Medicare Part D: Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited
Published: 2008-07-21T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) established a voluntary outpatient prescription drug benefit, known as Medicare Part D. The Centers for Medicare & Medicaid Services (CMS) contracts with private companies to serve as Part D sponsors and administer the Part D prescription drug benefit plans. To protect beneficiaries and the fiscal integrity of the program, the MMA requires Part D sponsors to implement programs to control for fraud and abuse in Part D. Subsequent regulations and guidance from CMS contain requirements and recommended measures for these programs. This report examines (1) the extent to which certain Part D sponsors have implemented programs to control fraud, waste, and abuse and (2) the extent of CMS's oversight of Part D sponsors' programs to control fraud, waste, and abuse. GAO conducted on-site reviews of five of the largest Part D sponsors' fraud and abuse programs. GAO also interviewed officials from CMS and reviewed CMS documents.
section_title: What GAO Found
paragraphs: The five Part D sponsors in GAO's review had not completely implemented all of CMS's required compliance plan elements and selected recommended measures for Part D fraud and abuse programs. All Part D sponsors had completely implemented the requirements and selected recommendations for three of the seven required compliance plan elements. However, Part D sponsors varied in their implementation of the remaining required elements and selected recommended measures. CMS oversight of Part D sponsors' fraud and abuse programs has been limited. To date, CMS's activities have been limited to the review and approval of sponsors' fraud and abuse program plans submitted as part of the initial Part D applications. For example, CMS officials reported that they worked with sponsors to help them develop fraud and abuse program plans that met the agency's compliance plan requirements and recommendations specific to fraud and abuse. However, CMS has not conducted oversight to assess Part D sponsors' implementation of fraud and abuse programs. Officials from CMS stated that the agency had not audited sponsors' implementation of fraud and abuse programs in 2007, and as of April 2008, no audits of these programs had been conducted.

section_title: Letter
paragraphs: Medicare Part D provides voluntary, outpatient prescription drug coverage  for eligible individuals 65 years and older and eligible individuals with  disabilities. The Part D program, which began in January 2006, is  administered by the Department of Health and Human Services’ (HHS)  Centers for Medicare & Medicaid Services (CMS). CMS contracts with  private companies—such as health insurance companies and pharmacy  benefit managers—to serve as Part D sponsors and administer the Part D  prescription drug benefit plans. About 24 million individuals were  enrolled in Medicare Part D as of January 2007 and estimated benefit  expenditures were $39 billion in calendar year 2007. We and others have  reported that the size, nature, and complexity of the Part D program make  it a particular risk for fraud, waste, and abuse. The Medicare program as a  whole, including Part D, is vulnerable to fraud, waste, and abuse. Due in  part to this vulnerability, we have designated Medicare as a high risk  program since 1990.
To protect beneficiaries and the fiscal integrity of the Medicare program,  the Medicare Prescription Drug, Improvement, and Modernization Act of  2003 (MMA), which established the Part D program, requires all Part D  sponsors to have programs to safeguard Part D from fraud, waste, and  abuse. Accordingly, on January 28, 2005, CMS issued regulations  requiring that sponsors have a comprehensive compliance plan that  includes a program to control fraud, waste, and abuse. These regulations  established required elements within comprehensive compliance plans. In  April 2006, CMS issued guidance through its Part D Prescription Drug  Benefit Manual; chapter 9 of the Manual contained further interpretation  and guidelines that include recommended measures for how Part D  sponsors should address fraud, waste, and abuse for Part D in each of the  required compliance plan elements. In order to fulfill statutory and  regulatory requirements regarding programs to control fraud, waste, and  abuse, Part D sponsors must develop and implement a compliance plan  detailing their fraud and abuse program. The compliance plan, which must  be approved by CMS, articulates policies, processes, and procedures for  Part D sponsors to detect, correct, and prevent fraud, waste and abuse.  Implementation of a compliance plan includes conducting the activities  described in the plan and developing comprehensive written procedures  for activities referenced in the plan.
CMS’s required compliance plan elements and the related recommended  measures for a fraud and abuse program specific to Part D include the  following:  1.  A sponsor’s compliance plan must include written policies,  procedures, and standards of conduct.  2.  A sponsor’s compliance plan must designate a compliance officer and  a compliance committee that are accountable to senior management.  3.  A sponsor’s compliance plan must include effective training and  education pertaining to fraud, waste, and abuse for the organization’s  employees and contractors. A Part D sponsor may contract some of its  Part D responsibilities to a third party; however, the Part D sponsor is  ultimately responsible for ensuring compliance with required  elements, including those pertaining to education and training.  Contractors include first-tier, downstream, and related entities.  4.  A sponsor’s compliance plan must include effective lines of  communication that should include a confidential or anonymous  mechanism, such as a hotline, to receive compliance questions and  reports of fraud, waste, or abuse.  5.  A sponsor’s compliance plan must have well-publicized disciplinary  guidelines through which sponsors must enforce standards.  6.  A sponsor’s compliance plan must include effective internal  monitoring and auditing procedures which should include the  development and implementation of procedures that are intended to  protect Part D from fraud, waste, and abuse, including monitoring and  auditing of contractors.  7.  A sponsor’s compliance plan must include procedures for ensuring  prompt responses to detected offenses and development of corrective  action initiatives, including responses to potential offenses.
While Medicare Part D is now in its third year of operation, little is known  about the extent to which Part D sponsors have implemented their fraud  and abuse programs or the extent of CMS’s oversight of Part D sponsors’  programs. You asked us to examine the implementation and CMS  oversight of Part D sponsors’ programs to control fraud, waste, and abuse.  Specifically, this report examines (1) the extent to which certain Part D  sponsors implemented programs to control fraud, waste, and abuse and  (2) the extent of CMS’s oversight of Part D sponsors’ programs to control  fraud, waste, and abuse.
To conduct our work, we reviewed relevant laws, regulations, and CMS  guidance to determine the required elements of a comprehensive  compliance plan and recommended measures for a comprehensive fraud  and abuse program. We also interviewed officials from CMS and HHS’s  Office of the Inspector General (OIG), and officials from the Department  of Veterans Affair’s (VA) Office of Compliance and Business Integrity. We  also interviewed industry representatives who were subject-matter experts  to learn more about fraud and abuse programs. In addition, to examine the  extent to which certain Part D sponsors have implemented programs to  control fraud, waste, and abuse, we conducted on-site reviews at five   Part D sponsors. We selected these five sponsors for our review because  they each offered a Part D prescription drug plan that provided nationwide  coverage, varied in enrollment size, and the plans collectively provided  coverage for a sizeable proportion of Part D beneficiaries. (The five  national prescription drug plans selected for our review from these  sponsors represented about 35 percent of total Medicare Part D  enrollment as of April 2007.) Our sample is not generalizable to the entire  Part D sponsor population. Four of the five sponsors we reviewed were  private health insurance companies and one was a pharmacy benefit  manager. During our on-site reviews, we reviewed these sponsors  compliance plans and examined the extent to which the sponsors’  implemented CMS’s seven required compliance plan elements and selected  recommended measures for detecting, correcting and preventing fraud,  waste, and abuse in Part D. We selected recommended measures for our  review based on a variety of factors, such as measures that we judged  were the most helpful to fulfilling the purpose of the requirements. (See  app. I for more-detailed information on our methodology for assessing the  extent to which certain Part D sponsors implemented their fraud and  abuse programs.)
To examine the extent to which CMS oversees Part D sponsors’ programs  to control fraud, waste, and abuse, we interviewed CMS officials from the  Center for Beneficiary Choices (CBC), the lead office for operational  oversight, and the Office of Financial Management (OFM), the lead office  for program and fiscal integrity. We also reviewed documentation from  CMS, including CMS’s Part D oversight strategy, CBC’s program audit  strategies, contracts related to OFM’s Part D program integrity efforts, and  technical assistance provided by CMS that was specific to the fraud and  abuse program requirement.
In conducting our work, we focused on the extent of implementation of  fraud and abuse programs rather than the effectiveness of the programs in  detecting, correcting, and preventing fraud, waste, and abuse. We did not  investigate actual occurrences of fraud, waste, and abuse; however, we did  ask for evidence of reported cases of potential fraud, waste, or abuse that  had been investigated. We conducted this performance audit from October  2006 through June 2008 in accordance with generally accepted  government auditing standards. Those standards require that we plan and  perform the audit to obtain sufficient, appropriate evidence to provide a  reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: In 2003, Congress passed the MMA, which created the Medicare Part D  program. The MMA requires that all Part D sponsors have a program to  control fraud, waste, and abuse. CMS is responsible for safeguarding the  Part D program from fraud, waste, and abuse.
subsections: section_title: The Medicare Part D Program
paragraphs: In 2003, Congress passed the MMA, which created a prescription drug  benefit known as Medicare Part D. Voluntary enrollment in the Medicare  Part D program began November 15, 2005, and the benefit went into effect  January 1, 2006. Although the Medicare Part D program is overseen by  CMS, Part D drug benefit plans are administered by private companies that  apply to CMS to participate in the program. When approved, these private  companies contract with the federal government to be Part D sponsors  and market Part D drug plans directly to Medicare beneficiaries.
section_title: Control of Fraud, Waste, and Abuse in Medicare Part D
paragraphs: The MMA includes a requirement that all Part D sponsors have a program  to control fraud, waste, and abuse in Part D; CMS regulations establish  the requirements for comprehensive compliance plans for Part D plan  sponsors. To guide Part D sponsors in designing a fraud and abuse  program that addressed Part D risks, in April 2006, CMS issued  recommendations for Part D sponsors’ fraud and abuse programs based on  input from various sources, including law enforcement and industry  representatives. The guidance, issued as chapter 9 in the Prescription  Drug Benefit Manual, contains further interpretation and guidelines on the  steps sponsors should take to detect, correct, and prevent fraud, waste,  and abuse in Part D.
CMS required Part D sponsors to have fraud and abuse programs  operational and in effect at the time their Part D contracts were awarded  and expected sponsors to adopt the recommendations in chapter 9 by  January 1, 2007. Table 1 describes the required elements of a  comprehensive compliance plan and selected recommended measures for  addressing fraud, waste, and abuse specific to Part D in each of the  required compliance plan elements.
In the chapter 9 guidance, CMS recommends that Part D sponsors design  their fraud, waste, and abuse programs to safeguard against identified risk  areas and identifies examples of fraud, waste, and abuse risks associated  with Part D stakeholders, including internal and external parties. Internal  parties include Part D sponsors and their employees; external parties  include physicians, pharmacies, and Medicare beneficiaries. Chapter 9 also  states that sponsors’ preexisting fraud and abuse programs should be  focused on controlling fraud by external parties submitting claims to the  sponsor, and stated that Part D sponsors are to identify and address  internal fraud, waste, and abuse by the sponsor and its employees as well.  In chapter 9, CMS also identified examples of potential fraud, waste, and  abuse by Part D sponsors, such as marketing schemes to improperly enroll  Medicare beneficiaries in Part D plans or deliberately using inaccurate  data to receive improper payments from CMS. CMS identified examples of  potential fraud, waste, and abuse by Medicare beneficiaries, such as  beneficiaries misrepresenting their identity to illegally obtain the drug  benefit or engaging in doctor shopping, where a patient seeks  prescriptions from multiple physicians with the intent to abuse or sell  drugs. CMS identified potential examples of fraud, waste, and abuse by  pharmacies, citing improper billing practices, such as billing for  nonexistent prescriptions.
Regulations and the chapter 9 guidance recognize that contractors can be  significant stakeholders in sponsors’ Part D operations. CMS permits   Part D sponsors to use contractors to perform various Part D functions.  However, CMS regulations and chapter 9 state that the Part D sponsor is  ultimately responsible for fulfilling the terms and conditions set out in the  sponsor’s contract with CMS, even if the sponsor delegates a Part D  function to a contractor. In addition, Part D rules establish contractual  obligations for Part D sponsors that delegate tasks to contractors.
section_title: CMS’s Oversight Responsibilities
paragraphs: CMS is responsible for safeguarding the Part D program from fraud, waste,  and abuse, including ensuring sponsors’ compliance with applicable  requirements. While many groups within CMS are responsible for  overseeing different aspects of the Part D program, two divisions provide  oversight of Part D sponsors’ fraud and abuse programs. OFM is the lead  office for program integrity and financial oversight, including  responsibility related to oversight of fraud, waste, and abuse in the Part D  program. OFM developed the chapter 9 guidance for sponsors’ fraud and  abuse programs and is responsible for reviewing and approving fraud and  abuse program plans when organizations first apply to become Part D  sponsors. CBC is the lead office for operational oversight of Part D,  including sponsor management, program audits, and enforcement actions.
OFM and CBC are responsible for conducting audits of Part D sponsors’  compliance with fraud and abuse program requirements. CBC is  responsible for conducting broad Part D program audits that include, but  are not limited to, Part D sponsors’ implementation of their compliance  plans, including fraud and abuse programs. In contrast, OFM is  responsible for financial audits and audits of Part D sponsors’ fraud and  abuse programs. CMS contracted with the MEDICs to support OFM’s  audit, oversight, and antifraud and abuse efforts in Part D.
In October 2005, CMS issued its Oversight Strategy for overseeing Part D  sponsors, particularly with regard to mitigating fraud, waste, and abuse. In  the strategy, CMS noted that in conducting oversight of Part D sponsors  CBC would rely on self-reported, unaudited data provided to CMS by   Part D sponsors. However, in the strategy, CMS also acknowledged that  program audits conducted by CBC would be necessary to ensure  compliance and to document that CMS has fulfilled its program oversight  responsibilities. According to the Oversight Strategy, CBC would follow a  3-year audit cycle that would include both desk audits—reviews of  documents requested from Part D sponsors—and on-site audits covering  all aspects of the Prescription Drug Benefit Manual over the 3 years. In  December 2006, HHS’s OIG conducted a review of Part D sponsors’  compliance plans that found that many Part D sponsors’ compliance plans  did not address all of CMS’s compliance plan requirements, including  fraud and abuse program plans. In response, CMS reported that “CMS will  begin these compliance plan audits in 2007, and sponsors will be  accountable for meeting all requirements.”
OFM’s oversight of Part D sponsors relies on the MEDICs to audit  Medicare Part D fraud and abuse programs. CMS has entered into  contracts under which task orders were issued to three MEDICs to  conduct various activities related to Part D. The first MEDIC began its  work in November 2005, and the other two MEDICs began work in  December 2006. At that time, OFM estimated that the MEDICs would  conduct audits of Part D sponsors’ fraud and abuse programs in the first  years of Part D. In 2005 and 2006, CMS estimated that at least 10 audits of  fraud and abuse programs would be conducted by each of the MEDICs  each year under task orders to be issued under the contract. Specifically,  CMS estimated that the first MEDIC would complete 10 of these audits  during the 2005—2006 contract year and that the three MEDICs would  complete 35 of these audits during the 2006—2007 contract year.
section_title: The Part D Sponsors We Reviewed Had Not Completely Implemented CMS’s Required Elements and Selected Recommended Measures for Part D Fraud and Abuse Programs
paragraphs: The five Part D sponsors we reviewed had not completely implemented all  of CMS’s seven required compliance plan elements and selected  recommended measures for Part D fraud and abuse programs. All Part D  sponsors had the required elements and recommended measures for  written policies, procedures, and standards of conduct (element 1);  effective lines of communication (element 4); and enforcement of  standards through disciplinary guidelines (element 5). However, Part D  sponsors varied in their implementation of the remaining required  elements and selected recommend measures. Table 2 illustrates the  variation in the extent to which the five Part D sponsors implemented the  required elements and selected recommended measures for their fraud  and abuse programs.
subsections: section_title: Written Policies, Procedures, and Standards of Conduct
subsections: section_title: Requirements
paragraphs: All five Part D sponsors we reviewed completely met the requirements for  written policies, procedures, and standards of conduct. All five had the  required written policies, procedures, or the standards of conduct that  articulated a commitment to comply with all applicable federal and state  standards. All three Part D sponsors that relied on a first-tier entity in  carrying out its Part D responsibilities had included provisions in their  contract with the entity requiring compliance with all applicable federal  laws, regulations, and CMS instructions.
section_title: Recommended Measures
paragraphs: All five Part D sponsors completely met the selected recommended  measures by having written policies, procedures, or standards of conduct  that applied to detecting, correcting, and preventing fraud, waste, and  abuse. All five had standards of conduct that were available to employees  on the Part D sponsors’ internal Web sites. In addition, Part D sponsors  reported that information regarding written policies, procedures, or  standards of conduct was disseminated through training or employees had  to sign attestations that they had reviewed and understood the policies, or  both.
section_title: Compliance Officer and Compliance Committee
subsections: section_title: Requirements
paragraphs: Four of the five Part D sponsors completely met the requirements for  having both a compliance officer and compliance committee accountable  to senior management. The remaining Part D sponsor only partially met  the requirement because it did not have a compliance committee. Of the  five Part D sponsors’ compliance officers, three of the compliance officers  had been in that role since the Part D benefit was implemented in January  2006. The other two compliance officers started in their roles during 2007.
All of the Part D compliance committees that existed were overseen by the  compliance officer, were accountable to senior management, and were  responsible for advising the compliance officer on various issues, ranging  from implementing compliance plans to developing their Part D  operations. For example, one Part D compliance committee was involved  in monitoring the implementation of the activities outlined in the  compliance plan, providing regular reports to senior management, and  providing input on training. Another Part D sponsor used its corporate  compliance committee instead of a separate Part D compliance committee  to address Part D issues; a formal Part D compliance committee had not  been implemented. The corporate compliance committee meetings  included senior executives and the Part D compliance officer.
section_title: Recommended Measures
paragraphs: Three Part D sponsors completely met the selected recommended  measures for a compliance officer and committee. Two Part D sponsors  partially met the recommended measures. Of these, one sponsor’s  compliance officer did not report to senior management on at least a  quarterly basis. The compliance officer from this Part D sponsor stated  that he or she did not report regularly to senior management because the  Part D sponsor had yet to have any cases that were determined to be  fraud, waste, or abuse. The remaining Part D sponsor’s compliance  committee did not meet on at least a quarterly basis.
All five Part D compliance officers were responsible for overseeing and  monitoring the implementation and maintenance of fraud and abuse  programs, as recommended. The range of activities and responsibilities for  the Part D compliance officers varied. Two compliance officers were  directly involved in fraud and abuse program activities, while the other  three delegated those responsibilities to other staff, or some components  of their role were a function of another department or were delegated to a  contractor. For example, one compliance officer was involved in decisions  regarding fraud, waste, and abuse investigations and corrective actions,  while another compliance officer delegated this responsibility.
section_title: Effective Training and Education
subsections: section_title: Requirements
paragraphs: We found that four of the five Part D sponsors provided their Part D  employees with general fraud, waste, and abuse training that covered   Part D. Two of these sponsors completely met the requirements for  education and training by also providing or ensuring that their Part D  employees and first-tier entity, if applicable, received general fraud, waste,  and abuse training. Two other sponsors partially met the requirements—  they provided general fraud, waste, and abuse training to Part D  employees, but they did not provide this training to their first-tier entity or  ensure that the entity’s employees received it. One Part D sponsor did not  meet the requirements because it did not provide a general training that  covered Part D fraud, waste, and abuse to its employees. However, this  sponsor reported that a general fraud, waste, and abuse training module  on Part D was in development.
The training curriculums of the Part D sponsors covered common fraud  risks and vulnerabilities; federal laws related to fraud, waste, and abuse;  and the sponsors’ protocols for detection and referral to government  authorities. However, the extent of information about detecting,  correcting, and preventing fraud in Part D varied among the curriculums.  For example, one sponsor’s corporate-wide Ethics and Compliance  training course contained a section on health-care fraud that had one  reference to Part D. Similarly, another sponsor added a section to its  preexisting healthcare fraud and abuse training curriculum for identifying  Part D violations, such as enrolling a Medicare beneficiary in a plan  different than the one the beneficiary selected. In contrast, one sponsor  developed a fraud and abuse training that was entirely devoted to Part D  and that discussed in detail CMS’s requirements and recommendations for  an effective Part D fraud and abuse program and how the sponsor was  meeting those standards. In addition, this sponsor’s curriculum was the  only one that identified the potential for misconduct at the sponsor level.  Specifically, this sponsor’s curriculum provided hypothetical scenarios of  risks that employees may encounter on the job—such as a supervisor  asking an employee to falsify Part D data submitted to the government to  inflate enrollment.
section_title: Recommended Measures
paragraphs: Only one Part D sponsor completely met the selected recommended  measures for education and training by providing general training that  covered Part D fraud, waste, and abuse to its employees on at least an  annual basis and providing specialized training to its employees whose  responsibilities or departments, such as marketing, put them at greater  risk of encountering fraud, waste, or abuse. This sponsor provided  employees in its pharmacy benefit management department with a  specialized training on the government’s guidelines for preventing fraud,  waste, and abuse in Part D. Three sponsors partially met the  recommended measures; two did not provide specialized training to their  Part D employees and three did not ensure that this training was provided  to first-tier entities. One Part D sponsor did not meet any of the selected  recommended measures for effective training and education. Additionally,  we found that one sponsor’s interpretation of CMS’s recommendation for  specialized training differed from CMS’s expectations. An official from this  sponsor considered that operational training in a particular job function  met this recommendation, even though the training did not include a  reference to fraud, waste, and abuse.
section_title: Effective Lines of Communication
subsections: section_title: Requirements
paragraphs: All five Part D sponsors completely met the requirements for effective  lines of communication by having lines of communication between the  compliance officer and the organization’s management, employees, and  contractors. While the lines of communications may not have been  directed to the compliance officers, all of these officers had access to  information received on these lines.
section_title: Recommended Measures
paragraphs: In addition, all five Part D sponsors met the selected recommended  measures. Specifically, all five Part D sponsors used reporting mechanisms  to receive reports of potential fraud, waste, and abuse and had  investigated these reports within two weeks, as recommended. All five had  confidential or anonymous mechanisms, such as hotlines, for receiving  compliance questions, reports of potential risks, and reports of potential  fraud, waste, or abuse from internal and external parties. All five sponsors  we reviewed had separate reporting mechanisms for internal parties,  including employees, and for external parties, including beneficiaries, to  report potential offenses.
All five Part D sponsors made information about the methods for reporting  potential offenses available to internal and external parties, as  recommended. For internal parties, all five Part D sponsors provided  information to employees regarding the methods for reporting potential  offenses on their companies’ internal Web sites. In addition, four Part D  sponsors provided information regarding the hotline number and other  methods for reporting to employees during their Medicare Part D fraud  and abuse training. For external parties, two of the compliance officers for  the Part D sponsors in our review reported that beneficiaries were  typically informed of the methods for reporting potential fraud and abuse  on their explanation of benefits. One Part D sponsor provided promotional  material to one of their first-tier entities with the hotline number for  reporting potential fraud, waste, or abuse.
All five Part D sponsors had investigated concerns and reports of potential  offenses received through the internal or external reporting mechanisms,  as recommended. One Part D sponsor delegated investigation activities to  a first-tier entity. Only two of the five Part D sponsors had received Part D  fraud reports through the internal reporting mechanism. One Part D  sponsor stated that Part D concerns may not have been reported through  the internal mechanism because employees were bypassing the internal  hotline and using other mechanisms for reporting, such as directly  reporting a potential case of fraud, waste, or abuse to the special  investigations unit. An official from another Part D sponsor reported that it  had yet to receive any calls related to Medicare Part D on its internal  reporting mechanism.
All five Part D sponsors in our review had addressed or responded to  reports of potential offenses received through their external reporting  mechanism, including reports of potential offenses by beneficiaries and  pharmacy providers. For example, one Part D sponsor received a report  from a pharmacy that a family member of one of the sponsor’s  beneficiaries was filling prescriptions for a drug for his own use and  paying for them with the beneficiary’s Medicare Part D benefit. Other   Part D sponsors received reports that beneficiaries were doctor shopping  or selling their prescription drugs.
section_title: Enforcement of Standards through Disciplinary Guidelines
subsections: section_title: Requirements
paragraphs: The requirements for the enforcement through disciplinary guidelines  were completely met by all five Part D sponsors. All five of the Part D  sponsors in our review enforced standards through well-publicized  disciplinary guidelines for individuals, as required. Most sponsors’  disciplinary guidelines were corporate policies that applied to all company  products, including the Part D prescription drug plan.
section_title: Recommended Measures
paragraphs: All five Part D sponsors promoted the disciplinary guidelines to encourage  reporting of potential offenses, as recommended. Officials for all five   Part D sponsors reported that disciplinary guidelines were incorporated  into training courses or were available on the sponsor’s internal Web sites,  or both. To publicize enforcement of disciplinary standards, one sponsor  used its Ethics and Compliance Newsletter to communicate that  disciplinary actions had been taken.
section_title: Internal Monitoring and Auditing
subsections: section_title: Requirements
paragraphs: Three Part D sponsors completely met the requirements by having  procedures for internal monitoring and auditing at the sponsor and first- tier entity level, when applicable. One Part D sponsor partially met the  requirements because, although it had procedures for internal monitoring  and auditing, this sponsor did not have the monitoring and auditing  procedures for its first-tier entity. One Part D sponsor did not meet the  requirements because it did not provide us with internal monitoring and  auditing procedures that met the criteria.
Sponsors’ monitoring procedures were often broadly-focused  departmental manuals that generally did not specifically refer to Part D.  Auditing procedures included work plans with time frames for completion  or processes for responding to auditing results.
section_title: Recommended Measures
paragraphs: Three Part D sponsors completely met the recommended measures for  internal auditing and monitoring because they implemented procedures  for monitoring and auditing at the sponsor and first-tier entity, when  applicable, and conducted data analysis and risk assessments. One Part D  sponsor partially met the recommended measures because it had not  monitored or audited its first-tier entity. One Part D sponsor did not meet  any of the recommended measures.
The data-monitoring activities of the sponsors in our review typically  focused on protecting corporate assets against fraudulent claims by third  parties, rather than detecting fraud, waste, or abuse at the sponsor level as  well, as recommended to protect the Medicare program and its  beneficiaries. Sponsors’ data monitoring for Part D typically focused on  the conduct of external parties, such as monitoring pharmacies’  dispensing patterns, beneficiaries’ drug utilization, and physicians’  prescribing patterns, and did not monitor internal practices by the sponsor  or its employees that also posed risks for Medicare, such as double billing  of Medicare.
Similarly, sponsors’ monitoring activities for Part D often reflected  activities in place before Part D for their other lines of business, such as  regular analyses of prescriptions claims data from pharmacies in their  network, and did not generate a separate analysis of Part D claims. In our  review, we found that only one sponsor targeted its monitoring efforts  specifically to detect fraud, waste, and abuse in a Part D risk area. This  sponsor mined Part D claims for irregular activities, such as signs of  doctor shopping among beneficiaries prescribed narcotics. The sponsor’s  compliance officer also noted that the special investigations unit  sometimes engaged in additional Part D data monitoring if prompted by a  suspected case of fraud, waste, or abuse.
We found that four of the five sponsors conducted internal audits for   Part D, as recommended. The audits generally focused on Part D  operations and did not specifically audit for fraud, waste, or abuse. In  general, sponsors’ Part D audit subjects related to operational issues or  risks to company assets, such as the accuracy and completeness of the  Part D membership process, Part D disenrollment issues, and the  completeness and accuracy of pharmacy claims data. For example, one  Part D sponsor’s audit identified administrative issues in collecting unpaid  premiums from Part D beneficiaries and lack of timely processing of  beneficiary applications. A Part D audit by another sponsor identified  inaccurate pharmacy claims as potentially leading to overpayments of  claims by the sponsor as opposed to Medicare. Only one sponsor’s audit  specifically cited detection of possible fraud, waste, and abuse in Medicare  Part D as the purpose of the audit. This audit of 20,000 pharmacy claims  identified more than $1.2 million in Part D overpayments for recovery from  pharmacies. This was the only example provided to us that identified  funds for possible repayment to Medicare.
Of the three sponsors that had a first-tier entity for Part D—such as a  pharmacy benefit manager—two monitored and audited their first-tier  entity, as recommended. One sponsor official said that because billing was  a high-risk area for fraud, they check for billing irregularities in audits of  their first-tier entity.
Four sponsors conducted risk assessments to identify risk areas  associated with their Part D programs. Sponsors’ risk assessments cited  internal issues that pose risks for fraud, waste, and abuse in Part D—such  as proper reporting of overpayments to CMS, accuracy and truthfulness of  the data submitted to CMS for the purpose of federal reimbursement, and  sales conduct that may mislead or confuse beneficiaries, or misrepresent  the product. One Part D sponsor had undertaken internal audits that  reflected the internal Part D fraud, waste, and abuse risks cited in its risk  assessment, as recommended.
section_title: Prompt Responses to Detected Offenses and Corrective Action
subsections: section_title: Requirements
paragraphs: Four sponsors completely met the requirements for prompt responses and  corrective action initiatives by developing the respective procedures and  conducting timely and reasonable inquiry into potential offenses. One  sponsor only partially met the requirements because this sponsor had not  developed corrective action procedures in the event that fraud, waste, or  abuse was detected. The corrective action procedures provided by Part D  sponsors varied in the level of detail and information provided. For  example, one sponsor cited its employee disciplinary guidelines as its  corrective action procedures, while another sponsor’s corrective action  procedures addressed various stakeholders—pharmacy providers and  beneficiaries—and the possible actions to be taken in the event of a  compliance violation or detected offense.
All Part D sponsors reported initiating inquiries into reported potential  offenses as required. Four Part D sponsors reported that they had cases  that warranted corrective action. Only one sponsor reported the need to  take disciplinary action against one of its employees. This Part D sponsor  reported terminating an employee for being involved in an identity-theft  scheme using the personal identification information of beneficiaries. This  Part D sponsor also reported terminating a pharmacy technician after the  technician stole a beneficiary’s prescription from the pharmacy refill  center and attempted to sell it to the beneficiary at a discounted price. As  a result of criminal proceedings, this individual was sentenced to 2 years  of probation, and ordered to pay restitution for the cost of the drug.  Finally, three sponsors reported repaying CMS an overpayment, as  required.
The four sponsors that reported taking disciplinary or corrective actions  varied in their understanding and use of such actions. One Part D sponsor  reported that instead of taking corrective or disciplinary action itself, most  often cases were turned over to the MEDICs or local law enforcement to  determine the necessary course of action. Another Part D sponsor  reported that its understanding of taking a corrective action was reporting  the case to the MEDIC.
section_title: Recommended Measures
paragraphs: Three of the Part D sponsors completely met the selected recommended  measures in our review by: (1) having procedures that specified that an  investigation into a detected offense would begin within two weeks after it  was reported; (2) having procedures to voluntarily self-report any findings  of potential fraud or misconduct to CMS or the appropriate government  authority; and (3) self-reporting any findings of potential fraud or  misconduct to CMS or the appropriate government authority, if warranted.  Two Part D sponsors only partially met the recommended measures  because they did not have procedures specifying that an investigation into  a detected offense would begin within 2 weeks after it was reported.
All five Part D sponsors we reviewed had procedures in place for  voluntarily self-reporting fraud or misconduct to the MEDICs or CMS, as  recommended. All five sponsors had also self-reported potential Part D  fraud or misconduct to the MEDICs. For example, an official from a Part D  sponsor reported that the sponsor referred a case to the MEDIC after  conducting an investigation that identified a “phantom pharmacy” billing  over $2 million in false claims.
section_title: CMS’s Oversight of Part D Sponsors’ Fraud and Abuse Programs Has Been Limited
paragraphs: CMS’s oversight of Part D sponsors’ fraud and abuse programs has been  limited. CMS’s oversight activities to date have included the review and  approval of fraud and abuse program plans that Part D sponsors submit as  part of their initial Part D sponsor applications. Although CMS indicated  that it planned to conduct audits to monitor Part D sponsors’  implementation of fraud and abuse programs, CMS has not yet conducted  these audits.
subsections: section_title: CMS’s Activities Have Been Limited to the Initial Review and Approval of the Plans for Part D Sponsors’ Fraud and Abuse Programs
paragraphs: CMS’s oversight activities to date have been limited to review and  approval of Part D sponsors’ compliance plans detailing their fraud and  abuse program plans submitted as part of their initial Part D sponsor  applications. A CMS official reported that in 2005, the first year program  plans were reviewed, some sponsors submitted plans that did not meet the  agency’s requirements and recommendations specific to fraud, waste, and  abuse in Part D. When starting the Part D program, a CMS official reported  that CMS expected that sponsors would understand the regulations and  that sponsors would articulate clearly how their compliance plans  addressed fraud, waste, and abuse specific to Part D. However, this official  told us that after reviewing the components of sponsors’ compliance plans  that were included in their Part D applications, CMS officials realized that  sponsors needed more guidance. For example, a CMS official told us that  some sponsors’ applications needed follow-up on all of the components of  their fraud and abuse programs. According to CMS officials, in many  cases, Part D sponsors initially submitted corporate-wide compliance  plans that did not address fraud, waste, and abuse specific to Part D, as  CMS expected. Rather than disapproving these sponsors’ fraud and abuse  program plans, CMS officials reported that they worked with the sponsors  to help them develop fraud and abuse program plans that would be  approved in that first year.
CMS’s review of fraud and abuse program plans was limited to the initial  contract-application process. CMS officials reported that sponsors with  approved fraud and abuse program plans prior to the issuance of chapter 9  in April 2006 were not required to resubmit program plans in order for  CMS to verify that sponsors’ plans were in accordance with the new  guidance. In addition, CMS officials told us that CMS did not require   Part D sponsors to submit new or updated fraud and abuse program plans  during the contract renewal process for program year 2007 or 2008, which  limited CMS’s ability to ensure that existing Part D sponsors continued to  maintain compliance with this requirement.
CMS also provided technical assistance, such as guidance and information  sessions to Part D sponsors to help them understand the agency’s  expectations regarding the development and implementation of fraud and  abuse programs. CMS also clarified its expectations regarding sponsors’  fraud and abuse programs by issuing a final rule in December 2007. In  addition, CMS provided information sessions, such as the Compliance  Conference in August 2006 that included Part D and an Open Door Forum  in May 2006, to discuss the guidance for Part D sponsors regarding the  development and implementation of fraud and abuse programs.
section_title: CMS Has Not Conducted Oversight Activities to Monitor Part D Sponsors’ Implementation of Fraud and Abuse Programs
paragraphs: CMS has not conducted oversight activities of Part D sponsors’ program  implementation, such as audit and enforcement actions, to ensure  compliance with fraud and abuse program requirements. CMS has taken a  collaborative rather than an enforcement approach with Part D sponsors  to implement the Part D program and safeguard it from fraud, waste, and  abuse. In its Part D Oversight Strategy, issued in 2005, CMS stated that it  would reserve enforcement activities to large, repeated, or extreme Part D  program violations.
Part D oversight responsibilities are shared between two CMS offices.  First, the CBC has responsibility for Part D operational oversight,  including sponsor compliance with all Part D program rules. In April 2006,  CMS’s CBC issued a Part D Audit Protocol identifying 14 program areas for  its audits of Part D sponsors, such as sponsors’ implementation of CMS’s  fraud and abuse program requirements. However, in November 2006,  CBC issued a short-term audit strategy stating that it had limited resources  for auditing Part D programs due to the increasing number of  organizations contracting with CMS to offer Medicare products. CBC  noted that it did not have the resources to audit every plan, across every  program attribute, every 3 years as originally stated in its 2005 Oversight  Strategy. CBC reported that it would identify the minimal level of effort  needed to meet its oversight responsibilities and ensure that Medicare  stakeholders remained confident in the program. CBC stated that to  conserve resources it would be conducting desk audits as much as  possible, which would consist of reviews of documents requested from  Part D sponsors.
In 2007, the CBC initiated program audits based upon the short-term audit  strategy it issued in November 2006. In 2007, these CBC program audits  assessed Part D sponsors’ compliance with selected program areas, but  the CBC audits did not assess sponsors’ implementation of fraud and  abuse programs. Moreover, CBC does not plan to audit sponsors’  implementation of fraud and abuse programs in 2008. In June 2007, CBC  conducted a self-assessment survey of Part D sponsors regarding the  implementation of their fraud and abuse programs. A CBC official  reported that the purpose of the survey was to help CMS identify the  degree to which sponsors implemented compliance plan requirements and  recommended measures. In a follow up survey conducted in March and  April 2008, CBC found that nearly all prescription drug plans (PDP)  reported that they fully met CMS’s compliance plan requirements.
Secondly, CMS’s OFM has a targeted role in oversight that focuses on  financial oversight and program integrity, such as Part D fraud prevention  and detection. CMS contracted with the MEDICs, which are overseen by  OFM, to assist with OFM’s program integrity efforts for Part D. Audits of  Part D sponsors’ compliance plans are part of the current MEDIC  statement of work. However, no task orders specific to auditing sponsors’  fraud and abuse programs have been issued. Accordingly, no audits of  sponsors’ fraud and abuse programs have been initiated since the Part D  program began. In comments on a draft of this report, CMS stated that  each MEDIC will begin audits of Part D sponsors’ compliance plans by the  end of summer 2008. The MEDICs will use the Compliance Plan Audit  Chapter of the Part D Audit Guide to perform this work.
An OFM official told us that OFM has limited funding for the MEDICs’  fraud and abuse program audits. OFM explained that under funding levels  as of April 2008, the MEDICs receive and investigate reports of fraud, but  the MEDICs did not have the staff to conduct audits of sponsors’ programs  to control fraud, waste, and abuse.
section_title: Conclusions
paragraphs: We have designated the overall Medicare program as high risk, and the  size, nature, and complexity of the Part D program make it a particular  risk for fraud, waste, and abuse. In spite of this risk and 3 years after the  start of the Part D program, CMS has not conducted oversight activities to  monitor sponsors’ implementation of fraud and abuse programs. CMS has  acknowledged that program compliance and integrity audits conducted by  CMS are necessary to ensure compliance and document CMS’s program  oversight responsibilities. In particular, the agency reported that it would  conduct audits of fraud and abuse programs in 2007. However, although  both offices have the responsibility to do so, CBC has not conducted these  audits, and OFM has not initiated MEDIC audits of fraud and abuse  programs as it had planned.
Our review of five Medicare Part D sponsors’ implementation of fraud,  waste, and abuse programs supports the need for such oversight. We  found that none of these five sponsors, which cover more than a third of  Part D enrollees, completely implemented all of the required compliance  plan elements and selected recommended measures for their fraud and  abuse programs. Lack of CMS oversight of Medicare Part D sponsors’  implementation of programs to prevent fraud, waste, and abuse risks  significant misuse of funds in this $39 billion program. We believe that  CMS oversight of Medicare Part D sponsors’ programs could increase the  completeness of sponsors’ implementation of required compliance plan  elements and selected recommended measures and, as a result, reduce the  risk to Medicare.
section_title: Recommendation for Executive Action
paragraphs: To help safeguard the Medicare Part D program from fraud, waste, and  abuse, we recommend the Administrator of CMS ensure that CMS  conducts timely audits of Part D fraud and abuse programs to monitor  sponsors’ implementation of these programs.
section_title: Agency Comments and Our Evaluation
paragraphs: CMS provided written comments on a draft of this report. CMS stated that  it concurred with our recommendation and that it is prioritizing its  oversight activities to ensure sponsors’ compliance with CMS’s policies.  CMS also agreed with our finding regarding the extent to which Part D  sponsors have implemented programs to control fraud, waste, and abuse.  CMS disagreed with our finding that the agency’s oversight has been  limited. However, CMS’s comments did not provide additional evidence of  audits of sponsors’ fraud, waste, and abuse programs, or of oversight  activities beyond those described in the report. We believe that such  audits are necessary to ensure sponsors’ compliance.
In addition, CMS stated that insufficient resources have been one of the  primary impediments to its implementation of a robust oversight strategy.  CMS noted that Congress did not respond to its request for additional  program integrity funds in fiscal year 2006 through fiscal year 2008.  However, we believe that program integrity will remain at risk until CMS  conducts timely audits to monitor Part D sponsors’ implementation of  fraud and abuse programs. CMS’s written comments are reprinted in  appendix II. CMS also provided technical comments, which we  incorporated as appropriate.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from  the date of this report. We will then send copies to the Administrator of  CMS, appropriate congressional committees, and other interested parties.  We will also make copies available to others upon request. This report is  also available at no charge on GAO’s Web site at http://www.gao.gov.
If you or your staff have questions about this report, please contact me at  (202) 512-7114 or at kingk@gao.gov. Contact points for our Office of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix III.
section_title: Appendix I: Methodology for Examining Certain Sponsors’ Implementation of Fraud and Abuse Programs for Part D
paragraphs: To examine the extent to which certain Part D sponsors implemented  programs to control fraud, waste, and abuse, we conducted on-site  reviews at five Part D sponsors. We selected these five sponsors for our  review because they each offered a stand-alone Part D prescription drug  plan that provided nationwide coverage, varied in enrollment size, and  collectively provided coverage for a sizeable proportion of Part D  beneficiaries. These five national prescription drug plans (PDP) selected  for our review from these five sponsors represented about 35 percent of  total Medicare Part D enrollment as of April 2007. Our sample is not  generalizable to the entire Part D sponsor population. Four of the five  sponsors we reviewed were private health insurance companies and one  was a pharmacy benefit manager.
For these on-site reviews, we developed a data collection instrument  based on: (1) the required compliance plan elements and certain  recommended measures for fraud and abuse programs outlined in  regulations and chapter 9 of the Part D Prescription Drug Benefit Manual  and (2) additional input provided by the Centers for Medicare & Medicaid  Services (CMS). CMS’s regulations provided the core required elements of  a compliance plan and established a framework for fraud and abuse  programs. CMS’s chapter 9 guidance provided several recommendations  for how sponsors should implement a program within that framework to  control fraud, waste, and abuse as part of an effective Part D compliance  plan. Our data collection instrument did not include all of CMS’s  recommended measures. We selected recommended measures for  inclusion in our data collection instrument based on a variety of factors,  such as measures that we judged were the most helpful to fulfilling the  purpose of the requirements, measures that were recommended by the  OIG and subject-matter experts for compliance program evaluations,  including government officials from Veterans’ Affairs (VA) and an industry  representative, measures that helped tailor a fraud and abuse program to  Part D, and measures that indicated that a required component or  procedure had been implemented. For example, CMS required procedures  for internal monitoring and auditing, but provided a variety of  recommendations on the types of internal monitoring and auditing that  could be implemented. We selected the recommendations we considered  to be the most helpful to fulfilling the requirements, such as the  recommendation to conduct an audit, rather than the recommendation  regarding the size, scope, and structure of the internal audit department.
This study extends beyond a previous report from the Office of the  Inspector General (OIG), which reviewed Part D sponsors’ compliance  plans to assess whether the plans addressed all of the requirements and  selected recommendations. The OIG limited its assessment to a document  review of the compliance plans submitted to CMS and did not assess the  extent to which the compliance plans had been implemented. However,  we assessed the implementation of the compliance plans by reviewing  documentary evidence on-site to examine how sponsors addressed fraud,  waste, and abuse specific to Medicare Part D for each of the required  elements of each Part D sponsor’s compliance plan. This included the  compliance plan and any additional documents, such as procedures, that  were referenced in the compliance plan.
To complete our data collection instrument, we used documentary  evidence to verify implementation of each element. We requested at least  one document pertaining to each of the required elements and selected  recommended measures. For example, we asked the sponsors to provide a  copy of the required auditing procedures and evidence that the Part D  sponsor had implemented the auditing procedures as recommended by  providing a copy of the findings from at least one audit related to Part D  that had been conducted. Our determination of whether sponsors met the  criteria for a requirement or recommendation was based on the  document’s applicability to Part D and the specific element under review,  not the extensiveness of the document’s content. For example, some  evidence we accepted contained one section referencing the requirement  or recommendation, while other documents were more detailed. All the  policies and procedures in the documents we reviewed were implemented  by sponsors and in use at the time of our on-site reviews. In addition, we  determined that the sponsors’ met the requirements or selected  recommendations if they implemented the required element or selected  recommended measures in their compliance plan.
We also conducted interviews with Part D sponsor senior administrators,  and compliance and other staff, including contractors’ employees. To gain  a comprehensive picture of the sponsor’s fraud and abuse activities, in  some cases, we also interviewed additional staff members involved in   Part D functions, including staff from departments such as special  investigations, monitoring and auditing, ethics, and pharmacy benefit  management.
section_title: Appendix II: Comments from the Centers for Medicare & Medicaid Services
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Martin T. Gahart, Assistant  Director; Jennifer Apter; Catina Bradley; Jawaria Gilani; Jennel Harvey;  Joy Kraybill; Amy Shefrin; and Jennifer Whitworth made key contributions  to this report.