Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of Providers and Suppliers
Published: 2012-04-10T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: According to the Centers for Medicare & Medicaid Services (CMS)the agency within the Department of Health and Human Services (HHS) that administers the Medicare programmore than 1.5 million health providers and suppliers of medical equipment were enrolled in the Medicare program in 2011, and 30,000 more enroll each month. CMS has established Medicare enrollment standards and procedures intended to ensure that only qualified providers and suppliers can enroll. While most providers and suppliers pose a limited risk to the Medicare program, our previous work found persistent weaknesses in CMSs Medicare enrollment standards and procedures that increased the risk of enrolling entities intent on defrauding the program. In 2010, the Patient Protection and Affordable Care Act (PPACA) authorized CMS to implement procedures to strengthen the Medicare enrollment process.
GAO was asked to review CMSs Medicare provider enrollment procedures. In this report, GAO describes (1) how CMS and its contractors use provider and supplier enrollment information to prevent improper payments and factors that may affect the usefulness of this information, and (2) the extent to which CMS has implemented new provider and supplier enrollment screening procedures since the enactment of PPACA. To do so, GAO reviewed relevant regulations and documents, and interviewed officials from CMS and a sample of four of the agencys contractors based on the volume of claims they processed and the status of their contracts with CMS.
section_title: What GAO Found
paragraphs: Medicare claims are screened against enrollment information, using automated enrollment-related prepayment edits, in an effort to prevent improper payments to ineligible providers and supplierssuch as those that are no longer active in the Medicare program or are not properly licensed to provide the services for which they have submitted claims. Officials with the contractors we interviewed described the use of several types of prepayment edits to ensure that claims data are valid. For example, verification edits are intended to check the providers National Provider Identifier (NPI), which indicates whether the claim was submitted by an active provider or supplier. However, factors such as the frequency with which contractors have updated provider and supplier enrollment information and limitations of the data used may affect the timeliness and accuracy of data used to screen claimsin turn limiting the ability of the edits to prevent improper payments from occurring. For example, to update information maintained in the Provider Enrollment, Chain and Ownership System (PECOS)CMSs centralized database for Medicare enrollment informationthe contractors have relied on a variety of data sources that vary in the frequency with which they are updated and the ease with which the data can be accessed. We have previously reported concerns about the accuracy of the enrollment information in PECOS and recommended CMS increase its oversight of its contractors provider and supplier enrollment activities. CMS acknowledged these concerns and indicated that the agency is working to address these issues.
Since the enactment of PPACA, CMS has implemented some new provider and supplier enrollment screening procedures and other measures intended to strengthen the existing Medicare enrollment process. New screening procedures include the designation of three different levels of risk of fraud, waste, and abuse, with categories of providers and suppliers assigned to limited, moderate, and high-risk levelsand those in the highest level subject to the most rigorous screening. For example, providers and suppliers in all three risk levels must undergo licensure checks, while those in moderate- and high-risk levels are subject to unannounced site visits. In addition, CMS implemented new application fees for some providers and suppliers. CMS also added two new Medicare contractors, an automated screening contractor and a site visit contractor, to conduct enhanced enrollment screening and site visits. CMS officials said that they expect the new automated screening contractor to identify additional data sources against which to screen, such as financial, tax, and business data sources. CMSs implementation of some additional enrollment screening procedures is still in progress. For example, by the end of 2012, CMS plans to contract with two Federal Bureau of Investigation-approved contractors to conduct fingerprint-based criminal background checks of high-risk providers and suppliers. In addition, the agency plans to extend the requirement for surety bonds to high-risk providers and suppliers beyond those already required of suppliers of durable medical equipment, orthotics and supplies. A surety bond guarantees that if a provider or supplier does not fulfill its obligation to Medicare, CMS can recover its losses via the surety bond.
HHS reviewed a draft of this report and in its written comments noted CMSs ongoing efforts to improve provider and supplier enrollment procedures. HHS also provided technical comments, which were incorporated as appropriate.

section_title: Letter
paragraphs: For more than 20 years, we have designated Medicare as a high-risk  program because of serious management challenges due to its size,  complexity, and susceptibility to fraud, waste, abuse, and improper  payments. In 2011, Medicare covered 48.4 million individuals 65 years  and older and eligible individuals with disabilities, and total Medicare  program expenditures were $565 billion. For fiscal year 2011, the  Department of Health and Human Services (HHS) estimated the agency  made improper payments of nearly $29 billion in the Medicare fee-for- service (FFS) program.
More than 1.5 million health providers and suppliers of medical equipment  were enrolled in the Medicare program in 2011, according to the Centers  for Medicare & Medicaid Services (CMS)—the agency within HHS that  administers the Medicare program—and 30,000 more enroll each month.  CMS has established Medicare enrollment standards and procedures  intended to ensure that only qualified providers and suppliers can enroll in  the Medicare program. For example, standards for suppliers of durable  medical equipment, prosthetics, orthotics, and supplies (DMEPOS)  include proper licensure and a physical facility on an appropriate site that  is accessible to beneficiaries and CMS. This information must be verified  prior to enrollment. Screening at the time of enrollment is a crucial step  to reduce the risk of enrolling providers intent on defrauding or abusing  the program.
According to CMS, the majority of providers and suppliers enrolling in  Medicare are legitimate and pose a limited risk to the Medicare program.  However, our previous work found persistent weaknesses in CMS’s  Medicare enrollment standards and procedures that increased the risk of  enrolling entities intent on defrauding the Medicare program. For  example, we found that the Medicare enrollment process for home health  agencies did not routinely include verification of the criminal background  of applicants, and without this information individuals and businesses that  misrepresent their criminal backgrounds could be allowed to enroll in the  Medicare program. We also conducted covert testing and found that DMEPOS suppliers were enrolled who did not meet Medicare’s standards  or were not legitimate businesses.the enrollment processes for home health agencies and DMEPOS  suppliers due to the higher incidence of improper payments among these  providers. We also recommended strengthening Medicare enrollment  standards and procedures as a key strategy for reducing fraud, waste,  abuse, and improper payments in Medicare.
We recommended stricter scrutiny of  In 2010, the Congress passed the Patient Protection and Affordable Care  Act (PPACA), which included provisions that will expand health insurance  coverage to millions of individuals, and provided CMS with increased  authority to combat fraud, waste, and abuse in Medicare.  Certain of  these provisions are designed to strengthen Medicare’s provider  enrollment standards and procedures. For example, PPACA requires  HHS to designate a level of screening according to the assessed risk of  fraud, waste, and abuse with respect to the category of provider or  supplier. At a minimum, PPACA requires all providers and suppliers to be  subject to licensure checks, which may include checks in multiple states.  PPACA gives CMS the authority to require additional screening  procedures, such as criminal background checks, depending on the type  of risk presented by the type of provider or supplier.
CMS oversees a network of contractors that implement and monitor the  Medicare program. Among these contractors are the Medicare  Administrative Contractors (A/B MAC) that enroll and pay providers and  suppliers, except for DMEPOS suppliers, for the services they provide to  Medicare beneficiaries for Medicare Part A and Part B, the National  Supplier Clearinghouse (NSC) that manages DMEPOS supplier  enrollment, and the Durable Medical Equipment Medicare Administrative  Contractors (DME MAC) that pay claims for DMEPOS items. The A/B MACs also educate their enrolled providers and suppliers on CMS  policies and procedures, provide information to beneficiaries, and  undertake efforts to detect and prevent fraud and abuse. The NSC serves  as the centralized contractor for the enrollment process and site visits for  DMEPOS suppliers. In 2011, CMS awarded contracts to two new  contractors—an automated screening and a national site visit  contractor—to perform aspects of the provider and supplier enrollment  screening process, including various screening activities and site visits  beginning in 2012. Effective implementation by CMS of PPACA’s provider  and supplier enrollment provisions, through these and other contractors,  is expected to aid CMS in its efforts to ensure that it only enrolls and pays  providers and suppliers that meet Medicare’s enrollment standards.
You asked us to examine how CMS uses enrollment information to  prevent payment of improper or potentially fraudulent Medicare claims  and to assess changes to CMS’s Medicare provider enrollment  procedures since the passage of PPACA. This report addresses (1) how  CMS and its contractors use provider and supplier information to prevent  improper payments and factors that may affect the usefulness of the  enrollment information, and (2) the extent to which CMS has implemented  new provider and supplier enrollment screening procedures since  enactment of PPACA.
To assess how CMS and its contractors use provider and supplier  enrollment information to prevent improper payments and factors that  may affect the usefulness of the information, we obtained and reviewed:  claims processing documents, including CMS procedural manuals and  directives; claims processing schematics; and the criteria used to develop  and implement prepayment edits that use enrollment information to  ensure claims are only paid to providers and suppliers that are eligible to  bill Medicare. We examined the role of the data in the Provider  Enrollment, Chain and Ownership System (PECOS) —CMS’s centralized  database for Medicare enrollment information—in the Medicare claims  payment process. In addition, we reviewed our past reports and those  issued by the HHS Office of Inspector General (HHS OIG) that discussed  the accuracy of PECOS data. We interviewed CMS officials and a total  of four A/B and DME MACs on how they use provider and supplier  enrollment information to prevent improper payments. We interviewed  A/B MACs whose workloads were fully implemented by 2010 and whose   In  contracts were not being recompeted during the course of our work.addition, we assessed A/B MAC claims processing workloads in order to  select A/B MACs that had the largest percentages of the national  workload. Our sample selection strategy resulted in two A/B MACs and  two DME MACs.
To assess the extent to which CMS has implemented new provider and  supplier enrollment screening procedures since the enactment of PPACA,  we reviewed agency documents, including the Proposed and Final Rule  that implemented PPACA’s provider screening and other enrollment  provisions, documents that described how PPACA-related enrollment  processes compared to previous CMS enrollment procedures, and  documents describing new processes that were not yet fully   We limited our review to only those PPACA provisions  implemented. that establish provider and supplier enrollment conditions that must be  met before enrollment in Medicare. We also interviewed CMS officials  about provider and supplier enrollment screening procedures that were  developed and implemented as a result of these PPACA provisions. In  addition, we conducted interviews with the two A/B MACs to learn about  their experiences implementing new enrollment procedures authorized by  PPACA. We also interviewed NSC officials responsible for enrolling  Medicare DMEPOS suppliers.
Medicare, Medicaid, and Children’s Health Insurance Programs; Additional Screening  Requirements, Application Fees, Temporary Enrollment Moratoria, Payment Suspensions  and Compliance Plans for Providers and Suppliers, 76 Fed. Reg. 5862 (Feb. 2, 2011).
We conducted this performance audit from July 2011 to February 2012 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Medicare comprises 12 percent of the federal budget and is the third  largest federal program after defense and Social Security. For fiscal year  2011, HHS reported an estimate of almost $29 billion in Medicare FFS  improper payments. Our Standards for Internal Control in the Federal  Government suggests that agencies should continually perform  monitoring activities to reduce the incidence of improper payments.  However, our prior reports found weaknesses in CMS’s monitoring of  Medicare provider and supplier enrollment and claims payment  contractors. Partly in response to our work, CMS took steps to  implement new DMEPOS supplier quality standards in an accreditation  rule issued in August 2006 and proposed additional DMEPOS supplier  enrollment standards in January 2008. To further address these concerns  and create a focal point for all Medicare program integrity activities, in   CPI, in  2010, CMS established a Center for Program Integrity (CPI).collaboration with other components within CMS, develops and  implements the agency’s Medicare program integrity mission and goals.  Among these goals is a reduction in instances of fraud, waste, and abuse,  as well as strategies to ensure program vulnerabilities are identified and  resolved.
According to CMS, the agency is pursuing an aggressive program  integrity strategy to prevent payment of potentially fraudulent claims,  rather than to recover funds from providers and suppliers after payment  has already been made. Because identifying and prosecuting providers  and suppliers engaged in potentially fraudulent activity is time consuming,  resource intensive, and costly, CMS has designed measures intended to  prevent enrollment by entities that might attempt to defraud or abuse the  Medicare program. For example, the agency requires that applicants use  a unique 10 digit National Provider Identifier (NPI) number and affirm that  they are not excluded from participating in another federal health  program. DMEPOS suppliers must also undergo pre-enrollment site  visits. In addition, the agency requires enrollment information to be  entered into PECOS, a single, centralized, provider and supplier  enrollment database that assists with data sharing across the contractors’  different geographic coverage areas. In addition, CMS has historically  required the A/B MACs and the NSC to conduct activities, such as  monthly reviews of state licensing board actions, to determine if individual  providers continue to meet state licensing requirements and to conduct  periodic checks to determine if entities continue to meet federal and state  requirements for their respective provider or supplier type. With the  implementation of the automated screening contract, these checks will be  automated and conducted on a continuous basis, according to CMS.
subsections: section_title: Medicare Contractors
paragraphs: Since the Medicare program was created in 1965, it has been  administered through a network of private contractors. CMS uses these  contractors to conduct claims administration activities, to implement  provider outreach and education, and to answer beneficiary inquiries  through the 1-800-Medicare help line. Contractors also perform program  integrity activities such as auditing providers and suppliers, reviewing  claims for medical necessity, and conducting investigations of potential  fraud, waste, and abuse. Central to program operations are the   A/B MACs that manage Medicare provider and supplier enrollment,  except for DMEPOS suppliers, and pay and review the claims submitted  in their jurisdictions. In 2011, A/B MACs managed more than 1.5 million  Medicare providers and suppliers. The previous year, A/B and DME  MACs paid approximately 4.5 million claims each work day on behalf of  CMS. Additionally, CMS contracts with the NSC to centralize the  enrollment process and site visits for DMEPOS suppliers. In 2010,  Medicare spent about $8.1 billion on DMEPOS supplies. In 2011, CMS  added two new Medicare contractors to centralize and standardize the  provider and supplier enrollment screening process.
section_title: Medicare Enrollment Process
paragraphs: To become eligible to bill for services or supplies provided to Medicare  beneficiaries, providers and suppliers must apply to the program.  Entities applying to the Medicare program may complete an online  enrollment form using PECOS or submit a paper application that is  manually entered into PECOS by the A/B MACs or the NSC. Enrolling  providers and suppliers submit identifying information such as their name,  address, specialty area, and information about applicable licensure and  accreditation.
After the enrollment data are entered into PECOS, the A/B MACs and the  NSC handle different aspects of the application process. The A/B MACs  process all provider and supplier applications except for those for  DMEPOS suppliers and the NSC processes all enrollment applications  from DMEPOS suppliers nationally. Provider and supplier applications in  PECOS are confirmed by the A/B MAC overseeing the jurisdiction where  the services will be provided and by the NSC for DMEPOS suppliers.  Contracts awarded in 2011 to new automated screening and site visit  contractors altered this structure. CMS’s new provider screening  contractor will automate many of the required enrollment checks that the  A/B MACs and the NSC have done manually and will allow CMS to  monitor all providers and suppliers on a continuous basis to help ensure  they continue to meet Medicare enrollment requirements. These  contractors assumed some functions from the A/B MACS and the NSC in  early 2012.
Prior to CMS’s automated screening contractor assuming these  responsibilities, the A/B MACs and the NSC confirmed the provider and  supplier enrollment information by checking various data sources such as  the Social Security Administration (SSA) to verify an individual’s Social  Security number, the National Plan and Provider Enumeration System to  verify the provider’s NPI, and state licensing boards to determine if the  provider is appropriately licensed to furnish medical services within a  given state. CMS also required the A/B MACs and the NSC to check  additional data sources including the HHS OIG’s List of Excluded  Individuals/Entities (LEIE) and the General Service Administration’s  Excluded Parties List System (EPLS). Starting March 25, 2011, CMS  required the A/B MACs to conduct site visits for categories of providers  and suppliers designated as moderate and high risk. The NSC will  continue to conduct site visits related to enrollment of DMEPOS suppliers.  In addition, due to long-standing concerns about high rates of fraud,  waste, and abuse by DMEPOS suppliers, they have been subject to  additional enrollment requirements. For example, DMEPOS suppliers  must meet additional quality standards before they can be enrolled in  Medicare, including proper accreditation, the successful completion of a  site visit inspection, and posting of a $50,000 surety bond.
section_title: Claims Processing and Enrollment-Related Prepayment Edits
paragraphs: CMS oversees contractors that manage the three major computer  systems used to process Medicare Part A, Part B, and DMEPOS claims.  Together, these computer systems are referred to as the “shared  systems,” because claims from all the A/B MACs and DME MACs are  processed by these systems. CMS refers to the contractors that manage  these systems as the “shared systems maintainers.” Provider and  supplier enrollment information in PECOS is downloaded to the shared  systems in provider files that are used in claims processing. Information  in the provider files is intended to ensure that providers and suppliers are  eligible to receive payment for the services for which they have submitted  claims. Although multiple contractors are involved in the claims payment  process, the A/B and DME MACs are ultimately responsible for timely and  accurate processing and payment of provider and supplier claims. For the  relationship between the various contractors prior to January 2012 see  figure 1.
Providers and suppliers submit most claims to Medicare electronically.  Upon electronic submission, claims first pass through an Electronic Data  Interchange (EDI) process that makes sure the claims are formatted  using the nationally established standards to exchange electronic  information between business entities. In the EDI process, the claim is  subject to automated prepayment controls called “edits.” Here, front end  edits screen the claim for formatting errors or missing data. For example,  a front end edit checks the claim to ensure that it contains the required   10 digit NPI but would not check the validity of the NPI. Medicare  contractors reported that Medicare Parts A and B and DMEPOS claims  that do not pass front end edits are considered unprocessable and are  returned by the contractors to the appropriate provider or supplier, which  may then correct the error(s) and resubmit the claim.
If a Medicare claim is in the correct electronic format and passes the front  end edits, it is then sent for further processing in the shared systems.  There, the claim is subject to a series of prepayment edits that can  prevent payment of an incomplete or incorrect claim and may reduce  improper payments and help minimize the extent to which the program is  vulnerable to fraud, waste, and abuse. Prepayment edits include provider  enrollment-related edits and subsequent edits that screen Medicare  claims against other criteria, such as medical necessity.
Enrollment-related prepayment edits can be implemented on either the  national or local level. The national enrollment-related prepayment edits  are CMS-directed edits that are “hard coded” into the shared systems by  the systems maintainers. National edits are updated quarterly and are  standard across all A/B or DME MACs. In contrast, local prepayment  edits are created and managed by the individual A/B or DME MACs. They  may develop local enrollment-related prepayment edits based on  differences in state law that determine the scope of a provider’s or  supplier’s practice. CMS may also direct the A/B and DME MACs to  develop local edits because they can be implemented on a more flexible  schedule than CMS’s quarterly updates to national edits.
section_title: Claims Are Screened against Enrollment Information to Prevent Improper Payments, but Prevention Depends on Timely and Accurate Information
paragraphs: Medicare claims are screened during the payment process by a series of  enrollment-related prepayment edits that check claims against provider  and supplier information maintained in PECOS. Such edits are designed  to prevent payments to providers and suppliers that the data indicate are  ineligible to receive Medicare payment. While prepayment edits are in  place to prevent improper payments, factors such as frequency of  information updates and the limitations of the data used to update  information in PECOS may affect the timeliness and accuracy of provider  and supplier information. In turn, this may limit the extent to which  enrollment-related edits prevent payments to ineligible providers and  suppliers.
subsections: section_title: Enrollment-Related Prepayment Edits Are Designed to Prevent Payments to Ineligible Providers and Suppliers
paragraphs: Enrollment-related prepayment edits are designed to prevent payments to  ineligible providers and suppliers—such as those that are no longer active  in the Medicare program or that are not properly credentialed or licensed  to provide the services for which they have submitted claims. Ineligible  providers and suppliers may be enrolled in Medicare despite CMS’s and  its contractors’ enrollment screening efforts. Officials with the A/B and  DME MACs we interviewed described the application of prepayment edits  to claims as a cascading series of checks that occurs progressively as the  claim moves through the process according to the edits’ “if/then” logic.  For example, a certain edit will compare the NPI contained in a provider’s  file with the date of service contained in the claim, and if the NPI was  active on the date of service, then the claim would move to the next stage  of processing. The two types of enrollment-related prepayment edits are  provider and supplier verification edits and specialty edits.
Provider and supplier verification prepayment edits: Medicare  claims are subject to edits that verify basic provider and supplier  enrollment information. These enrollment-related verification edits  screen the claim’s data to ensure that the provider or supplier is  eligible for payment. For example, such edits verify the validity of the  entity’s NPI, which indicates whether the claim was submitted by an  active provider or supplier. Verification edits at this stage of claims  processing also screen claims to ensure that the provider’s or  supplier’s enrollment date is before the claim’s date of service, thus  indicating that they were an active provider or supplier on that date  and therefore generally eligible for payment. A/B and DME MAC  officials reported that claims failing these enrollment verification  prepayment edits are not paid. Information on a denied claim due to  provider or supplier ineligibility, including reason codes that explain  the reason(s) for which the claim was not paid, is sent to the provider  or supplier. These codes include reasons such as “the provider must  update license information with the payer” and “invalid provider  identifier.” One DME MAC estimated that the number of claims denied  due to the claim’s date of service occurring outside of a DMEPOS  supplier’s “effective dates” for billing eligibility was only about 36,000  claims out of a total of about 50 million claims per year.
Specialty prepayment edits: Enrollment-related specialty  prepayment edits screen for provider- or item-specific information  about providers or suppliers, such as their eligibility to bill for certain  services that can only be provided by a certain provider type or  specialty. For example, limited license providers such as chiropractors  can only be paid for a limited number of allowable billing codes  determined by CMS. Specialty edits screen claims to ensure that the  claim contains these allowable codes. DME MAC officials told us that  edits at this stage would also ensure, for example, that a podiatrist is  only paid for podiatry services and not ophthalmology services.
Verification and specialty enrollment-related prepayment edits may be  implemented as either national or local edits. According to one A/B MAC  we spoke with, because there is little differentiation among Part A  providers most enrollment-related prepayment edits for these providers  are implemented as national edits, which are programmed into the shared  systems. A/B MAC officials reported that additional enrollment-related  local edits are more likely to be implemented for Part B provider claims  due to differences among states regarding reimbursement for certain  services and provider types. These Part B specialty edits are  implemented as local edits by the A/B MAC responsible for that state.  Regarding DME claims, one contractor we spoke with reported that CMS  more frequently standardizes the DME claims payment process. This  assures uniform coverage decisions across all DME MACs. DME MAC  officials reported that DME specialty edits include those applied to  oxygen, pharmacy, prosthetics, and orthotics claims. For example, DME  MAC officials told us that the edits applied to oxygen claims ensure that  only suppliers who have the required valid license to provide oxygen  services receive payment. All three types of claims—Part A, Part B, and  DME—that fail prepayment edits, whether at the national or local level,  are denied and returned to the provider or supplier with a reason code  that explains why the claim was not paid. For example, it may indicate  “this provider type/provider specialty may not bill this service.”
While prepayment edits are implemented to reduce the likelihood of  improper payments due to provider or supplier ineligibility, the  effectiveness of specific enrollment-related edits is not assessed by the  A/B or DME MACs or CMS. A/B MAC officials reported that they generally  do not need to analyze data on claims that are not paid because a  prepayment edit indicates the provider or supplier is ineligible to bill for  services. Thus, these contractors do not report on which of the  prepayment edits prevented the improper payment. A/B MAC officials  explained that each enrollment-related prepayment edit is developed to  perform a specific function and therefore they do not rank edits in order of  their effectiveness in preventing improper payments. Additionally, they  told us that they do not submit reports to CMS that identify which  enrollment-related prepayment edits are most effective. CMS requires  A/B MACs to submit quarterly supplements to monthly workload reports  that provide the agency with information on the number of denied claims  and reasons for denials, but this information is used to identify problem  areas for resolution, measure trends in denial rates, and monitor fraud  and abuse workloads. Although officials from one A/B and two DME  MACs told us that they may generate reports on claim activity, these data  generally are used for internal workload planning purposes or as the  basis for provider education on proper coding, not to determine the  effectiveness of certain categories of edits.
section_title: Edits Depend on Timely and Accurate Information in PECOS
paragraphs: The ability of enrollment-related edits to prevent improper payments  depends on the timeliness and accuracy of provider and supplier  enrollment information contained in PECOS. In turn, the timeliness and  accuracy of information in PECOS—which is downloaded as provider files  into the shared systems each night—is affected by factors such as the  frequency with which contractors update this information and limitations of  the sources of the information used. A/B MACs and the NSC are  responsible for updating PECOS when conducting initial and revalidation  enrollment for providers and suppliers.NSC were not able to confirm the status, such as licensure, of every  provider or supplier in PECOS on a daily basis. Instead, certain aspects  of provider and supplier status have been checked less frequently. For  example, A/B MACs were required to conduct monthly reviews of provider  licensure status and an A/B MAC official told us that they searched  individual state websites for this information. A/B MACs and NSC also  have relied on a variety of data sources such as state licensure boards,  the HHS OIG’s exclusions list, and SSA’s Death Master File (DMF) to  update provider and supplier information in PECOS. These sources vary  in the ease with which A/B MACs and the NSC have been able to access  their data and the frequency with which they are updated. For example,  CMS officials reported that the A/B MACs had to manually access state  data sources to update licensure status. In addition, contractors we spoke  with said SSA releases updates to its DMF monthly and therefore there is  an interval between a provider’s death and when that information can be  updated in PECOS. As a result, payments may still be made for claims  submitted under a deceased provider’s NPI for medical services allegedly  provided after the provider’s death. One A/B MAC official said that  PECOS must first be updated to reflect the provider’s status and this  information in turn must be downloaded into the shared systems in a  timely manner to prevent an improper payment from being made. This is  because, while enrollment-related prepayment edits can identify and deny  invalid claims, the edits use the existing provider and supplier information  to do so. Thus, if the PECOS provider and supplier information is not  current or is inaccurate, the edits will be ineffective in preventing improper  payments.
However, A/B MACs and the  We have previously reported concerns about the accuracy of the provider  and supplier enrollment information in PECOS and CMS’s oversight of  A/B MACs’ provider and supplier enrollment activities. CMS has  acknowledged these concerns and indicated that the agency is working to  address these issues. For example, we recently reported that incomplete  or conflicting provider contact information in PECOS limited CMS from  using its own data to operate its Physician Feedback Program.  Furthermore, in 2010 we reported that A/B MACs had difficulty  recognizing when nursing home provider information in PECOS was  incomplete or inaccurate and CMS oversight of A/B MACs in this regard  was limited. In that same report, we found that although CMS conducted  desk reviews and onsite audits from years 2000 through 2009 to review  contractors’ management of nursing home providers’ enrollment  functions, these audits were limited. In addition, beyond these audits,  CMS did not conduct checks on the PECOS database for internal  consistency. According to a CMS official, this limited oversight was due to  a lack of resources and competing priorities within the agency. As a result  of these findings, we recommended that CMS more closely monitor the  activities of A/B MACs’ provider and supplier enrollment activities to help  ensure the accuracy and completeness of PECOS data. CMS concurred  with this recommendation and recently reported that the agency is  evaluating the criteria it uses to assess A/B MACs’ performance as it  relates to the timeliness and accuracy of processing Medicare enrollment   Further, the agency reported that it plans to evaluate the  applications.completeness and accuracy of provider and supplier enrollment data as  part of reviews of the contractors’ enrollment operations. Given that these  activities have not been implemented, we could not determine their effect  on the completeness and accuracy of PECOS data used to process  claims or whether improper payments result from inaccurate information  in the provider files.
section_title: CMS Has Implemented Some New Enrollment Screening Procedures Since PPACA, While Others Remain in Progress
paragraphs: Since the enactment of PPACA, CMS has implemented new provider and  supplier enrollment screening procedures and has also implemented  other measures intended to strengthen existing procedures. However, the  implementation of some additional enrollment screening procedures by  CMS is still in progress.
subsections: section_title: CMS Implemented Some New Screening Procedures and Added Measures Intended to Strengthen Other Existing Procedures
paragraphs: Since the enactment of PPACA, CMS has implemented some new  provider and supplier enrollment screening procedures, and put in place  other measures intended to strengthen existing procedures. New  screening procedures that define conditions for provider and supplier  enrollment in Medicare include CMS’s determination of different levels of  screening according to the risk of fraud, waste, and abuse with respect to  categories of providers or suppliers, and a new application fee for some  types of providers. CMS also published a regulation consistent with its  existing practice, requiring providers and suppliers to include their NPI on  all enrollment applications and claims, and added two new Medicare  contractors—an automated screening contractor and a site visit  contractor—that are intended to conduct enhanced enrollment screening  and site visits.
To strengthen the screening activities already conducted by CMS’s  contractors, PPACA required that the level of screening applied to each  category of provider and supplier be based on their assessed risk of  fraud, waste, and abuse and that screening procedures for Medicare  providers and suppliers be explicitly established. On February 2, 2011,  CMS published a Final Rule to implement these new screening  procedures. The Final Rule requires, among other things, that the A/B  MACs and the NSC conduct enrollment screening based on categories of  providers and suppliers and levels of risk.levels—limited, moderate, and high—to categories of providers and  suppliers based on determinations of which categories were at a greater  risk for fraud, waste, and abuse. (See table 1.) A/B MACs and the NSC  designate the appropriate screening level in PECOS for each enrolling  provider and supplier upon submission of an application. Screening levels  are designated based upon CMS guidance. As of October 2011, A/B  MACs and the NSC had entered the screening level information in  PECOS for all providers and suppliers that submitted an application.
CMS assigned these new risk  CMS stated that it assigned these categories of provider and supplier risk  levels based on the agency’s experience with claims data used to identify  potentially fraudulent billing practices, as well as on the expertise of its  contractors charged with investigating and identifying instances of  Medicare fraud across providers and suppliers. The agency also based  these risk levels on prior findings in reports by GAO and HHS OIG. In  addition, CMS will adjust the screening level of an individual provider or  supplier from ‘‘limited’’ or ‘‘moderate’’ to ‘‘high’’ based on other factors,  such as whether the provider or supplier has had its Medicare billing  privileges revoked, has been terminated or is otherwise precluded from  billing Medicaid, or has been subject to any final adverse action within the  past 10 years such as license revocation or suspension, or certain felony  convictions.
Based on these new risk levels, providers and suppliers are subject to  different screening procedures, with those in the high-risk level subject to  the most rigorous screening. While PPACA requires that all categories of  providers and suppliers be subject to licensure checks, it gave CMS  discretion to establish a risk-based application of other screening  procedures. CMS determined that providers and suppliers in all  categories also must continue to undergo existing enrollment checks  using various data sources to verify certain information such as Social  Security number, NPI, HHS OIG exclusion, and taxpayer identification  number. According to CMS’s new risk-based screening, moderate- and  high-risk providers and suppliers additionally must undergo unscheduled  or unannounced site visits, while high-risk providers and suppliers also  will be subject to fingerprint-based criminal background checks.
PPACA required HHS, for the first time, to impose an application fee on  each institutional provider and on suppliers. In response, effective   March 25, 2011, CMS, in its Final Rule, required all institutional providers  and suppliers enrolling in Medicare, adding a practice location, or  revalidating their enrollment to pay a $505 application fee. PPACA  specifies that amounts collected as the result of the application fee shall  be used for program integrity efforts, including to cover the cost of  enrollment screening and to carry out other screening. However,  PPACA permits CMS to grant a hardship exception for institutional  providers and suppliers on a case-by-case basis if the agency determines  that the imposition of the application fee would cause a hardship.  According to CMS officials, an institutional provider or supplier working  with underserved populations or engaged in extensive charity work would  be a possible candidate for a hardship exception. CMS has instructed its  contractors in guidance on March 23, 2011, not to process any Medicare  enrollment applications without the proper application fee having been  paid or a hardship exception approved.about application fee payments by institutional providers and suppliers—  CMS transmits information  which are made through an electronic payment system—to the A/B  MACS or the NSC via PECOS.
PPACA required HHS to promulgate a regulation for the inclusion of an  NPI on all Medicare applications and claims by all providers and suppliers  that qualify for an NPI—a practice that was already in effect. regulation was published as an interim Final Rule on May 5, 2010, and  was effective July 6, 2010. Prior to the PPACA requirement for a  specific regulation, CMS had required contractors to confirm that  providers and suppliers included their NPI on Medicare enrollment  applications and claims. Since 2006, the agency has required that  enrollment applications include an NPI and since 2008 providers and  suppliers have been required to report their NPI on Medicare claims.
PPACA, § 6402, 124 Stat. 119, 753-763 (codified at 42 U.S.C. § 1320a-7k). provider or supplier meets Medicare eligibility criteria such as valid  licensure, accreditation, and a valid NPI, and is not on exclusion lists,  such as the HHS OIG list of providers and suppliers excluded from  participating in federally funded health care programs. This screening  process results in a report to the A/B MACs and NSC that indicates the  screening components that the applicant passed and also screening  components flagged for additional review. The A/B MACs and NSC,  which remain responsible for enrollment and revalidation, obtain  documentation from the provider or supplier on any flagged information  that requires additional review to determine if the applicant meets  Medicare enrollment or revalidation requirements. In addition to  conducting screening at enrollment and revalidation, the automated  screening contractor conducts checks of certain screening information on  an ongoing basis. For example, the automated screening contractor is  responsible for validating licensure status at least weekly. Previously, A/B  MACs and the NSC were responsible for manually reviewing state- provided licensure information monthly to determine if any enrolled  Medicare providers’ or suppliers’ licenses had been revoked, suspended,  or otherwise inactivated in the last 60 days.
CMS officials said that the automated screening contractor is developing  an individual risk score for each provider or supplier. This individual risk  score is similar to a credit risk score. The contractor’s risk scores may be  used eventually as additional risk criteria that determine screening  activities for providers and suppliers.
CMS officials said the new automated screening contractor provides a  centralized point for Medicare enrollment screening and allows for a  national view of provider and supplier information, rather than the more  limited regional view that the A/B MACs provided previously. For  example, the automated screening contractor has been able to access  information about providers and suppliers who operate across geographic  regions. In addition, CMS officials said that the agency has taken a  centralized approach to automated screening of enrollment data because  of weaknesses observed in enrollment screening efforts, which were due  generally to the large number of providers and suppliers for which the A/B  MACs and the NSC had to manually screen applications and the lack of  efficient access to data sources containing enrollment information.  According to CMS officials, they expect the new automated screening  contractor to improve the integrity of the enrollment and revalidation  processes by automating the data checks and integrating new data  sources. For example, CMS has directed the automated screening  contractor to identify additional data sources for screening checks, such  as financial, tax and business, and geospatial data sources.
Additionally, in December 2011, CMS contracted with a site visit  contractor to perform nationwide physical site visits for all providers and  suppliers, except DMEPOS suppliers, in the moderate- and high-risk  screening categories in all states and six U.S. territories. The site visit  contractor began conducting site visits and making site visit reports  available electronically through a portal accessible to CMS and its other  contractors in February 2012. These site visits previously were performed  by the A/B MACs. The A/B MACs will order any required on-site visits  through the site visit contractor, which will schedule and conduct them  and provide the results to the appropriate A/B MAC. However, the NSC  will continue to conduct site visits related to provider enrollment of  DMEPOS suppliers.
CMS requires two types of site visits: routine and rapid response.  According to CMS, routine site visits involve a physical location  verification and collection of required data elements using predefined  checklists. Rapid response site visits are triggered by an alert of possible  fraudulent activity, and may require the same elements as a routine site  visit but with rapid reporting and response due to the alert. Except for  DMEPOS suppliers, the national site visit contractor collects site visit  information at the physical provider or supplier site using defined  questionnaires and gathers photographic evidence for transmission to  CMS. The data elements required during routine and rapid response site  visits include validation of the physical location of the provider or supplier,  including capturing global positioning system coordinates of the site,  photographs of the door of the provider or supplier office, and signage of  the office. The contractor is required to conduct site visits and deliver  completed site visit reports within a specified time period. Depending on  the request from CMS or an A/B MAC, the contractor will make site visits  within 30, 15, or 7 days, for routine visits, or within 36 hours for rapid  response visits. CMS estimated that in the first year of the contract, the  site visit contractor would conduct nearly 60,000 site visits within 30 days,  almost 5,000 site visits within 15 days, almost 1,000 site visits within   7 days, and about 30 rapid response site visits. CMS officials said the  national site visit contractor is expected to provide consistency of site  visits across the country and, similar to the automated screening  contractor, reduce the A/B MACs’ workloads.
section_title: Several New Screening Procedures Remain in Progress
paragraphs: CMS’s implementation of some enrollment screening procedures  authorized by PPACA remains in progress, including efforts to (1) extend  surety bond requirements to additional providers and suppliers,   (2) conduct fingerprint-based criminal background checks of high-risk  providers and suppliers, (3) require enrolling providers and suppliers to  disclose additional types of information, and (4) require compliance and  ethics programs for providers and suppliers.
CMS is in the process of drafting a proposed rule to extend the surety  bond requirement to certain providers and other suppliers. Previously,  surety bonds generally had been required only for DMEPOS suppliers.  Specifically, CMS officials said that they are seeking comments on  extending surety bonds to home health agencies and independent  diagnostic testing facilities (and, potentially, outpatient rehabilitation  facilities) and that they expected to issue a proposed rule to require  surety bonds as conditions of enrollment for certain other types of  providers in the fall of 2012. PPACA extended CMS’s authority to impose  surety bonds on certain additional providers and suppliers, based on a  determination about their level of risk. The surety bond would be in an  amount commensurate with the provider’s or supplier’s billing volume, but  not less than $50,000. CMS officials also said they are considering giving  a new supplier provisional enrollment and then setting the amount of the  surety bond after a review of billing activities.
While CMS is considering extending surety bonds to additional providers  and suppliers, a 2011 HHS OIG report stated that CMS did not have  finalized procedures for recovering DMEPOS overpayments through  surety bonds, and therefore, as of July 2011, no overpayments had been  recovered through surety bonds since October 2, 2009, the date the  surety bond requirement became effective. However, in January 2012,  CMS released guidance on claims against surety bonds for DMEPOS  suppliers. The guidance states that the surety—a company that  provides the surety bond —is liable for any overpayments incurred during  the term of the surety bond and that the surety must pay CMS within   30 days of receiving written notice of an overpayment. CMS’s guidance  also advises DME MACs on how to collect overpayments incurred during  the term of a surety bond. CMS officials said that they expect that many  of the requirements for obtaining and maintaining DMEPOS surety bonds  can be easily applied to home health agencies and independent  diagnostic testing facilities.
CMS officials said the agency was working with the Federal Bureau of  Investigation (FBI) to gain access to its criminal background information  for use in conducting fingerprint-based criminal background checks of  high-risk providers and suppliers. PPACA authorized, but did not require,  the use of criminal background checks in its risk-based provider and  supplier screening. In order to conduct criminal background checks, CMS  officials said they will contract with FBI channelers, whose contracts were  recently recompeted by the FBI; CMS officials said that as of December  2011, 20 contracts were approved and 13 had been awarded by the  FBI. CMS plans to contract with two channelers, one to conduct background checks and one to handle provider and supplier  fingerprinting. CMS officials said they are developing a scope of work to  solicit among the FBI-approved channelers and expect to have contracts  in place before the end of 2012. CMS officials also said that they plan to  develop guidance to further define A/B MAC and NSC responsibilities and  work flow of these checks.
CMS officials said the agency was developing and reviewing regulations  to address the requirement for increased disclosures for enrolling or  revalidating Medicare providers and suppliers. PPACA requires providers  and suppliers to disclose any current or previous affiliation with another  provider or supplier that has uncollected debt; has been or is subject to a  payment suspension under a federal health care program; has been  excluded from participation under Medicare, Medicaid, or CHIP; or has  had its billing privileges denied or revoked at the time of initial enrollment  or revalidation of enrollment. CMS officials noted that the development of  these regulations is complicated by many issues that need to be  addressed, such as provider and supplier concern about what information  will be collected, what CMS will do with information once it is collected,  and how to address concerns about maintaining the privacy and security  of the information. CMS officials said the agency did not meet its own  time frame for publishing a regulation to address this PPACA provision by  November 2011 and they are not certain when the regulation will be  published.
CMS officials said that the agency was studying criteria found in HHS  OIG model plans as it worked to address the PPACA requirement that the  agency establish the core elements of compliance and ethics programs  for providers and suppliers. PPACA required that Medicare providers  establish compliance programs that contain the core elements  established by CMS in consultation with the HHS OIG. In general, a  compliance program is the internal set of policies, processes, and  procedures that a provider organization implements to help it act ethically  and lawfully. In this context, a compliance program is intended to help  provider and supplier organizations prevent and detect violations of  Medicare laws and regulations. CMS does not have a projected target  date for implementation.
section_title: Concluding Observations
paragraphs: Timely and accurate Medicare provider and supplier enrollment  information maintained in the PECOS database are essential to reducing  fraud, waste, and abuse and the likelihood of making improper payments.  Although PECOS information has been routinely updated by CMS’s A/B  MACs and the NSC using multiple national and state data sources,  limitations in these data sources and in the frequency with which updates  are made may lead to delays in, or failures to, accurately update  information in PECOS, resulting in payments to ineligible providers or  suppliers. As a result of the provisions in PPACA, CMS has begun to  supplement its previous provider enrollment activities with new  procedures and contracts that have the potential to improve the accuracy  and timeliness of information stored in PECOS. In particular, CMS’s new  enrollment screening and site visit contracts shift some provider  enrollment activities from the A/B MACs and NSC to centralized national  contractors. CMS anticipates that the new screening contractor will  improve the accuracy and timeliness of updates to the provider  enrollment information in PECOS by automating the process and using  additional data sources for enrollment screening. In addition, CMS  expects that the new site visit contractor will enable the agency to  conduct routine and targeted site visits of certain providers and suppliers  in categories considered at greater risk for submitting improper or  potentially fraudulent Medicare claims. Our previous work has found, and  we recommended, that contractor monitoring is needed to ensure that  CMS and its contractors identify and address the causes of improper  payments. However, it is too early to determine whether these new  contractors—and the agency’s pending action on other PPACA provisions  intended to strengthen provider enrollment standards—will improve the  integrity of the Medicare provider enrollment and claims payment  processes and reduce the likelihood of improper payments.
section_title: Agency Comments
paragraphs: HHS reviewed a draft of this report and in its written comments  highlighted continuing steps that CMS is taking to improve the accuracy  and timeliness of data used to screen providers and suppliers and to  further strengthen contractor oversight and PECOS data integrity. In its  general comments, HHS noted that, since we conducted our work, CMS  has increased the frequency with which it receives the SSA’s DMF and  now populates PECOS with this information weekly, rather than monthly.  In addition, CMS will use its new automated screening contractor to  routinely monitor changes that can affect enrollment status, such as death  or loss of required licenses for providers and suppliers. HHS also  commented that CMS is taking action to further strengthen quality control  by performing follow-up analysis to ensure actions reported during the  enrollment and revalidation processes are properly updated in PECOS.  HHS noted that CMS is taking steps to improve the QASP process used  to evaluate specific contractor functions by improving the depth at which  these studies are performed and concentrating on areas that affect the  quality of PECOS data. HHS’s comments are printed in appendix I. HHS  also provided technical comments, which we incorporated as appropriate.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of CMS and other interested  parties. The report also will be available at no charge on the GAO Web  site at http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Other major contributors to this report are  listed in appendix II.
section_title: Appendix I: Comments from the Department of Health and Human Services
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Karen Doran, Assistant Director;  April Brantley; Jennel Harvey; Anne Hopewell; Laurie Pachter;   Monica Perez-Nelson; and Jessica Colbert Smith made key contributions  to this report.