Medicaid: Additional Reporting May Help CMS Oversee Prescription-Drug Fraud Controls
Published: 2015-07-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Medicaid is a significant expenditure for the federal government and the states, with total federal outlays of $310 billion in fiscal year 2014. CMS reported an estimated $17.5 billion in potentially improper payments for the Medicaid program in 2014.
GAO was asked to review pharmacy-related program-integrity efforts at selected states. Among other reporting objectives, this report (1) identifies and analyzes indicators of potentially fraudulent or abusive prescribing activities in fiscal year 2011, and (2) examines the extent to which federal and state oversight policies, controls, and processes are in place to prevent and detect instances of prescription-drug fraud and abuse.
GAO analyzed Medicaid claims paid in fiscal year 2011, the most-recent reliable data available, for four states: Arizona, Florida, Michigan, and New Jersey. These states were chosen, in part, because they were among those with the highest Medicaid expenditures; the results are not generalizable to all states. GAO performed data matching with various databases to identify indicators of potential fraud, reviewed CMS and state Medicaid program-integrity policies, and interviewed CMS and state officials performing oversight functions.
section_title: What GAO Found
paragraphs: GAO found indicators of potential prescription-medication fraud and abuse among thousands of Medicaid beneficiaries and hundreds of prescribers during fiscal year 2011—the most-recent year for which reliable data were available in four selected states: Arizona, Florida, Michigan, and New Jersey. These states accounted for about 13 percent of all fiscal year 2011 Medicaid payments. Specifically, in these four states, GAO found the following:
More than 16,000 of the 5.4 million beneficiaries potentially engaged in “doctor shopping,” by visiting five or more doctors to receive prescriptions for antipsychotics or respiratory medications valued at about $33 million.
About 700 beneficiaries received more than a 1-year supply of the same drug in 2011 at a cost to Medicaid of at least $1.6 million. This is an indicator of diversion, which is the redirection of prescription drugs for illegitimate purposes.
As required by federal law, the Medicaid Drug Utilization Review program is a two-phase review process states use to promote safety while also monitoring prescription-drug activity for fraud. Federal law requires each state to report on the operation of its review program, a key monitoring tool that the Centers for Medicare & Medicaid Services (CMS) uses to oversee the review process in states, but GAO identified additional actions that could improve oversight. In the first phase, states use tools and eligibility screening to promote patient safety and avoid abuse before the drugs are dispensed. The second phase involves ongoing and periodic examination of claims data to identify patterns of fraud, abuse, gross overuse, or medically unnecessary care, and implement corrective action when needed.
However, GAO identified two potential controls that are not included in CMS's current reporting requirements:
Lock-in programs for noncontrolled substances. Lock-in programs address doctor shopping by restricting beneficiaries who have abused the Medicaid program to one health-care provider, one pharmacy, or both, for receiving prescriptions. Lock-in programs have typically been used on controlled substances. Expanding lock-in programs that currently focus on controlled substances to restrict abusers of noncontrolled substances, such as the human immunodeficiency virus medications Atripla and Truvada, to a single prescriber or pharmacy may help address potential fraud and abuse.
Prohibition of automatic refills. Pharmacies permitting automatic refills automatically refill prescriptions for certain medications without any customer action. Concerns with pharmacy automatic refill include the potential for stockpiling, continued fill of discontinued medications, and increased cost and waste of prescription medications. Two states GAO reviewed—Florida and Arizona—have prohibited the practice.
CMS does not collect information about lock-in programs for noncontrolled substances or automatic refill prohibitions, but doing so would help the agency determine whether additional guidance is needed.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS require states to report information about specific drug-utilization review controls to determine whether additional guidance is needed. The agency concurred with the recommendation and stated that it will consider requiring states to report on these areas.

section_title: Letter
paragraphs: Established in 1965 by Title XIX of the Social Security Act, Medicaid is a  joint federal–state program that finances health care for low-income and  medically needy individuals. The Centers for Medicare & Medicaid  Services (CMS), within the Department of Health and Human Services  (HHS), is responsible for overseeing the Medicaid program, including  disbursing federal matching funds, and provides guidance, technical  assistance, and periodic assessments of state Medicaid programs.  Federal laws prescribe responsibility for both federal and state entities to  protect the Medicaid program from fraud, waste, and abuse. Specifically,  federal law requires CMS to issue regulations to improve Medicaid  program integrity, with which state Medicaid programs must comply.
Medicaid is a significant expenditure for the federal government and the  states, with total federal outlays of $310 billion in fiscal year 2014. In  February 2015, we reported that Medicaid remains at high risk because of  concerns about the adequacy of fiscal oversight of the program, including  improper payments to Medicaid providers. In fiscal year 2014, CMS  reported an estimated improper payment rate of 6.7 percent, or $17.5  billion for the Medicaid program, which is an increase over its 2013  estimate of 5.8 percent, or $14.4 billion.
While most improper payments are not related to fraud, and the full extent  to which fraud, waste, and abuse related to prescription drugs affects  Medicaid is unknown, we have previously identified potentially fraudulent  or abusive practices in CMS’s health-care programs. For example, in September 2009, we found tens of thousands of potential “doctor  shoppers” of controlled substances in Medicaid. Doctor shopping is a  beneficiary fraud scheme in which patients visit several doctors and  pharmacies, receiving more drugs than any single physician would have  prescribed. Additionally, in September 2011, we reported on indications of  doctor shopping in the Medicare Part D program, which provides  voluntary, outpatient prescription-drug coverage for eligible individuals 65  years and older and eligible individuals with disabilities. As part of that  work, we found that about 170,000 Medicare beneficiaries received  prescriptions from five or more medical practitioners for frequently abused  controlled substances. In both of those reports we made  recommendations that CMS improve efforts to address doctor shopping.  CMS agreed with our recommendations and implemented them. In May  2015, we issued a report on our work associated with Medicaid  beneficiary and provider fraud.
Because of the substantial amount of funds that are expended in the  Medicaid program and our prior work detailing potential fraudulent or  abusive practices, you asked us to review any pharmacy-related  program-integrity efforts at selected states. Specifically, for this review we  1.  evaluated the reliability of Medicaid data from CMS and selected  states for the purpose of identifying indicators of potential fraud or  abuse;  2.  identified and analyzed indicators, if any, of potentially fraudulent or  abusive activities related to prescription drugs in Medicaid; and  3.  examined the extent to which federal and selected state oversight  policies, controls, and processes are designed to prevent and detect  instances of prescription-drug fraud in Medicaid.
To evaluate the reliability of Medicaid data from CMS and state Medicaid  programs for our selected states that could be used to identify indicators  of potential fraud or abuse, we took several steps. We vetted 11 states for  possible inclusion in our study. We selected states based on high  Medicaid beneficiary enrollment, geographic diversity, and availability of  data. In the selection process, we also considered whether drugs were  paid under fee-for-service (FFS) or managed care, by including states  that included these program types in our review. We performed electronic  testing to determine the validity of specific data elements in the federal  and selected states’ databases that we used to perform our work. We  also reviewed related documentation, including data layouts and agency  reports. Specifically, we used a January 2013 Mathematica Policy Report  that details Medicaid Statistical Information System (MSIS) state data  characteristics and anomalies to further vet states selected for our audit  work. We also used published GAO and HHS Office of Inspector  General (OIG) reports that detailed the limitations of the MSIS data we  used for our study. Additionally, we interviewed officials responsible for  their respective databases to discuss data-reliability considerations, and  reviewed prior work related to the quality of the MSIS data used for our  study. On the basis of our discussions with agency officials and our own  testing, we concluded that the data elements from four states—Arizona,  Florida, Michigan, and New Jersey—used for this report were sufficiently  reliable for the purpose of identifying indicators of potential fraud or  abuse. However, in assessing the reliability of the data, we observed  reportable shortcomings such as issues with timeliness, completeness,  and accuracy in the data that may affect Medicaid administrators’ ability  to effectively oversee their program. However, the results of the data- reliability evaluation only apply to the states we selected for fiscal year  2011 and cannot be generalized to other states or periods. We discuss  these shortcomings in greater detail later in this report.
To identify indicators of potentially fraudulent or abusive activities related  to prescription drugs in Medicaid, we obtained and analyzed Medicaid  claims paid in fiscal year 2011, the most-recent period from which we  could draw reliable data, for four states: Arizona, Florida, Michigan, and  New Jersey. Medicaid payments to these states constituted about 13  percent of all Medicaid payments made during fiscal year 2011. These  states were selected primarily because they had consistently comparable  and reliable data and were among the states with the highest Medicaid  expenditures. The results of our analysis of these states are not  generalizable to other states.
We obtained MSIS beneficiary, provider, prescription-drug, and other  services claims data, as well as state Medicaid Management Information  Systems (MMIS) crosswalk data (with personal identifiers) to perform our  work. The crosswalk data we used contained specific identifying  information on prescribers, pharmacies, and beneficiaries that were not  collected in the MSIS data, such as name and address.
We reviewed literature related to health-care fraud, including reports  discussing fraud, waste, and abuse related to prescription drugs. We  interviewed federal, state, and private-sector auditors, program  administrators, and other relevant officials that had published work that  investigated or researched prescription-drug fraud. On the basis of this  research, we identified areas at greater risk of fraud and abuse such as  drugs at high risk for diversion and types of prescribing patterns that  warranted additional review. We used this information to develop our  analytic approach to identify indicators of potential fraud and abuse  related to prescription drugs in Medicaid. To identify potential overuse, we  reviewed beneficiaries who received more than a 480-day supply of the  same medication in a single year based on the national drug code. To  identify potential doctor-shopping activities, we examined beneficiaries  who received prescriptions for drugs within one of two therapeutic classes  of drugs from five or more prescribers. We focused on beneficiaries who  received prescriptions for antipsychotics or respiratory medications from  five or more different prescribers over the course of 1 year. We selected  medications in these therapeutic classes because they had a large  number of individuals who received drugs from five or more prescribers  relative to other classes of noncontrolled substances we considered, have  a known diversion risk, and are relatively expensive. We selected the  five-or-more prescribers threshold based on our review of drug diversion  literature and prior GAO work. We also looked for prescribers and  pharmacies with a high proportion of prescribing or dispensing activities  for brand-name drugs (versus generics) compared to the average activity  of other prescribers and pharmacies and we looked for pharmacies  without any adjusted or voided claims. To identify potentially  unnecessary prescription-drug activities, we reviewed claims paid on  behalf of beneficiaries who received human immunodeficiency virus (HIV)  and diabetes medications despite having no HIV or diabetes-related  indicators related to such ailments in their fiscal year 2011 Medicaid  outpatient claims listed in the MSIS “other services” file.
We also matched the Medicaid data to other external sources to identify  potential fraud and improper payments. These matches sought to identify  individuals who may be ineligible to receive Medicaid benefits or  providers who should not have received Medicaid payments due to  residency, death, or other exclusionary factors. We used the beneficiary  files to identify individuals who had payments made on their behalf  concurrently by two or more of our selected states. We compared the  beneficiary and prescriber identity information shown in the Medicaid  claims data to the Social Security Administration’s (SSA) complete file of  death information to determine whether any individuals were reportedly  deceased when they purportedly prescribed, dispensed, or received  prescription drugs from Medicaid. To identify prescription-drug claims that  might have been improperly processed and paid by the Medicaid program  because either the prescribers or beneficiaries were incarcerated, we  compared the Medicaid claims to data files listing incarcerated individuals  from the four selected states. To identify claims that might have been  improperly processed and paid by the Medicaid program because the  federal government had banned the corresponding prescribers from  providing services to Medicaid beneficiaries, we compared the Medicaid  claims to the exclusion and debarment files from the HHS OIG and the  General Services Administration (GSA). We compared files from the  different states to identify beneficiaries who received concurrent benefits  from multiple states.
To determine the extent to which federal and state oversight policies,  controls, and processes are designed to prevent and detect indicators of  prescription-drug fraud in Medicaid, we reviewed CMS and state Medicaid  policies pertinent to program integrity over pharmaceuticals, met with  CMS officials, and visited state Medicaid offices that perform oversight  functions for the four states we selected. We used federal standards for  internal control, GAO’s Fraud Prevention Framework, and Medicaid  statutes and regulations addressing the administration of pharmacy  benefits to evaluate these functions.
To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  federal and selected states’ databases that we used to perform our work.  We also interviewed officials responsible for their respective databases  and reviewed documentation related to the databases and literature  related to the quality of the data. On the basis of our discussions with  agency officials and our own testing, we concluded that the data elements  used for this report were sufficiently reliable for our purposes.
We conducted this performance audit from March 2014 to July 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  audit findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives. More details on our  objectives, scope, and methodology can be found in appendix I.
subsections: section_title: Background
subsections: section_title: Medicaid Prescription- Drug Programs
paragraphs: State Medicaid programs do not directly purchase prescription drugs but  instead reimburse pharmacies for covered prescription drugs dispensed  to Medicaid beneficiaries. States operate their Medicaid programs by  paying qualified health-care providers (including prescribers and  pharmacies) for a range of covered services provided to eligible  beneficiaries and then seeking reimbursement for the federal share of  those payments. States may directly pay health-care providers for  services rendered using a FFS delivery system or may delegate these  responsibilities to managed-care organizations (MCO). Under managed- care arrangements, states contract with MCOs to deliver care through  networks. States typically pay the MCOs a fixed amount each month,  called a capitation payment. All four of the states included in our review— Arizona, Florida, Michigan, and New Jersey—had MCO arrangements in  place.
Although the federal government establishes broad requirements, each  state has flexibility in managing its Medicaid program. Guidelines  established by federal statutes, regulations, and policies allow each state  to (1) broaden its eligibility standards; (2) determine the type, amount,  duration, and scope of services; (3) set the rate of payment for services;  and (4) administer its own program, including enrollment of providers and  beneficiaries, processing and monitoring of medical claims, payment of  claims, and maintenance of fraud-prevention programs. CMS is  responsible for administering legislation and regulations affecting the  Medicaid program. CMS also provides guidelines, technical assistance,  and periodic assessments of state Medicaid programs.
The federal government requires coverage for certain mandatory services  under Medicaid, but states may decide to include other optional services  as well. Some of the largest and most commonly included services  include nursing facilities, home and community-based care, and hospital  inpatient care. Although pharmacy coverage is an optional service under  federal Medicaid law, all 50 states currently provide coverage for  prescription drugs. States may pay for drugs dispensed through MCOs  using either the “carve-in” or the “carve-out” approach. To use the carve- in approach, states include payment for the drugs dispensed to  beneficiaries in the MCOs’ fixed monthly payment amounts. In the carve- out approach, states exclude payment for the drugs dispensed to  beneficiaries from the MCOs’ fixed monthly payment amounts and  instead pay for these drugs using the traditional FFS system. States may  also use a combination of carve-out and carve-in approaches.
section_title: Medicaid Data Collection and Reporting
paragraphs: The Medicaid prescription-drug programs, such as the Drug Utilization  Reviews (DUR), include the management, development, and  administration of systems and the data collection necessary to operate  them. As part of data-collection efforts, states are mandated to report FFS  claims and individual encounter data for managed-care enrollees to CMS.  MSIS is the mechanism by which CMS requires states to report these  data on a quarterly basis, although delays in reporting data occur. The  database is used for analytical research, program integrity, planning,  budgeting, and policy analyses associated with Medicaid.
section_title: Medicaid Pharmacy Fraud
paragraphs: Federal law prohibits Medicaid providers and beneficiaries from taking  certain actions related to billing for or receiving Medicaid services. For  example, the Federal False Claims Act makes it illegal to submit false  claims to Medicare, Medicaid, and other government health-care  programs for payment.regulations may constitute fraud. We and other federal oversight entities  have recently issued a number of reports related to fraud and other types   Violation of these or other relevant laws and  of improper payments in CMS’s health-care programs, including  Medicaid. For example, in May 2014 we reported that neither state nor  federal Medicaid entities were well positioned to identify improper  payments made to MCOs due to a gap in state and federal efforts to  ensure Medicaid managed-care program integrity. A report released by  the HHS OIG in August 2014 found over 1,500 Medicare beneficiaries  who had questionable utilization patterns for HIV drugs, including  beneficiaries who had no indication of HIV in their Medicare histories,  received an excessive dose or supply of HIV drugs, or received HIV drugs  from a high number of pharmacies or prescribers. In October 2014, we  reported on 23 practices for addressing prescription-drug fraud, waste,  and abuse in Medicare developed from a detailed literature review as well  as interviews with relevant stakeholders.
section_title: Reliability Issues Limit Usefulness of Medicaid Data for Identifying Indicators of Potential Fraud and Abuse
paragraphs: According to CMS guidance to state Medicaid directors, programs with  the size and scope of Medicaid require robust, timely, and accurate data  to identify potential fraud or waste. However, CMS’s MSIS data continue  to have limited usefulness for identifying fraud, waste, and abuse due to  issues with accuracy, completeness, and timeliness.
We analyzed 11 states to possibly include in our study, but had to  exclude data from four states—California, Maryland, Ohio, and  Pennsylvania—due to fiscal year 2011 data-availability and quality  issues.
In California, officials expressed concerns regarding the reliability of  their data due to issues of reporting from the health plans and data  conversions to other systems. Officials also had concerns about the  ability to identify prescribing providers in the MCO data.
The January 2013 Mathematica Policy Research report noted that for  Maryland fiscal year 2011 MSIS data, National Provider Identifier (a  unique identifier for Medicaid providers) and physician-specialty  information were missing on managed-care prescription transactions.
Similarly, the January 2013 Mathematica Policy Research report  identified that Ohio MSIS data were missing provider-identifying  information and prescription-drug and pharmacy information.
The January 2013 Mathematica Policy Research report identified that  Pennsylvania had not reported any data related to managed-care  encounters through at least the fourth quarter of fiscal year 2011,  even though the majority of the state’s Medicaid-eligible population  was enrolled in comprehensive managed care.
Although the MSIS data from Arizona, Florida, Michigan, and New Jersey  were sufficiently reliable for the purpose of identifying indicators of  potential fraud or abuse, we identified issues with their timeliness and  completeness. For example, the most-recent validated data available  from CMS for Arizona, Florida, Michigan, and New Jersey were more  than 3 years past the date when they should have been validated. The  fiscal year 2011 claim files were the most-current claim files contained in  the MSIS system. In addition, about 20 million (26 percent) of the  records included filler data (e.g., 01-01-0001) in the prescribed date  fields. While the data help identify potential vulnerabilities to Medicaid  prescription-drug fraud, waste, and abuse, they are not sufficiently timely  to enable investigation of specific transactions. These problems with the  MSIS data used for this review are consistent with concerns raised in  previous GAO and HHS OIG reports.
In October 2012, we reported that MSIS data were not timely because of  late state submissions and the time it takes CMS to review and validate  data. In that report we found that 37 states were late with their quarterly  data by six quarters in July 2012. We further reported that even though  CMS requires states to submit MSIS data within 45 days, states’ reporting  of MSIS data and the subsequent validation process can be up to 3 years  late. In interviews for this review, both CMS and state Medicaid officials  agreed that this validation process can be lengthy. For example, CMS  officials may identify a data-quality issue during the validation process in  which they analyze the data and ensure that errors do not exceed a  predetermined threshold. If the threshold is exceeded, CMS will then  request the state to resubmit corrected data, which can take several  additional months, according to both CMS and state Medicaid officials.
In addition, we reported in June 2012 that MSIS-based audits were  hampered by deficiencies in the data, and noted that CMS had initiatives  to transition into a new system called the Transformed Medicaid  Statistical Information System (T-MSIS).CMS guidance to state Medicaid directors, T-MSIS is intended to  modernize and enhance the way states will submit operational data about  beneficiaries, providers, claims, and encounters and will be the  foundation of a robust state and national analytic data infrastructure.  Additionally, in the August 2013 CMS guidance to state Medicaid  directors, CMS stated that this change will enhance the agency’s ability to  observe trends or patterns indicating potential fraud, waste, and abuse in  the state Medicaid programs to prevent or mitigate the effect of these  activities. States may also have enhanced capabilities to counter fraud,  waste, and abuse capabilities. The guidance also indicates CMS and the  states will be able to analyze the data submitted by the states along with  other information in the CMS data repositories, including Medicare data,  enhancing abilities to better identify potential anomalies for further  investigation. CMS officials stated that they will not begin to analyze the  benefits derived from T-MSIS until the transition reaches the point where  data for at least half of the Medicaid population in the United States are  included in T-MSIS.
Department of Health and Human Service, Office of Inspector General, Early Outcomes  Show Limited Progress for the Transformed Medicaid Statistical Information System, OEI- 05-12-00610 (Washington, D.C.: September 2013). and timely information to T-MSIS to support effective oversight. According  to the Fiscal Year 2016 HHS OIG Justification of Estimates for  Appropriations Committees, this recommendation remains a priority  unimplemented recommendation.
CMS began implementing T-MSIS with states on a rolling basis in July  2014 and is working towards full implementation in 2015. Specifically,  CMS officials stated that the T-MSIS project is in the midst of  implementation with all states. Moreover, all states are working towards  completion of the T-MSIS implementation in 2015, according to CMS.  CMS went live with its federal T-MSIS platform in May 2015, and  estimates that at least half the Medicaid population in the United States  will be available through submitted T-MSIS files by the end of 2015.  However, officials from the four states included in our review told us that  they are experiencing challenges with implementing T-MSIS  requirements. Specifically, officials from three of the states explained that  CMS continues to change data-field requirements for the data  submissions.
section_title: Medicaid Prescription-Drug Claims Data Contained Indicators of Potential Fraud and Improper Payments in Four Selected States
paragraphs: Our analysis of fiscal year 2011 Medicaid prescription claims data from  four selected states identified several indicators of potential fraud.  Specifically, we found indicators of potential fraud among beneficiaries,  prescribers, and pharmacies (1) with questionable patterns related to  received, prescribed, and dispensed drugs; (2) who received drugs for  certain conditions for which the beneficiaries had no other indicators in  their fiscal year 2011 Medicaid outpatient claims; and (3) with concerns  identified using data matching—such as prescribers who appeared to be  deceased by the prescribed date. Because of the age of the data, we did  not independently investigate individual transactions to confirm whether a  particular beneficiary, prescriber, or pharmacy actually engaged in fraud,  waste, or abuse.
subsections: section_title: Questionable Patterns Related to Drugs Received in Four Selected States Indicate Potential Fraud
subsections: section_title: Potentially Excessive Prescription Claims
paragraphs: Beneficiaries who receive large numbers of drugs, especially of the same  drug, can indicate possible overutilization and, in more-egregious cases,  drug diversion. Additionally, beneficiaries obtaining services from many  different prescribers can raise questions. In our analysis of potentially  excessive prescription claims, we found the following:
Beneficiaries with high quantities of the same drug. About 700 of  the 5.4 million beneficiaries we reviewed received more than a 1-year  supply (a 480-day supply) of the same drug in 2011 at a cost to   About 50 of these beneficiaries  Medicaid of at least $1.6 million.received more than 2 years’ worth (a 730-day supply) of the same  drug. One beneficiary appeared to receive more than 3-1/2 years’  worth of the same respiratory medication at a cost to Medicaid of at  least $10,000. Another beneficiary received more than 1 year’s worth  of seven different drugs at a cost to Medicaid of at least $30,000.
Beneficiaries visiting five or more prescribers. Doctor shopping is  a beneficiary fraud scheme in which Medicaid beneficiaries visit  multiple prescribers to obtain more prescriptions for the same or  similar drugs than a single physician would prescribe. Specifically,  when a beneficiary obtains drugs from many prescribers or  pharmacies, it could mean the beneficiary is seeking drugs to divert  for profit or that the beneficiary’s identification number was stolen.  Another concern is that the beneficiary is getting excessive doses or  supplies. According to CMS data, more than 16,000 beneficiaries out  of the 5.4 million we reviewed visited five or more prescribers to  receive prescriptions for antipsychotics or respiratory medications  valued at about $33 million.15 prescribers and 10 pharmacies to obtain various antipsychotics at  a cost to Medicaid of about $23,000 in 1 year. Another beneficiary   For example, a single beneficiary visited  received prescriptions for respiratory medications at 11 pharmacies  written by 21 prescribers at a cost to Medicaid of at least $4,800 in 1  year. Table 1 shows the number of potential doctor shoppers and the  costs associated with the purchased drugs for these therapeutic  classes, by prescribers visited.
Beneficiaries may have a justifiable reason for receiving prescriptions  from multiple medical practitioners. For example, a beneficiary may  legitimately receive prescriptions from different prescribers within the  same practice. Also if a beneficiary moves multiple times over the course  of the year, he or she may still require the same prescriptions, which will  necessitate visits to additional prescribers. There may be other legitimate  medical reasons for receiving prescriptions for the same drug from  multiple prescribers, such as visiting multiple specialists.
section_title: Questionable Prescribing and Dispensing Patterns
paragraphs: Analysis of prescribing and dispensing patterns can also help identify  indicators of potential fraud, waste, and abuse. Excessive patterns of  prescribing or dispensing, relative to peers, can indicate potential fraud.  For example, we examined and identified prescribers and pharmacies  with an unusually high proportion of activity for brand-name drugs.addition, analysis of pharmacy adjustments on claims can indicate  whether pharmacies are properly billing Medicaid. In our analysis of  prescription claims for questionable prescribing and dispensing patterns,  we found the following:
Prescribers and pharmacies associated with high numbers of  brand-name drugs. In our discussions with officials that had  investigated or researched prescription-drug fraud, we found that  brand-name drugs can be at greater risk of diversion due to their  relatively high expense. In more egregious examples, an unusually  high proportion of brand-name drugs could represent a kickback  scheme benefitting the prescriber or indicate a substitution of generic  drugs scheme where the pharmacy dispenses generics but bills for  more-expensive brand-name drugs. Our analysis identified 119 out  of about 28,000 prescribers associated with at least 500 claims for  which at least 75 percent of the prescriptions were written for brand- name drugs. Among the 8,800 pharmacies we reviewed with at least  500 claims, we found about 300 pharmacies for which over half of the  prescriptions filled were for brand-name drugs. We also found 37  pharmacies with at least 500 claims that only dispensed brand-name  drugs.
Pharmacies without adjustments. When a change to a prescription  is made or when a beneficiary fails to pick up the prescribed drugs,  the pharmacy must adjust the claim transaction. According to officials  in New Jersey, instances of pharmacies with too many or too few  adjustments may be red flags for concern. We identified about 70 out  of approximately 4,000 pharmacies that filed over 5,000 claims  without a single adjustment. These pharmacies received at least $23  million from Medicaid during fiscal year 2011. In contrast, among  pharmacies that filled over 5,000 claims, the median pharmacy  adjusted about 2 percent of its claims and the mean pharmacy  adjusted about 5 percent of its claims. As we stated previously,  adjustments may reflect changes to claims for medications that are  not picked up by beneficiaries. While there may be legitimate reasons  for a pharmacy to have low percentages of adjustments to claims,  such pharmacies may warrant follow-up review by state oversight  officials. For example, Michigan officials stated that there are some  long-term nursing care facilities that only bill for the medications  consumed by patients at the end of the month. These facilities would  not have adjustments in their claims because the bill at the end of the  month reflects the accurate amount of medication used by the patient.
section_title: Beneficiaries in Four Selected States Receiving Drugs for Conditions Not Identified in Their Fiscal Year 2011 Medicaid Outpatient Claims Indicate Potential Improper Payments
paragraphs: We identified beneficiaries in our four selected states who received  prescription drugs only used to treat HIV and medications primarily used  to treat diabetes but who had no additional (beyond receiving the HIV or  diabetes medications) indicators of HIV or diabetes in their outpatient  Medicaid activity from fiscal year 2011. The absence of such evidence  does not prove that the beneficiary did not have HIV or diabetes or that  there was inappropriate off-label use: the claims files we used were for  a limited period and did not reflect the beneficiary’s entire medical history,  and our search may not have included every possible diagnosis or  service code related to HIV and diabetes.
subsections: section_title: HIV Medications Prescribed to Beneficiaries without Indicators of HIV in Their Fiscal Year 2011 Medicaid Outpatient Claims
paragraphs: The HHS OIG reported in August 2014 that antiretroviral drugs that treat  HIV are a target for fraud, waste, and abuse because they can be very  expensive and can have psychoactive effects. Our analysis showed that  the majority (94 percent) of the approximately 13,000 beneficiaries who  received prescriptions for one of five HIV drug treatments had an HIV- related diagnosis indicator documented in their fiscal year 2011 Medicaid  outpatient claims. In contrast, more than 750 of the 13,000 beneficiaries  received HIV medications despite having no apparent indicator of having  HIV in their fiscal year 2011 Medicaid outpatient claims. These  beneficiaries received the HIV medications Atripla, Combivir, Norvir,  Reyataz, and Truvada, which according to Food and Drug Administration  indications and usage labeling are used to treat HIV-positive patients.
Medicaid paid about $3.7 million in claims for HIV medications for  beneficiaries with no other indications in their fiscal year 2011 outpatient  claims of having HIV. For example, 60 beneficiaries each received  Truvada at least 12 times despite not having a HIV diagnosis code or  other indicator for HIV, costing Medicaid at least $523,000. About 30  beneficiaries with no HIV indicators each received the HIV medication  Atripla at least 12 times at a cost to Medicaid of at least $418,000. One  such beneficiary had 52 claims for multiple different HIV medications at a  cost to Medicaid of over $50,000. Our analysis found that about 20  pharmacies dispensed HIV medications to at least 10 different  beneficiaries who had no HIV indicators according to their fiscal year  2011 Medicaid claims. Table 2 summarizes the costs associated with  each drug under review received by beneficiaries who did not have a  Medicaid HIV indicator in the fiscal year 2011 outpatient claims file,  broken out by beneficiaries with 1 to 11 claims and beneficiaries with 12  or more claims.
We cannot determine from data analysis alone which cases represent  inappropriate prescriptions and which permissible prescribing patterns  are. Such determinations would require additional review of the facts and  circumstances of each individual case by state oversight officials.
section_title: Diabetes Medications Prescribed to Beneficiaries without Indicators of Diabetes in Their Fiscal Year 2011 Medicaid Outpatient Claims
paragraphs: Our analysis showed that the majority (96 percent) of the approximately  57,000 beneficiaries who received prescriptions for one of four diabetes  treatments had diabetes-related indicators elsewhere in their fiscal year  2011 Medicaid outpatient claims. However, we identified about 2,300  beneficiaries who received diabetes medications, including Actos,  Humalog, Lantus, and Novolog, without other indicators for the disease in  their Medicaid outpatient claims. The costs for providing these  medications amounted to at least $680,000. For example, about 100  beneficiaries each received 12 or more prescriptions for Actos at a total  cost to Medicaid of at least $96,000. Another 72 beneficiaries each  received 12 or more prescriptions for Lantus costing Medicaid at least  $46,000. Table 3 summarizes the costs associated with each drug under  review received by beneficiaries who did not have a diabetes-related  indicator in the fiscal year 2011 outpatient claims file, broken out by  beneficiaries with 1 to 11 claims and beneficiaries with 12 or more claims.
We cannot determine from data analysis alone which cases represent  inappropriate prescriptions and which represent permissible prescribing  patterns or anomalies within the data. Again, such determinations would  require additional review of the facts and circumstances of each individual  case by oversight officials.
section_title: Indicators of Potential Improper Payments Identified Using Data Matching
paragraphs: Of the 5.4 million beneficiaries in the four states we examined, we found  hundreds of cases from the fiscal year 2011 data that showed potential  indicators of improper payments, which may include fraudulent activity  (e.g., prescriptions written by apparently deceased prescribers), due to  concerns about the beneficiary, prescriber, or pharmacy. Figure 1  summarizes the results of our matching data to external sources to  identify indicators of potential improper payments or fraud. Additional  investigation would be required to definitively determine whether improper  payment or fraud occurred.
Deceased prescribers. The identities of 290 deceased prescribers in  the four states we examined were used to prescribe drugs to  individuals who received Medicaid benefits. The cost of the drugs  totaled at least $77,000 for fiscal year 2011.
Deceased beneficiaries. The identities of about 170 deceased  beneficiaries in the four states we examined were used to obtain  prescriptions that were subsequently filled and paid for by Medicaid.   The cost of the drugs totaled at least $32,000 for fiscal year 2011.
Identity theft is stealing identifying information from providers and patients and using it  for nefarious purposes. Phantom billing is billing for prescription drugs (or other services)  that were not provided to the beneficiary. which Medicaid officials must check before paying for a prescription  claim: the List of Excluded Individuals and Entities, managed by HHS,  and the System for Award Management, managed by GSA. The  primary effect of these exclusions is that no payment will be provided  for any items or services furnished, ordered, or prescribed by an  excluded individual or entity. This includes Medicare, Medicaid, and  all other federal plans and programs that provide health benefits  funded directly or indirectly by the United States. We found about 200  excluded prescribers who wrote prescriptions that were then used to  obtain prescription drugs that were paid for by Medicaid. The selected  states approved and paid the claims at a cost of over $1 million.
Beneficiaries concurrently receiving benefits in two or more  states. Beneficiaries are entitled to Medicaid prescription-drug  benefits in the states in which they currently reside but are not eligible  to receive Medicaid benefits in more than one state concurrently.We identified about 618 beneficiaries that received prescription drugs  from Medicaid in two or more of our selected states concurrently. The  costs associated with these drugs were at least $186,000.
section_title: Drug Utilization Reviews Help States Detect and Prevent Unnecessary Prescriptions, and Additional Reporting Would Help CMS Determine Whether More Guidance on Controls Is Needed
paragraphs: CMS monitors state Medicaid programs’ efforts to prevent and detect  instances of prescription-drug fraud in Medicaid, but we identified areas  that may require additional guidance for oversight. Required by federal  law, the Medicaid Drug Utilization Review (DUR) program is one process  states use to promote patient safety and monitor prescription-drug activity  for fraud, waste, and abuse. In the first phase (prospective DUR) the  states use tools such as point-of-sale edits, preferred-drug lists, and  eligibility screening to promote patient safety and avoid abuse. The  second phase (retrospective DUR) involves ongoing and periodic  examination of claims data to identify patterns of fraud, abuse, gross  overuse, or medically unnecessary care and implements corrective action  when needed. For example, these measures can include postpayment  reviews, lock-in programs, and pharmacy automatic refill restrictions. An  effective DUR can reduce states’ exposure to potential fraud schemes,  such as those described earlier in this report. Federal statute and  regulation require that states report on their DUR activities as well as cost  savings generated from their DUR programs.
CMS also collects information from states about DUR program  operations, cost savings from DUR programs, and innovative DUR  practices by means of the Medicaid Drug Utilization Review Annual  Report Survey. CMS compiles this information into an annual summary  report that is publicly available, and may be used to highlight innovative  practices that state Medicaid programs have implemented. According to  the fiscal year 2013 Medicaid Drug Utilization Review State Comparison  Annual Report (2013 CMS DUR Summary), DUR activities saved an  average of about 18 percent on drug costs, adding up to about $3.9 billion  in savings. CMS does not collect information about lock-in programs for  noncontrolled substances or automatic refill prohibitions, despite the  concerns detailed below.
subsections: section_title: Prospective DUR
paragraphs: Prospective DUR screens prescription-drug claims to identify possible  safety and overuse indicators before the drugs are dispensed. Key  prospective DUR controls include the following:
Point-of-sale edits. Point-of-sale edits are alerts that occur at the  pharmacy point of sale and promote patient safety and program  integrity by sending alerts to pharmacies during the process of filling  the prescription to determine whether certain criteria are met.  Effective point-of-sale edits can address issues such as the potentially  excessive and unnecessary prescriptions described earlier in this  report. Alerts, such as drug–drug interactions or therapeutic  duplication, appear when there is a drug interaction risk or when a  patient is to be dispensed a drug that is in the same therapeutic class  as another recently dispensed drug, respectively. These alerts also  work to promote patient safety as well as program integrity. A DUR  can also include alerts such as a gender-specific alert that occurs  when a drug is dispensed that is not recommended for use by the  gender indicated on the recipient’s eligibility file. Other alerts such as  early-refill warnings are routine edits that may signal that the patient is  not taking the drug according to the directions or may be misusing the  medication. Early-refill alerts also help to prevent Medicaid from  paying for excessive amounts of medication above and beyond what  is necessary. According to the 2013 CMS DUR Summary, all states  set early-refill thresholds as a way of preventing prescriptions from  being refilled too soon, which is categorized as a point-of-sale edit.
Preferred-drug list. DUR often include a preferred-drug list, which is  designed to help keep health-care costs down by encouraging use of  preferred, generic and over-the-counter drugs. The preferred-drug list  drives a market shift to generic drugs when the generic drug pricing is  less than the brand-name drug pricing (net of CMS and supplemental  rebates), although prescribers can override the preferred-drug list  using a prior-authorization request. Use of the preferred-drug list may  limit or prevent wasteful spending.
Eligibility screening. As described earlier in this report, states are to  screen for the eligibility of beneficiaries, prescribers, pharmacies, and  other entities to ensure that they have coverage under or participate in  a health-insurance program. States are to use federal death sources  such as SSA’s Death Master File as well as local sources such as the  state’s vital statistics office and prisoner files to check for the death  and incarcerations of beneficiaries. Per CMS regulations, states are  also required to use tools such as the List of Excluded Individuals and  Entities, managed by HHS, and the System for Award Management,  managed by GSA, to screen prescribing providers or pharmacies for  federal exclusions and debarments.
section_title: Retrospective DUR
paragraphs: Retrospective DUR involves ongoing and periodic examination of claims  data to identify potentially problematic patterns. Key retrospective DUR  fraud controls include postpayment reviews, lock-in programs, and  automatic refill prohibitions.
Postpayment reviews. Postpayment reviews involve reviewing  claims and other documents after payment to ensure compliance with  payment rules, and to determine whether the prescription was  medically necessary. These reviews permit states to suspend  payments and obtain and review medical records. Specific tactics  states may choose to employ to find fraud in these payments include  examining claims by amount paid, average costs, number of claims,  adjustment rates, or percentage of claims for brand-name or Drug  Enforcement Administration Schedule II drugs. States can vary the  period of review depending on available data and may monitor overall  activity as well as activity within subsections of the population. For  example, states can look for top beneficiary recipients of a certain  drug or therapeutic class, prescribers who most frequently prescribe  controlled substances, or pharmacies that dispense certain drugs at  an average cost that is significantly higher than that of their peers.  There are numerous ways the data can be analyzed and checks can  be combined to strengthen detection of indicators of potential fraud.  Effective strategies can then be repeated. While it is likely not  possible to determine from data analysis alone whether any given  prescription was appropriate, such analysis can detect anomalies that  might warrant additional audit and investigation outside the DUR  process. For example, as we discussed previously in this report, a  pharmacy may dispense an unusually high proportion of brand-name  medications. States can use pharmacy audits to ensure dispensary  compliance with program rules and regulations while looking for fraud  and abuse.
Lock-In Programs (also known as Restricted Recipient  Programs). As noted earlier in this report, we identified about 16,000  individuals whose visits to multiple prescribers for antipsychotics and  respiratory medications raise questions.DUR tool that can address doctor shopping by locking beneficiaries  who have abused the Medicaid program in to one prescriber, one  pharmacy, or both for receiving prescriptions. Lock-in allows both  prescribers and pharmacies to develop a more-complete picture of the  beneficiary’s drug-utilization history. Lock-in programs historically  have applied to those beneficiaries in an FFS arrangement, although  MCOs may employ similar measures to “lock-in” enrollees when such  actions are warranted.
Lock-ins are typically triggered by abuse of controlled substances.  Officials in Arizona and New Jersey stated that their lock-in program  has historically focused on lock-in for controlled substances, although  lock-ins for other drugs were permitted. Officials in Florida stated that  their program does not use lock-in for noncontrolled substances and  has trended towards using point-of-sale edits to restrict doctor- shopping activities related to controlled substances. Michigan officials  stated that the state Medicaid program has two categories of lock-ins:  beneficiaries may be locked in to a specific prescriber for controlled  substances, or beneficiaries may be locked in to specific prescribers  and pharmacies for all medications. Michigan officials indicated that  they apply specific criteria to determine the lock-in category a  beneficiary is assigned.
According to CMS officials, CMS does not have specific guidance for  the state Medicaid programs on lock-ins. They said that states decide  the requirement for placing a beneficiary in a lock-in program. Given  that we found more than 16,000 beneficiaries who received  prescriptions for relatively high-value medications from at least five  prescribers in 1 fiscal year, there is a risk that Medicaid is wasting  funds on prescriptions that are medically not necessary, and  potentially fraudulently diverted. Although there is no federal  requirement for states to implement a lock-in program, according to  the 2013 CMS DUR Summary all but one of the states has a lock-in  program for controlled substances. However, the report does not  contain information on lock-in programs for noncontrolled substances.
Pharmacy Automatic Refill. Pharmacies may automatically refill  prescriptions for certain medications without any customer action.  Automatic refill services can be employed at both retail and mail- service pharmacies. In retail settings, medications that are not picked  up by the patient within a finite period must be returned to stock.  However, mail-service pharmacies are unable to return the medication  to stock once the prescription is delivered. Concerns with pharmacy  automatic refill include the potential for stockpiling, continued fill of  discontinued medications, and an increase in the cost and waste of  prescription medications. In 2013, CMS banned pharmacy automatic  refills in the Medicare Part D program because these practices were  potentially generating significant waste and unnecessary additional  costs for the Medicare Part D program overall.
Unlike Medicare Part D, CMS currently does not have specific  guidance on pharmacy automatic refills for the Medicaid program.
CMS officials stated that policy on pharmacy automatic refills is a  state-specific decision and states may have information in their billing  instructions to pharmacies on their policy regarding automatic refills.  In addition, CMS officials said that each state’s Board of Pharmacy  may have a policy on this subject and that these boards may audit  pharmacies regarding their compliance with state regulations.  Currently, Florida and Arizona are the states in our review that do not  allow automatic refills. When asked why such prohibitions were in  place, officials in Arizona noted that its Medicaid population was  transient, and automatic refills could lead to prescriptions mailed to  old addresses where the beneficiary no longer lived, at the state’s  expense. Officials in Florida cited concerns about beneficiaries  stockpiling medications and not wanting to pay for prescriptions that  were no longer needed.
Federal regulations define abuse as provider practices that are  inconsistent with sound fiscal, business, or medical practices, and  result in an unnecessary cost to the Medicaid program, or in  reimbursement for services that are not medically necessary.  Automatic refill programs may result in Medicaid beneficiaries  obtaining medications far in excess of what was utilized or needed,  resulting in wasted Medicaid resources. In fact, officials in New Jersey  stated that automatic refills pose a problem for both fraud and waste  of government funds, but at the time of our review did not have a  policy preventing this practice.
According to the Standards for Internal Control in the Federal  Government, internal controls should generally be designed to ensure  that ongoing monitoring occurs in the course of normal operations, and  that it is performed continually and ingrained in the agency’s operations.Our review of CMS monitoring activities found that CMS surveys states  on a variety of different measures for fraud and waste prevention as well  as cost-savings measures. Our discussions with officials in the selected  states and CMS indicated that lock-in programs for noncontrolled  substances and automatic refill prohibitions may warrant additional  review. As discussed previously, state Medicaid programs varied in the  type of medications that are included in lock-in programs. Additionally, we  found more than 16,000 beneficiaries who received prescriptions for  relatively high-value medications from at least five prescribers in 1 fiscal  year, indicating that there is a risk that Medicaid is wasting funds on  prescriptions that are medically not necessary, and potentially  fraudulently diverted. The Medicare Part D program, as well as Florida  and Arizona Medicaid programs, prohibit automatic refills, citing both  patient safety and unnecessary costs as concerns for implementing these  practices. However, CMS does not collect this information in the DUR  survey or other collection methods. As a result, CMS does not know the  number of state Medicaid programs that prohibit automatic refills or have  lock-in programs for noncontrolled substances. Additional information  would allow CMS to determine whether additional guidance for locking in  recipients of noncontrolled substances and prohibiting automatic refills in  Medicaid could prevent some of the problems we identified in our analysis  and lead to cost savings.
section_title: Conclusions
paragraphs: Our review of fiscal year 2011 prescription-drug claims data from four  states uncovered indicators of potential fraud, waste, and abuse  throughout the Medicaid prescription-drug program in those states,  including potential doctor shopping of noncontrolled substances. In  addition, interviews with officials from these four states highlighted  Medicaid practices that were prone to waste and abuse, such as  pharmacy automatic refills. Ensuring that cost-effective controls are in  place and working properly requires additional improvements from the  MCOs, states, and CMS responsible for administering Medicaid. While  CMS oversees the administration of state Medicaid programs, CMS does  not currently identify whether states have implemented lock-in programs  for noncontrolled substances or automatic refill prohibitions. Lock-in  programs are an important tool that can be used to address doctor  shopping by locking beneficiaries who have abused the Medicaid  program in to one prescriber, one pharmacy, or both for receiving  prescriptions. Automatic refill prohibitions may help limit waste and  unnecessary program expenditures. Expanding monitoring efforts to  examine these matters in greater depth would provide CMS with more- complete information to help determine whether there is a need to issue  guidance to address these potential problems more consistently to help  ensure greater program integrity and additional cost savings.
section_title: Recommendation for Executive Action
paragraphs: To enhance monitoring of potentially wasteful or abusive practices in the  Medicaid program, we recommend that the Acting Administrator of CMS  require states to report to CMS whether their state has lock-in programs  for abusers of noncontrolled substances and prohibitions on pharmacy  automatic refills, and examine the results to determine whether additional  guidance is appropriate.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft copy of this report to HHS, SSA, and state Medicaid  program offices for Arizona, Florida, Michigan, and New Jersey. Written  comments from HHS; SSA; the Arizona Health Care Cost Containment  System (AHCCCS); the Florida Agency for Health Care Administration  (AHCA); and the State of New Jersey, Department of Human Services,  Division of Medical Assistance and Health Services (DMAHS) are  summarized below and reprinted in appendixes II–VI. HHS concurred  with our recommendation. The letter from SSA stated the agency had no  comments on our report. AHCCCS disagreed with our methodology and  provided detailed comments on our findings, as described below. AHCA  did not comment on the report’s findings but stated that the state  Medicaid program already prohibits pharmacy automatic refills and will  work with CMS to implement a lock-in program for noncontrolled  substance abusers. DMAHS did not comment on the report’s findings but  outlined several steps the state has taken that could address the types of  issues raised in our report, which are summarized below. In an e-mail  received on May 28, 2015, officials from the Michigan Department of  Community Health did not comment on the report’s findings but provided  technical comments, which we incorporated as appropriate. In addition,  we provided excerpts of this draft report related to the reliability issues of  Medicaid data to state Medicaid program offices for California, Illinois,  Maryland, New York, Ohio, Pennsylvania, and Texas for technical  comment. In an e-mail received on May 19, 2015, the Deputy Director,  Division of Program Development and Management of the New York  Department of Health, provided suggestions regarding CMS’s  implementation of T-MSIS, which was outside the scope of our review, so  we did not incorporate these comments in our draft report. Officials from  California, Illinois, Maryland, New York, Ohio, Pennsylvania, and Texas  did not provide technical comments.
In its written comments, HHS concurred with our recommendation and  stated that it will consider requiring states to report on lock-in programs  for abusers of noncontrolled substances and pharmacy automatic refill  policies. HHS also outlined the steps the agency has taken to improve  data collection in Medicaid and address prescription-medication fraud  since the fiscal year 2011 data used in our study. We incorporated these  comments in our report as appropriate.
In its written comments, AHCCCS said that it takes exception to being  included in a series of findings that offer no state-specific detail. As we  noted in our meetings with all state agencies included in our study, we did  not provide state-level detail for two primary reasons. First, because CMS  was the audited agency for our work, conducting analysis at the state- level would be outside the scope of our work and would put the focus on  a comparison between the states, rather than on CMS oversight. In  addition, due to the age and limitations of the data, as noted in the report,  we would not be referring specific cases for follow-up. Moreover,  AHCCCS noted that the findings of our study represent less than one- tenth of Medicaid spending for the four states used in our study.  As we  stated previously in this report, all of the states in our study had MCO  arrangements in place during our study period. As a result, the Medicaid  paid amounts associated with managed care may not be reflected in the  state claims that were submitted to CMS for medical services, and hence  our estimate is likely understated.
AHCCCS also commented on specific sections of our analysis. First,  AHCCCS stated that our report did not identify state practices that are  able to leverage more-accurate data sources on a real-time basis. As  mentioned above, the focus of our work was CMS oversight of the  Medicaid program rather than an in-depth discussion of current, specific  practices employed by the states. Second, AHCCCS incorrectly stated  that we used the federal incarceration file in our analysis. As we note in  appendix I, we used each state’s department of corrections prisoner  databases for individuals incarcerated for any period during fiscal year  2011. Specifically, for our work, we used the same Arizona Department of  Corrections file to perform matches that AHCCCS outlined in its response  letter. Third, AHCCCS provided an overview of the additional checks the  state performs to identify incarcerated beneficiaries, as well as deceased  providers and beneficiaries. This overview does not refute the findings in  our report, and we did not incorporate these details in the report.
Regarding our analysis of prescription-drug medication claims data,  AHCCCS stated that our report should have used more than a single year  of claims data to identify diagnosis information. We acknowledge this  limitation, and updated our report with the appropriate caveats.  Specifically, we state that we identified beneficiaries who did not have  indicators of HIV or diabetes in their outpatient Medicaid activity from  fiscal 2011, and that the absence of such evidence does not prove that  the beneficiary does not have HIV or diabetes or that there was  inappropriate off-label use. Further we stated that the results of this  analysis may also be caused by off-label use, record-keeping, or data- coding issues. In addition, we noted that timing differences in the prior- authorization process could explain some of these observations. We also  note that we cannot determine from data analysis alone which cases  represent inappropriate prescriptions and which are permissible  prescribing patterns.
Regarding our analysis of brand-name medications, AHCCCS stated that  our findings represent 0.425 percent of prescribing clinicians. In the draft  report provided to AHCCCS, we provided the number of individuals we  found and the total study population to provide the appropriate context.  AHCCCS also noted that our report did not take into consideration that  states may continue to require brand-name coverage because it may be  more costly to the state to purchase the generic product. As a result, we  incorporated discussion of this limitation in our report. Similarly, AHCCCS  stated that our report does not differentiate between retail pharmacies  and specialty pharmacies, and that some specific specialty pharmacies  are expected to have a high percentage of branded medications. We  noted that we did not control for medications where there was not a  generic version available. However, to address the specific concern of  AHCCCS, we incorporated this caveat into our report. Again, as noted  several times in our report, the results of our analysis are indicators of  potential fraudulent or improper payments.
AHCCCS further stated that Arizona protocols already apply the  recommendations in our report. In our report, we note that Arizona has a  lock-in program that can incorporate noncontrolled medications and  prohibits automatic refills in the Medicaid program. As noted in our report,  the recommendation is addressed to CMS, and not the states used in our  study. Specifically, we recommended that CMS collect information on  what other states’ practices are related to lock-ins of noncontrolled  medications and prohibitions of automatic refills, and examine the results  to determine whether additional guidance is appropriate.
Finally, AHCCCS stated that our report reaches sweeping conclusions  without validating findings based on state-specific data. Again, as  mentioned earlier, the focus of our report is CMS oversight of the  Medicaid program. Our report provides the appropriate context for our  findings, including limitations of our analysis to ensure that the results of  our analysis were not taken in an inappropriate context.
In response to our draft report, the Florida Agency for Health Care  Administration (AHCA) stated that the Florida Medicaid program currently  does not allow pharmacy automatic refills. Further AHCA stated that it will  work with CMS’s guidance and recommendations for the implementation  of a lock-in program for abusers of noncontrolled substances  In its response to our draft report, the New Jersey Department of Human  Services, Division of Medical Assistance and Health Services (DMAHS),  stated that automatic prescription refills are a major concern for the State  of New Jersey. According to DMAHS, although characterized by retail  pharmacies as a “patient-friendly” service designed to improve the quality  of prescription services, automatic prescription refills pose several  concerns, such as the potential for stockpiling medications; continued  filling of discontinued medications; unrecognized changes in drug  therapies; and increases in fraud, waste, and abuse of prescription drugs.  DMAHS stated that it looked forward to better understanding the audit  practices used by CMS and certain states to audit this practice.
In addition, DMAHS outlined steps the New Jersey Medicaid program has  taken to strengthen prescription-drug internal controls, including requiring  MCO programs to implement a pharmacy lock-in program. DMAHS also  provided comments to address additional actions the state has taken that  would address the findings we outlined in our report, including a quality- management and utilization-review program that focuses on medical  encounters and a quarterly doctor-shopper report that identifies recipients  who may be engaged in fraudulent activities. While we did not make any  specific recommendations to the states, we believe that such actions  should enhance their oversight of prescription-drug controls.
Additionally, DMAHS provided comments on timely submission of MSIS  data and stated that timely submission of MSIS data is related to the time  required for CMS to validate New Jersey claims file submissions. We  incorporated its comments in our report, as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  Secretary of Health and Human Services, the Commissioner of Social  Security, relevant state agencies, and interested congressional  committees. In addition, the report is available at no charge on the GAO  website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff that made key contributions to this  report are listed in appendix VII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: In this report, we (1) evaluated the reliability of Medicaid data from the  Centers for Medicare & Medicaid (CMS) and selected states for the  purpose of identifying indicators of potential fraud or abuse; (2) identified  and analyzed indicators, if any, of potentially fraudulent or abusive  activities related to prescription drugs in Medicaid; and (3) examined the  extent to which federal and selected state oversight policies, controls, and  processes are designed to prevent and detect indicators of prescription- drug fraud in Medicaid.
To evaluate the reliability of Medicaid data from CMS for our selected  states that could be used to identify indicators of potential fraud or abuse,  we took several steps. We vetted 11 states for possible inclusion in our  study. We selected states based on high Medicaid beneficiary  enrollment, geographic diversity, and availability of data. In the selection  process, we also considered whether drugs were paid under fee-for- service (FFS) or managed care, by including states that included these  program types in our review. We performed electronic testing to  determine the validity of specific data elements in the federal and  selected state databases that we used to perform our work. We also  reviewed related documentation, including data layouts and agency  reports. Specifically, we used a January 2013 Mathematica Policy  Research report that details Medicaid Statistical Information System  (MSIS) state data characteristics and anomalies to further vet states  selected for our audit work. We also used published GAO and  Department of Health and Human Services (HHS) Office of the Inspector  General (OIG) reports that detailed the limitations of the MSIS data we   Additionally, we interviewed officials responsible for  used for our study.their respective databases to discuss data-reliability considerations, and  reviewed prior work related to the quality of the MSIS data used for our  study.testing, we concluded that the data elements from the four states— Arizona, Florida, Michigan and New Jersey—used for this report were  sufficiently reliable for the purpose of identifying indicators of potential  fraud or abuse. However, in assessing the reliability of the data, we  observed reportable shortcomings such as issues with timeliness,  completeness, and accuracy in the data that may affect Medicaid  administrators’ ability to effectively oversee their program. We discuss  these shortcomings in greater detail earlier in this report.
On the basis of our discussions with agency officials and our own  To identify indicators of potentially fraudulent or abusive activities related  to prescription drugs in Medicaid, we obtained and analyzed Medicaid  claims paid in fiscal year 2011, the most-recent period from which we  could draw reliable data, for four states: Arizona, Florida, Michigan and  New Jersey. These states accounted for about 13 percent of the federal  share of fiscal year 2011 Medicaid expenditures. These states were  selected primarily because they had consistently comparable and reliable  data and were among the states with the highest Medicaid expenditures.  The results of our analysis of these states are not generalizable to other  states.
We obtained CMS MSIS beneficiary, provider, prescription-drug, and  other services claims data, as well as state Medicaid Management  Information Systems (MMIS) crosswalk data (with personal identifiers) to  perform our work. The crosswalk data we used contained specific  identifying information on prescribers, pharmacies, and beneficiaries that  were not collected in the MSIS data, such as name and address.  Additionally, managed-care organizations (MCO) receive a monthly  capitated payment.with managed care may not be reflected in the state claims that were  submitted to CMS for medical services, and hence our estimate is likely  understated. All of the states included in our review—Arizona, Florida,  Michigan, and New Jersey—had MCO arrangements in place.
As a result, the Medicaid paid amounts associated  We reviewed literature related to health-care fraud, including reports  discussing fraud, waste, and abuse related to prescription drugs. We  interviewed federal, state, and private-sector auditors, program  administrators, and other relevant officials who had published work that  investigated or researched prescription-drug fraud. On the basis of this  research, we identified areas at greater risk of fraud and abuse such as  drugs at high risk for diversion and types of prescribing patterns that  warranted additional review. We used this information to develop our  analytic approach to identify indicators of potential fraud and abuse  related to prescription drugs in Medicaid. To identify potential overuse, we  reviewed beneficiaries who received more than a 480-day supply of the  same medication in a single year based on the national drug code. To  identify potential doctor-shopping activities, we examined beneficiaries  who received prescriptions for drugs within one of two therapeutic classes  of drugs from five or more prescribers. We focused on beneficiaries who  received prescriptions for antipsychotics or respiratory medications from  five or more different prescribers over the course of 1 year. We selected  medications in these therapeutic classes because they had a large  number of individuals who received drugs from five or more prescribers  relative to other classes of noncontrolled substances we considered, have  a known diversion risk, and are relatively expensive. We selected the  five-or-more prescribers threshold based on our review of drug-diversion  literature and prior GAO work. Since we did not focus on all noncontrolled  substances, our analysis understates the number of instances and dollar  amounts related to potential doctor-shopping activities. We also looked  for prescribers and pharmacies with a high proportion of prescribing or  dispensing activities for brand-name drugs (versus generics) compared to  the average activity of other prescribers and pharmacies and pharmacies  without any adjusted or voided claims.
Our review did not include all drugs that may be used to treat HIV or diabetes. population. We restricted our review to only include beneficiaries who  received at least one prescription written during fiscal year 2011.
We also matched the Medicaid data to other external sources to identify  potential fraud and improper payments. We compared the beneficiary and  prescriber identity information shown in the Medicaid claims data to the  Social Security Administration’s (SSA) complete file of death information  from October 2012 to determine whether any individuals were reportedly  deceased before or when they purportedly prescribed, dispensed, or  received prescription drugs covered by Medicaid. To identify prescription- drug claims that might have been improperly processed and paid by the  Medicaid program because either the prescribers or beneficiaries were  incarcerated, we matched our selected states’ MMIS data to the states’  departments of corrections prisoner databases. Prisoner data included  individuals incarcerated for any period during fiscal year 2011. For  Arizona, Florida, and New Jersey, we identified provider and beneficiary  records for which the Medicaid Social Security number (SSN) and names  matched that of a person who was incarcerated in fiscal year 2011 in any  of the four states. Michigan did not provide SSNs in its incarceration data.  For Michigan, we identified provider and beneficiary records for which the  Medicaid name and birth day exactly matched that of a person who was  incarcerated in fiscal year 2011 in any of the four states. We then  identified Medicaid claims associated with the identified individuals by  matching to the MSIS data. We compared the beginning service date of  the claims to the individual’s admittance and release date to identify all  claims that occurred while the associated beneficiary or provider identity  was incarcerated. Additionally, we reviewed these claims’ type of service  to determine that none qualified for federal matching funds.
It is not possible to determine from data matching alone whether these  matches definitively identify recipients who were deceased or  incarcerated without reviewing the facts and circumstances of each case.  For example, it is possible that individuals can be erroneously listed in the  full Death Master File. Similarly, a provider or beneficiary may have an  SSN, name, and date of birth similar to an individual in state prison  records. Alternatively, our matches may also understate the number of  deceased or incarcerated individuals receiving assistance because  matching would not detect applicants whose identifying information in the  Medicaid data differed slightly from their identifying information in other  databases.
To identify Medicaid beneficiaries who received benefits in two or more  states concurrently, we identified all beneficiary SSNs that appeared in  two or more states’ MMIS data in fiscal year 2011. We then found all  claims associated with the beneficiary identities. We conducted further  analysis to determine the states in which each beneficiary identity  appeared and the service ranges—first and last prescribed date—for  those states. We defined a concurrent claim as a claim that occurred  within the service range of a second state for the same beneficiary  identity. For each claim, we compared its prescription date to the service  ranges for the beneficiary identity to determine whether it was a  concurrent claim. It is not possible to definitely say through data matching  alone that a beneficiary was improperly receiving Medicaid benefits in two  or more states concurrently without looking into further information for  each claim and beneficiary. For example, a beneficiary could have been a  resident in one state and received services, then changed residency to a  second state and received benefits for a brief period, before finally  relocating again back to the original state and receiving additional  services. In this case, the claims could have been identified as a  concurrent claim even if the beneficiary did not receive any services from  the original state during his or her relocation period in the second state.
To identify claims that might have been improperly processed and paid by  the Medicaid program because the federal government had excluded  these providers from providing services to Medicaid beneficiaries, we  compared the Medicaid claims to the exclusion and debarment files from  the Department of Health and Human Services’ (HHS) Office of Inspector  General (OIG) and the General Services Administration (GSA).  Specifically, we used the HHS List of Excluded Individuals and Entities  file from September 2012 and the GSA Excluded Parties List System  database extract from October 2011 to perform our match. We matched  MMIS and MSIS Medicaid data using SSN and individual name with both  the List of Excluded Individuals and Entities and the Excluded Parties List  System data extracts. We then identified unique individuals who had  Medicaid claims processed where the date of exclusion occurred before  the prescribed date in the Medicaid claims file.
To determine the extent to which federal and state oversight policies,  controls, and processes are designed to prevent and detect instances of  prescription-drug fraud in Medicaid, we reviewed CMS and state Medicaid  policies pertinent to program integrity over pharmaceuticals, met with  CMS officials, and visited state Medicaid offices that perform oversight  functions for the four states we selected. We used federal standards for  internal control, GAO’s Fraud Prevention Framework,statutes and regulations addressing the administration of pharmacy  benefits to evaluate these functions.
To determine the reliability of the data used in our analysis, we performed  electronic testing to determine the validity of specific data elements in the  federal and selected state databases that we used to perform our work.  We also interviewed officials responsible for their respective databases,  and reviewed documentation related to the databases and literature  related to the quality of the data. On the basis of our discussions with  agency officials and our own testing, we concluded that the data elements  used for this report were sufficiently reliable for our purposes.
We identified criteria for Medicaid fraud controls by examining federal and  state policies, laws, and guidance, including policy memos and manuals.  We interviewed officials from CMS and the state governments of Arizona,  Florida, Michigan, and New Jersey involved in Medicaid program  administration, auditing, and Medicaid fraud response.
We conducted this performance audit from March 2014 to July 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  audit findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: Comments from the Social Security Administration
section_title: Appendix IV: Comments from the Arizona Health Care Cost Containment System
section_title: Appendix V: Comments from the State of Florida Agency for Health Care Administration
section_title: Appendix VI: Comments from the New Jersey Department of Human Services
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Matthew Valenta (Assistant  Director), John Ahern, Mariana Calderón, Melinda Cordero, Julia DiPonio,  Lorraine Ettaro, Colin Fallon, Katherine Iritani, Barbara Lewis, Maria  McMullen, Kevin Metcalfe, Rubén Montes de Oca, James Murphy,  Christine San, and Paola Tena made key contributions to this report.