Medicare Program Integrity: Increased Oversight and Guidance Could Improve Effectiveness and Efficiency of Postpayment Claims Reviews
Published: 2014-07-18T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Several types of Medicare contractors conduct postpayment claims reviews to help reduce improper payments. Questions have been raised about their effectiveness and efficiency, and the burden on providers. GAO was asked to assess aspects of the claims review process.
Building on GAO's July 2013 report on postpayment claims review requirements, this report examines, among other things, the extent to which CMS has (1) data to assess whether contractors conduct duplicative postpayment claims reviews, (2) requirements for contractor correspondence with providers to help ensure effective communication, and (3) strategies for coordination of claims review activities. GAO reviewed CMS's requirements for claims reviews; interviewed CMS officials, selected contractors, and provider associations; analyzed CMS data; assessed a nongeneralizable sample of 114 pieces of contractor correspondence for compliance with requirements; and assessed CMS's requirements and oversight against federal internal control standards and other guidance.
section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) has taken steps to prevent its contractors from conducting certain duplicative postpayment claims reviews—reviews of the same claims that are not permitted by the agency—but CMS neither has reliable data nor provides sufficient oversight and guidance to measure and fully prevent duplication. The four types of contractors GAO reviewed that examine providers' documentation to determine whether Medicare's payment was proper included
Medicare Administrative Contractors (MAC), which process and pay claims;
Zone Program Integrity Contractors (ZPIC), which investigate potential fraud;
Recovery Auditors (RA), tasked with identifying on a postpayment basis improper payments not previously reviewed by other contractors; and
the Comprehensive Error Rate Testing (CERT) contractor, which reviews claims used to annually estimate Medicare's improper payment rate.
CMS implemented a database to track RA activities, designed in part to prevent RAs, which conducted most of the postpayment reviews, from duplicating other contractors' reviews. However, the database was not designed to provide information on all possible duplication, and its data are not reliable because other postpayment contractors did not consistently enter information about their reviews. CMS has not provided sufficient oversight of these data or issued complete guidance to contractors on avoiding duplicative claims reviews.
CMS requires its contractors to include certain content in postpayment review correspondence with providers, but some requirements vary across contractor types and are not always clear, and contractors vary in their compliance with their requirements. These factors can lead to providers receiving less information about the reviews and thus decrease effective communication with them. In addition, the extent of CMS's oversight of correspondence varies across contractors, which decreases assurance that contractors comply consistently with requirements. In the correspondence reviewed, GAO found high compliance rates for some requirements, such as citing the issues leading to an overpayment, but low compliance rates for requirements about communicating providers' rights, which could affect providers' ability to exercise their rights.
CMS has strategies to coordinate internally among relevant offices regarding requirements for contractors' claims review activities. The agency also has strategies to facilitate coordination among contractors, such as requiring joint operating agreements between contractors operating in the same geographic area. However, these strategies have not led to consistent requirements across contractor types or full coordination between ZPICs and RAs. GAO previously recommended that CMS increase the consistency of its requirements, where appropriate, and the HHS Office of Inspector General has recommended steps to improve coordination between ZPICs and RAs.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS take actions to improve the efficiency and effectiveness of contractors' postpayment review efforts, which include providing additional oversight and guidance regarding data, duplicative reviews, and contractor correspondence. In its comments, the Department of Health and Human Services concurred with the recommendations and noted plans to improve CMS oversight and guidance.

section_title: Letter
paragraphs: In fiscal year 2014, Medicare will cover more than 50 million elderly and  disabled beneficiaries at an estimated cost of $595 billion. Because of its  size, complexity, and susceptibility to mismanagement and improper  payments, for more than 20 years we have designated Medicare as a  high-risk program. Improper Medicare payments include payments made  for treatments or services that were not covered by program rules, that  were not medically necessary, or that were not provided to beneficiaries  in the way that they were billed to Medicare. In fiscal year 2013, the  Centers for Medicare & Medicaid Services (CMS)—the agency within the  Department of Health and Human Services (HHS) that administers the  Medicare program—made payments for about 1.2 billion fee-for-service  (FFS) claims and was estimated to have made improper payments of   $36 billion in the Medicare FFS program.
CMS has a goal to reduce improper payments in the Medicare program  and conducts a number of activities in order to protect the integrity of the  program—that is, to ensure that payments are made correctly the first  time and to identify, investigate, and recoup payments made in error. One  such activity is the review of FFS claims and related documentation from  providers after payment has been made. These postpayment claims  reviews by Medicare contractors’ trained clinicians and coders can  determine if a claim was paid properly and may help determine if the  claim was potentially fraudulent. Currently, CMS uses several different  types of contractors to conduct postpayment claims reviews: Medicare  Administrative Contractors (MAC), which process and pay claims and  also recoup overpayments and remediate underpayments; Zone Program  Integrity Contractors (ZPIC), which investigate potential fraud; the  Comprehensive Error Rate Testing (CERT) contractor, which conducts  postpayment reviews as part of estimating Medicare’s improper payment  rate; and Recovery Auditors (RA), which conduct postpayment reviews to  detect improper payments in claims not previously reviewed by staff from  other contractors. In 2012, the RAs conducted 83 percent of the roughly  1.4 million postpayment claims reviews conducted that year, with MACs,  ZPICs, and the CERT contractor conducting the remainder.
The four types of contractors use the same general process for  conducting postpayment claims reviews: they select claims, request  documentation from providers to support Medicare coverage of those  claims, apply Medicare coverage and coding requirements to determine if  the claims were paid properly, communicate the results of their reviews to  the providers, and use quality assurance processes to help ensure the  quality and consistency of their reviewers’ decisions. However, as we  reported in July 2013, these types of contractors were established by  different laws and for varying purposes, and they report to different units  within CMS. This presents challenges to CMS’s coordination and  oversight of contractors’ claims review efforts, including ensuring  consistency in the claims review process, and creates the potential for the  same claims to be reviewed more than once by different contractors.  Further, we also reported that CMS’s requirements for many aspects of  the claims review process differ across the contractor types. Some of  these differences may impede the efficiency and effectiveness of  postpayment claims reviews and are inconsistent with federal guidelines  to streamline service delivery. In July 2013, we recommended that CMS  examine the postpayment review requirements for the contractors to  determine those that could be made more consistent without impeding  efforts to reduce improper payments. HHS concurred with the  recommendations in the report and CMS officials told us that they have  begun examining their requirements with the intention of increasing the  consistency of requirements where possible.
In addition, questions have been raised recently about whether CMS’s  coordination and oversight of postpayment review contractors provide  adequate assurance that the reviews are effective and efficient and  whether the agency is minimizing administrative burdens on providers.  CMS officials indicated that they consider duplicative claims reviews to be  appropriate under some circumstances. However, CMS officials consider  other duplicative claims reviews to be inappropriate; any such  inappropriate reviews could create an unnecessary burden on some  providers and contractors. You asked us to assess several aspects of  CMS’s coordination and oversight of claims review activities, building on  our earlier report.
This report examines the extent to which (1) CMS has data to assess  whether contractors conduct duplicative postpayment claims reviews and  whether CMS ensures that these contractors do so only when  appropriate, (2) CMS’s requirements for contractor correspondence with  providers help ensure effective communication, (3) CMS uses quality  assurance processes to ensure that contractors’ postpayment claims  review decisions about whether claims were paid properly are  appropriate, and (4) CMS has strategies for coordination of postpayment  claims review activities among different types of contractors.
For the first objective, we defined a duplicative claims review as one in  which more than one contractor conducted postpayment reviews of the  same claim, using associated documentation obtained from the same  provider. We reviewed CMS documents, such as the Medicare Program  Integrity Manual, to identify the CMS requirements for contractors to  prevent inappropriate duplicative claims reviews. We reviewed relevant  documentation and interviewed knowledgeable officials about CMS’s  Recovery Audit Data Warehouse—a database of claims CMS developed,  in part, to prevent duplicative claims reviews by the RAs—to assess  whether it could be used to estimate the number of times in 2012 that a  contractor reviewed a claim for which an RA had also initiated a review.  We assessed the Recovery Audit Data Warehouse data for this purpose  by reviewing relevant documents; conducting electronic data testing to  look for missing data, outliers, or obvious errors; and analyzing the data  to identify potentially duplicative reviews. We also reviewed relevant  Recovery Audit Data Warehouse summary data provided by CMS. We  determined the data were not sufficiently reliable to estimate the number  of times in 2012 that a contractor reviewed a claim for which an RA had  also initiated a review, as further discussed in the report.
We interviewed CMS officials from the three offices responsible for  managing and overseeing the four contactor types—the Center for  Medicare, Office of Financial Management, and Center for Program  Integrity—about what types of duplicative claims reviews the agency  considers appropriate and inappropriate, about the reliability of the data  the agency had on duplication, and about the agency’s efforts to limit  inappropriate duplicative claims reviews. We interviewed representatives  from 11 postpayment review contractors—all 4 RAs, the CERT  contractor, and a nongeneralizable sample of 3 of the 6 ZPICs and 3 of  the 16 MACs—to learn about any steps the contractors take to prevent  duplication. (Details about how we selected our sample are in app. I.) We  also interviewed representatives from 13 associations representing  Medicare FFS providers who have experienced postpayment claims  reviews to learn about their concerns regarding duplicative claims  reviews. Using federal internal control standards for control activities, we  evaluated CMS’s efforts to help ensure that contractors do not  inappropriately duplicate other contractors’ claims reviews.
To assess the extent to which CMS’s requirements for contractor  correspondence with providers help to ensure effective communication  with providers, we reviewed CMS manuals, such as the Medicare  Program Integrity Manual, and contractors’ statements of work to identify  CMS’s requirements for the content of the correspondence, and we  confirmed those requirements with agency officials. We focused our  review on two frequently used types of correspondence sent to providers  during postpayment claims reviews: letters requesting documentation  such as medical records from providers—called additional documentation  requests (ADR)—and letters providing information on the results of the  reviews, called results letters. We evaluated the extent to which CMS’s  requirements for contractor correspondence with providers help to ensure  effective communication with providers on the basis of federal standards   as well as according to guidance developed by the  for internal controls Office of Management and Budget (OMB) to help agencies implement  Executive Order 13571—Streamlining Service Delivery and Improving  Customer Services. We interviewed CMS officials and representatives  from postpayment review contractors and provider associations about  contractor correspondence. We collected and analyzed a  nongeneralizable sample of 114 letters from the contractors in our sample  to assess their compliance with CMS requirements. (Details about how  we selected the correspondence and assessed it for compliance with  CMS requirements are in app. I.) We reviewed CMS’s processes for  overseeing contractor correspondence against an internal control  standard for monitoring quality. To ascertain CMS’s procedures for  contractor oversight related to correspondence, we reviewed CMS  documents, such as manuals and contractors’ statements of work, and  interviewed CMS officials.
To examine how CMS uses quality assurance processes to ensure that  contractors’ postpayment claims review decisions about whether claims  were paid properly are appropriate, we reviewed CMS documents, such  as manuals and contractors’ statements of work, to identify relevant CMS  requirements and agency efforts to monitor postpayment reviews. We  also interviewed CMS officials and representatives from postpayment  review contractors about quality assurance efforts, and representatives of  provider associations about contractors’ claims review decisions. We  assessed CMS’s requirements and the agency’s monitoring efforts using  the standards outlined in the federal internal control standards for  monitoring.
To assess the extent to which CMS has strategies to coordinate  postpayment claims review activities among the different types of  contractors, we reviewed CMS manuals and contractors’ statements of  work to identify CMS’s requirements and practices for (1) coordinating  internally among the three CMS offices that oversee postpayment review  contractors, and (2) coordinating contractors’ postpayment claims review  activities. We also interviewed CMS officials and representatives from  postpayment review contractors about CMS’s coordination efforts. We  evaluated CMS’s requirements and practices for coordinating internally  and coordinating its contractors’ postpayment claims review activities  using prior GAO work on practices that can help federal agencies  collaborate effectively.
We conducted this performance audit from April 2013 to July 2014 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Contractors have a long-standing and essential role in administering the  Medicare program, including conducting program integrity activities, such  as postpayment claims reviews, which are integral to protecting the  Medicare program from improper payments or fraud. The four types of  contractors we examined conducted about 1.4 million claims reviews that  involved examining documentation sent in by providers in 2012, which  represented less than one percent of all FFS claims in that year.
subsections: section_title: Four Types of Contractors That Conduct Postpayment Claims Reviews
paragraphs: MACs conduct postpayment claims reviews on a small percentage of paid  claims to determine if the payments were proper based on the underlying  documentation. MACs use the findings from postpayment claims reviews  to help prevent future payment errors, for example, by reviewing claims  received from specific providers or for specific services with a history of  improper payments to determine whether additional action is needed to   As of February 2014,  prevent similar improper payments in the future.12 A/B MACs processed Medicare Part A and Part B claims from  providers in each of 12 jurisdictions nationwide, and 4 DME MACs  processed DME claims from providers in each of 4 jurisdictions  nationwide. In 2012, A/B and DME MACs conducted 84,070  postpayment claims reviews, or 6 percent of about 1.4 million total  postpayment claims reviews conducted that year.
The mission of the ZPICs is to identify and investigate potentially  fraudulent FFS claims and providers in each of seven geographic  jurisdictions, which are called zones. They use several methods to  investigate potentially fraudulent claims and providers, including  postpayment claims reviews. In 2012, ZPICs conducted 107,621  postpayment claims reviews, or 8 percent of the total postpayment claims  reviews that year.
The CERT contractor conducts postpayment claims reviews on a  nationwide random sample of claims, which are used to annually estimate  the national Medicare FFS improper payment rate. This helps CMS  comply with legal requirements for improper payment reporting.reviews are used to estimate the national Medicare improper payment  rate, and to estimate the improper payment rate for each MAC and by  type of service and provider. In 2012, the CERT contractor conducted  41,396 postpayment claims reviews used to estimate the improper  payment rate, or 3 percent of the total postpayment claims reviews  conducted that year.
The mission of the RAs is to conduct postpayment claims reviews to  identify improper payments not previously identified through MAC claims  processing or other contractors’ reviews. Following a demonstration of  recovery auditing required by the Medicare Prescription Drug,  Improvement, and Modernization Act of 2003, the Tax Relief and Health  Care Act of 2006 established the National RA program. Use of RAs  expands the capacity for claims reviews without placing additional  demands on CMS’s budget, because the RAs are paid from funds  recovered rather than appropriated funds. As a result of lessons learned  during the RA demonstration project and to establish tighter controls on  RAs, CMS imposed certain postpayment requirements unique to the RAs  when it implemented the national program that it has not imposed on the  other contractors. For example, prior to widespread use, RAs must submit  to CMS for review and approval descriptions of the types of claims that  they propose to review. CMS expects the RAs to select only those claims  with the highest risk of improper payments. RAs must also submit the  basis for assessing whether the claims for those services are proper.  CMS established national RA operations in 2009 with one RA in each of  four regions that together cover the United States. Federal law requires  CMS to pay RAs on a contingency basis from Medicare overpayments  recouped. However, if an RA’s overpayment determination is overturned  on appeal, the RA is not paid for that claim. In contrast, MACs, ZPICs,  and the CERT contractor are paid on the basis of the costs for the tasks  performed. CMS reported that overpayments collected from the RAs  increased from about $75 million in fiscal year 2010 to about $2.29 billion  in fiscal year 2012. In 2012, the RAs conducted over 1.1 million  postpayment claims reviews, or 83 percent of the total postpayment  claims reviews that year.
section_title: Postpayment Claims Review Process
paragraphs: CMS provides guidance to its contractors on how they should analyze  data to select claims for review. Within that guidance, contractors select  the specific claims to review. Each of the four types of contractors selects  claims for postpayment claims review using somewhat different bases for  selection. (See table 1.) The potential for duplicative reviews exists  because claims may be selected by more than one contractor. CMS  officials told us that, in some cases, duplication is appropriate. For  example, CMS officials told us that the CERT contractor may review a  claim that has already been reviewed by another contractor because it  must select a random sample of claims to estimate the Medicare  improper payment rate.
Once a contractor selects a claim for review, the contractor notifies the  provider that a particular claim is under postpayment review and requests  documentation from the medical record to substantiate the claim. When  the contractor receives the documentation, a trained clinician or coder  evaluates the documentation in light of all applicable Medicare coverage  policy and coding guidelines to determine whether the payment for the  services or items claimed was proper. If a MAC or another contractor  determines that an overpayment was made, the MAC will seek repayment  and send the provider what is referred to as a demand letter. In the event  of an underpayment, the MAC will return the balance in a future  remittance. Providers may appeal the contractors’ determinations.
section_title: Recovery Audit Data Warehouse
paragraphs: CMS developed the Recovery Audit Data Warehouse to track RA review  activities and to prevent RAs from duplicating other contractors’ claims  reviews. Since most of the postpayment claims reviews were conducted  by RAs, RA review would be most likely to cause any potential  duplications. To prevent RAs from duplicating reviews, the MACs, ZPICs,  the CERT contractor, and other entities can enter the claims they have  reviewed into the Recovery Audit Data Warehouse, and the database  stores them as excluded claims (or exclusions). Exclusions are  permanent, meaning that excluded claims are not supposed to ever be  available for review by the RAs. In addition, the ZPICs and law  enforcement entities, such as the HHS Office of Inspector General (OIG),  can upload claims into the Recovery Audit Data Warehouse that they  may, but not necessarily will, select for postpayment review as part of a  fraud investigation and the database stores them as suppressions.While a claim is suppressed, it is unavailable for RA review. When a ZPIC  or law enforcement agency concludes its investigation, the suppressions  are required to be lifted. CMS then requires formerly suppressed claims  for which medical records were requested to be excluded and thus  become ineligible for RA review; all other formerly suppressed claims are  to be released for possible future postpayment review. CMS requires  ZPICs and law enforcement agencies to renew their suppressions every  12 months. If not renewed, the Recovery Audit Data Warehouse is to  automatically release the suppressed claims.
Before an RA begins postpayment claims reviews, it enters the claims it is  considering for review into the Recovery Audit Data Warehouse. The  database then checks to see if any of the claims the RA entered match  the excluded or suppressed claims already stored in the database. If  there is a match, the claim is not available for the RA to review and the  Recovery Audit Data Warehouse will not allow the RA to enter any  additional information about the claim. Although the other postpayment  review contractors also are able to check the Recovery Audit Data  Warehouse to see if the claims they are considering for review have  already been reviewed by other contractors, the database is intended  primarily to prevent RAs from conducting duplicative reviews. According  to CMS officials, the amount of duplicative claims reviews among the four  types of contractors is likely to be very small.
section_title: Criteria for Assessing Efficient and Effective Postpayment Claims Review Activities
paragraphs: Internal controls can help ensure that contractors are conducting  postpayment claims reviews efficiently and effectively. Internal controls  are the plans, methods, and procedures used to meet an organization’s  mission, goals, and objectives, and help provide reasonable assurance  that an organization achieves effective and efficient operations. For  example, monitoring helps agencies ensure that contractor activities  follow agency requirements. CMS requirements for contractors  performing postpayment claims reviews and the manner in which the  agency delegates authority and responsibility through these requirements  help establish the control environment and control activities. Contractor  requirements also establish the mechanisms that contractors use to  communicate and interact with providers. Ineffective or inefficient  requirements for claims reviews or insufficient monitoring and oversight  create the risk of generating false findings of improper payments and an  unnecessary administrative and financial burden for Medicare- participating providers and the Medicare program.
The process of postpayment claims review requires contractors to interact  and communicate with Medicare providers that directly provide medical  services to beneficiaries. Executive Order 13571—Streamlining Service  Delivery and Improving Customer Services—was issued in April 2011 to  improve government services to individuals and private entities by  requiring agencies to develop customer service plans in consultation with  OMB. OMB issued implementing guidance for agencies for those  services that the agencies plan to focus on improving.calls on agencies to improve customers’ experiences by a number of  activities, including developing a process for ensuring consistency across  the agency’s interactions with customers and coordinating with other  agencies serving the same customers, as well as identifying opportunities  to use common materials and processes.
Collaboration is important when multiple contractors that conduct similar  activities are overseen by different CMS units. Previous GAO work has  identified practices that can help federal agencies collaborate effectively  when they work together to achieve goals. This work highlighted, for example, the importance of agreeing on roles and responsibilities;  establishing compatible policies, procedures, and other means to operate  across organizational boundaries; and establishing mutually reinforcing or  joint strategies to help align activities, processes, and resources to  achieve a common outcome. These collaboration practices can also be  useful when multiple offices within an agency—or an agency’s  contractors—work together toward a common purpose.
section_title: CMS Lacks Reliable Data to Estimate the Number of Duplicative Claims Reviews and Has Not Taken Sufficient Steps to Prevent Inappropriate Duplication
paragraphs: CMS lacks reliable data to estimate the number of duplicative claims  reviews that are conducted. The Recovery Audit Data Warehouse was  not designed to estimate the number of duplicative reviews among all four  types of contractors, and not all contractors have been entering  information consistently into the database. CMS has not monitored  contractors’ data entry into the Recovery Audit Data Warehouse to  ensure that it is complete and correct. CMS also has not issued complete  guidance for MACs and ZPICs on whether it is appropriate for them to  conduct duplicative reviews.
subsections: section_title: CMS Lacks Reliable Data and Does Not Sufficiently Oversee Data Entry to Avoid Inappropriate Duplication
paragraphs: CMS does not have reliable data to estimate the total number of  duplicative claims reviews by all four types of contractors. In part, this is  because CMS did not design the Recovery Audit Data Warehouse to  estimate the total number of duplicative reviews. The RAs performed  more than 80 percent of the claims reviews in 2012 and the Recovery  Audit Data Warehouse was designed to track RA claims review activities  and to prevent RAs from duplicating other contractors’ claims reviews; it  was not designed to track and prevent duplicate claims reviews by the  other three contractor types. For example, the Recovery Audit Data  Warehouse does not show whether contractors other than RAs, such as a  MAC and a ZPIC, duplicated each others’ claims reviews. Therefore, the  Recovery Audit Data Warehouse data are not sufficient and reliable for  accurately estimating the number of duplicative reviews by all four types  of contractors.
Another reason the Recovery Audit Data Warehouse cannot be used to  estimate the amount of duplication is that not all of the four types of  contractors consistently enter data into the database. For example, in  response to our analysis that showed anomalies in the distribution of  apparently duplicated claims, CMS officials told us that some MACs have  been entering data from appeals reviews into the Recovery Audit Data  Warehouse as exclusions.Data Warehouse data were used to estimate duplication, claims reviews  for which MACs entered appeals of claims as exclusions would appear to  be duplicative reviews.
The officials noted that if Recovery Audit  Similarly, we found that, in 2012, more than half of the ZPICs did not  enter claims they reviewed into the Recovery Audit Data Warehouse as  exclusions, which makes the database less effective in preventing the  RAs from duplicating other contractors’ claims reviews. CMS provided  data to us that showed that five of the six ZPICs had not entered any  claims into the Recovery Audit Data Warehouse as exclusions in 2012,  although these ZPICs had performed postpayment claims reviews. officials told us they do not monitor contractors’ entry of exclusions and  suppressions to ensure this information is accurate or complete, although  they recognized, before we examined the Recovery Audit Data  Warehouse exclusion data with CMS, that some ZPICs may not enter  claims they review as exclusions. These officials stated that if ZPICs did  not exclude these claims, they would be available for an RA to review,  which could lead to inappropriate duplication. CMS officials told us that  they had held meetings with all of the ZPICs to educate them about the  available options in the Recovery Audit Data Warehouse that could  augment their antifraud activities.
Although there are seven ZPIC zones, only six ZPICs are operational and four program  safeguard contractors conduct reviews in one zone.
RA of an ongoing investigation either by suppressing affected claims in  the Recovery Audit Data Warehouse or through any other methods of  coordination. Checking the accuracy of data is part of a strong internal  control environment and provides an agency with assurance that the data  needed for operations are reliable and complete.
section_title: CMS Has Issued Guidance for Some but Not All Contractors about When Duplicative Reviews Are Permitted
paragraphs: CMS has issued guidance for RAs and the CERT contractor about  whether they may conduct duplicative claims reviews. CMS’s Medicare  Program Integrity Manual states that RAs are prohibited from reviewing  claims that have been reviewed by other contractors.manual for the CERT contractor states that it should select and review a  random sample of claims regardless of whether they have been reviewed  by other contractors, in order to establish the Medicare improper payment  rate accurately.
In contrast, CMS’s  However, CMS has not developed complete guidance for MACs and  ZPICs about whether they are permitted to duplicate other contractors’  claims reviews. Although a CMS official told us that MACs are not  permitted to conduct duplicative reviews and are required to check the  Recovery Audit Data Warehouse to prevent duplication, CMS guidance  states only that MACs are not permitted to duplicate the ZPICs’ claims  reviews and does not address whether MACs are permitted to duplicate  RA claims reviews. The guidance also does not address whether MACs  are expected to check the Recovery Audit Data Warehouse to prevent  duplication. Furthermore, representatives from two of the three MACs we spoke with believed that CMS permitted them to duplicate some  contractors’ reviews. A CMS official stated that clear guidance could be  helpful for contractors.
In the absence of complete guidance, officials from CMS and  representatives from a ZPIC and MAC differed in their understanding of  whether ZPICs could conduct duplicative reviews. CMS officials, including  those who oversee ZPICs, provided conflicting information about whether  CMS permits ZPICs to conduct duplicative reviews, and CMS officials  were unable to provide guidance to clarify whether duplication is  allowed. Representatives from a ZPIC and some CMS program integrity  officials told us that CMS permits ZPICs to conduct duplicative claims  reviews because ZPICs must be able to review any claim they deem  necessary to investigate potential fraud. However, CMS program integrity  officials told us that ZPICs may not duplicate reviews conducted by RAs  or MACs because overpayment for an improperly paid claim cannot be  collected twice.
Written guidance stating explicitly which contractors may conduct  duplicative claims reviews and when the different contractor types should  check the Recovery Audit Data Warehouse to avoid duplication is  important to prevent inappropriate duplication among the contractors and  to minimize confusion among CMS staff, CMS contractors, and  stakeholders, such as providers, about what is permitted. It is also  consistent with federal internal control standards, agencies to establish control activities that enforce management’s  directives. Without complete guidance for all postpayment claims review  contractors about when duplicative reviews are permitted, CMS does not  have assurance that MACs and ZPICs understand when and how to  avoid duplicative reviews. Absence of such guidance can also leave  providers confused about whether a duplicative review is appropriate.
See GAO/AIMD-00-21.3.1 and GAO-01-1008G, sections related to control activities.
section_title: Efficiency and Effectiveness of Communications to Providers May Be Reduced by Differences and Lack of Clarity in CMS’s Requirements, Contractor Compliance, and Extent of CMS’s Oversight
paragraphs: Several factors may reduce the efficiency and effectiveness of  contractors’ correspondence with providers. First, CMS’s requirements  differ across contractors for the content of two types of correspondence  contractors often send to providers during postpayment review, and  therefore contractors do not have to convey the same type of information  to providers. Second, for the correspondence we reviewed, we found that  contractors did not comply consistently with all applicable requirements.  Third, the extent of CMS’s oversight of contractor correspondence  differed across contractor types.
subsections: section_title: CMS’s Requirements for Correspondence Content Vary across Contractor Types and Are Not Always Clear
paragraphs: CMS requires contractors to include certain content in the  correspondence they send to providers, but the requirements sometimes  differ. All four types of contractors send providers an ADR if a provider’s  claim is selected for postpayment review. Upon completing their review,  MACs, ZPICs, and RAs notify providers of their findings in  correspondence we refer to as results letters. The CERT contractor  does not send results letters.correspondence include the reason the claim was selected for review, the  information the provider must submit, the contractor’s findings, and steps  providers may take in response to those findings.
CMS’s requirements for these types of  Some CMS requirements for correspondence are similar across all  contractor types. For example, CMS requires that ADRs for all contractors  specify the number of days the provider has to submit documentation in  response to a contractor’s request. Similarly, CMS requires that all  contractors’ results letters regarding an overpayment describe the issues  leading to the overpayment as well as any recommended corrective  actions the provider can take to avoid similar billing errors in the future.
However, other CMS requirements for correspondence differ by  contractor type. For example, ADRs from MACs, RAs, and the CERT  contractor, but not those from ZPICs, must give providers the option of  submitting documentation via paper, fax, CD/DVD, or electronically.  Similarly, results letters from MACs and ZPICs regarding claims that were  overpaid are required to include the overpayment amount for each claim, but CMS officials told us RAs are not required to include these amounts.MACs’ and ZPICs’ results letters are required to include the signature of a  person to contact with inquiries about the correspondence, whereas RAs’  results letters are not required to contain this information. (Table 2 shows  examples of CMS’s requirements for results letters.)
In addition, inconsistencies in CMS’s guidance made it difficult to identify  some of the requirements and their applicability. CMS conveys  requirements through statements of work contained in the contracts, and  in manuals that provide additional guidance on what contractors must do  and that may be specifically referenced in a statement of work. For ADRs  and results letters, we identified requirements in the RA statement of work  (which applies to RAs), the Medicare Program Integrity Manual, the  Medicare Contractor Beneficiary and Provider Communications Manual  (which applies to MACs and ZPICs), and the CERT Manual and CERT  statement of work (which apply to the CERT contractor). These  documents sometimes contained differing guidance about the information  the correspondence from different contractors must include. For example,  the RA statement of work in effect during our review specifically required  RA results letters to explain the procedures for recovering any  overpayments and providers’ rights to appeal, but the Medicare Program  Integrity Manual did not include these requirements for RAs. CMS officials  told us that the RA statement of work was the primary guiding document  for RA requirements; however, they also told us that they were not  requiring the RAs to include some of the content requirements listed for  results letters in the RA statement of work. As another example, the  Medicare Program Integrity Manual contains some differing guidance to  the MACs about their ADRs. While chapter 3 of the Medicare Program  Integrity Manual instructs MACs to notify providers in ADRs that they  have 45 days to respond to the request for documentation, this manual  also includes a sample ADR that MACs may use for postpayment review  that includes language informing providers that they have 30 days to  respond to the documentation request. In addition, the Medicare  Program Integrity Manual’s list of results letter requirements includes one  statement indicating that the MACs and ZPICs must include appeals  information in their results letters, as well as a different statement right  next to it indicating that only MACs must do so.
Without consistent and specific requirements for the content across  contractor types, CMS does not have assurance that, consistent with  federal internal control standards, providers receive similar and sufficient  information during claims reviews to understand their responsibilities in  responding or their rights if their claims are denied. Establishing  consistent processes to communicate with providers is also aligned with  OMB guidance to agencies to streamline service delivery and improve  customer service, which can increase administrative efficiency. Further,  inconsistencies in CMS’s requirements in contractors’ statements of work  and the Medicare Program Integrity Manual could make it difficult for  contractors to easily identify the most current set of requirements that  apply to contractor correspondence. CMS officials told us in October  2013 that the agency has begun to explore making requirements for the  content of ADRs more consistent across contractor types, such as by  standardizing the introduction for the letters used by each contractor.
section_title: Contractors Did Not Consistently Comply with Requirements for Correspondence Content
paragraphs: Compliance with CMS requirements was not consistent across contractor  types for the correspondence we reviewed. Our examination of 67 ADRs  found that, on average, contractor ADRs overall complied with 94 percent  of their applicable CMS requirements, but the compliance rate varied by  contractor type. RAs had the highest compliance rate (100 percent) and  the CERT contractor had the lowest rate (86 percent) (see fig. 1). Unlike  the ADRs from the other three contractor types, the ADRs that the CERT  contractor sends to providers are uniform and based on form letters  written by CMS. (See app. I for a list of the requirements we analyzed for  each type of contractor and each type of correspondence.)
While all four types of contractors met most or all of their ADR  requirements, compliance sometimes varied by requirement. For  example, though representatives of several provider associations have  reported that providers do not understand the reason their claims were  selected for review, all the MAC and RA ADRs we reviewed complied  with applicable requirements to identify the basis for the claim’s selection.  All of the contractors’ ADRs that were required to include instructions for  how to submit documentation to support the claim also complied.  However, not all contractor ADRs complied with a requirement that had  the potential to affect the timeliness of providers’ responses to the ADRs:  about 50 percent of the MAC ADRs, 30 percent of the ZPIC ADRs, and  100 percent of the CERT contractor ADRs gave providers fewer than the  required number of days to submit documentation.
Similar to ADRs, the number of requirements for results letters differed by contractor  type. On average, 18 requirements were applicable to each MAC results letter, 14 for  each ZPIC results letter, and 8 for each RA results letter. with the requirement to document in the letter a reason for conducting the  review or the rationale for good cause for having reopened the claims;  instead, the letters directed the provider to the contractor’s website or to  the ADR sent by the contractor previously. Also, 40 percent of the  ZPICs’ results letters complied with the requirement to cite a reason for  noncoverage or incorrect coding for each claim.
Contractors’ inconsistent compliance with CMS’s correspondence  requirements may lead to provider confusion and increased  administrative burden, and is not consistent with federal internal control  standards to have control activities to ensure that management’s  directives are carried out and to monitor the performance of agency  activities. For example, several provider associations indicated that it  was burdensome to pull together complete documentation quickly.  Therefore, giving providers response times that are shorter than required  in ADRs can add to providers’ burden. In addition, it can lead to less  efficient claims reviews—and potentially unnecessary claims denials—if  providers do not submit complete information (or respond) within the  shorter time frame. When providers are not notified of their rights in  results letters as required, they may have more difficulty exercising their  rights within required time frames, which could have financial  consequences for them.
section_title: Extent of CMS Oversight of Correspondence Differs by Contractor Type
paragraphs: The extent of CMS oversight of the content of contractors’ postpayment  review-related correspondence differs by type of contractor. For MACs,  CMS staff may review correspondence with providers during their annual  evaluations of each MAC’s performance. CMS staff indicated that they do  not review ZPIC postpayment claims review correspondence. An  independent RA validation contractor that evaluates RAs’ claims reviews  also assesses each RA’s correspondence for clarity and accuracy by  reviewing results letters associated with reviews included in a random  sample of up to 100 claims per RA per month, and CMS officials noted  that they review a sample of the RA correspondence during quarterly RA  performance assessments. According to CMS officials, the CERT  contractor’s ADRs are uniform and based on form letters written by CMS.  CMS officials stated that they did not believe they needed to monitor the  content of these ADRs since most of the text was a standard template  written by CMS. Our findings that contractors did not comply consistently  with CMS’s requirements for the correspondence we reviewed indicate  that CMS’s monitoring efforts in this area are not adequate to meet  federal internal control standards to monitor contractors’ activities.  Without adequate monitoring of contractors’ compliance with  correspondence content, CMS’s internal control is weakened and the  agency does not have assurance that the correspondence is accurate  and includes all of the content required.
section_title: CMS Requires Quality Assurance Processes for All Contractor Types to Help Ensure Appropriateness of Postpayment Review Decisions
paragraphs: CMS requires quality assurance processes for each of the contractor  types to help ensure the accuracy of their claims review decisions about  whether claims were paid properly, but the processes differ by contractor  type. These processes can be internal, external, or both. CMS requires  the four contractor types we reviewed to have some type of internal  quality assurance process to verify the accuracy of their claims review  decisions about whether claims were paid properly. In addition, for the  MACs, ZPICs, and RAs, CMS has implemented external validation  reviews in which staff from CMS or an independent contractor review a  selection of those contractors’ claims reviews.
subsections: section_title: All Four Contractor Types Must Use Internal Quality Assurance Processes
paragraphs: CMS requires the four contractor types to establish an internal quality  assurance process for verifying the accuracy of their claims review  decisions about whether the claim was proper to pay because the service  was medically necessary and billed properly according to Medicare  coverage and billing rules. In addition, CMS specifically requires the  MACs, ZPICs, and CERT contractor to conduct interrater reliability (IRR)  assessments—assessments that compare multiple decisions by their staff  reviewers about the same claim to determine the extent of their  agreement about whether the claim was paid properly or not—as part of  their overall quality assurance efforts. CMS officials told us that for the  new RA contracts the agency expects to award in 2014, CMS will also  require RAs to conduct IRR assessments as part of their efforts.
Contractors have discretion in how they conduct their IRR assessments,  according to CMS officials.
CMS monitors the results of contractors’ IRR assessments to varying  degrees but has not collected that information routinely from all contractor  types. CMS officials said they review monthly reports from the CERT  contractor about its IRR assessment results. CMS officials also told us  they expect to see a roughly 98 percent accuracy rate for each month’s  IRR assessment, which they said the CERT contractor usually achieves.  Beginning with the new contracts expected to be awarded in 2014, RAs  also will be expected to provide monthly information to CMS about their  IRR assessments, according to CMS officials. In contrast, CMS does not  routinely collect information from the MACs or ZPICs about their IRR  assessments. According to CMS officials, CMS does not require MACs to  report regularly on their IRR assessments, but agency officials may, at  their discretion, discuss MACs’ IRR assessments during their routine on-  CMS revised its requirements in October 2013 to  site visits with MACs. state that MACs must report their IRR assessment results to CMS as  directed, and CMS officials indicated that they will request MACs’ IRR  information on an as-needed basis rather than requiring all MACs to  provide specific IRR information on a predetermined schedule. Similarly,  CMS officials may discuss ZPICs’ IRR assessments during ZPICs’ annual  performance assessments or at other times, but have not collected  information routinely about ZPICs’ IRR assessment results, according to  CMS officials we spoke with.
section_title: CMS Has Some External Validation Reviews for Three of Four Contractor Types
paragraphs: CMS has implemented additional quality assurance processes in which  the MACs, ZPICs, and RAs have a sample of their claims reviews  undergo external validation by CMS or an independent contractor, using  clinical staff or coders, to assess the appropriateness of the contractors’  claims review decisions about whether the claim was paid properly  according to Medicare coverage and billing rules. These validation efforts  differ in frequency and process. While CMS has not implemented a  separate external validation of the CERT contractor’s claims reviews,  CMS officials told us that they have several other mechanisms to gauge  the appropriateness of those reviews.
MACs: According to CMS officials, in 2010, CMS implemented the  Accuracy Project to learn more about MACs’ claims review processes  and decision making, and to identify areas in which contractor training  might be needed or where CMS could clarify or modify its guidance. For  this project, a team of CMS clinical staff conducted validation reviews for  a selection of MACs’ claims reviews. In 2010 and 2011, CMS reviewed  more than 200 claims per year, and in each year CMS staff concurred  with all but one of the MACs’ claims review decisions. In 2012, CMS  increased the number of Accuracy Project staff and from September 2012  through February 2014 reviewed 1,160 claims and concurred with over   90 percent of the MACs’ decisions, according to CMS. CMS officials  noted that this has been a limited effort to date, most recently focused on  DME claims—specifically, power mobility devices. CMS officials said  they plan to broaden this effort to include other services. For this broader  effort, CMS plans to have the CERT contractor conduct validation reviews  of a random sample of 100 claims per MAC. The CERT contractor will  review the documentation the MACs used to reach decisions for those  claims, such as medical records, and evaluate the accuracy of MACs’  decisions by determining whether the MACs properly paid, adjusted, or  denied the claims on the basis of Medicare coverage, coding, and billing  rules. In April 2014, CMS officials told us that the CERT contractor had  just begun conducting validation reviews for several MACs.
ZPICs: To assess the appropriateness of the ZPICs’ claims reviews, CMS  staff examine a sample of those reviews when they conduct each ZPIC’s  annual performance assessment. For each ZPIC, CMS staff select 5  investigations or cases of particular providers and then select 5 claims for  each investigation or case, for a total of 25 claims. CMS clinical staff  then assess whether the ZPICs’ decisions were consistent with CMS  guidance and clinical judgment. According to CMS officials, they typically  find that ZPICs’ claims reviews decisions are satisfactory.
RAs: CMS has established an external validation process in which the  independent RA validation contractor uses licensed clinical professionals  and coders to assess the quality of each RA’s claims reviews. Each  month the RA validation contractor reviews a random sample of up to   400 RA-reviewed claims (up to 100 claims per RA) that are proportional  to the provider types that each RA determined had been paid improperly.  CMS officials told us that the RA validation contractor sends monthly  reports to CMS on the RAs’ claims review accuracy rates. According to  CMS’s most recently published report to Congress on the RAs, the  cumulative accuracy rates for fiscal year 2012 were between about 93  and 97 percent for the RAs.
CERT contractor: While CMS does not require a separate external  validation of the CERT contractor’s claims reviews, CMS officials told us  that the expansion of the Accuracy Project to involve CERT contractor  reviews of MACs’ claims will give them increased ability to examine the  CERT contractor’s claims review decisionmaking. They added that they  review the CERT contractor’s decisions on an as-needed basis, such as  when MACs dispute the CERT contractor’s findings of the MACs’  improper payment rates, or if a provider raises a concern to CMS about a  CERT contractor decision.
section_title: CMS Has Multiple Strategies for Coordinating Postpayment Claims Reviews, but Differences in Requirements and Contractor Coordination Remain That May Hamper Effectiveness and Efficiency of Claims Reviews
paragraphs: CMS has strategies to coordinate internally among relevant CMS offices  in developing the requirements for postpayment claims review  contractors’ activities and has strategies to facilitate coordination among  the contractor types. However, differences in contractor requirements  have continued and there is less coordination between ZPICs and RAs  compared to the coordination among other contractors.
subsections: section_title: CMS Has Strategies to Coordinate among Its Offices Regarding Contractor Requirements, but Differences in Requirements Continue to Exist
paragraphs: CMS has established strategies for coordination among the three CMS  offices that oversee postpayment review contractors—the Center for  Medicare, the Office of Financial Management, and the Center for  Program Integrity—to review proposed new or updated requirements for  contractors’ activities. This internal coordination is important because  contractors have many postpayment claims review activities in common,  but responsibilities for overseeing postpayment review contractors are  distributed across seven components within three CMS offices. (See   fig. 3.) Thus, coordination strategies among CMS’s offices are critical to  help ensure that contractor requirements are consistent when possible  and that the four types of contractors are conducting postpayment claims  reviews efficiently and effectively.
According to CMS officials, the Enterprise Electronic Change Information Management  Portal system is formal in that it provides a uniform entry and validation process before  any changes to CMS documents are finalized. In addition, there are written instructions for  how CMS officials are to submit, share, and sign off on documents in the Enterprise  Electronic Change Information Management Portal. contractors they were responsible for managing. As a result, one  office can make changes to requirements for the contractors they  manage that might lead to differences among the four types of  contractors’ requirements, but these changes might not be thoroughly  reviewed by all the offices.
However, CMS’s internal coordination strategies have not resolved long- standing differences in requirements across contractor types. In our July  2013 report, we reported that inconsistencies in contractor requirements  may impede efficiency and effectiveness of claims reviews by increasing  administrative burden on providers. For example, contractors had  different time frames for providers to submit documentation, which might  confuse providers and reduce compliance. CMS has begun to take steps  to make contractor requirements more consistent, where appropriate.  For example, in October 2013, CMS began requiring MAC, RA, and  CERT contractor ADRs to all give providers the same options for  submitting documentation. In addition, CMS officials said that their new  RA contracts will require RAs to establish an IRR process to assess their  claims reviews. Our findings in this report indicate that variations in  requirements continue to exist. Such variations may result in inefficient  processes and present challenges for providers for responding to  documentation requests. Variation in requirements across contractors  also is inconsistent with OMB’s executive-agency guidelines to streamline  service delivery and with having a strong internal control environment.  Further, this variation does not follow a practice that we have identified to  help facilitate and enhance collaborative efforts across organizational  boundaries.
section_title: CMS Has Strategies to Coordinate among Contractors
paragraphs: CMS has established multiple strategies to facilitate coordination among  postpayment claims review contractors. In addition to using the Recovery  Audit Data Warehouse to help prevent duplicative claims reviews, CMS  requires MACs, RAs, and ZPICs operating in the same geographic  jurisdiction to establish Joint Operating Agreements (JOA) to facilitate  coordination. CMS also sponsors meetings between different types of  contractors.
According to CMS officials, the JOA is a mechanism for different types of  contractors to document how they plan to work together. For example,  CMS officials told us JOAs are used by MACs and RAs to agree on  methods of communication and levels of service related to improper  payments, such as data sharing, file transmissions, data warehouse  uploads, and appeals. Officials also said ZPICs use the JOAs to come to  an agreement with the other contractors on how they will coordinate to  avoid duplicating claims reviews and to exchange information on potential  fraud. determined all the JOAs between the different contractor types had been  agreed upon by the contractors and were actively in use. We reported  previously that when implementing coordination strategies, agencies  benefit from having participants document their agreement for how they  will collaborate and that agencies should consider whether all relevant  participants have been included in and regularly attend collaboration- related activities.
Although CMS guidance on what should be included in these agreements varies by the  contractors’ relationships to each other, in general, JOAs are to specify how the  contractors intend to interact with one another. For example, CMS guidance states that  JOAs between MACs and RAs should include a communication process and time frames  for adjustments, recoupment, appeals, inquiries, and receipt of provider names and  addresses.
In addition to requiring JOAs, CMS holds regular meetings between  different types of contractors to help them coordinate their workloads and  to facilitate discussions of vulnerabilities and issues related to  postpayment claims reviews. Depending on the meeting, some types of  contractors are required to attend, while others are invited. For example,  to help MACs and RAs better target their claims selection to identify  improper payments, CMS has required these contractors to meet weekly  to discuss vulnerabilities identified by RAs. CMS officials said that ZPICs  also are invited to these meetings, but they are not required to attend.  CMS also requires the MACs, CERT contractor, and RAs to attend CMS’s  annual medical review training conference, where CMS and contractor  staff discuss CMS policy, program integrity vulnerabilities, and other  medical review issues. Although ZPICs are not required to attend this  conference, some do.
Other than CMS’s annual medical review training conference, ZPICs and  RAs do not have structured meetings with each other to share information  on vulnerabilities and potential fraud. All three ZPICs we spoke with said  they meet with MACs on a regular basis to discuss medical review  strategies, operational issues, and their JOAs with the MAC. According to  one ZPIC, the interactions with the MAC ensure they are sharing best  practices and receiving information expeditiously. However, two of the  ZPICs we spoke with also said they do not coordinate with the RAs in  their geographic jurisdictions. HHS’s OIG recently recommended that to  ensure that RAs refer all appropriate cases of potential fraud, CMS  should facilitate increased collaboration between RAs and ZPICs, such as  by coordinating regular meetings to share information about potentially  fraudulent coding or billing schemes and to advise RAs of emerging fraud  schemes.recommendation. CMS officials also told us that the new RA statement of  work for the upcoming procurement will include a requirement for the RAs  to meet with the ZPICs in their geographic jurisdictions quarterly, at a  minimum, to discuss trends in possible fraudulent billing.
According to the OIG report, CMS concurred with OIG’s  Established JOAs and regular meetings between different contractor  types provide more assurance that postpayment claims reviews are  conducted as efficiently and effectively as possible and opportunities to  further reduce improper payments are not overlooked. Coordination  among the contractors promotes sharing of information that can be critical  to identifying vulnerabilities to improper payments. For example, while  reviewing claims, each contractor may be identifying vulnerabilities to  improper payment that may also be present in other jurisdictions, as well  as improper payment issues that could be better addressed by another  type of contractor. In addition, MACs’ and RAs’ claims reviews sometimes  identify instances of potential fraud, which they are expected to refer to  ZPICs for further investigation.
section_title: Conclusions
paragraphs: Postpayment claims review contractors play an important role in helping  CMS reduce improper payments in the Medicare program. Because  different types of contractors conduct similar claims reviews, CMS  guidance, oversight, and coordination of them is essential to maintaining  an appropriate balance between detecting improper payments effectively  and efficiently and avoiding unnecessary administrative burdens. CMS  has taken a number of steps to guide, oversee, and coordinate its  contractors’ postpayment claims review efforts. However, further actions  by CMS could help improve the efficiency and effectiveness of its  contractors’ efforts.
CMS does not have sufficient information to determine whether its  contractors are conducting inappropriate duplicative claims reviews. We  found that CMS has conducted insufficient data monitoring to prevent the  RAs from conducting inappropriate duplicative reviews. If the Recovery  Audit Data Warehouse information on excluded claims is inaccurate, as  we found is sometimes the case, the Recovery Audit Data Warehouse’s  effectiveness in preventing the RAs from conducting inappropriate  duplicative claims reviews is limited. In addition, while CMS has issued  clear guidance for RAs and the CERT contractor about whether they are  permitted to conduct duplicative reviews, it has not issued similar  guidance for the MACs and ZPICs. If CMS does not intend for the MACs  and ZPICs to conduct duplicative reviews, issuing complete guidance  stating so is important to prevent inappropriate duplication.
Furthermore, having consistent guidance and ensuring that contractors  comply with the requirements that apply to them can improve the  efficiency and effectiveness of contractors’ communication with providers.  It is important that providers understand the postpayment claims review  process, including what documentation they need to send to contractors,  the steps in the review process, and their rights. More consistent  requirements and better monitoring of contractors’ compliance with  correspondence content guidance would increase CMS’s assurance that  providers are given similar and sufficient information during claims  reviews and that the correspondence is accurate and includes all of the  content required.
Although CMS has strategies to coordinate internally among the CMS  offices that oversee postpayment claims review contractors—as well as  strategies to facilitate coordination among the contractors themselves— differing requirements for the postpayment claims reviews conducted by  different types of contractors continue to exist. CMS is currently working  to address some of the differences, but will need to remain vigilant as  requirements are updated in the future. Moreover, CMS must ensure that  its current methods for ensuring effective collaboration among contractors  are working as intended. The comparatively limited amount of required  communication between ZPICs and other contractors addressing  improper payment issues reduces CMS’s assurance that the four types of  postpayment contractors that we reviewed are coordinating as effectively  as possible to reduce improper payments and fraud.
section_title: Recommendations for Executive Action
paragraphs: In order to improve the efficiency and effectiveness of Medicare  postpayment claims review efforts and simplify compliance for providers,  we recommend that the Administrator of CMS take the following four  actions: monitor the Recovery Audit Data Warehouse to ensure that all  postpayment review contractors are submitting required data and that  the data the database contains are accurate and complete; develop complete guidance to define contractors’ responsibilities  regarding duplicative claims reviews, including specifying whether and  when MACs and ZPICs can duplicate other contractors’ reviews;  clarify the current requirements for the content of contractors’ ADRs  and results letters and standardize the requirements and contents as  much as possible to ensure greater consistency among postpayment  claims review contractors’ correspondence; and assess regularly whether contractors are complying with CMS  requirements for the content of correspondence sent to providers  regarding claims reviews.
section_title: Agency and Third Party Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS and received written comments,  which are reprinted in appendix II. In its comments, HHS agreed with our  findings and concurred with all four recommendations. HHS also  described steps it plans to take to remedy the issues we identified.
We also provided portions of the draft report for review and comment to  the contractors in our sample. We received responses via email from all  but one contractor. The contractors generally agreed with our findings as  applicable to their contractor type. Representatives from all four RAs  commented on our finding that none of the RA results letters met the  requirement to document in the letter a reason for conducting the review  or the rationale for good cause for reopening the claims. Representatives  from two RAs commented that they believed their results letters did  sufficiently indicate the reason for the review, and representatives from  three RAs pointed out that CMS had reviewed and approved the text of  their letters. However, as we noted in the draft report, we determined that  none of the RA results letters met this requirement because the text was  not sufficient to provide a reason for review or rationale for good cause. In  response to comments from the RAs, we have modified the text in the  report to more prominently note that the results letters do refer providers  to the contractor’s website or to the ADR to obtain the reason for the  review.
HHS and the contractors also provided technical comments, which we  incorporated into the report as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff that made key contributions to this  report are listed in appendix III.
section_title: Appendix I: Scope and Methodology
paragraphs: This appendix gives additional detail about two aspects of our  methodology for addressing the report’s objectives. Specifically, we  explain our methodology for selecting and assessing the sample of  postpayment claims review contractors we interviewed as part of our work  to address all four objectives. We also provide information on our  methodology for selecting the correspondence—additional documentation  requests (ADR) and results letters—from the contractors in the sample  we used to examine how CMS’s requirements for contractor  correspondence with providers help ensure effective communication.
To learn about postpayment claims review contractors’ claims review  efforts, we interviewed representatives from 11 postpayment review  contractors. We selected all four Recovery Auditors (RA) because they  conduct substantially more postpayment claims reviews than all the other  contractors combined, and the Comprehensive Error Rate Testing  (CERT) contractor, which reviews a nationwide random sample of claims.  We also selected a nongeneralizable sample of 3 of the 16 Medicare  Administrative Contractors (MAC), including 2 of the 12 MACs that  process Part A and B claims and 1 of the 4 MACs that process claims for  durable medical equipment. We selected these 3 MACs because they  had been in operation for at least 6 months, performed postpayment  claims reviews in 2012, and were geographically diverse. We selected a  nongeneralizable sample of 3 of the 6 Zone Program Integrity Contractors  (ZPIC) that had been in operation for at least 1 year and whose service  areas included some of the same states served by the 3 MACs in our  sample.
To assess the extent to which CMS requirements for the content of  contractors’ correspondence with providers help ensure effective  communication, we focused our review on ADRs and results letters. We  reviewed the Medicare Program Integrity Manual, Medicare Claims  Processing Manual, Medicare Financial Management Manual, Medicare  Contractor Beneficiary and Provider Communications Manual, CERT  Manual, and the contractors’ statements of work to identify CMS  requirements for this correspondence. Because there were some  discrepancies and issues of clarity in the requirements for these sources,  we confirmed the requirements with CMS. To assess the correspondence  against these requirements, we asked the contractors in our sample to  provide us with all correspondence associated with four claims they  determined had been paid improperly and two claims that had been paid  properly. To prevent bias, we asked them to select claims for which the  ADR had been sent on a date that we randomly selected. If they had not  sent ADRs on that date, we asked them to choose the closest date on  which they had sent ADRs. Upon receiving the sample of contractor  correspondence, we chose two frequently used postpayment review- related forms of correspondence—ADRs and results letters—to assess  compliance. We limited our review of results letters to assess compliance  for those that reported improper payments. The final sample we reviewed  included 67 ADRs and 47 results letters.
We assessed compliance with CMS requirements in effect as of the date  on the letter. Each letter was reviewed by two of our staff working  independently. The reviewers compared each requirement with each  letter’s content to determine if a requirement was “met,” “not met,” “not  applicable,” or “unknown.” Afterward, the reviewers met to resolve any  differences in their scores. Their final score was checked by a third  reviewer. We calculated a compliance rate for each letter by dividing the  total number of applicable requirements that were met (numerator) by the  total number of applicable requirements that were met or not met  (denominator). An average compliance rate for each type of contractor  was based on the sum of the contractors’ letter-specific numerators  divided by the sum of the letter-specific denominators. Requirements for  ADRs are listed in table 3 and for review results letters in table 4. We note  in the tables several requirements that we did not include in our  assessment of compliance and why.
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Appendix III: GAO Contacts and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Sheila. K. Avruch, Assistant  Director; Robin Burke; Carrie Davidson; Iola D’Souza; Carolyn Garvey;  Leslie V. Gordon; Richard Lipinski; Elizabeth Morrison; Amanda Pusey;  and Jennifer Whitworth made key contributions to this report.
section_title: Related GAO Products
paragraphs: Medicare Program Integrity: Contractors Reported Generating Savings,  but CMS Could Improve Its Oversight. GAO-14-111. Washington, D.C.:  October 25, 2013.
Medicare Program Integrity: Increasing Consistency of Contractor  Requirements May Improve Administrative Efficiency. GAO-13-522.  Washington, D.C.: July 23, 2013.
GAO’s 2013 High-Risk Update: Medicare and Medicaid. GAO-13-433T.  Washington, D.C.: February 27, 2013.
Medicare Program Integrity: Greater Prepayment Control Efforts Could  Increase Savings and Better Ensure Proper Payment. GAO-13-102.  Washington, D.C.: November 13, 2012.
Medicare Fraud Prevention: CMS Has Implemented a Predictive  Analytics System, but Needs to Define Measures to Determine Its  Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012.
Program Integrity: Further Action Needed to Address Vulnerabilities in  Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.:  June 7, 2012.
Medicare Integrity Program: CMS Used Increased Funding for New  Activities but Could Improve Measurement of Program Effectiveness.  GAO-11-592. Washington, D.C.: July 29, 2011.
Improper Payments: Reported Medicare Estimates and Key Remediation  Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.
Improper Payments: Recent Efforts to Address Improper Payments and  Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.
Status of Fiscal Year 2010 Federal Improper Payments Reporting.   GAO-11-443R. Washington, D.C.: March 25, 2011.
Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.
Medicare: Program Remains at High Risk Because of Continuing  Management Challenges. GAO-11-430T. Washington, D.C.: March 2,  2011.
Medicare Recovery Audit Contracting: Weaknesses Remain in  Addressing Vulnerabilities to Improper Payments, Although  Improvements Made to Contractor Oversight. GAO-10-143. Washington,  D.C.: March 31, 2010.
Medicare Contracting Reform: Agency Has Made Progress with  Implementation, but Contractors Have Not Met All Performance  Standards. GAO-10-71. Washington, D.C.: March 25, 2010.