Medicare Part D: Changes Needed to Improve CMS's Recovery Audit Program Operations and Contractor Oversight
Published: 2015-08-14T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In 2014, the federal government spent $58 billion on Medicare Part D, the voluntary, outpatient prescription drug coverage program. An estimated $1.9 billion of this total was improper payments--including overpayments or underpayments that may be due to errors, such as the submission of duplicate claims for the same service. In January 2011, CMS began a RAC program in Part D that was intended in part to identify and recoup improper payments, as required under the Patient Protection and Affordable Care Act. The RAC is paid a contingency fee from amounts recovered.
GAO was asked to review CMS's Part D RAC program implementation, oversight, and results. GAO examined (1) how CMS has implemented the Part D RAC program and any challenges it faced during implementation; (2) the extent to which CMS has overseen the RAC's audit activities; and (3) the results of the RAC's work to date and any challenges CMS and the RAC faced in identifying and collecting improper payments. To do this, GAO analyzed the RAC contract and audit documents, and federal statutes and regulations on Part D and federal contracting. GAO also interviewed CMS and RAC officials.
section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) implemented the Part D recovery audit contractor (RAC) program in January 2011 by undertaking various activities, including establishing a statement of objectives and conducting a solicitation process to select a RAC to identify improper payments. However, CMS's challenges in setting expectations about the work the Part D RAC would conduct and establishing the length of time required for CMS and the RAC to reach project milestones hampered Part D RAC program implementation. Consistent with federal contracting requirements, agencies should clearly define requirements for services. As a result of CMS's challenges in setting expectations and establishing realistic timelines as it implemented the RAC program, the RAC did not have a clear understanding about the work it should perform, and CMS recovered improper payments for Part D more than a year after it had projected.
As of May 2015, CMS had not completed any annual evaluations of the Part D RAC, but an initial evaluation of the RAC's contract year 2014 performance was in progress, and the agency had conducted other oversight of the RAC's performance. Federal internal controls and contracting standards and GAO's prior work contain requirements and suggestions for conducting regular performance evaluations and developing performance measures. In March 2015, CMS officials acknowledged that the agency should have completed annual evaluations and noted that CMS has been behind schedule in conducting evaluations of some its contractors, including the RAC. In May 2015, CMS officials finished the initial evaluation of the RAC's 2014 performance and provided the evaluation to the RAC for review and comment. An annual performance evaluation would provide CMS with a clear basis for assessing RAC performance in identifying improper payments and provide the RAC with targets against which the RAC could compare its performance. While CMS has not completed annual evaluations, it has established quality assurance procedures to conduct oversight of the RAC. For example, CMS uses a separate contractor to review and validate 100 percent of the RAC's audit findings, in part because of concerns about the quality of the RAC's work.
As of May 2015, CMS had collected less than $10 million in improper payments, and had not approved the RAC to perform new audit work since March 2014. Both CMS and the RAC are charged with reducing Medicare Part D improper payments, and federal internal control standards call for agencies to have effective and efficient processes to meet agency goals. However, as a result of CMS's and the RAC's challenges in determining audit work to conduct and the RAC's challenges in developing audit methodologies, CMS has approved 1 of the 15 audit proposals from the RAC since the beginning of the contract in 2011 and has collected a limited amount of improper payments relative to the estimated $1.9 billion in improper payments in Part D in 2014. With a more effective and efficient process for identifying, reviewing, and approving appropriate new audit work, more audit work would likely have been approved each year of the RAC contract, resulting in more improper payments being identified and collected.
section_title: What GAO Recommends
paragraphs: As CMS prepares to solicit the next RAC contract(s), CMS should set clear expectations in contract work statements, conduct annual RAC performance evaluations, and review the process for developing new audit issues. HHS concurred with GAO's recommendations.

section_title: Letter
paragraphs: In 2014, the federal government made an estimated $1.9 billion in  improper payments for the Medicare Part D prescription drug program— about 3.3 percent of the $58 billion spent for Part D that year. Improper  payments include overpayments or underpayments that may be due to  errors, such as the inadvertent submission of duplicate claims for the  same service. Since billions of dollars are estimated to be paid in error  annually, the Centers for Medicare & Medicaid Services (CMS), the  agency within the Department of Health and Human Services (HHS) that  is responsible for managing and overseeing the Part D program, conducts  a number of activities to address improper payments, including post- payment reviews of claims potentially paid in error. The Tax Relief and  Health Care Act of 2006 required CMS to implement a national Medicare  recovery audit contractor (RAC) program in Medicare’s fee-for-service  programs to increase efforts to identify and recoup improper payments.  The Patient Protection and Affordable Care Act (PPACA) expanded the  RAC program to Part D, and required CMS to enter into a Part D RAC  contract by December 31, 2010, among other things. CMS awarded a  contract to a Part D RAC to carry out recovery audit activities in January  2011.
In light of Medicare Part D’s susceptibility to improper payments and the  PPACA requirement to extend recovery audit activities to the Part D  program, you asked us to study CMS’s RAC program implementation,  oversight, and results. This report examines (1) how CMS has  implemented the Medicare Part D RAC program, and what, if any,  challenges CMS has faced during its implementation; (2) the extent to  which CMS has conducted oversight of the Medicare Part D RAC; and   (3) the results of the RAC’s audit work to date, and what, if any,  challenges CMS and the RAC have faced in identifying potential improper  payments.
To determine how CMS has implemented the Medicare Part D RAC  program and what, if any, challenges CMS has faced during its  implementation, we analyzed PPACA requirements and CMS rules and  federal notices to identify requirements for the Part D RAC program. We  reviewed relevant CMS documents, including CMS’s statement of  objectives for the Part D RAC program and the RAC contract and its  subsequent modifications, to examine the policies and guidance CMS  established to implement the RAC program. We also reviewed relevant  documents created by the Part D RAC and incorporated into its contract,  including its performance work statement, which outlines how the RAC  planned to conduct its work, and its implementation timeline. In addition,  we reviewed relevant Federal Acquisition Regulation (FAR) provisions  and our prior work regarding clearly defining requirements and managing  change for projects and compared implementation activities to the FAR  requirements and our prior work. We interviewed CMS officials from the  Center for Program Integrity, Center for Medicare, and Office of  Acquisition and Grants Management and RAC officials regarding CMS’s  implementation of the Part D RAC program, including challenges CMS  faced during its implementation.
To determine the extent to which CMS has conducted oversight of the  Medicare Part D RAC, we analyzed contract documents to determine  whether CMS had set a performance evaluation schedule and  performance standards for the RAC. We also reviewed CMS  documentation for evaluations and other oversight conducted by CMS.  We interviewed the CMS and RAC officials regarding CMS oversight of  the RAC. In addition, we compared CMS’s oversight activities to criteria  on performance assessment, such as those outlined in federal internal  control standards, applicable FAR provisions, and our prior work.
To determine the results of the RAC’s audit work to date and what, if any,  challenges CMS and the RAC have faced in identifying potential improper  payments, we reviewed the contract documents and other CMS  documents related to the RAC work CMS requested, and the processes  the RAC was required to follow to conduct its audit work. We analyzed  data we received from the RAC on proposed audit work submitted to  CMS for approval, CMS’s decision notices on proposed work, and, for  approved work, data on the amounts of improper payments identified and  the amounts recouped. We determined that these data were sufficiently  reliable for our purposes by confirming and clarifying information provided  by the RAC with CMS officials. We also reviewed records of  communications between the RAC and CMS and interviewed RAC and  CMS officials to determine what, if any, challenges the RAC and CMS  have faced in identifying potential overpayments and underpayments. In  addition, we reviewed CMS’s strategic plan and the RAC’s statement of  objectives and compared RAC program results and activities to these  goals and objectives.
We conducted this performance audit from September 2014 to August  2015 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Since 2006, CMS has contracted with private companies, referred to as  plan sponsors, to provide outpatient prescription drug plans for Medicare  beneficiaries. In 2014, there were 3,455 prescription drug plans offered  nationwide. Every time a Medicare beneficiary fills a prescription covered  under Part D, the sponsor must submit a prescription drug event (PDE)  record to CMS. These records include drug cost and payment information  that enables CMS to administer and monitor the Part D benefit. Plan  sponsors are required to have comprehensive compliance programs that  include a plan to safeguard the program from fraud, waste, and abuse.
subsections: section_title: Medicare Part D Benefit and Payment Structure
paragraphs: Plan sponsors are required to offer plans that provide a minimum set of  benefits to beneficiaries—the standard benefit—or an actuarially  equivalent benefit. Beneficiaries pay monthly premiums and cost  sharing—such as coinsurance—for drug purchases. The amount of cost  sharing varies over the course of the year as beneficiaries move through  the phases of the benefit. As shown in figure 1, the standard benefit in  2014 featured a $310 deductible and an initial coverage period during  which beneficiaries pay coinsurance of 25 percent of the cost for  prescription drugs until they reach the initial coverage limit of $2,850.  After the initial coverage period, beneficiaries enter a coverage gap,  during which beneficiaries pay a large share of drug costs. After  reaching the catastrophic threshold, beneficiaries pay a small share of  total drug costs. Under Part D, certain individuals are also entitled to a  low-income subsidy, through which they pay reduced premiums and  generally have zero or nominal cost sharing.
In addition to the subsidy for certain low-income individuals, Medicare  also provides Part D plans with direct subsidy payments and reinsurance  payments. The direct subsidy is a monthly prospective capitated payment  to plans adjusted for the health status of beneficiaries expected to enroll,  among other things. Reinsurance payments are monthly subsidies  Medicare pays to plans that cover 80 percent of plans’ estimates for  beneficiaries that incur costs above the catastrophic threshold.
section_title: CMS Oversight of Part D
paragraphs: CMS has a goal to reduce improper payments in the Medicare Part D  program and conducts a number of activities to protect the integrity of the  program—that is, to ensure that payments are made correctly the first  time and to identify, investigate, and recoup payments made in error.  CMS’s Center for Program Integrity oversees Part D program integrity.  Within the Center for Program Integrity, the Division of Plan Oversight  and Accountability is responsible for administering the Part D RAC  program. The Division of Plan Oversight and Accountability coordinates  its efforts with components in CMS’s Center for Medicare and the Office  of Acquisition and Grants Management.
section_title: Part D RAC Program
paragraphs: The Part D RAC is required under PPACA to conduct post-payment  reviews to identify improper payments in the Part D program. In addition,  the RAC is required to conduct three additional activities: ensure that each Part D prescription drug plan has an antifraud plan  in effect and review the effectiveness of each plan; examine Part D prescription drug plans’ claims for reinsurance  payments to determine whether costs were incurred in excess of the  costs allowed; and  review Part D prescription drug plans’ estimates for the enrollment of  high-cost beneficiaries and compare to the numbers of high-cost  beneficiaries actually enrolled.
The RAC uses a CMS-approved audit methodology to identify potential  improper payments, takes steps to have its work validated by another  contractor, and provides plan sponsors with an opportunity to appeal its  findings, prior to CMS collecting any confirmed improper payments. The  RAC may use data from CMS and the HHS Office of Inspector General,  such as CMS’s Medicare Exclusion Database or the Office of Inspector  General’s List of Excluded Individuals/ Entities, among other sources, and  compare those data to Medicare Part D claims data that plan sponsors  submit in PDE records to identify potential improper payments. The  RAC reviews all contracts that fall within a particular year for a particular  plan sponsor unless directed to do otherwise by CMS, and may identify  potential improper payments on PDE records within 4 years of the plan  sponsor’s current plan year. After the RAC has identified potential  improper payments in PDE records, a data validation contractor confirms  the results and works with the RAC to resolve any discrepancies, for  example in the amount of improper payments identified or the number of  PDE records containing potential improper payments. Once the RAC’s  results are finalized, the results are sent to the plan sponsor to give it an  opportunity to appeal the RAC’s results, that is, to request a  reconsideration of the identified potential improper payments and provide  additional documentation to support its request. After all appeals are  considered and final decisions are made, CMS collects improper  payments from plan sponsors. The RAC is paid on a contingency fee  basis from amounts recovered, as required by law. This payment is a  percentage of the improper payments that CMS collects after the appeals  process has been completed.
section_title: CMS Undertook Various Activities to Establish the Part D RAC Program, but Unclear Expectations and Unrealistic Project Timelines Hampered Implementation
paragraphs: CMS implemented the Part D RAC program in January 2011 by  undertaking various activities, including establishing a statement of  objectives and conducting a solicitation process to select a RAC to  identify improper payments. CMS officials told us the agency addresses  additional PPACA requirements for the Part D RAC program through  other activities it conducts. However, unclear expectations about the work  the Part D RAC would conduct and unrealistic timelines regarding project  milestones hampered Part D RAC program implementation.
subsections: section_title: CMS Implemented the Part D RAC Program by Establishing a Statement of Objectives and Conducting a Solicitation Process to Select a Contractor
paragraphs: CMS implemented the Part D RAC program in January 2011 by  undertaking various activities, such as establishing a statement of  objectives, conducting a solicitation process to select a contractor, and  awarding a Part D RAC contract. CMS’s statement of objectives  described the outcomes that CMS required a Part D RAC to achieve,  such as developing a methodology to identify improper payments.  Prospective contractors were to use this statement of objectives to design  a performance work statement to describe how they would conduct their  work to achieve those objectives. According to CMS officials, the  majority of CMS contracts include a statement of work that describes how  contractors should conduct their work. However, CMS officials decided  that prospective contractors for the Part D RAC program would design  their own performance work statements instead because CMS officials  said they wanted to give industry the opportunity to shape the program.
After CMS created the statement of objectives, it solicited contractors to  serve as the Part D RAC using the General Services Administration’s  Federal Supply Schedule. Although using the Federal Supply Schedule  limited the number of potential contractors that could respond to CMS’s  solicitation and from which CMS could choose, CMS officials said the  agency chose this solicitation method because it was a streamlined  approach to generate interest from contractors already approved to work  for the federal government. According to CMS officials, CMS received two  proposals from potential contractors, and only one of them was found to  be technically acceptable. CMS officials said that they reviewed the  potential contractors’ performance work statement and assessed their  experience with Medicare Part D and knowledge of Medicare Part D  statutes and regulations, along with other qualifications. CMS selected  the only contractor whose proposal, including its performance work  statement, the agency considered technically acceptable. While this  contractor did not have any previous federal experience, CMS determined  that its recovery audit experience in the private sector was sufficient. In  January 2011, when CMS awarded a contract to the contractor selected  to serve as the Part D RAC, the contractor’s performance work statement  became part of the contract. As such, the performance work statement  established requirements and set expectations for the work the RAC  would perform and how the work would be conducted.
The RAC’s initial contract period was for 1 base year with four 1-year  options for extension, although CMS extended the base period of the  contract eight times over a 2-year period through contract modifications.  The base period was originally through January 2012; however, it was  extended through December 2013. At that time, CMS and the RAC  agreed in a contract modification to revise the performance period to  reflect a 3-year base period, two 12-month option periods, and a separate  nearly 13-month option for administrative and appeals activities. CMS and  the RAC exercised the first option period of the modified contract, which  ran from January through December 2014, and then the second and final  option period, which ends December 31, 2015.
CMS officials said they plan to obtain the RAC services on the open  market using a full and open competitive solicitation and select a  contractor to begin serving as the Part D RAC under new contract terms  in January 2016. CMS officials also said the 2016 Part D RAC contract  will include a statement of work.
section_title: CMS Said It Implemented Three Additional PPACA Requirements for the Part D RAC Program
paragraphs: According to CMS officials, the RAC cannot perform activities to address  the three additional PPACA requirements for the Part D RAC program,  and therefore CMS conducts activities that address these requirements.  CMS officials told us that the RAC cannot perform activities to address  the additional requirements because the fee that CMS is statutorily  required to pay the RAC is based on improper payments identified by the  RAC, and there is no allowance under the statute for payment for other  work done by the RAC.
However, CMS conducts certain activities that, according to CMS  officials, address the three PPACA requirements:
Ensure that each Part D plan has an antifraud plan in effect and  review the effectiveness of each plan—According to CMS officials, the  agency meets this requirement by conducting program compliance  audits of plan sponsors, which include a review of the sponsors’  antifraud plans. According to CMS officials, 96 percent of beneficiaries  are enrolled in Part D plans that have been reviewed within a 5-year  period as part of these compliance audits. In addition, CMS conducted  a pilot study from September 2013 to February 2014 to review the  effectiveness of five plan sponsors’ antifraud plans. CMS officials said  the findings from this study will be used to inform and, if necessary,  improve CMS’s reviews of sponsors’ antifraud plans as part of its  compliance audits.
Examine Part D plans’ claims for reinsurance payments to determine  whether costs were incurred in excess of the reinsurance costs  allowed—According to CMS officials, the agency meets this  requirement through its reconciliation of Part D plans’ reinsurance  estimates to their actual costs. As CMS has noted, Part D plans  legitimately incur costs in excess of allowable reinsurance costs  during the catastrophic coverage period of the Part D benefit. CMS  pays prospective reinsurance payments to Part D plans, based on the  plans’ estimates of reinsurance costs, and reconciles these  prospective reinsurance payments to the plans’ actual reinsurance  costs on an annual basis.
Review Part D plans’ estimates for the enrollment of high-cost  beneficiaries and compare to the numbers of high-cost beneficiaries  actually enrolled—According to CMS officials, the agency meets this  requirement through its reconciliation of Part D plans’ reinsurance  estimates to their actual costs. These officials said that although   Part D plans do not submit actual estimates for the enrollment of   high-cost beneficiaries to CMS, the plans’ estimates of the number   of beneficiaries who will reach the catastrophic threshold affect plans’  reinsurance estimates, which are examined as part of the  reconciliation process, as noted above.
section_title: Unclear Expectations and Unrealistic Project Timelines Hampered RAC Program Implementation
paragraphs: CMS’s challenges in setting expectations about the work the Part D RAC  would conduct and establishing the length of time required for CMS and  the RAC to reach project milestones hampered Part D RAC program  implementation. CMS’s expectations for the work the RAC would perform  were unclear because although CMS incorporated the terms of work set  out in the performance work statement into the RAC’s contract without  making any changes to the performance work statement, CMS later  proposed audit work for the RAC to pursue that differed from the work  described in the performance work statement. For example, the initial  RAC audit process outlined in the performance work statement broadly  focused on reviews of all PDE records to eliminate duplicate payments, to  validate the accuracy of information in required PDE data fields and edit  checks, and to validate the information in direct and indirect remuneration  reports and PDE records by comparing it to additional documentation  received from the plan sponsors. However, CMS officials proposed that  the RAC focus its initial audit work only on providers that were excluded  from the Medicare program yet had written or filled prescriptions that were  paid for by CMS, and this became part of a contract modification in  February 2012. A senior official with the RAC said that the RAC  expected to conduct the audit process described in its performance work  statement and did not learn until after the first contract year that the initial  audit work would be narrowly scoped and proposed by CMS.
In addition, CMS required the RAC to follow processes for determining  audit work and validating audit findings that differed from the processes  set out in the performance work statement. For example, after CMS  selected the initial audit work the RAC would conduct, CMS required the  RAC to obtain CMS approval before it began work on subsequent audits.  CMS also required a data validation contractor to review and validate the  RAC audit findings. However, these steps were not included in the  processes outlined in the performance work statement, and a senior  official with the RAC said the RAC did not learn that CMS had adopted  processes that required these steps until the end of the first contract year.  The senior official with the RAC said the additional steps significantly  lengthened the time it took to select audit topics and conduct audits, and  reduced the number of audits the RAC was able to perform.
CMS officials said they proposed that the RAC perform work and follow  processes that were not in the performance work statement because they  recognized during the first year of the contract that the RAC had less  expertise in Medicare Part D regulations and the Part D benefit than was  necessary. For example, CMS officials said that the RAC required  significant assistance in developing its audit methodology because it  lacked staff with adequate knowledge of Medicare Part D. According to  these officials, in some cases it was necessary for CMS to develop audit  methodology on the RAC’s behalf, and in other cases, CMS needed to  revise the RAC’s methodology to eliminate numerous false positives— payments that the RAC incorrectly determined were overpayments— identified by the data validation contractor. CMS officials also said that  they incorporated into the audit work CMS guidance, policies, and other  internal processes in order to help ensure that the audit work was  reasonable and viable.
CMS officials said that once they recognized it was necessary to take a  more prescriptive approach to directing the RAC’s work, they began  developing a statement of work for the RAC, which was intended to  replace the performance work statement. This statement of work included  the processes that the RAC should follow to obtain CMS approval for new  audit topics and to conduct audits. CMS sent the Part D RAC the initial  draft statement of work in December 2011, but it was not finalized until   2 years later in December 2013. CMS officials said that prior to finalizing  the statement of work, CMS provided guidance to the RAC about its  expectations for the work the RAC was to perform through contract  modifications. However, a senior official with the RAC said that  throughout this period, the RAC did not have a clear understanding about  CMS’s expectations regarding the work it should perform.
In addition to not setting clear expectations for the work the Part D RAC  would perform, the agency also did not establish realistic timelines  regarding the length of time required for CMS and the RAC to reach  project milestones. The Part D RAC contract and implementation timeline,  which CMS reviewed, did not adequately reflect the time needed to meet  certain goals. (See fig. 2 for a comparison of the projected and actual  timelines of key implementation activities.) For example, the RAC was  required to ensure its information technology systems comply with the  agency’s information system security guidelines before CMS would grant  it the authority to operate. The implementation timeline projected that the  RAC would receive its authority to operate within 3 months of the contract  award. However, the RAC did not receive its authority to operate until  about 8 months after the contract was awarded. CMS officials told us that  it typically takes up to a year for a new contractor to obtain its authority to  operate.
Furthermore, CMS did not begin collecting improper payments and the  Part D RAC did not begin receiving contingency fees until more than a  year after projected in the 2011 Part D RAC contract. The Part D RAC  contract projected CMS would collect improper payments and the RAC  receive contingency fees by January 2012, the end of the original base  period of the contract. Instead, CMS began collecting improper payments  more than 1 year later, in February 2013. The RAC did not begin  receiving contingency fees until April 2013, 16 months later than  projected. The RAC was required to cover its operating expenses until  audits could begin, but a RAC official said that the RAC had not expected  the projected implementation deadlines to be incorrect by more than a  year. In response to concerns RAC officials raised about expenses the  RAC incurred during perceived delays in receiving contingency fees,  CMS officials said they made several modifications to the Part D RAC  contract. For example, CMS waived key personnel requirements and  extended the base period of the contract eight times.
Since CMS faced challenges setting expectations about the work the   Part D RAC would conduct and about the length of time required for CMS  and the RAC to reach implementation milestones for the Part D RAC  program, the RAC did not have a clear understanding about the work it  should perform, and CMS did not recover improper payments for Part D  until a year later than projected. Consistent with FAR requirements,  agencies should clearly define requirements for services. Furthermore,  well-defined requirements are critical to ensuring the government gets  what it needs from service contractors, as reported in our August 2011  review of opportunities to build strong foundations for better services  contracts. While requirements for a project can change at any point,  officials must aggressively manage changes in requirements to avoid a  negative effect on project results.
section_title: CMS Has Not Completed Annual Evaluations of the Part D RAC but Has Conducted Other Oversight of the RAC’s Performance
paragraphs: Since the Part D RAC contract was executed in January 2011, CMS has  not completed any annual evaluations of the RAC’s performance. CMS is  currently in the process of finalizing an evaluation of the RAC’s 2014  contract year performance. CMS has conducted other oversight of the  RAC by establishing quality assurance procedures, such as progress  meetings, inspection of deliverables, and audit finding review and  acceptance.
subsections: section_title: CMS Has Not Completed Any Annual Evaluations of the RAC Since the RAC Contract Was Signed, but Evaluation for 2014 Is in Progress
paragraphs: CMS has not completed any annual evaluations of the Part D RAC’s  performance since the RAC contract was signed in January 2011. A  senior official with the RAC said that despite the RAC’s requesting annual  evaluations, CMS had not conducted annual evaluations since the  beginning of the contract and did not explain to the RAC why it did not  conduct these evaluations. In March 2015, CMS officials acknowledged  that they should have completed annual evaluations and said the agency  has been behind in its evaluations of some of its contractors, including the  RAC. CMS officials said they started an evaluation of the RAC’s  contract year 2014 performance in December 2014. In May 2015, CMS  officials finished the initial evaluation of the RAC’s 2014 performance and  provided the evaluation to the RAC for review and comment. The RAC  has 60 days to submit a rebuttal to the agency’s evaluation, prior to CMS  completing the evaluation. CMS officials said that the agency would not  likely evaluate the RAC’s performance prior to 2014, but did not indicate  its plans for performance evaluation of the 2015 contract year.
In addition to not having completed an annual evaluation of the RAC,  CMS has not established performance standards with measurable targets  against which to evaluate the RAC’s performance. A senior official with  the RAC said that in addition to requesting evaluations, the RAC  requested performance standards with targets, but has not received  them. CMS officials said that the January 2014 statement of work  included performance standards for the RAC, such as deadlines for  submitting deliverables and error rate targets for audit work—that is, the  target percentage of incorrect determinations of potential improper  payments the RAC should not exceed. However, CMS did not create a  target for how often the RAC must meet deadlines for submitting  deliverables. Also, CMS officials acknowledged that the error rate target  was a threshold used to determine how much time the data validation  contractor would be given to conduct its work. Therefore, it is not a direct  performance standard with targets for the RAC. While performance  standards with targets do not exist for the Part D RAC, they do exist for  other Medicare RACs. For example, the Medicare Parts A and B RACs  have targets of 100 percent compliance in both maintaining private   health information security and responding to written correspondence  within 30 calendar days of receipt.
Multiple federal standards and our prior work contain requirements and  suggestions for conducting regular performance evaluations and  developing performance measures, which would have provided CMS and  the RAC with a basis for evaluating the RAC’s performance. In March  2013, the Office of Management and Budget issued a memorandum  establishing targets in fiscal years 2013 through 2015 to improve  compliance in conducting annual performance evaluations, with a target  of 100 percent compliance in fiscal year 2015. The FAR requires federal  performance-based contracts to include measurable performance  standards and a method for assessing contractor performance against  performance standards, as well as to clearly define requirements for  services. According to federal internal control standards, federal  agencies should conduct monitoring activities to assess the quality of  performance over time and ensure that the findings of audits and other  reviews are resolved promptly. According to our prior work, performance  measurement systems should include not only the collection of data on  various metrics, but also a designation of specific performance measures,  with realistically achievable performance targets against which to  measure progress. Since CMS had not completed annual contractor  performance evaluations of the RAC using performance standards with  measurable targets, CMS did not have a clear basis for assessing RAC  performance in identifying improper payments and did not provide the  RAC with targets against which the RAC could compare its performance.
section_title: CMS Has Conducted Other Oversight of the RAC’s Performance, Including Inspecting Its Work Products and Reviewing Its Audit Findings
paragraphs: While CMS has not conducted annual contractor performance  evaluations, it has conducted other oversight by establishing quality  assurance procedures through contract modifications, including a  statement of work. CMS first established certain quality assurance  procedures in April 2012, through a contract modification, to ensure  compliance with the contract. The quality assurance procedures included  progress meetings, inspection of deliverables, and audit finding review  and acceptance. CMS revised its quality assurance procedures in the  statement of work effective January 1, 2014. The new quality assurance  procedures included monitoring RAC performance using measures including, but not  limited to, demonstration of ongoing dialogue or meetings with the  appropriate and necessary parties;  requiring the RAC to “maintain the highest degree of quality” for all  activities performed throughout the period of performance of the  contract; and monitoring contractor performance using measures including, but not  limited to, completeness and accuracy of data analysis and all  deliverables.
However, these performance measures do not include targets, as called  for in federal standards and our prior work.
CMS took steps to oversee the RAC’s activities using these quality  assurance procedures. For example, CMS officials said they conducted  biweekly meetings with the RAC and held ad hoc meetings, as needed.  CMS has also conducted oversight through audit finding review and  acceptance. A data validation contractor reviews the RAC’s findings, and  with the RAC, it resolves any discrepancies that were found between the  review results and the RAC’s initial findings. CMS officials said that the  data validation contractor reviews 100 percent of the RAC’s findings, in  part because of concerns CMS had about the quality of the RAC’s initial  audit work.
In addition to this ongoing oversight, in June 2014 CMS sent the RAC a  letter titled “Areas of Concern for the RAC Part D Contract” to inform the  RAC of concerns CMS program staff had about the overall performance  of the contract. In the letter, CMS cited the quality assurance procedures  in the statement of work as the source of its performance expectations for  the RAC. CMS identified the following concerns about the RAC’s audit  work:  Incorrect templates and materials being used by the RAC to  communicate with plan sponsors;
Quality issues with identifying potential improper payments and  preparing documents for data validation during audit work; and
Formatting errors and erroneous information in letters to be sent to  plan sponsors.
While the RAC acknowledged that some of the concerns were valid, the  RAC also disagreed with other concerns CMS raised. The RAC  acknowledged that among other things, concerns CMS raised about  some of the formatting errors and erroneous information were valid.  However, the RAC rebutted some of CMS’s concerns. For example, the  RAC noted that there was no measurable target for evaluating the RAC’s  performance for one issue CMS raised. Specifically, CMS stated in the  “Areas of Concern” letter that the agency had identified about 14,000  PDE records that the RAC had incorrectly determined to be potential  improper payments, but did not state what would be an appropriate error  rate. Since CMS did not set a maximum acceptable error rate, the RAC  did not have an established target against which it could measure its  work, and CMS did not have an established target with which to compare  the RAC’s performance. Without performance standards with targets,  CMS is unable to adequately assess the quality of the RAC’s  performance in determining improper payments.
The RAC also noted in its response to CMS’s Areas of Concern letter that  CMS was assessing the RAC’s performance on some of its audit work— identifying potential improper payments for excluded providers—using  expectations that were not in place at the time the RAC was conducting  the work. CMS stated in the second letter replying to the RAC’s response  that while it understood that the performance expectations referenced in  the Areas of Concern letter were not directly in effect when the RAC was  conducting the audit work, CMS’s expectation was that all contractors  would implement and maintain a standard of quality control at all times  during their period of performance. When asked about the fact that  performance expectations were established after the RAC’s audit work  was conducted, CMS officials told us that these concerns stemmed from  expectations originally set in contract modifications and later formalized in  the statement of work. However, our analysis of the contract modifications  in place at the time of the RAC’s work under question did not find contract  language indicating how the RAC’s performance would be evaluated, or  measurable targets establishing a standard of quality control.
section_title: CMS Collected Less than $10 Million in Improper Payments as of May 2015, in Part Because of Challenges in Determining and Conducting Audit Activities
paragraphs: From January 2011 through May 2015, for five audit issues, CMS both  authorized the RAC to conduct audit activities and pursued improper  payment collections. Audit issues include two elements: (1) areas within  the Part D program that should be considered for audits; and (2) the year  or years for which PDE records are being audited. The five audit issues  CMS approved addressed three types of issues: (1) excluded providers,  (2) unauthorized prescribers, and (3) inappropriate refills of certain  drugs regulated by the Drug Enforcement Administration under the  Controlled Substances Act.
CMS had collected less than $10 million in improper payments as of May  2015 for the five approved audit issues. CMS authorized the RAC to  conduct audit activities that identified about $19.8 million in potential  improper payments, and has collected about $9.7 million as of May 2015.  Of the remaining approximately $10.1 million, $7.3 million in potential improper payments has been determined to  be proper, for example, because the plan sponsor provided additional  information verifying the amount of the Part D claim; $45,000 in potential improper payments has been identified as being  uncollectible for various reasons, such as the plan sponsor’s contract  was terminated before audit activity took place; and $2.8 million in improper payments remain that have not yet been  collected, not yet determined to be proper, or not yet identified as  being uncollectible. (See table 1 for each of the five approved audit  issues for which CMS pursued collections, the amount CMS approved  for the RAC to conduct audit activities, and the status of potential  improper payments identified.)
From the beginning of the contract in January 2011 until the statement of  work became effective on January 1, 2014, CMS and the RAC faced  challenges in determining audit issues on which to conduct work. As  noted above, CMS did not initially authorize the RAC to begin conducting  the audit work that the RAC had proposed and outlined in the  performance work statement that became part of the contract. Instead,  the first audit issue CMS approved the RAC to conduct was an audit of  excluded providers for plan year 2007, which CMS suggested and which  was included in a contract modification in February 2012. By the time the  statement of work became effective on January 1, 2014, CMS had  suggested that the RAC conduct audit work on three audit issues:  excluded providers for plan year 2007, excluded providers for plan years  2008 through 2011, and unauthorized prescribers for plan years 2009  through 2011. During that same time, CMS denied four of the six audit  issues the RAC proposed. Of the remaining two audit issues, CMS later  denied one issue and approved the other. CMS denied issues for  various reasons; for example, one audit issue was denied because the  improper payments identified were outside the 4-year period prior to a  plan sponsor’s current plan year, which is the time limit for identifying  improper payments.
After CMS and the RAC agreed to a new process for identifying,  reviewing, and approving audit issues, which became effective on  January 1, 2014, the RAC faced challenges in applying Part D regulations  and CMS rules to develop audit methodologies. The statement of work  CMS and the RAC agreed to included a new process by which the RAC  would submit new audit issues for CMS’s consideration. Figure 3 outlines  the process the RAC and CMS follow to submit, evaluate, and decide on  new audit issues. Under this process, CMS officials said, under some  circumstances the RAC can resubmit an audit issue for a particular plan  year once it has been denied. For example, CMS may deny the  methodology the RAC used and ask the RAC to resubmit the audit issue  using a different audit methodology.
Since the new process took effect, the RAC has faced challenges in  applying regulations and CMS rules to audit methodologies, resulting in  CMS denials. For example,
CMS denied the RAC’s proposal to audit hospice care beneficiaries’  PDE records because CMS guidance published in March 2014,   3 days after the RAC made the proposal, prevents CMS from  performing hospice audits associated with Medicare Part D potential  improper payments prior to May 1, 2014. CMS noted in its denial  that a retrospective audit would not be pursued at the time because  previous CMS guidance was ambiguous and there were no objective  criteria for plan sponsors to apply in determining whether the  beneficiaries were eligible for Medicare Part D.
CMS denied the RAC’s proposal to audit deactivated prescribers in  plan years 2010 through 2012 in part because the RAC’s audit  methodology included using a field in the PDE record that plan  sponsors were not required to submit until January 1, 2013.
CMS officials said they provide the RAC with assistance in developing  audit issues; nevertheless, CMS has not approved any audit issues  submitted since the new process took effect. CMS officials said they hold  regular phone conversations between the RAC and program officials with  subject matter expertise from several CMS program offices, and provide  feedback to the RAC after an audit issue is submitted. However, since the  new process took effect in January 2014, the RAC has proposed nine  audit issues, and CMS has not approved any of them. (See table 2 for  each of the nine denied audit issues.)
Challenges faced by CMS and the RAC have resulted in few audit issues  being approved and therefore a small amount of improper payments  being identified and collected relative to CMS’s estimates of improper  payments in Medicare Part D. In more than 4 years, initial CMS and RAC  challenges in determining the audit work to conduct and later RAC  challenges in determining how to apply regulations and rules to audit  issues have resulted in CMS’s approving 1 of the 15 audit issues the RAC  proposed, and no approvals for issues submitted since the new audit  issue process took effect. The RAC can only resubmit an audit issue  under some circumstances, once it has been denied, so a denial not only  results in lost time and effort, but also may result in a lost opportunity to  identify and collect potential improper payments. In addition, the RAC  may only identify potential improper payments on PDE records within   4 years of the plan sponsor’s current plan year. Therefore, as each year  passes, another prior plan year can no longer be audited by the RAC.
Both CMS and the RAC are charged with reducing Medicare Part D  improper payments. CMS has a goal to reduce improper payments in  Medicare Part D, according to the fiscal year 2016 Annual Performance  Plan and Report. The RAC’s mission is to reduce Medicare improper  payments through the efficient detection and collection of improper  payments, using a methodology that maximizes recoveries as well as  meets all regulatory requirements, according to CMS’s statement of  objectives for the RAC. In addition, federal internal control standards state  that agencies should have effective and efficient processes in place that  enforce management’s directives and that these processes are  monitored. The $9.7 million in improper payments that CMS has collected  since 2011 is a relatively small amount compared to CMS’s estimated  improper payments in Medicare Part D of $1.9 billion in 2014 alone. If the  process for identifying, reviewing, and approving new audit issues was  more efficient in developing appropriate issues, the process would likely  have resulted in more issues being approved each year of the RAC  contract and more improper payments being identified and collected.
section_title: Conclusions
paragraphs: Given Medicare’s vulnerability to improper payments, it is important to  develop a RAC program that effectively identifies and recovers those  improper payments. The effectiveness of the RAC program, which began  in January 2011, has been hindered by various challenges faced by both  CMS and the RAC that resulted in relatively little in improper payment  collections. The first RAC contract is ending on December 31, 2015, and  CMS is contemplating how to solicit contractors for the next RAC  contract. Among CMS’s considerations is obtaining RAC services on the  open market using a full and open competitive solicitation. As CMS  considers its upcoming solicitation for the next contract period, it has an  opportunity to address the challenges it and the RAC faced during the  first contract. Establishing clear work statements, realistic timelines, and  an improved process for identifying, reviewing, and approving audit  issues would provide more assurance that audit work can be conducted  more effectively and efficiently through the next RAC contract.  Additionally, conducting annual performance evaluations against  measurable targets would allow CMS to regularly assess the  effectiveness of a RAC contractor and identify and address any areas for  improvement. Setting in place these improvements would significantly  increase the likelihood of identifying and collecting more improper  payments in the Part D program.
section_title: Recommendations for Executive Action
paragraphs: As CMS prepares to solicit the next RAC contract(s), we recommend that  the Administrator of CMS take the following three actions to improve the  agency’s RAC program operations and contractor oversight:
Ensure that work statements included in solicitations for contract  proposals and the executed contract(s) set clear expectations about  the work CMS intends the RAC to perform and that time frames are  established that reflect the time needed to reach milestones.
Conduct annual evaluations of the RAC’s performance against  measurable performance standards to provide a clear basis on which  CMS and the RAC can assess RAC performance in identifying  improper payments.
Review the agency’s process for identifying, reviewing, and approving  new audit issues to identify process improvements that will help  ensure the efficient development of appropriate audit issues (i.e.,  reduce audit issue denials and increase audit issue approvals) and  thereby maximize the collection of improper payments.
section_title: Agency Comments
paragraphs: We provided a draft of this report to HHS for comment, and its comments  are reprinted in appendix I. HHS also provided technical comments,  which we incorporated as appropriate. We shared portions of the draft  report with the current Part D RAC; the contractor provided oral technical  comments, which we incorporated as appropriate.
In commenting on this report, HHS agreed with our three  recommendations. HHS stated that it plans to select a contractor to serve  as the Part D RAC under new contract terms in January 2016. For this  Part D RAC, HHS stated that it will address our recommendations by  setting clear expectations, reasonable timelines, and measurable  performance standards, as well as developing improved processes for  reviewing new audit topics by strengthening the collaboration between  CMS’s policy experts, PDE review experts, and data analytics experts, as  well as the Part D RAC’s team of analysts. In its comments, HHS also  noted additional steps it has taken to strengthen Part D program integrity,  such as enrolling prescribers of Part D drugs in Medicare by January  2016, and subjecting these prescribers to the screening procedures used  for other Medicare providers. HHS also created a web-based tool to allow  CMS, law enforcement, and plan sponsors to share information and  coordinate actions against high-risk pharmacies.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of the Centers for Medicare &  Medicaid Services, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Major contributors to this report are listed in appendix II.
section_title: Appendix I: Comments from the Department of Health and Human Services
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Kathleen M. King, (202) 512-7114 or kingk@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Karen Doran (Assistant Director),  Muriel Brown, Christine Davis, Peter Mangano, Roseanne Price,   Mandy Pusey, and Jennifer Whitworth made key contributions to   this report.