Medicaid Fraud and Abuse: CMS's Commitment to Helping States Safeguard Program Dollars Is Limited
Published: 2005-06-28T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Today's hearing addresses fraud and abuse control in Medicaid, a program that provides health care coverage for eligible low-income individuals and is jointly financed by the federal government and the states. In fiscal year 2003, Medicaid covered nearly 54 million people and the program's benefit payments totaled roughly $261 billion, of which the federal share was about $153 billion. States are primarily responsible for ensuring appropriate payments to Medicaid providers through provider enrollment screening, claims review, overpayment recoveries, and case referrals. At the federal level, the Centers for Medicare & Medicaid Services (CMS) is responsible for supporting and overseeing state fraud and abuse control activities. Last year, GAO reported that CMS had initiatives to assist states, but the dollar and staff resources allocated to oversight suggested that CMS's level of effort was disproportionately small relative to the risk of federal financial loss. Concerned about the stewardship of federal Medicaid funds, Congress has raised questions about CMS's commitment to Medicaid fraud and abuse control. This statement focuses on (1) the level of resources CMS currently applies to helping states prevent and detect fraud and abuse in the Medicaid program and (2) the implications of this level of support for CMS fraud and abuse control activities.
section_title: What GAO Found
paragraphs: Since GAO reported last year, the resources CMS expends to support and oversee states' Medicaid fraud and abuse control activities remain out of balance with the amount of federal dollars spent annually to provide Medicaid benefits. In fiscal year 2005, CMS's total staff resources allocated to these activities was about 8.1 full-time equivalent (FTE) staffing units--approximately 3.6 FTEs at headquarters and 4.5 FTEs in the regional offices. Among CMS's 10 regional offices--each of which oversees states whose Medicaid outlays include billions of federal dollars--7 offices each have a fraction of an FTE and the rest each have less than 2 FTEs allocated to Medicaid fraud and abuse control efforts. Moreover, the placement of the Medicaid fraud and abuse control staff at headquarters--apart from the agency's office responsible for other antifraud and abuse activities--as well as a lack of specified goals for Medicaid fraud and abuse control raise questions about the agency's level of commitment to improve states' activities in this area. CMS's support and oversight initiatives include a pilot project for states to enhance claims scrutiny activities by coordinating with the Medicare program. Despite the project's positive results in several states, less than one-fifth of the states currently participate in the project and resource constraints may require CMS to scale back these efforts instead of expanding them to additional states that are seeking to participate. Similarly, CMS's support activities--such as conducting national conferences, regional workshops, and training--have been terminated altogether. The frequency of CMS's on-site reviews of states' fraud and abuse control activities--about seven to eight visits a year--has not changed since GAO reported on this last year. This means that federal oversight of a state's Medicaid program safeguards will not occur, at best, more than once every 7 years. Relatively few and questionably aligned resources and an absence of strategic planning underscore the limited commitment CMS has made to strengthening states' ability to curb fraud and abuse. Despite the millions of dollars CMS receives annually from a statutorily established fund for fraud and abuse control, the agency has not allocated these resources to sufficiently fund initiatives that can help states increase the effectiveness of their Medicaid fraud and abuse control efforts. Developing a strategic plan for Medicaid fraud and abuse control activities would give CMS a basis for providing resources that reflect the financial risk to the federal government. In discussing the facts in this statement with a CMS Medicaid official, he stated that the agency does not view antifraud and abuse initiatives as separate from financial oversight, an area that has received substantial resources in recent years. While we agree that financial management is important to program integrity, we believe that an increased commitment to helping states fight fraud and abuse is warranted.

section_title: Letter
paragraphs: I am pleased to be here today as you discuss fraud and abuse control in  Medicaid, a program that provides health care coverage for eligible low- income individuals and is jointly financed by the federal government and  the states. In fiscal year 2003, Medicaid covered nearly 54 million people,  and the program’s benefit payments totaled $261 billion, of which the  federal share was about $153 billion. Because fraud and abuse by their  nature are unknown until detected, the amount of Medicaid funds lost  through health care providers’ inappropriate billings cannot be precisely  quantified. Some states have made estimates of their respective programs’  improper Medicaid payment rates that reflect not only fraudulent and  abusive billings but also inadvertent billing errors, such as clerical  mistakes. A nationwide improper payment rate for Medicaid has not been  made, but even a rate as low as 3 percent would mean a loss of almost $4.6  billion in federal funds in fiscal year 2003. To put this hypothetical figure  in perspective, it is roughly the amount that the federal government spent  in fiscal year 2003 on the State Children’s Health Insurance Program  (SCHIP).
Such a drain of vital program dollars is a detriment to both taxpayers and  beneficiaries. For example, paying for services billed but not provided  wastes funds that could have been used for health care. For example, in  2004, the owners of a Louisiana health care clinic were found guilty of  billing the program more than $400,000 for health care screening services,  nurse consultations, and nutrition consultations never provided.  Alternatively, paying for unnecessary services can have a substantial, if not  quantifiable, impact on health care quality. Consider the charge in 2004  against 20 dentists in California for conspiracy to defraud the state’s  Medicaid program of $4.5 million. As part of the conspiracy, the dentists  billed Medicaid for unnecessary or inappropriate services that placed  patients at risk by reusing dental instruments without sterilizing them,  performing dental surgeries without adequate anesthesia, developing  treatment plans that called for unneeded root canals and fillings, and  forcibly restraining children during dental operations.
States are primarily responsible for the fight against Medicaid fraud and  abuse. Specifically, they are responsible for ensuring the legitimacy of  providers billing the program, detecting improper payments, recovering  overpayments, and referring suspected cases of fraud and abuse to law  enforcement authorities. At the federal level, the Centers for Medicare &  Medicaid Services (CMS) in the Department of Health and Human Services  (HHS) is responsible for supporting and overseeing state fraud and abuse  control activities. Last year, we reported that CMS had initiatives to assist  states in combating fraud and abuse in their Medicaid programs, but its  oversight of states’ activities in this area was limited. The dollar and staff  resources allocated to compliance reviews suggested that CMS’s level of  effort was disproportionately small relative to the risk of serious financial  loss.
Concerned about the stewardship of federal Medicaid funds, this  Committee has raised questions about CMS’s commitment to Medicaid  fraud and abuse control. It is important to note that activities designed to  prevent, detect, and recover improper payments made to providers  resulting from fraud and abuse are a component of ensuring Medicaid  program integrity. These activities are valuable not only from a financial  standpoint but also have a sentinel effect on providers that may otherwise  consider billing the program inappropriately. Another component is  financial management activities, which involve the oversight of state  claims for federal reimbursement, including the matching, administrative,  and disproportionate share funds that CMS provides the states. While  these program integrity functions are related, they are not  interchangeable. My remarks today will focus on (1) the level of resources  CMS currently applies to helping states prevent and detect fraud and  abuse in the Medicaid program and (2) the implications of this level of  support for CMS fraud and abuse control activities.
To do this work, we reviewed agency documents on Medicaid program  safeguard support and oversight activities as well as our issued reports on  this topic. We also interviewed officials at headquarters and CMS’s 10  regional offices. We conducted our work in May and June 2005 in  accordance with generally accepted government auditing standards.
In summary, since we reported last year, the resources CMS expends to  support and oversee states’ Medicaid fraud and abuse control activities  remain out of balance with the amount of federal dollars spent annually to  provide Medicaid benefits. In fiscal year 2005, CMS’s total staff resources  allocated to these activities was about 8.1 full-time equivalent (FTE)  staffing units—approximately 3.6 FTEs at headquarters and 4.5 FTEs in  the regional offices. Among CMS’s 10 regional offices—each of which  oversees states whose Medicaid outlays include billions of federal  dollars—7 offices each have less than 1 FTE and the rest each have less  than 2 FTEs allocated to Medicaid fraud and abuse control efforts.  Moreover, the placement of the Medicaid fraud and abuse control staff at  headquarters—apart from the agency’s office responsible for other  antifraud and abuse activities—as well as a lack of specified goals for  Medicaid fraud and abuse control raise questions about the agency’s level  of commitment to improving states’ activities in this area.
CMS’s support and oversight initiatives include a pilot project for states to  enhance claims scrutiny activities by coordinating with the Medicare  program. Despite the project’s positive results in several states, less than  one-fifth of the states currently participate in the project, and resource  constraints may require CMS to scale back these efforts instead of  expanding them to additional states that are seeking to participate.  Similarly, some of CMS’s other support activities—such as conducting  national conferences, regional workshops, and training—have been  terminated altogether. The frequency of CMS’s on-site reviews of states’  fraud and abuse control activities remains about seven to eight visits a  year. This means that federal oversight of a state’s Medicaid program  safeguards will not occur, at best, more than once every 7 years.
In discussing the facts in this statement with a CMS Medicaid official, he  stated that the agency does not view antifraud and abuse initiatives as  separate from financial oversight, an area that has received substantial  resources in recent years. While we agree that financial management is  important to program integrity, we believe that an increased commitment  to helping states fight fraud and abuse is warranted.
subsections: section_title: Background
paragraphs: Although jointly financed by the states and the federal government,  Medicaid is administered directly by the states and consists of 56 distinct  state-level programs. Within broad federal guidelines, each program  establishes its own eligibility standards; determines the type, amount,  duration, and scope of covered services; and sets payment rates. In  general, the federal government matches state Medicaid spending for  medical assistance according to a formula based on each state’s per capita  income. In fiscal year 2004, the federal contribution ranged from 50 to 77  cents of every state dollar spent on medical assistance. For most state  Medicaid administrative costs, the federal match rate is 50 percent.
As program administrators, states have primary responsibility for  conducting program integrity activities that address provider enrollment,  claims review, and case referrals. Specifically, federal statute or CMS  regulations require states to    collect and verify basic information on potential providers, including  whether the providers meet state licensure requirements and are not  prohibited from participating in federal health care programs;    have an automated claims payment and information retrieval system— intended to verify the accuracy of claims, the correct use of payment  codes, and patients’ Medicaid eligibility—and a claims review system— intended to develop statistical profiles on services, providers, and  beneficiaries to identify potential improper payments; and  refer suspected overpayments or overutilization cases to other units in the  Medicaid agency for corrective action and potential fraud cases, generally,  to the state’s Medicaid Fraud Control Unit for investigation and  prosecution.  As noted in our 2004 report, states use a variety of controls and  safeguards to stem improper provider payments. For example, states  target high-risk providers seeking to bill Medicaid with on-site facility  inspections, criminal background checks, and probationary or time-limited  enrollment. States also reported using information technology to integrate  databases containing provider, beneficiary, and claims information and to  increase the effectiveness of their utilization reviews. Various states  individually attributed cost savings or recoupments to these efforts valued  in the millions of dollars.
In contrast, CMS’s role in curbing fraud and abuse in the Medicaid  program is largely one of support to the states. As we reported last year,  CMS administers two pilot projects—one focused on measuring the  accuracy of a state’s Medicaid claims payments (Payment Accuracy  Measurement (PAM)) and the other focused on improper billing detection  and utilization patterns by linking Medicare and Medicaid claims  information (Medi-Medi). CMS also sponsors general technical assistance  and information-sharing through its Medicaid fraud and abuse technical  assistance group (TAG). In addition, CMS performs oversight of states’  Medicaid fraud and abuse control activities. (See table 1.)
section_title: CMS Expends Limited Resources and Lacks Coherent Plan to Improve States’ Medicaid Fraud and Abuse Control Activities
paragraphs: A wide disparity exists between the level of resources CMS expends to  support and oversee states’ fraud and abuse control activities and the  amount of federal dollars at stake in Medicaid benefit payments. In  addition, CMS’s organizational placement of staff and lack of strategic  planning suggest a limited commitment to improving states’ Medicaid  fraud and abuse control efforts.
subsections: section_title: Disparity Exists between Level of Resources and Program’s Financial Risk
paragraphs: The resources CMS devotes to working with states to fight Medicaid fraud  and abuse do not appear to be commensurate with the size of the  program’s financial risk. In fiscal year 2005, CMS’s Medicaid staff  resources allocated to supporting or overseeing states’ anti-fraud and  abuse operations was an estimated 8.1 FTEs—3.6 FTEs at headquarters  and 4.5 FTEs in the regional offices. Staff at headquarters are engaged in  arranging and conducting the on-site compliance reviews of states’ fraud  and abuse control efforts and in information-sharing activities. Staff at the  regional offices also participate in the state compliance reviews and  respond to state inquiries. Canvassing the 10 regional CMS offices, we  found that 7 regions each have a fraction of an FTE and the rest each have  less than 2 FTEs devoted to providing assistance on fraud and abuse  issues. For example, Region IV—which covers eight states and accounted  for $33 billion of federal funds for Medicaid benefits in fiscal year 2004— reported having 1 FTE devoted to Medicaid fraud and abuse control  activities. (See table 2.)
For fiscal year 2006, CMS’s budget has no line item devoted to Medicaid  fraud and abuse control activities. The project to estimate payment error  rates known as PAM/PERM (required by statute) and the Medi-Medi pilot  project (with benefits accruing to both programs) are financed through a  statutorily established fund—the Health Care Fraud and Abuse Control  (HCFAC) account. (See table 3.) The HCFAC monies from which these  two projects are largely financed are known as “wedge” funds. As CMS’s  distribution of these funds varies from year to year, the level of support for  fraud and abuse control initiatives is uncertain and depends on the  priorities set by the agency. For example, fiscal year 2005 funds allocated  from the HCFAC account for PAM/PERM and Medi-Medi were less than  half the funds allocated in fiscal year 2004. In contrast, Medicare fraud and  abuse control activities at CMS are financed primarily through earmarked  funds from another HCFAC component—the Medicare Integrity Program.
CMS’s Medicaid compliance reviews are funded through a different  source—HHS’s budget appropriation. In fiscal year 2004, the budget for  this activity was $26,000, down from $40,000 in fiscal year 2003 and  $80,000 in fiscal year 2002.
section_title: CMS Structure and Lack of Planning Suggest Weak Commitment to Supporting States’ Medicaid Fraud and Abuse Control Efforts
paragraphs: The placement of Medicaid’s antifraud and abuse function in CMS’s  organizational structure and a lack of stated goals and objectives suggests  a limited institutional commitment to Medicaid fraud and abuse control  activities. Currently, two different headquarters offices are charged with  working with states on fraud and abuse issues. CMS’s Office of Financial  Management staffs the PAM/PERM and Medi-Medi initiatives, while the  Center for Medicaid and State Operations (CMSO) staffs the state  compliance reviews and TAG functions. Under this organizational  structure, the Medicaid fraud and abuse staff in CMSO are not in an  optimal position to leverage the resources allocated to the office with  responsibility for developing tools and strategies for combating fraud and  abuse.
As further evidence of the low priority assigned to Medicaid fraud and  abuse control, the planning, outreach, and building of staff expertise lacks  leadership continuity. From 1997 to 2003, the leadership and funding of  CMS’s support for states’ antifraud and abuse efforts resided in a  consortium of two regional offices. The consortium led a network of  regional fraud and abuse coordinators and state Medicaid representatives,  sponsoring telephone conferences and workshops, seminars, and training  sessions aimed at sharing best practices for fighting fraud and abuse.  Medicaid staff based at headquarters reported to a national network  coordinator located at one of the consortium’s regional offices. With the  retirement of the national coordinator in 2003, the consortium  relinquished its leadership and funding role and the Medicaid antifraud  and abuse activities were reassigned to CMSO without additional  resources. Since then, no nationwide meetings with state program  integrity officials have been held.
At the same time, CMS lacks a strategic plan to drive its Medicaid  antifraud and abuse operations. Goals for the long term, as well as plans  on how to achieve them, have not been specified in any public department  or agency planning documents. For example, HHS’s fiscal year 2004  performance and accountability report cited Medicaid’s high risk of  payment errors as the department’s management challenge for fighting  Medicaid fraud and abuse. To address this challenge, the report cited the  PAM/PERM initiative for estimating payment error rates, as this activity is  required in federal statute. But there was no mention of any other fraud  and abuse support or oversight activities or goals. Similarly, the discussion  of Medicaid program integrity in the Administration’s Budget for Fiscal  Year 2006 covers activities to curb states’ inappropriate financing  mechanisms but makes no mention of federal support or oversight of  states’ fraud and abuse efforts. At the agency level, CMS officials were  unable to provide any publicly available planning documents specifying  short- or long-term Medicaid program goals that target fraud and abuse.
section_title: Lack of Priority Threatens CMS’s Medicaid Fraud and Abuse Control Activities, While Potential to Do More Goes Untapped
paragraphs: The low priority given to CMS activities in support of states’ fraud and  abuse control efforts is having serious consequences for current projects.  CMS’s distribution of resources may require some activities to be scaled  back and others to be eliminated.
Specifically, the expansion of the Medi-Medi data match project has been  slow, leaving potentially millions of dollars in cost avoidance and cost  savings unrealized. This project enables claims data analysts to detect  patterns that may not be evident when providers’ billings for either  Medicare or Medicaid are viewed in isolation. For example, by combining  data from each program, analysts can identify “time bandits,” or providers  who bill for more than 24 hours in a single day. As of March 31, 2005,  seven states with fully operational projects reported returns to the  Medicaid and Medicare programs of $133.1 million in provider payments  under investigation, $59.7 million in program vulnerabilities identified, and  $2.0 million in overpayments to be recovered. In addition, 240  investigations had been initiated and 28 cases referred to law enforcement  agencies. Two additional states, Ohio and Washington, have begun Medi- Medi projects that are expected to be operational later this year.
Because of anticipated unmet funding needs, existing Medi-Medi data  match activities are in jeopardy of being scaled back considerably. As CMS  stated in its fiscal year 2005 second quarter report on Medi-Medi projects,  “Eliminating certain Medi-Medi projects in their entirety and/or  dramatically reducing the level of effort across all of the projects are  among the approaches under consideration. Beyond FY 2006, the entire  project will terminate if additional funding is not identified.” Agency  officials noted that several additional states have expressed interest in  participating but expanding the program to more states will not occur  without a new allocation or realignment of resources. Plans for additional  activities that involve coordination with Medicare have been put on hold,  pending budget decisions. These include enhanced oversight of  prescription drug fraud when Medicare begins covering Medicaid  beneficiaries’ drug benefits in 2006 and the use of a unified provider  enrollment form instead of separate forms for Medicare and Medicaid.
Similarly, CMS’s role as provider of technical assistance and disseminator  of states’ best practices has been severely limited because of competing  priorities. At a health care fraud and abuse conference sponsored by HHS  and the Department of Justice in 2000, participants from states and CMS  regional offices articulated their common unmet needs with regard to  fraud and abuse technology. The top three areas cited were information- sharing and access to data; training in data analysis and use of technology;  and staffing, hardware, and software resources. CMS has not sponsored a  national conference with state program integrity officials since 2003 and  has not sponsored any fraud and abuse workshops or training since 2000.  According to a CMS official, such information-sharing and technical  assistance activities would not be expensive to support—less than  $100,000 annually—and could result in returns that would exceed this  relatively low amount.
Resource shortages also account for CMS’s limited oversight of states’  Medicaid prevention, detection, and referral activities for improper  payments. Since January 2000, CMS’s Medicaid staff from headquarters  and regional offices have been conducting compliance reviews of about  seven to eight states a year. The reviews are aimed at ensuring that states  have processes and procedures in place, in compliance with federal  requirements for enrolling providers, reviewing claims, and referring  cases. These compliance reviews have been effective at identifying  weaknesses in states’ efforts to combat fraud and abuse. For example, in  the course of these reviews, CMS has found instances in which    a state had no process in place to prevent payments to excluded providers,    states did not use their authority to evaluate providers’ professional or  criminal histories as part of the provider enrollment process, and    a state did not follow appropriate procedures for referring a case to state  law enforcement authorities.
States have reported making positive modifications in their programs as a  result of the CMS compliance reviews. Nevertheless, at the currently  scheduled pace, states’ programs will be reviewed once in 7 years at the  earliest. Because the compliance reviews are infrequent, CMS’s knowledge  of states’ fraud and abuse activities is, for many states, substantially out- of-date at any given time.
section_title: Concluding Observations
paragraphs: Relatively few and questionably aligned resources and an absence of  strategic planning underscore the limited commitment CMS has made to  strengthening states’ ability to curb fraud and abuse. Despite the millions  of dollars CMS receives annually from a statutorily established fund for  fraud and abuse control, the agency has not allocated these resources to  sufficiently fund initiatives that can help states increase the effectiveness  of their Medicaid fraud and abuse control efforts. Developing a strategic  plan for Medicaid fraud and abuse control activities would give CMS a  basis for providing resources that reflect the financial risk to the federal  government.
We discussed facts in this statement with a relevant CMS official. He noted  that CMS does not view fraud and abuse control activities as separate from  its financial management responsibilities. He indicated that CMS has  invested substantial resources in program integrity activities that focus on  the financial oversight of the Medicaid program. While we agree that  financial oversight of Medicaid is a key component of program integrity,  we maintain that the other component—fraud and abuse control  activities—warrants a greater commitment than it currently receives.
Mr. Chairman, this concludes my prepared remarks. I would be happy to  answer any questions that you or other Members of the Committee may  have.
section_title: Contact and Acknowledgments
paragraphs: For further information regarding this testimony, please contact Leslie G.  Aronovitz at (312) 220-7600. Hannah Fein, Sandra Gove, and Janet  Rosenblad contributed to this statement under the direction of Rosamond  Katz.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. It may be reproduced and distributed in its entirety without further  permission from GAO. However, because this work may contain copyrighted images or  other material, permission from the copyright holder may be necessary if you wish to  reproduce this material separately.