comprehensive, full-year evaluation of each PSC,  including assessments of its medical review and benefit integrity efforts.  CMS officials said that the agency will use the results to decide whether to  renew a PSC’s contract. The officials also said that CMS will use these  results to determine whether a PSC may earn award fees—a monetary  performance reward for good performance—in addition to the regular  payments it receives under its contract.
The general performance evaluation tool is intended to assess the PSCs in  four overall areas: (1) the quality of their work and work products;   (2) their success in completing their work within an agreed upon budget;  (3) their ability to provide work products on time; and (4) their ability to  develop and maintain productive business relationships with law  enforcement and suppliers.
The medical review evaluation tool is intended to assess PSC performance  in reviewing claims before and after payment. For example, the tool is  designed to assess the degree to which a PSC reviewed claims in  accordance with the medical review strategy that the PSC established for  that year, and that had been approved by CMS. The tool also is intended to  verify the accuracy of medical review for each PSC by using a sample of  five claims that had received medical review from the respective PSC.  CMS officials told us that they are currently in the process of determining  whether a broader measure of a region’s improper payments will be  reflected in the evaluations of PSC performance in the future.
The benefit integrity evaluation tool is intended to assess a PSC’s  investigations of suppliers suspected of fraud, development of supplier  case referrals for the HHS OIG, and assistance to law enforcement. For  instance, the benefit integrity evaluation tool requires evaluators to assess  whether a PSC maintains a documented audit trail of the actions it has  taken for each supplier investigation initiated. It also requires an  assessment of whether a PSC’s case referrals to the HHS OIG include all of  the elements for law enforcement to pursue an investigation.
section_title: Conclusions
paragraphs: When CMS and its contractors fall short in protecting the Medicare  program, hundreds of millions of dollars can be lost to improper payments  for DMEPOS. The agency and its contractors conduct a number of  program integrity activities designed to prevent and minimize improper  payments for DMEPOS. However, we found that CMS’s contractors did not  have sufficient automated prepayment controls to flag claims that are part  of unexplained increases in billing, or that were medically improbable.  Currently, the PSCs and DME MACs are not required to exchange  information about their successful automated prepayment controls that  could be effective in other regions. While PSCs have the flexibility to  implement prepayment controls that they consider to be the most effective  for their region, knowing about effective controls in other regions could  provide useful information when developing their own. CMS’s recent  initiative to add automated prepayment controls that would deny certain  medically improbable claims is a positive step towards reducing improper  DMEPOS payments.
section_title: Recommendations for Executive Action
paragraphs: We recommend that the Administrator of CMS take two actions:    Require the PSCs to develop thresholds for unexplained increases in  billing—and use them to develop automated prepayment controls as one  component of their manual medical review strategies.
Require the DME MACs, DMERC, and PSCs to exchange information on  their automated prepayment controls, and have each of these contractors  consider whether the automated prepayment controls developed by the  others could reduce their incidence of improper payments.
section_title: Agency Comments
paragraphs: CMS provided comments on a draft of this report, agreed with both of our  recommendations, and stated that it has begun efforts to address them.  Specifically, CMS agreed with our recommendation to require PSCs to  develop thresholds for unexplained increases in billing and use them in  developing their automated prepayment controls. CMS responded that it  would build upon existing PSC processes for identifying billing increases  and would work to improve contractors’ automated prepayment controls.  CMS also discussed a related initiative it has begun to automatically deny  or automatically suspend payment for services billed in excess of  medically probable amounts. CMS stated that this initiative will address  some of the issues that we raised in our report. We consider this initiative  to be one important aspect of preventing improper payments for DMEPOS.
CMS also agreed with our recommendation to require the DME MACs,  DMERC, and PSCs to exchange information on their automated  prepayment controls and to have each of these contractors consider  whether the controls developed by the others could reduce their incidence  of improper payments. CMS responded that these contractors’ Joint  Operating Agreements (JOA) provide a means through which information  can be shared among them, and stated that it believes the contractors are  currently coordinating their automated prepayment control processes.  CMS also said it would review the JOAs to ensure that information-sharing  requirements are clear and are being followed by the contractors. This  would be a good first step towards ensuring that information sharing  occurs and that the contractors are considering the prepayment controls  of other contractors when developing their own prepayment controls.
CMS’s comments appear in appendix III.
We provided DOJ with a draft of this report for its review. DOJ provided  us with technical comments, which we incorporated as appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  date. We will then send a copy of this report to the Secretary of HHS, the  Administrator of CMS, and the Attorney General, appropriate  congressional committees, and other interested parties. We will also make  copies available to others upon request. This report also will be available  at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (312) 220-7600 or aronovitzl@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix IV.
section_title: Appendix I: DMEPOS Regions and Associated DME MACs and PSCs
paragraphs: U.S.
Reion A - DME MAC: Ntionl Heritge Insunce Compny; PSC: TriCentrion, LLC Reion B - DME MAC: AdminaSr Federl, Inc.; PSC: TriCentrion, LLC Reion C - DME MAC: To nnonced; PSC: TrusSoltion, LLC Reion D - DME MAC: Noridin Adminitrtive Service, LLC; PSC: Electronic D Stem Corp.
section_title: Appendix II: Scope and Methodology
paragraphs: To discuss the program integrity activities of the Centers for Medicare &  Medicaid Services (CMS) and its contractors to prevent and minimize  improper payments made for durable medical equipment, prosthetics,  orthotics, and supplies (DMEPOS), we reviewed aspects of the  contractors’ medical review and benefit integrity responsibilities. We  reviewed the automated prepayment controls—called edits—that  contractors introduce into their payment systems to deny claims or flag  them for medical review, and contractors’ benefit integrity activities. We  included edits because they are generally the contractors’ first line of  defense for avoiding payment of improper claims. We did not evaluate  other aspects of medical review, which can include analysis or  examination of claims after payment, but we discuss these functions in  relation to automated prepayment controls and benefit integrity activities.  We also included benefit integrity efforts—such as referring potential  cases to law enforcement—because these efforts allow contractors to  enlist federal law enforcement agencies to act against suppliers who have  defrauded Medicare. As part of our work, we reviewed related GAO  reports and CMS’s Medicare Program Integrity Manual (PIM), which  establishes CMS’s guidelines for contractors’ program integrity activities.  We also conducted interviews with CMS officials responsible for  safeguarding Medicare, as well as contractor officials responsible for  program integrity activities in three of the four DMEPOS regions—  Regions A, C, and D. These contractor officials included staff at the  outgoing Durable Medical Equipment Regional Carriers (DMERC) for  Regions C and D, and the incoming Program Safeguard Contractors (PSC)  for Regions A, C, and D. We interviewed staff at the incoming Durable  Medical Equipment Medicare Administrative Contractor (DME MAC) for  Region A, which had the only DME MAC contract within our selected  regions that had been implemented at the time of our interviews. We also  interviewed contractor staff at the Statistical Analysis Durable Medical  Equipment Regional Carrier (SADMERC)—a contractor which is  responsible for performing statistical analyses on national and regional  DMEPOS billing data to identify potential fraud.
In order to specifically review edits, we analyzed national Medicare  DMEPOS claims data on atypical billing trends for suppliers and items for  the first quarter of 2003 through the first quarter of 2005 generated by  SADMERC. We performed further analyses on individual Medicare  DMEPOS claims data from the first quarter of 2003 through the second  quarter of 2005 from five states—California, Florida, Illinois, New York,  and Texas. We also obtained data from the National Supplier  Clearinghouse (NSC)—a contractor which is responsible for enrolling  suppliers in Medicare and revoking the billing privileges of suppliers who  do not comply with program guidelines. We used the NSC data to obtain  information on the geographic location of the suppliers’ companies, such  as by zip code and state, and to inform us as to whether the Medicare  billing privileges of certain suppliers were considered by the NSC to be  active, inactive, or revoked, as of October 3, 2005. In addition, we used  other analyses performed by SADMERC on national DMEPOS claims data  to simulate how many dollars might have been saved for periods of time  from 2002 through 2005 by adding certain edits into the payment system to  identify potential improper payments. We assessed the reliability of the  data sets used for these analyses by reviewing documentation related to  each data set, and we determined that each was sufficiently reliable to  address the issues in this report.
In order to specifically describe contractors’ benefit integrity efforts, we  interviewed law enforcement officials on both the national and local levels  who are responsible for investigating and prosecuting such cases, and for  coordinating their efforts with the CMS contractors. The officials we  interviewed included those from Department of Health and Human  Services (HHS) Office of Inspector General (OIG), who receive suspected  fraud cases from Medicare contractors and may opt to investigate the  cases further; the Federal Bureau of Investigation (FBI), which may opt to  assist in the investigation of Medicare fraud cases or open an independent  investigation on cases for which the HHS OIG has decided not to open an  investigation; and U.S. Attorney’s offices, which are responsible for the  prosecution of Medicare fraud cases. In addition to interviewing  headquarters officials from these organizations, we also interviewed local  law enforcement officials from these agencies in Los Angeles, California;  Miami, Florida; and New York City, New York.
To describe CMS’s oversight of its PSCs’ program integrity efforts, we  reviewed the PIM, and the PSCs’ statements of work, which describe the  terms of the PSC contracts. We also read CMS’s PSC performance  evaluation tools, and interviewed CMS officials about PSC oversight. In  addition, we interviewed PSC contractors about CMS’s oversight of its  PSCs. We performed our work from June 2005 through January 2007 in  accordance with generally accepted government auditing standards.
section_title: Appendix III: Agency Comments
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: Acknowledgments
paragraphs: In addition to the contact named above, Sheila K. Avruch, Assistant  Director; Ramsey L. Asaly; Kevin Dietz; Krister P. Friday; Kelli A. Jones;  Joy L. Kraybill; Suzanne M. Post; and Craig Winslow made key  contributions to this report.
section_title: Related GAO Products
paragraphs: Medicare Integrity Program: Agency Approach for Allocating Funds  Should Be Revised. GAO-06-813. Washington, D.C.: September 6, 2006.
Medicare Payment: CMS Methodology Adequate to Estimate National  Error Rate. GAO-06-300. Washington, D.C.: March 24, 2006.
Medicare: More Effective Screening and Stronger Enrollment Standards  Needed for Medical Equipment Suppliers. GAO-05-656. Washington, D.C.:  September 22, 2005.
Medicare Contracting Reform: CMS’s Plan Has Gaps and Its Anticipated  Savings Are Uncertain. GAO-05-873. Washington, D.C.: August 17, 2005.
Health Care Fraud and Abuse Control Program: Results of Review of  Annual Reports for Fiscal Years 2002 and 2003. GAO-05-134.  Washington, D.C.: April 29, 2005.
High-Risk Series: An Update. GAO-05-207. Washington, D.C.: January  2005.
Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending  for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004.
Medicare: CMS Did Not Control Rising Power Wheelchair Spending.  GAO-04-716T. Washington, D.C.: April 28, 2004.