Medicare Advantage: Required Audits of Limited Value
Published: 2007-10-16T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2006, the Centers for Medicare & Medicaid Services (CMS) estimated it spent over $51 billion on the Medicare Advantage program, which serves as an alternative to the traditional feefor- service program. Under the Medicare Advantage program, CMS approves private companies to offer health plan options to Medicare enrollees that include all Medicare-covered services. Many plans also provide supplemental benefits. The Balanced Budget Act (BBA) of 1997 requires CMS to annually audit the financial records supporting the submissions (i.e., adjusted community rate proposals (ACRP) or bids) of at least onethird of participating organizations. BBA also requires that GAO monitor the audits. This testimony provides information on (1) the ACRP and bid process and related audit requirement, (2) CMS' efforts related to complying with the audit requirement, and (3) factors that cause CMS' audit process to be of limited value.
section_title: What GAO Found
paragraphs: Before 2006, companies choosing to participate in the Medicare Advantage program were annually required to submit an ACRP to CMS for review and approval. In 2006, a bid submission process replaced the ACRP process. The ACRPs and bids identify the health services the company will provide to Medicare members and the estimated cost for providing those services. CMS contracted with accounting and actuarial firms to perform the required audits. According to our analysis, CMS did not meet the requirement for auditing the financial records of at least one-third of the participating Medicare Advantage organizations for contract years 2001-2005. CMS is planning to conduct other financial reviews of organizations to meet the audit requirement for contract year 2006. However, CMS does not plan to complete the financial reviews until almost 3 years after the bid submission date each contract year, which will affect its ability to address any identified deficiencies in a timely manner. CMS did not consistently ensure that the audit process for contract years 2001-2005 provided information to assess the impact on beneficiaries. After contract year 2003 audits were completed, CMS took steps to determine such impact and identified an impact on beneficiaries of about $35 million. CMS audited contract year 2006 bids for 80 organizations, and 18 had a material finding that affected amounts in approved bids. CMS officials took limited action to follow up on contract year 2006 findings. CMS officials told us they do not plan to sanction or pursue financial recoveries based on these audits because the agency does not have the legal authority to do so. According to our assessment of the statutes, CMS had the authority to pursue financial recoveries, but its rights under contracts for 2001-2005 were limited because its implementing regulations did not require that each contract include provisions to inform organizations about the audits and about the steps that CMS would take to address identified deficiencies. Further, our assessment of the statute is that CMS has the authority to include terms in bid contracts that would allow it to pursue financial recoveries. Without changes in its procedures, CMS will continue to invest resources in audits that will likely provide limited value.

section_title: Letter
paragraphs: We are pleased to be here today to testify on the results of our review of  the Centers for Medicare & Medicaid Services’ (CMS) audit activities  related to Medicare Advantage (MA) organizations that was mandated by  the Balanced Budget Act (BBA) of 1997. Our results are documented in  our July report, Medicare Advantage: Required Audits of Limited Value.  BBA requires CMS to annually audit the financial records (including data  relating to Medicare utilization and costs) of at least one-third of the  organizations participating in the Medicare Advantage program. BBA also  requires us to monitor CMS’ audit activities.
In fiscal year 2006, CMS estimated it spent over $51 billion on the Medicare  Advantage program, which serves as an alternative to Medicare’s  traditional fee-for-service program. Under Medicare Advantage, CMS  approves private companies to offer health plan options that include all  Medicare-covered services. In addition, many plans provide supplemental  benefits, such as a reduction in the enrollee’s required cost sharing (e.g.,  beneficiaries’ Part B premiums) or coverage for items and services not  included under the traditional fee-for-service program, such as dental care.  According to CMS, in fiscal year 2006, over 16 percent of Medicare  beneficiaries—or about 7 million of the approximately 43 million—were  enrolled in a Medicare Advantage plan.
Our review covered CMS audits for contract years 2001 through 2006. In  summary, we found that the required audits were of limited value, which is  similar to what we reported on audits for contract year 2000 in October  2001, when we last reviewed CMS’ audit activities under BBA. The  findings in our latest review cause us continuing concern about the audit  process. CMS did not document its process to determine whether it met  the requirement to audit the financial records of at least one-third of the  participating organizations for contract years 2001 through 2006, and  based on our analysis of available CMS data, CMS did not meet that  requirement. For those audits that CMS completed, it did not consistently  ensure that the audit process provided information needed for assessing  the potential impact on beneficiaries, and CMS took limited action to  follow-up on the audit findings.
Today, we will discuss the findings in our recent report. Specifically, we  will tell you about:  the adjusted community rate proposal (ACRP) and bid process and the  related audit requirement for organizations that participate in the  Medicare Advantage program,    CMS’ efforts to comply with the audit requirement for organizations’ ACRP  and bid submissions, and  factors that cause CMS’ audit process to be of limited value.
Our prior work on which this testimony is based was performed in  accordance with generally accepted government auditing standards.
subsections: section_title: Medicare Advantage ACRP and Bid Process and Related Audit Requirements
paragraphs: Before 2006, companies choosing to participate in the Medicare Advantage  program were required to annually submit an ACRP to CMS for review and  approval for each plan they intended to offer. The ACRP consisted of two  parts—a plan benefit package and the adjusted community rate (ACR).  The plan benefit package contained a detailed description of the benefits  offered, and the ACR contained a detailed description of the estimated  costs to provide the package of benefits to an enrolled Medicare  beneficiary. These costs were to be calculated based on how much a plan  would charge a commercial customer to provide the same benefit package  if its members had the same expected use of services as Medicare  beneficiaries. CMS made payments to the companies monthly in advance  of rendering services.
In 2003, Congress enacted the Medicare Prescription Drug, Improvement  and Modernization Act of 2003 (MMA). MMA included provisions that  established a bid submission process to replace the ACRP submission  process, as well as a new prescription drug benefit, both effective for 2006.  Under the bid process, an organization choosing to participate in Medicare  Advantage is required to annually submit a bid for review and approval for  each plan they intend to offer. The bid submission includes the  organization’s estimate of the cost of delivering services (submitted on a  bid form) to an enrolled Medicare beneficiary and a plan benefit package  that provides a detailed description of the benefits offered. In addition,  each MA organization and prescription drug plan that offers prescription  drug benefits under Part D is required to submit a separate prescription  drug bid form, a formulary, and a plan benefit package to CMS for its  review and approval. On the bid forms, MA organizations include an  estimate of the per-person cost of providing Medicare-covered services.
BBA requires CMS to annually audit the submissions of one-third of MA  organizations. In defining what constituted an organization for the purpose  of selecting one-third for audit, CMS officials explained that they  determined the number of participating organizations based on the  number of contracts they awarded. Under each contract, an organization  can offer multiple plans. Further, an organization like Humana Inc. can  have multiple contracts.
CMS contracts with accounting and actuarial firms to perform these  audits. For audits of the contract year 2006 bid forms, CMS contracted in  September 2005 with six firms. CMS gave the auditors guidance. It is  important to note that the audit guidance includes procedures to verify  information used in the projection or estimation of costs submitted in the  bids, not actual results or costs each year, as the bids do not report actual  costs.
section_title: GAO Analysis Shows CMS Did Not Meet the Audit Requirement
paragraphs: According to our analysis of available CMS data, CMS did not meet the  statutory requirement to audit the financial records of at least one-third of  the participating MA organizations for contract years 2001 through 2005,  nor has it done so yet for the 2006 bid submissions. We performed an  analysis to determine whether CMS had met the requirement because CMS  could not provide documentation to support the method it used to select  the ACRs and bids for audit, nor did CMS document whether or how it met  the one-third requirement for contract years 2001 through 2006. Our  analysis shows that between 18.6 and 23.6 percent, or fewer than one- third, of the MA organizations (as defined by the number of contracts each  year) for contract years 2001 through 2005 were audited each year.  Similarly, we determined that only 13.9 percent of the MA organizations  and prescription drug plans with approved bids for 2006 were audited, as  of the end of our review. Table 1 summarizes our results.
As stated earlier, CMS selects organizations to meet the one-third audit  requirement based on the number of contracts awarded and not the total  number of plans offered under each contract. However, to present  additional perspective, we also analyzed the percentage of plans audited of  the total number of plans offered by each audited organization. Our  analysis shows that with the exception of contract year 2002, the level of  audit coverage achieved by CMS audits has progressively decreased in  terms of the percentage of plans audited for those organizations that were  audited. Audit coverage has also decreased in terms of the percentage of  plans audited of all plans offered by participating organizations each  contract year. In contract year 2006, a large increase in the number of bid  submissions meant that the 159 plans audited reflected only 3.2 percent of  all the plans offered. Table 2 summarizes our analysis.
Regarding contract years 2001 through 2004, CMS officials told us that  they did not know how the MA organizations were selected for audit, and  the documentation supporting the selections was either not created or not  retained. For contract year 2005 audits, CMS officials told us that the  selection criteria included several factors. They said that the criteria  considered included whether the MA organization had been audited  previously and whether it had significant issues.
With respect to contract year 2006, CMS officials acknowledged the one- third requirement, but they stated that they did not intend for the audits of  the 2006 bid submissions to meet the one-third audit requirement. They  explained that they plan to conduct other reviews of the financial records  of MA organizations and prescription drug plans to meet the requirement  for 2006. In September 2006, CMS hired a contractor to develop the  agency’s overall approach to conducting reviews to meet the one-third  requirement. Draft audit procedures prepared by the contractor in May  2007, indicate that CMS plans to review solvency, risk scores, related  parties, direct medical and administrative costs, and, where relevant,  regional preferred provider organizations’ (RPPO) cost reconciliation  reports for MA bids. For Part D bids, CMS indicated it also plans to review  other areas, including beneficiaries’ true out-of-pocket costs. However,  when our review ended, CMS had not yet clearly laid out how these  reviews will be conducted to meet the one-third requirement. Further,  CMS is not likely to complete these other financial reviews until almost 3  years after the bid submission date (see figure 1) for each contract year, in  part because it must first reconcile payment data that prescription drug  plans are not required to submit to CMS until 6 months after the contract  year is over. Such an extended cycle for conducting these reviews greatly  limits their usefulness to CMS and hinders CMS’ ability to recommend and  implement timely actions to address identified deficiencies in the MA  organizations’ and prescription drug plans’ bid processes.
section_title: CMS’ Audit Process Was of Limited Value
paragraphs: In its audits for contract years 2001-2005, CMS did not consistently ensure  that the audit process provided information needed for assessing the  potential impact of errors on beneficiaries’ benefits or payments to the MA  organizations. The auditors reported findings ranging from lack of  supporting documentation to overstating or understating certain costs, but  did not identify how the errors affected beneficiary benefits, copayments,  or premiums. In addition, although the auditors categorized their results as  findings and observations, with findings being more significant, depending  on their materiality to the average payment rate reported in the ACR, the  distinction between findings and observations, was based on judgment,   and therefore varied among the different auditors. In our 2001 report, we  reported that CMS planned to require auditors, where applicable, to  quantify in their audit reports the overall impact of errors. Further, during  the work for the 2001 report, CMS officials stated that they were in the  process of determining the impact on beneficiaries and crafting a strategy  for audit follow-up and resolution. CMS did not initiate any actions to  attempt to determine such impact until after the contract year 2003 audits  were completed. CMS took steps to determine such impact and identified  a net of about $35 million from the contract year 2003 audits that  beneficiaries could have received in additional benefits. The only audit  follow-up action that CMS has taken regarding the ACR audits was to  provide copies of the audit reports to the MA organizations and instruct  them to take action in subsequent ACR filings.
In CMS’ audits of the 2006 bid submissions, 18 (or about 23 percent) of the  80 organizations audited had material findings that have an impact on  beneficiaries or plan payments approved in bids. CMS defined material  findings as those that would result in changes in the total bid amount of 1  percent or more or in the estimate for the costs per member per month of  10 percent or more for any bid element. CMS officials told us that they  will use the results of the bid audits to help organizations improve their  methods in preparing bids in subsequent years and to help improve the  overall bid process. Specifically, they told us they could improve the bid  forms, bid instructions, training, and bid review process.
CMS’ audit follow-up process has not involved pursuing financial  recoveries from Medicare Advantage organizations based on audit results  even when information was available on deficiencies or errors that could  impact beneficiaries. CMS officials told us they do not plan to pursue  financial recoveries from MA organizations based on the results of ACR or  bid audits because the agency does not have the legal authority to do so.  According to our assessment of the statutes, CMS has the authority to  pursue financial recoveries, but its rights under contracts for 2001 through  2005 are limited because its implementing regulations did not require that  each contract include provisions to inform organizations about the audits  and about the steps that CMS would take to address identified  deficiencies, including pursuit of financial recoveries. Regarding the bid  process that began in 2006, our assessment of the statutes is that CMS has  the authority to include terms in bid contracts that would allow it to  pursue financial recoveries based on bid audit results. CMS also has the  authority to sanction organizations, but it has not.
CMS officials believe the bid audits provide a “sentinel or deterrent effect”  for organizations to properly prepare their bids because they do not know  when the bids may be selected for a detailed audit. Given the current audit  coverage, CMS is unlikely to achieve significant deterrent effect, however,  because only 13.9 percent of participating organizations for contract 2006  have been audited.
section_title: Concluding Remarks
paragraphs: Appropriate oversight and accountability mechanisms are key to  protecting the federal government’s interests in using taxpayer resources  prudently. When CMS falls short in meeting the statutory audit  requirements and in a timely manner resolving the findings arising from  those audits, the intended oversight is not achieved and opportunities are  lost to determine whether organizations have reasonably estimated the  costs to provide benefits to Medicare enrollees. Inaction or untimely audit  resolution also undermines the presumed deterrent effect of audit efforts.
While the statutory audit requirement does not expressly state the  objective of the audits or how CMS should address the results of the  audits, the statute does not preclude CMS from including terms in its  contracts that allow it to pursue financial recoveries based on audit  results. If CMS maintains the view that statute does not allow it to take  certain actions, the utility of CMS’ efforts is of limited value.
In our recent report, we made several recommendations to the CMS  Administrator to improve processes and procedures related to its meeting  the one-third audit requirement and audit follow-up. We also  recommended that CMS amend its implementing regulations for the  Medicare Advantage Program and Prescription Drug Program to provide  that all contracts CMS enters into with MA organizations and prescription  drug plan sponsors include terms that inform these organizations of the  audits and give CMS authority to address identified deficiencies, including  pursuit of financial recoveries. We further recommended that if CMS does  not believe it has the authority to amend its implementing regulations for  these purposes, it should ask Congress for express authority to do so. In  response to our report, CMS concurred with our recommendations and  stated it is in the process of implementing some of our recommendations.
section_title: Contacts and Acknowledgments
paragraphs: For information about this statement, please contact Jeanette Franzel,  Director, Financial Management and Assurance, at (202) 512-9471 or  franzelj@gao.gov or James Cosgrove, Acting Director, Health Care, at  (202) 512-7029 or cosgrovej@gao.gov. Individuals who made key  contributions to this testimony include Kimberly Brooks (Assistant  Director), Christine Brudevold, Paul Caban, Abe Dymond, Jason Kirwan,  and Diane Morris.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.