Medicare Advantage Program Integrity: CMS's Efforts to Ensure Proper Payments and Identify and Recover Improper Payments
Published: 2017-07-19T00:00:00

Fast Facts:
The Centers for Medicare & Medicaid Services estimates that about $16 billion or nearly 10% of its payments to Medicare Advantage organizations were improper.
In this testimony, we reviewed several problems we have found with CMS's efforts to ensure proper payments in this program that serves about a third of Medicare beneficiaries.
For example, certain CMS audits do not target Medicare Advantage contracts at highest risk for improper payments—payments made in error or due to potential fraud. CMS has also not fully validated the data—known as "encounter data"— it uses to ensure proper Medicare Advantage payments.

Highlights:
section_title: Why GAO Did This Study
paragraphs: GAO has designated Medicare as a high-risk program because of its size, complexity, and susceptibility to mismanagement and improper payments, which reached an estimated $60 billion in fiscal year 2016.
CMS contracts with MAOs to provide services to about one-third of all Medicare beneficiaries, and paid MAOs about $200 billion for their care in 2016. CMS's payments to the MAOs vary based on the health status of beneficiaries. For example, an MAO receives a higher risk-adjusted payment for an enrollee with a diagnosis of diabetes than for an otherwise identical enrollee without this diagnosis. Improper payments in MA arise primarily from diagnosis information unsupported by medical records that leads CMS to increase its payments.
This testimony is based on GAO's 2016 and 2017 reports addressing MA improper payments and highlights (1) factors that have hindered CMS's efforts to identify and recover improper payments through payment audits and (2) CMS's progress in validating encounter data for use in risk adjusting payments to MAOs. For these reports, GAO reviewed research and agency documents, analyzed data from ongoing RADV audits, and compared CMS's activities with the agency's protocol for validating Medicaid encounter data and federal internal control standards. GAO interviewed CMS officials for both reports, and also asked for updates on the status of GAO's prior recommendations for this statement.
section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services (CMS) estimated that about $16 billion—nearly 10 percent—of Medicare Advantage (MA) payments in fiscal year 2016 were improper. To identify and recover MA improper payments, CMS conducts risk adjustment data validation (RADV) audits of prior payments. These audits determine whether the diagnosis data submitted by Medicare Advantage organizations (MAOs), which offer private plan alternatives to fee-for-service (FFS) Medicare, are supported by a beneficiary's medical record. CMS pays MAOs a predetermined monthly amount for each enrollee. CMS uses a process called risk adjustment to project each enrollee's health care costs using diagnosis data from MAOs and demographic data from Medicare. In its 2016 report, GAO found several factors impeded CMS's efforts to identify and recover improper payments, including:
RADV audits were not targeted to contracts with the highest potential for improper payments. The agency's method of calculating improper payment risk for each contract, based on the diagnoses reported for the contract's beneficiaries, had shortcomings, and CMS did not use other available data to select the contracts with the greatest potential for improper payment recovery.
Substantial delays in RADV audits in progress jeopardize CMS's goal of eventually conducting annual RADV audits. CMS had RADV audits underway for payment years 2011, 2012, and 2013.
CMS had not expanded the use of Recovery Audit Contractors (RAC) to the MA program as required by law in 2010. RACs have been used in other Medicare programs to recover improper payments for a contingency fee.
GAO recommended that CMS improve the accuracy of its methodology for identifying contracts with the greatest potential for improper payment recovery, modify the processes for selecting contracts to focus on those most likely to have improper payments, and improve the timeliness of the RADV audit process. CMS reported in July 2017 that it had taken initial actions to address these recommendations, but none had been fully implemented. GAO also recommended that CMS develop specific plans for incorporating a RAC into the RADV program. In July 2017, CMS reported that the agency is evaluating its strategy for the MA RAC with CMS leadership.
CMS has begun to use encounter data, which are similar to FFS claims data, along with diagnosis data from MAOs to help ensure the proper use of federal funds by improving risk adjustment in the MA program. Encounter data include more information about the care and health status of MA beneficiaries than the data CMS uses now to risk adjust payments. In its January 2017 report, GAO found CMS had made progress in developing plans to use encounter data for risk adjustment. However, CMS had made limited progress in validating the completeness and accuracy of MA encounter data, as GAO recommended in 2014. GAO continues to believe that CMS should establish plans for using encounter data and thoroughly assess the data for completeness and accuracy before using it to risk adjust payments.

section_title: Letter
paragraphs: I am pleased to be here today to discuss program integrity in Medicare,  particularly ongoing efforts to reduce and recover improper payments in  Medicare Advantage (MA). GAO has designated Medicare as a high-risk  program since 1990, because of its size, complexity, and susceptibility to  mismanagement and improper payments. Improper payments, which are  payments that either were made in incorrect amounts, such as over- or  underpayments, or were made in error, are a significant risk for Medicare.  In fiscal year 2016, improper payments in Medicare reached an estimated  $60 billion. Some improper Medicare payments are due to fraud, which  involves willful misrepresentation. The Centers for Medicare & Medicaid  Services (CMS), within the Department of Health and Human Services,  faces many challenges related to implementing payment methods that  encourage efficient service delivery and safeguarding the program from  loss as a result of improper payments.
In 2016, Medicare was projected to finance health services for more than  57 million elderly and disabled beneficiaries with expenditures of $696  billion. About two-thirds of Medicare beneficiaries are enrolled in  traditional, fee-for-service (FFS) Medicare, with the remaining third  enrolled in MA. In 2016, Medicare paid about $200 billion to MA  organizations (MAOs), which are entities that offer a private plan  alternative to FFS Medicare. CMS estimates that improper payments in  MA totaled about $16.2 billion in fiscal year 2016, nearly 10 percent of  CMS’s payments to MAOs that year.
Under MA, CMS contracts with MAOs to provide services to beneficiaries.  MAOs may have multiple contracts with CMS; for example, plans with  varying benefit levels would each have a separate contract. CMS pays  MAOs a predetermined monthly amount for each beneficiary, no matter  how many services are provided or how much they cost. CMS adjusts  payments to MAOs to reflect enrollees’ projected health care costs—a  process known as risk adjustment. CMS pays MAOs more for enrollees  who are projected to have higher medical costs, based on prior-year  diagnoses and demographics (such as age and gender), and less for  those projected to have lower costs. For example, a MAO receives a  higher risk-adjusted payment for an enrollee with a diagnosis of diabetes  or heart disease than for an otherwise identical enrollee without those  diagnoses. The purpose of risk adjustment is to pay MAOs fairly and  accurately, thereby decreasing incentives for MAOs to avoid enrolling  sicker beneficiaries. MAOs can incur losses if their aggregate spending  exceeds payments, but they can retain savings if their aggregate  spending is less than payments. Because MAOs are paid a  predetermined amount for each enrollee that is based on prior diagnoses,  improper payments primarily result from unsupported diagnosis  information from MAOs that lead to increased payments. CMS conducts  risk adjustment data validation (RADV) audits of past payments to verify  the accuracy of the diagnosis information submitted by MAOs.  Additionally, CMS has begun to use encounter data, which are similar to  FFS claims data, to help ensure that CMS appropriately risk adjusts MAO  payments.
My testimony summarizes the findings and recommendations of two of  our recent reports relevant to MA improper payments. In particular, I will  describe (1) factors that have hindered CMS’s ability to identify and  recover MA improper payments through payment audits, and (2) progress  CMS has made in validating encounter data for use in risk adjusting  payments to MAOs.
My remarks on factors that have hindered CMS’s ability to recover MA  improper payments are based on our 2016 report examining the extent to  which CMS has addressed improper payments in the MA program. For  that report, we reviewed research and agency documents, and we  analyzed data from ongoing RADV audits of 2007 and 2011 payments,  which were CMS’s two initial contract-level RADV audits. We also  interviewed CMS officials. My remarks on the progress CMS has made in  validating encounter data and its plans to use the data are based on our  2017 report examining these issues. For that report, we compared  CMS’s activities with the agency’s protocol for validating Medicaid  encounter data, which are comparable data collected and submitted by  entities similar to MAOs, and federal internal control standards. We also  reviewed relevant agency documents and interviewed CMS officials about  MA encounter data collection and reporting. More detailed information on  our objectives, scope, and methodology for this work can be found in the  issued reports. For this statement, we also asked CMS officials for  updates on the status of our prior recommendations.
We conducted the work on which this statement is based in accordance  with generally accepted government auditing standards. Those standards  require that we plan and perform the audit to obtain sufficient, appropriate  evidence to provide a reasonable basis for our findings and conclusions  based on our audit objectives. We believe that the evidence obtained  provides a reasonable basis for our findings and conclusions based on  our audit objectives.
subsections: section_title: Background
paragraphs: FFS Medicare generally pays providers directly for the services they  perform—such as paying physicians for office visits—based on  predetermined payment formulas. FFS payments are based on claims  data received directly from providers. CMS relies primarily on prepayment  automated checks and postpayment medical reviews to identify and  recover FFS improper payments. Under the Improper Payments  Information Act of 2002 (IPIA), as amended, CMS reported that the FFS  improper payment rate was 11 percent for fiscal year 2016. Two-thirds of  the FFS improper payment rate, according to CMS, was a result of  insufficient documentation.
CMS and its contractors engage in a number of activities to prevent,  identify, and recover improper payments in FFS. The Patient Protection  and Affordable Care Act of 2010 included provisions designed to  strengthen Medicare’s provider enrollment and screening requirements.  Subsequently, CMS implemented a revised screening process for new  and existing providers and suppliers based on the potential risk of fraud,  waste, and abuse. In November 2016, we evaluated this revised  screening process and found that CMS used the new process to screen  and revalidate over 2.4 million unique applications and existing enrollment  records. As a result of this process, over 23,000 new applications were  denied or rejected, and over 703,000 existing enrollment records were  deactivated or revoked. CMS estimates that this process saved $2.4  billion in Medicare payments to ineligible providers and suppliers from  March 2011 to May 2015.
Also in FFS, CMS uses different types of contractors to conduct  prepayment and postpayment reviews of Medicare claims at high risk for  improper payments. We examined the review activities of these  contractors and in April 2016 reported that using prepayment reviews to  deny improper claims and prevent overpayments is consistent with CMS’s  goal to pay claims correctly the first time. In addition, prepayment reviews  can better protect Medicare funds because not all overpayments can be  collected. We recommended that CMS seek legislation to allow Recovery Auditors, who are currently paid on a postpayment contingency  basis from recovered payments, to conduct prepayment reviews.  Although CMS did not concur with this recommendation, we continue to  believe CMS should seek legislative authority to allow Recovery Auditors  to conduct these reviews.
Medicare Administrative Contractors (MACs) process Medicare claims,  identify areas vulnerable to improper billing, and develop general  education efforts focused on these areas. In March 2017, we evaluated  MACs’ provider education efforts to help reduce improper billing. We  found that CMS collects limited information about how the efforts focus on  the areas MACs identify as vulnerable to improper billing, and  recommended that CMS require MACs to report in sufficient detail to  determine the extent to which their provider education efforts focus on  vulnerable areas. According to CMS, the agency has updated its  reporting guidance and MACs will begin reporting more detailed  information beginning in July 2017.
Whereas Medicare pays FFS providers for services provided, Medicare  pays MAOs a fixed monthly amount per enrollee regardless of the  services enrollees use. To identify and recover MA improper payments  resulting from unsupported data submitted by MAOs for risk adjustment  purposes, CMS conducts two types of RADV audits: national RADV  activities and contract-level RADV audits. Both types determine whether  the diagnosis codes submitted by MAOs are supported by a beneficiary’s  medical record. CMS conducts national RADV activities annually to  estimate the national IPIA improper payment rate for MA. For 2016, CMS  estimated that 71 percent of the improper payments resulted from the  insufficient medical record documentation MAOs submitted to CMS that  did not support diagnoses they had previously submitted to CMS. The  second type of RADV audit, contract-level audits, seeks to identify and  recover improper payments from MAOs, and thus deter MAOs from  submitting inaccurate diagnosis information. CMS conducted contract- level audits of 2007 payments for a sample of enrollees in 32 MA  contracts. CMS’s goal is to conduct contract-level audits annually to  recover improper payments efficiently, among other things. It plans to  recoup overpayments by calculating a payment error rate for a sample of  enrollees in each audited contract and extrapolating the error rate to  estimate the total amount of improper payments made under the contract.  CMS has RADV audits underway for three payment years—2011, 2012,  and 2013. In general, CMS audits about 5 percent of contracts for each  year, or roughly 30 contracts.
CMS calculates a beneficiary’s risk score—a relative measure of  projected Medicare spending—based on both demographic  characteristics and health status (diagnoses). The agency uses Medicare  data to determine a beneficiary’s demographic characteristics; however, it  must rely on data submitted by MAOs for health status information. CMS  requires MAOs to submit diagnosis codes for each beneficiary in a  contract in order to calculate risk scores. Since 2004, CMS has used the  Risk Adjustment Processing System (RAPS) to collect diagnosis  information from MAOs. In 2012, CMS began requiring MAOs to submit  encounter data. Such data include diagnosis and treatment information  for all medical services and items provided to an enrollee, with a level of  detail similar to FFS claims. Since 2015, CMS has used both RAPS and  encounter data submitted by MAOs to risk adjust MA payments.
When CMS proposed collecting encounter data in 2008, the agency  stated it would use the data for risk adjustment and may also use them for  specified additional payment and oversight purposes. CMS has  recognized the importance of ensuring that the data collected are  complete—representing all encounters for all enrollees—and accurate— representing a correct record of all encounters that occurred—given the  important functions for which the data will be applied.
section_title: Several Factors Hinder CMS’s Efforts to Recover MA Improper Payments
paragraphs: In our 2016 report, we found several factors that hamper CMS’s recovery  activities, including its failure to select contracts for audit that have the  greatest potential for payment recovery, delays in conducting CMS’s first  two RADV payment audits, and its lack of specific plans or a timetable for  incorporating Recovery Audit Contractors (RACs) into the MA program to  identify improper payments and help with their recovery.
subsections: section_title: CMS Did Not Focus RADV Audits on Contracts with Highest Potential for Improper Payments
paragraphs: Our 2016 report found that the results from the RADV audits of 2007  payments indicated that the scores CMS calculates to identify contracts  that are candidates for audit, called coding intensity scores, were not  strongly correlated with the percentage of unsupported diagnoses. CMS  defines coding intensity as the average change in the risk score  component specifically associated with the reported diagnoses for the  beneficiaries in each contract. Increases in coding intensity measure the  extent to which the estimated medical needs of the beneficiaries in a  contract increase from year to year; thus, contracts whose beneficiaries  appear to be getting “sicker” at a relatively rapid rate, based on the  information submitted to CMS, will have relatively high coding intensity  scores. Figure 1 shows, for example, that CMS reported that the  percentage of unsupported diagnoses among the high coding intensity  contracts it audited (36 percent) was nearly identical to the percentage  among the medium coding intensity contracts (35.7 percent). Our report  also found that the RADV audits were not targeted to contracts with the  highest potential for improper payments.
We identified two reasons that the RADV audits were not targeted on the  contracts with the greatest potential for recoveries. The first reason is that  the coding intensity scores have shortcomings. For example, our report  found that CMS’s calculation may be based on scores that are not  comparable across contracts, because the years of data used for each  contract may differ, and there are known year-to-year differences in  coding intensity scores. In addition, CMS’s calculation does not  distinguish between diagnoses likely coded by providers and diagnoses  subsequently coded by MAOs. Medical records that providers create from  diagnoses are apt to support the diagnoses better than diagnoses  subsequently coded by the MAO through medical record review. CMS  has a method available to it—the Encounter Data System—that will  distinguish between the two diagnoses. Although using encounter data  would help target the submitted diagnoses that may be most likely related  to improper payments, CMS has not outlined plans for using it.  Furthermore, CMS follows contracts that are renewed or consolidated  under a different existing contract within the same MAO, but CMS’s  coding intensity calculation does not incorporate prior risk scores from an  earlier contract into the MAO’s renewed contract. This could result in an  improper payment risk if MAOs move beneficiaries with higher risk  scores, such as those with special needs, into one consolidated  contract.
The second reason audits are not targeted to the contracts with the  greatest potential for recovery is that CMS does not always use the  information available to it to select audit contracts with the highest  potential for improper payments. CMS did not always target the contracts  with the highest coding intensity scores, use results from prior contract- level RADV audits, account for contract consolidation, or account for  contracts with high enrollment. For example, only four of the contracts  selected for the 2011 RADV audit had coding intensity scores at the 90th  percentile or above. Even though we found that coding intensity scores  are not strongly correlated with diagnostic discrepancies, they are still  somewhat correlated. Also, CMS’s 2011 contract selection methodology  did not consider results from the agency’s prior RADV audits, potentially  overlooking information indicating contracts with known improper  payment risk. Finally, even though the potential dollar amount of improper  payments to MAOs with high rates of unsupported diagnoses is likely  greater when contract enrollment is large, CMS officials stated that the  2011 contract-level RADV audit contract selection did not account for  contracts with high enrollment.
We made two recommendations to address these issues:
We recommended that (1) CMS improve the accuracy of coding  intensity calculations, and (2) modify its processes for selecting  contracts for RADV audit to focus on those most likely to have  improper payments. In July 2017, CMS officials told us that the  agency is working to implement these recommendations regarding the  selection of contracts for audit. These officials said that CMS is  reevaluating the design of the RADV audits to ensure its rigor in the  context of all the payment error data acquired since the original  design of the RADV audits, including an examination of whether  coding intensity is the best criterion to use to select contracts for audit.
section_title: RADV Process Incurred Substantial Delays Completing Contract-level Audits and Appeals
paragraphs: Our 2016 report found that prior contract-level RADV audits have been  ongoing for years, and CMS lacks an annual timetable to conduct and  complete audits. CMS officials reported at that time that the current and  previous contract-level RADV audits had been ongoing for several years.  CMS has audits for payment years 2011, 2012, and 2013 underway. We  concluded that this slow progress in completing audits conflicted with  CMS’s goal of conducting contract-level RADV audits annually, and  slowed recovery of improper payments. CMS lacked a timetable that  would help the agency complete these contract-level audits annually. In  this regard, CMS had not followed established project management  principles, which call for developing an overall plan to meet strategic  goals and to complete projects in a timely manner.
In addition to the lack of a timetable, we found other factors that  lengthened the time frame of the contract-level audit process. The  sequential notification of MAOs that identify contracts selected for audit  and then, sometimes months later, identify the beneficiaries under these  contracts creates a time gap that hinders the agency from conducting  annual audits. Technology problems with CMS’s system for receiving  medical records are the main cause of the delay in completing CMS’s  contract-level audits of 2011 payments. Additional technical issues with  other systems led CMS to more than triple the medical record submission  time frame for the 2011 audits.
Our report found that disputes and appeals of contract-level RADV audits  have also continued for years, and CMS has not incorporated measures  to expedite the process. Nearly all of the MAOs whose contracts were included in the 2007 contract-level RADV audit cycle disputed at least  one diagnosis finding following medical record review. CMS stated that  MAOs disputed a total of 624 (4.3 percent) of the 14,388 audited  diagnoses, and that the determinations on these disputes, which were  submitted from March through May 2013, were not complete until July  2014. In addition, because the dispute process took a year and a half to  complete, CMS officials stated that it did not receive all 2007 appeal  requests for hearing officer review until August 2014. The hearing officer  adjudicated or received a withdrawal request for 377 of the 624 appeals  from August 2014 through September 2015.
For the 2011 audit cycle, CMS officials stated that the medical record  dispute process will be incorporated into the appeal process. Thus, MAOs  can request reconsideration of medical record review determinations  concurrent with the appeal of payment error calculations, rather than  sequentially, as was the case for the 2007 cycle. While this change may  help, the new process does not set time limits for when reconsideration  decisions must be issued. Lack of explicit time frames for appeal  decisions at reconsideration hinders CMS’s collection of improper  payments because the agency cannot recover extrapolated  overpayments until the MAO exhausts all levels of appeal, and the lack of  time frames is inconsistent with established project management  principles.
We made two recommendations to address these issues:
We recommended that CMS take steps to improve the timeliness of  the RADV audit process. In July 2017, CMS officials told us that, as  part of the agency’s efforts to consolidate program integrity initiatives  into one center, the decision was made to transition RADV contract- level audits to the CMS Center for Program Integrity (CPI) at the end  of 2016. With the transition, CMS is implementing a formal project  management structure to facilitate the timeliness of the audit process.
We also recommended that CMS require that reconsideration  decisions be rendered within a specified number of days, similar to  other time frames in the Medicare program. In July 2017, CMS  officials told us that the agency is actively considering options for  expediting the appeals process.
section_title: CMS Made Little Progress toward Incorporating a Recovery Audit Contractor in MA
paragraphs: Our 2016 report found that CMS had not expanded the RAC program to  MA, as it was required to do by the end of 2010 by the Patient Protection  and Affordable Care Act. Implementing an MA RAC would help CMS  address the resource requirements of conducting contract-level audits. In  2014, CMS issued a request for proposals for an MA RAC, which would  audit improper payments in three areas of MA, but CMS officials told us  that CMS did not receive any proposals to do the work in those audit  areas, and that its goal was to reissue the MA RAC solicitation in 2015.  CMS reconsidered the audit work in the request for the MA RAC. In  December 2015, CMS issued a request for information seeking industry  comment on how an MA RAC could be incorporated into CMS’s existing  contract-level RADV audit framework. In the request, CMS stated that it  was seeking an MA RAC to help the agency expand the number of MA  contracts subject to audit each year, and stated that its ultimate goal is to  have all MA contracts subject to either a contract-level RADV audit or  another audit that would focus on specific diagnoses determined to have  a high probability of being erroneous. Officials from three Medicare FFS  RACs all told us their organizations had the capacity and willingness to  conduct contract-level RADV audits.
We recommended that CMS develop specific plans for incorporating a  RAC into the RADV program. In July 2016, CMS described to us its  initial steps to meet this goal. In July 2017, CMS officials told us that  the agency is evaluating its strategy for the MA RAC with CMS  leadership.
section_title: CMS Has Made Limited Progress Validating Encounter Data Used to Ensure Proper Payments
paragraphs: In July 2014, we recommended that CMS complete all the steps  necessary to validate encounter data, including performing statistical  analyses, reviewing medical records, and providing MAOs with summary  reports on CMS’s findings, before using the data to risk adjust payments  or for other intended purposes. In our 2017 report, we found that CMS  had made limited progress toward validating encounter data. (See fig.  2.) As of January 2017, CMS had begun compiling basic statistics on the  volume and consistency of data submissions and preparing automated  summary reports for MAOs indicating the diagnosis information used for  risk adjustment; however CMS had not yet taken other important steps  identified in its Medicaid protocol, which we used for comparison.
The steps CMS had not yet taken as of our January 2017 report are:
Establish benchmarks for completeness and accuracy. This step  would establish requirements for collecting and submitting MA  encounter data. Without benchmarks, CMS does not have objective  standards against which to hold MAOs accountable for complete and  accurate data reporting.
Conduct analyses to compare with established benchmarks. This  would help ensure accuracy and completeness. Without such  analyses, CMS has limited ability to detect potentially inaccurate or  unreliable data.
Determine sampling methodology for medical record review and  obtain medical records. Medical record review would help ensure  the accuracy of encounter data. Without these reviews, CMS cannot  substantiate the information in MAO encounter data submissions and  lacks evidence for determining the accuracy of encounter data.
Summarize analyses to highlight individual MAO issues. This  step would provide recommendations to MAOs for improving the  completeness and accuracy of encounter data. Without actionable  and specific recommendations from CMS, MAOs might not know how  to improve their submissions.
In July 2014, we also recommended that CMS establish specific plans  and time frames for using the data for all intended purposes in addition to  risk adjusting payments to MAOs. We found in our 2017 report that CMS  had made progress in defining its objectives for using MA encounter data  for risk adjustment and in communicating its plans and time frames to  MAOs. CMS reported it plans to fully transition to using MA encounter  data for risk adjustment purposes by 2020. However, even though CMS  had formed general ideas of how it would use MA encounter data for  purposes other than risk adjustment, as of January 2017 it had not  specified plans and time frames for most of the additional purposes for  which the data may be used. These other purposes include activities to  support program integrity.
In July 2017, CMS officials told us that the agency had not taken any  further actions in response to our July 2014 recommendations. Because  CMS is making payments that are based on data that have not been fully  validated for completeness and accuracy, the soundness of billions of  dollars in Medicare expenditures remains unsubstantiated. In addition,  without planning for all of the authorized uses, the agency cannot be  assured that the amount and types of data being collected are necessary  and sufficient for specific purposes. Given CMS’s limited progress in  planning and time frames for all authorized uses of the data, we continue  to believe CMS should implement our July 2014 recommendations that  CMS should establish specific plans for using MA encounter data and  thoroughly assess data completeness and accuracy before using the data  to risk adjust payments or for other purposes. In response to our 2014  recommendations, the Department of Health and Human Services did not  specify a date by which CMS would develop plans for all authorized uses  of the data and did not commit to completing data validation before using  the data for risk adjustment in 2015. CMS began using encounter data for  risk adjustment in 2015, although it had not completed activities to  validate the data.
In conclusion, Medicare remains inherently complex and susceptible to  improper payments. Therefore, actions CMS takes to ensure the integrity  of the MA program by identifying, reducing, and recovering improper  payments would be critical to safeguarding federal funds.
Chairman Buchanan, Ranking Member Lewis, and Members of the  Subcommittee, this concludes my prepared statement. I would be  pleased to respond to any questions that you may have.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: For questions about this statement, please contact James Cosgrove at  (202) 512-7114 or cosgrovej@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this statement.
Individuals who made key contributions to this testimony include Martin T.  Gahart (Assistant Director), Aubrey Naffis (Analyst-in-Charge), Manuel  Buentello, Elizabeth T. Morrison, Jennifer Rudisill, and Jennifer  Whitworth.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.