Medicare: Initial Results of Revised Process to Screen Providers and Suppliers, and Need for Objectives and Performance Measures
Published: 2016-11-15T00:00:00

Fast Facts:
Can bad guys be kept from billing Medicare?
Screening doctors and other providers to make sure they are legitimate helps. In 2011 Medicare strengthened its screening process—for example, by visiting more doctors' offices to verify information and conducting more background checks. As a result, over 700,000 medical providers lost their Medicare billing privileges, saving an estimated $2.4 billion.
But the screening process could work even better if Medicare had ways to measure progress toward its screening goals, such as reducing payment errors. We recommend Medicare create such measures.

Highlights:
section_title: Why GAO Did This Study
paragraphs: An effective provider and supplier enrollment process is a cornerstone of ensuring Medicare program integrity and limiting improper payments. The Patient Protection and Affordable Care Act contained provisions designed to strengthen CMS's enrollment screening process. In response, CMS implemented a revised screening process on March 25, 2011, that assigned all providers and suppliers to one of three risk categories—limited, moderate, or high—and based screening on the level of potential risk of fraud, waste, and abuse they present. The process is used to screen prospective, and revalidate enrolled, providers and suppliers. In September 2011, CMS began its first large scale revalidation effort to verify all enrolled providers' and suppliers' information and determine whether they remain eligible to bill Medicare. As of March 2016, it had begun its second large scale revalidation effort.
GAO was asked to examine the revised enrollment screening process. GAO examined 1) the results of the 2011 revised screening process, 2) CMS's implemented or planned modifications to the process, and 3) CMS's monitoring of the revised process. GAO examined enrollment data from March 25, 2011, through December 31, 2015, reviewed CMS policies and procedures, and interviewed CMS and Medicare contractor officials.
section_title: What GAO Found
paragraphs: GAO's analysis of the Centers for Medicare & Medicaid Services' (CMS) Medicare enrollment data found that CMS used its revised enrollment screening process to screen and revalidate over 2.4 million unique new applications and existing enrollment records. GAO's analysis showed that the screening resulted in over 23,000 new applications being denied or rejected and over 703,000 existing enrollment records being deactivated or revoked. CMS estimates the revised process avoided $2.4 billion in Medicare payments to ineligible providers and suppliers from March 2011 to May 2015 and resulted in other benefits, such as more accurate provider and supplier enrollment data. In June 2015, GAO reported some inaccuracies in the enrollment data after the revised process took effect, such as potentially ineligible practice location addresses, which CMS has taken action to address.
Since 2011, CMS has implemented some modifications to the revised screening process and made operational modifications to its revalidation efforts. For example, CMS eliminated automatic approvals of provider and supplier requests to extend the deadline for submitting enrollment information for revalidation. CMS officials stated that they plan to implement further modifications, but have not yet identified these future modifications. CMS officials said that they are waiting to see the results of the previous modifications before modifying the enrollment process further.
CMS has set goals and conducted monitoring of the enrollment screening process, but those monitoring activities lack objectives and performance measures for assessing progress toward those goals. CMS officials said they want to assess the screening process but they are uncertain of what objectives and performance measures to establish, in part because they are concerned that some measures would be inappropriate. While there may be challenges in developing objectives and performance measures, there are opportunities to do so that would allow CMS to better monitor the enrollment screening process without setting specific targets that could create inappropriate incentives for contractors. For example, CMS could focus on developing objectives and performance measures related to its goals for enrollment screening, such as keeping enrollment information up to date. Federal internal control standards and leading practices specify defining objectives and establishing performance measures so that an agency can monitor progress toward achieving desired goals. Without objectives and performance measures to use in ongoing monitoring, CMS will be unable to measure the progress it has made toward achieving its goals.
In commenting on this report, the Department of Health and Human Services agreed with GAO's recommendation.
section_title: What GAO Recommends
paragraphs: To improve the revised screening process, CMS should establish objectives and performance measures for assessing progress toward achieving its goals.

section_title: Letter
paragraphs: An effective provider and supplier enrollment process is a cornerstone of  ensuring program integrity and limiting improper payments in Medicare,  the federal health insurance program for persons aged 65 or over, certain  individuals with disabilities, and individuals with end-stage renal disease.  The Centers for Medicare & Medicaid Services (CMS)—the agency within  the Department of Health and Human Services (HHS) that administers  the Medicare program—screens prospective providers and suppliers and  enrolls those it determines are eligible to bill Medicare for services they  provide to beneficiaries. In fiscal year 2015, Medicare payments totaled  $568.9 billion, and CMS estimates that $59.6 billion was paid improperly.  Partly due to its susceptibility to improper payments, we have designated  Medicare as a high-risk program for more than 20 years.
CMS has made efforts to reduce improper payments and strengthen  program integrity by moving away from a traditional “pay and chase”  approach to a more preventive strategy, in part by using authorities  granted by the Patient Protection and Affordable Care Act (PPACA). In  response to PPACA, on March 25, 2011, CMS implemented a revised  enrollment screening process for new and existing providers and  suppliers based on the potential risk of fraud, waste, and abuse that each  presents; CMS implemented this process to help ensure that only eligible  providers and suppliers bill Medicare. Using this revised screening  process, CMS undertook its first program-wide effort to rescreen, or  revalidate, the enrollment records of about 1.5 million existing providers  and suppliers, and determine whether they remain eligible to bill  Medicare. As of March 2016, CMS has begun its second program-wide  revalidation effort.
You asked us to examine the revised enrollment screening process CMS  put into place in 2011. This report examines  1) the results of the 2011 revised enrollment screening process,  2) the modifications CMS has implemented or planned to the  revised enrollment screening process since 2011, and  3) the extent to which CMS monitors the revised enrollment  screening process.
To examine the results of the 2011 revised enrollment screening process,  we analyzed data from the Provider Enrollment, Chain and Ownership  System (PECOS), CMS’s centralized database for Medicare enrollment  information. We analyzed PECOS data from March 25, 2011, through  December 31, 2015, to determine (1) the number of enrollment records  and enrollment applications to which CMS applied the revised screening  process, (2) the number of approved, denied, and rejected new  enrollment applications, (3) the number of deactivated or revoked existing  enrollment records, and (4) the number of enrollment records associated  with providers and suppliers eligible to bill Medicare. We did not  independently verify the accuracy of the PECOS data; however, we  checked the PECOS data for obvious errors and omissions, compared  analysis results to CMS’s publicly reported information on screening  process outcomes, and interviewed CMS officials to resolve any identified  discrepancies. On the basis of these actions, we determined that the  PECOS data were sufficiently reliable for the purpose of this report. We  also interviewed CMS officials and officials from each of the Medicare  Administrative Contractors (MAC), which conduct enrollment screening  and reach decisions on the applications of prospective providers and  suppliers, about the results of the enrollment screening process put into  place in 2011. See appendix I for more detail on the scope and  methodology used for our PECOS data analysis.
To examine the modifications CMS has implemented or planned to the  revised enrollment screening process since 2011, we reviewed  documentation on actions it has implemented or planned, such as CMS  memoranda and instructions about process modifications, a performance  work plan, a press release, a CMS blog post, and provider education and  outreach materials. We also interviewed CMS and MAC officials about  actions to modify the process.
To examine the extent to which CMS monitors the revised enrollment  screening process, we obtained and analyzed documentation on the  extent to which the agency has monitored and evaluated the  effectiveness of the screening process, such as CMS proposed and final  rules, and CMS memoranda and instructions about process  modifications. We interviewed CMS officials regarding the agency’s  monitoring and evaluation efforts, including the following: CMS’s goals for  the process; information CMS is using to assess its effectiveness; any  challenges faced and lessons learned; and the extent to which the  agency is establishing different goals for the next cycle of revalidation.  We also interviewed Medicare contractor officials about challenges faced  and lessons learned regarding the effectiveness of the enrollment  screening process. We then compared CMS’s efforts to set goals and measure the effectiveness of the process in meeting those goals to  identified federal standards for internal control related to monitoring and  leading practices for performance management.
We conducted this performance audit from July 2015 to November 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: To become eligible to bill for services provided to Medicare beneficiaries,  prospective Medicare providers and suppliers apply to the program by  completing an online enrollment application in PECOS or by submitting a  paper enrollment application that is manually entered into PECOS.  Application information, such as name, address, specialty area, licensure,  and accreditation, is used to create the provider’s or supplier’s enrollment record in PECOS. An individual  provider or supplier may have more than  one enrollment record; for example, a provider may have one enrollment  record for a practice in one state and another enrollment record for a  practice in another state.
CMS places all provider and supplier types into risk categories—limited,  moderate, or high—based on CMS’s assessments of the potential risk of  fraud, waste, and abuse each provider and supplier type poses to  Medicare program integrity. CMS also designates specific screening  activities for each risk category. See table 1 for the types of Medicare  providers and suppliers assigned to each enrollment screening risk  category.
Under contract to CMS, MACs screen providers and suppliers in all risk  categories to verify that they meet Medicare eligibility requirements, such as having current federal or state licenses or accreditation. Medicare  regulations require that site visits be conducted for all high- and  moderate-risk providers and suppliers. Those conducting the site visits  determine whether the reported practice locations are operational and  meet requirements such as specified hours of operation. In addition to  these site visits, high-risk providers and suppliers also are subject to a  fingerprint-based criminal background check. In the course of this  screening, MACs may request additional information from the prospective  provider or supplier. Upon completion of screening, the MAC reaches a  decision to approve eligible providers and suppliers, deny ineligible  providers and suppliers, or reject incomplete applications. Figure 1  shows the enrollment process, including the screening conducted for  each risk category.
Once enrolled, to remain eligible to bill Medicare providers and suppliers  must continue to meet CMS’s enrollment requirements, and they must  report to CMS any changes to their enrollment information, including final  adverse actions taken against them, such as a suspension or licensure  revocation by a state licensing authority. In addition, providers and  suppliers periodically are required to resubmit enrollment information to  the MAC to update their enrollment records. The MAC revalidates the  provider’s or supplier’s enrollment record using the enrollment screening  process, to determine whether the provider or supplier remains eligible to  bill Medicare. Upon completing the revalidation process, the MAC  reaches a decision to approve providers and suppliers that remain eligible; deactivate billing privileges for providers and suppliers that have not  responded to a request to resubmit enrollment information or have not  submitted all required information—privileges that may be reactivated  upon submission of a new enrollment application or recertifying that  current enrollment information is correct; or  revoke billing privileges for providers and suppliers determined  ineligible.
Providers and suppliers must submit updated information for their  enrollment records for revalidation every 5 years, with the exception of  durable medical equipment, prosthetics, orthotics, and supplies  (DMEPOS) suppliers, which must submit their information every 3  years. CMS initiated the first program-wide revalidation effort for all  providers and suppliers enrolled in Medicare prior to March 25, 2011, by  mailing notices to providers and suppliers in three phases, from  September 2011 through March 2015, as shown in figure 2.
Each notice sent by the MAC asks the provider or supplier to submit a  newly completed enrollment application for revalidation,  which the MAC  then screens using the enrollment screening process to verify the  information provided and determine whether the provider or supplier  remains eligible to bill Medicare. A provider or supplier must respond by  the due date or may request an extension to submit an application. If the  provider or supplier does not respond within the allowed time, the  provider or supplier is to be placed on a payment hold and is not to  receive Medicare payment for services billed until a complete enrollment  application has been submitted and approved by the MAC. Figure 3  illustrates the process MACs use to revalidate existing providers and  suppliers.
section_title: CMS Applied the Revised Enrollment Screening Process to over 2.4 Million New Applications and Existing Records, and Estimated Avoiding $2.4 Billion in Medicare Payments to Ineligible Providers and Suppliers
subsections: section_title: CMS Denied or Rejected over 23,000 New Applications and Deactivated or Revoked over 703,000 Existing Enrollment Records
paragraphs: According to our analysis of PECOS data, CMS applied its revised  enrollment screening process to over 2.4 million unique new applications  and existing enrollment records from March 25, 2011, through December  31, 2015. As a result, CMS took action to deny or reject new  applications and to deactivate or revoke existing enrollment records that  did not meet the revised screening requirements.
CMS’s screening of new enrollment applications resulted in actions  against more than 23,000 new enrollment applications—CMS denied over  6,000 applications for ineligible providers and suppliers and rejected over  17,000 incomplete applications during the time period we reviewed.  According to our analysis, the denials and rejections were  disproportionately for providers and suppliers in the moderate- and high- risk categories. The most commonly recorded reason for a denial was  because Medicare provider or supplier type requirements were not met  (over 42 percent of total denials). Officials from a MAC said this may  occur, for example, if a provider does not hold a certification required for  that provider type. See table 2 for the most commonly recorded reasons  in PECOS for denial by risk category.
The most commonly recorded reason in PECOS for a rejected enrollment  application was a deleted enrollment application (about 25 percent of total  rejections), which officials from a MAC said may occur when an  enrollment application has been entered into PECOS in error, either by a  provider or supplier, or by the MAC. See table 3 for the most commonly  recorded reasons in PECOS for rejection by risk category.
Denied and rejected enrollment applications were relatively more  common for moderate- and high-risk providers and suppliers and less  common for limited-risk providers and suppliers. According to our  analysis, while moderate- and high-risk providers and suppliers  accounted for less than 10 percent of all new enrollment application  decisions during the time period we reviewed, they accounted for over 30  percent of denials and over 22 percent of rejections. The disproportionate  deactivations and rejections could be the result of the additional  screening for moderate- and high-risk applicants or the underlying greater  risk that these moderate- and high-risk providers and suppliers posed to  Medicare.
CMS’s screening of existing enrollment records resulted in actions  against more than 703,000 provider and supplier enrollment records— CMS deactivated over 660,000 and revoked over 43,000 throughout this  period. Providers and suppliers lose their ability to bill Medicare when  CMS either deactivates or revokes their enrollment record. Providers and  suppliers in the limited-risk category accounted for about 90 percent of  deactivations and 84 percent of revocations. Enrollment records of  limited-risk providers and suppliers represented about 90 percent of the  1.9 million approved enrollment records as of December 31, 2015.
The reasons for deactivations and revocations varied, according to our  analysis. Many were the result of enrollment screening conducted during  CMS’s first revalidation cycle. For example, the most commonly recorded  reason in PECOS for deactivations was not responding to a revalidation  request (about 47 percent overall). See table 4 for the most commonly  recorded reasons in PECOS for deactivation by risk category.
The most commonly recorded reason overall for revocations was not  being professionally licensed (over 61 percent), but the most commonly  recorded reasons differed between the limited-risk category and the  moderate- and high-risk categories. See table 5 for the most commonly  recorded reasons in PECOS for revocation by risk category.
According to our analysis of PECOS data, there were about 500,000  more approved enrollment records nearly 5 years after CMS began  applying its revised enrollment screening process. When the revised  enrollment screening process took effect on March 25, 2011, there were  about 1.4 million approved enrollment records in PECOS, which  increased by more than 30 percent to about 1.9 million approved  enrollment records by December 31, 2015. During roughly the same  time frame, the number of Medicare beneficiaries increased by more than  13 percent, from 48.7 million in 2011 to 55.3 million in 2015.
section_title: CMS Estimates It Avoided $2.4 Billion in Medicare Payments to Ineligible Providers and Suppliers from Enrollment Screening Process, Among Other Benefits
paragraphs: CMS estimates the revised enrollment screening process avoided $2.4  billion in Medicare payments to ineligible providers and suppliers from  March 2011 to May 2015, and CMS and MAC officials report additional  benefits. According to CMS officials, the estimate is based on Medicare  payments providers and suppliers with revoked enrollment records would  have received had they not been revoked. To make its estimate, CMS  used the provider’s or supplier’s past billing history and a formula it has  developed for estimating Medicare payments avoided from other  Medicare program integrity efforts. In addition to Medicare payments  avoided, CMS and MAC officials report other benefits from the revised  enrollment screening process, including the following:
More accurate and complete data in PECOS. For example, the MACs  deactivated providers and suppliers that were no longer billing  Medicare, and created new PECOS enrollment records during the first  program-wide revalidation effort for providers and suppliers that were  in the Medicare claims system but not in PECOS.
Providers and suppliers more knowledgeable about their  responsibilities to keep enrollment information up to date. MAC  officials said providers and suppliers are now more frequently  providing them with changes of information, which according to CMS  and MAC officials may result in fewer deactivated enrollment records  during the second program-wide revalidation effort that began in  March 2016.
Identified  provider and supplier enrollment records that needed  increased scrutiny. CMS reported in September 2016 that it identified  about 1,700 such cases and raised the provider’s or supplier’s risk  category from limited or moderate risk to high risk.
While CMS and MAC officials reported benefits from the revised  enrollment screening process, they also reported challenges. For  example, MAC officials said that there were challenges revalidating  enrollment information for providers and suppliers with multiple billing  locations during the first program-wide revalidation effort, which led to  deactivations of some otherwise eligible providers and suppliers.  According to officials at one MAC we interviewed, this could have  occurred, for example, if the provider’s or supplier’s address information  in PECOS was not accurate and a revalidation letter was not sent to each  billing location or if the revalidation notice did not reach the correct office  personnel handling the requests for enrollment information for  revalidation.
We and the HHS Office of the Inspector General have also found some  issues with PECOS data since the revised process took effect. In June  2015, we reported that a review of PECOS data as of early 2013 found  that an estimated 23,400 of 105,234 practice location addresses in  PECOS were potentially ineligible,  for example because they were vacant  addresses. CMS concurred with our recommendations to incorporate  flags into its software to help identify potentially questionable practice  location addresses and to collect additional license information. In  January 2016, CMS replaced the current PECOS address verification  software used during the enrollment screening process for new  applications with software that, according to CMS, will better detect  potentially ineligible addresses. In April 2016, the HHS Office of the  Inspector General reported that PECOS did not contain the reasons for  enrollment application submissions—for example, whether a new  enrollment application or an application submitted in response to a  revalidation request—for 54,903 of 479,115 applications submitted from  March 25, 2012, through March 24, 2013. The reason for submission  determines the screening level for certain providers and suppliers—for  example, newly enrolling home health agencies are screened in the high- risk category while home health agencies being revalidated are screened  in the moderate-risk category—and therefore some providers and  suppliers may not have received appropriate screening. CMS concurred  with the HHS Office of the Inspector General’s recommendations.
section_title: CMS Modified Elements of the Revised Enrollment Screening Process and Plans to Implement Further Modifications in the Future
paragraphs: Since 2011, CMS has modified some of the methods it uses to screen  providers and suppliers trying to enroll or maintain eligibility to bill  Medicare. For example, CMS officials said that screening modifications  include the addition of a licensure continuous monitoring report, beginning  in November 2013, and a criminal continuous monitoring report,  beginning July 2015. CMS officials stated that the MACs now use these  reports to help ensure that providers and suppliers continue to meet  CMS’s enrollment requirements after they have been enrolled. The MACs  do so by identifying those providers and suppliers that no longer meet  licensure requirements or that now have certain criminal convictions, and  deactivating or revoking their enrollment records. Before implementing  the reports, MACs did not receive routine reporting to use for checking  licensure and criminal convictions of enrolled providers and suppliers, and  CMS officials said they did not know whether the MACs were conducting  such reviews regularly. CMS officials reported the agency made these  screening modifications in part to meet PPACA requirements for provider  and supplier enrollment. Table 6 includes examples of modifications CMS  has made to methods used to screen providers and suppliers under the  revised enrollment screening process put into effect in 2011.
CMS has also made a number of operational modifications to the  enrollment screening process used to revalidate existing providers and  suppliers since 2011. These modifications include some that CMS  officials said are intended to encourage providers to be more responsive  to revalidation requests, such as establishing revalidation due dates that  are posted online 6 months in advance and eliminating automatic  approvals of provider and supplier requests for deadline extensions.  Others are modifications that help the MACs better manage and  streamline their operations, CMS officials said, such as eliminating the  requirement for MACs to send CMS bi-monthly revalidation data, as MAC  officials told us that CMS can pull that data directly from PECOS. CMS  also began giving the MACs the lists of providers to contact for  revalidation further in advance of the required mailing date than CMS did  during the first program-wide revalidation cycle. CMS officials said these  changes resulted from work groups that included CMS and MAC officials  that were set up to identify and plan operational modifications to improve  and streamline revalidation.  See appendix II  for examples of operational  modifications CMS has made to the enrollment screening process used to  revalidate existing providers and suppliers.
CMS plans to implement additional modifications using a detailed work  plan, but has not yet determined these modifications. In March 2016,  CMS officials said they plan to continue to work with the MACs to  generate modifications as in the past, allowing each of the four MAC work  groups, which according to CMS officials include CMS points-of-contact,  to keep track of its own notes and individually  manage its activities as it  works to generate ideas and proposals for modifications that each work  group then submits to CMS for consideration. While CMS did not use a  detailed work plan to make operational modifications to the enrollment  screening process in preparation for the second program-wide  revalidation effort, CMS officials said that the agency intends to develop a  detailed work plan for the modifications they select for implementation,  but have not yet set a time frame for developing such a plan. CMS  officials stated that they have not yet determined future modifications and  are waiting to see the results of the previous modifications before  modifying the enrollment process further.
section_title: CMS Monitors Elements of Its Screening Process but Monitoring Is Limited by a Lack of Objectives and Performance Measures
paragraphs: CMS monitoring includes reviewing certain results of enrollment  screening, examining the efficiency of the enrollment screening process,  and evaluating the performance of contractors.
CMS officials said that the agency reviews, at least monthly,  information such as the number of deactivations and revocations,  including the reasons for deactivations and revocations, the number of  deactivations and revocations that result from fingerprint checks and  site visits, and the number of provider and supplier revocations that  are overturned upon appeal.
CMS and MAC officials said they meet periodically to examine  operational efficiency. For example, CMS officials met with the MACs  to examine the efficiency of the first program-wide revalidation effort  and reviewed operations to identify potential efficiency improvements.  According to CMS and MAC officials, those meetings resulted in  changes to operations, such as CMS giving MACs the lists of  providers to contact for revalidation further in advance of the required  mailing date. CMS and MAC officials said they convened work groups  based on those meetings and are continuing to use those work  groups to identify future operational modifications, as we noted earlier  in this report.
We found that CMS also annually evaluates contractor performance  by comparing performance against specific measures for the MACs  and other contractors that assist with enrollment screening, such as  the site visit contractor. For example, CMS developed the  Performance Assessment Program for the MACs, which includes  three evaluative reviews—the Quality Control Plan review, the Quality  Assurance Surveillance Plan review, and the Award Fee Plan review.  The Quality Assurance Surveillance Plan review includes, and the  Award Fee Plan review may include, contractor performance  measures for provider enrollment. The contractor performance  measures relate to MAC processing of provider enrollment  applications and are designed to assess elements such as timeliness  and accuracy.
Despite these efforts, we found that CMS’s monitoring of enrollment  screening, including screening conducted as part of revalidation, lacks  objectives and performance measures for assessing progress toward  achieving its goals. In November 2015, CMS officials stated that the goals  for the enrollment screening process are to (1) place providers and  suppliers into proper risk categories and (2) effectively screen the  providers in each category. According to CMS officials, the agency also  set goals for its revalidation effort to (1) implement provisions of PPACA,  (2) keep provider and supplier information up to date, (3) reduce improper  payments, and (4) ensure program integrity. However, CMS officials said  they have not established objectives and performance measures to use in  monitoring progress toward achieving these goals. Federal internal  control standards specify that management should define objectives in  specific and measurable terms, establish appropriate performance  measures for the defined objectives, and conduct ongoing monitoring so  that progress toward achieving desired goals can be assessed. In  addition, leading practices call for performance measures to monitor and  gauge results.
In March 2016, CMS officials said that the agency does not plan to  develop any objectives or performance measures for enrollment  screening, including screening conducted as part of revalidation, which is  contrary to federal internal control standards and leading practices for  managing programs. Performance measures focus on whether a program  has achieved measurable standards. They allow agencies to monitor and  report program accomplishments on an ongoing basis. CMS officials  stated that while they want to assess the screening process, they are  uncertain of what performance measures to establish in part because  they are concerned that some measures would be inappropriate. For  example, CMS officials stated that while they review the number of  deactivations and revocations, it would not be appropriate to have targets  for deactivating or revoking a predetermined number of providers or  suppliers. This is consistent with our previous work in which CMS officials  stated that setting such targets could create incentives that could  potentially jeopardize the quality of contractors’ work. We also  previously reported that it is important that agencies avoid the  appearance of striving to achieve certain numerical quotas regardless of  quality.
However, without developing objectives and performance measures to  use in ongoing monitoring, the agency will be unable to measure the  progress it has made toward achieving its goals for the screening process  and for revalidating provider and supplier enrollment information. We  have previously reported that performance measurement gives managers  crucial information to identify gaps in program performance and plan any  needed improvements. While there may be challenges in developing  such objectives and performance measures, there are opportunities to do  so that would allow CMS to better monitor the enrollment screening  process without setting specific targets for the number of deactivations or  revocations. For example, CMS could focus on developing objectives and  performance measures related to its goals for enrollment screening, such  as keeping enrollment information up to date. CMS officials have said that  since the revised screening process took effect, providers and suppliers  are more aware of their responsibilities to keep information up to date,  and MAC officials have stated that providers and suppliers are more  frequently providing MACs with changes of information. According to  CMS officials, this may result in fewer deactivated enrollment records  during the second program-wide revalidation effort. CMS officials said  they regularly review the number of deactivated enrollment records, and  the agency has information on the reasons for deactivation. Some of  those reasons may be associated with failing to keep information up to  date, such as nonresponse to requests for updated enrollment  information. However, CMS has no objectives and performance  measures for the reasons for deactivation to use in measuring progress  toward its goal of keeping enrollment information up to date.
section_title: Conclusions
paragraphs: Effective provider and supplier enrollment screening is critical to ensuring  program integrity and preventing improper payments. With its revised  enrollment screening process, CMS has implemented a preventive risk- based strategy for achieving program integrity where increased scrutiny  and greater resources are dedicated to providers and suppliers that  present a higher potential risk of fraud, waste, and abuse. CMS has  subsequently modified some elements and conducted monitoring of the  process. However, CMS has not taken certain important steps that could  help ensure the effectiveness of these actions. As CMS considers future  modifications to the enrollment screening process and undertakes its  second program-wide revalidation effort, opportunities exist to address  limitations in its current monitoring of the process. By establishing specific  objectives and performance measures for the enrollment screening  process and periodically assessing the progress, the agency could better  ensure the effectiveness of the screening process as a means of  maintaining program integrity and limiting improper payments in  Medicare.
section_title: Recommendation for Executive Action
paragraphs: To improve the efficiency and effectiveness of the agency’s enrollment  screening process, we recommend that the Administrator of CMS  establish objectives and performance measures for assessing progress  toward achieving its goals.
section_title: Agency Comments
paragraphs: We provided a draft of this report to HHS for comment, and its comments  are reprinted in appendix III.  HHS also provided technical comments,  which we incorporated as appropriate.
In commenting on this report, HHS agreed with our recommendation.  HHS stated that it will review the goals of the enrollment screening  process and determine if there are appropriate objectives and  performance measures for the program that the agency can establish.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Administrator of the Centers for Medicare &  Medicaid Services, and other interested parties. In addition, the report is  available at no charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or kingk@gao.gov.  Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. Major contributors to this report are listed in appendix IV.
section_title: Appendix I: Scope and Methodology for the Provider Enrollment, Chain and Ownership System Data Analysis
paragraphs: To examine the results of the revised enrollment screening process put  into place in 2011, we analyzed data from provider and supplier  enrollment records in the Provider Enrollment, Chain and Ownership  System (PECOS), the Centers for Medicare & Medicaid Services’ (CMS)  centralized database for Medicare enrollment information. We analyzed  PECOS data from March 25, 2011 (the date the new screening process  went into effect) through December 31, 2015 (the most current data  available at the time of our analysis) to determine (1) the number  enrollment records and enrollment applications to which CMS applied the  revised screening process, (2) the number of approved, denied, and  rejected new enrollment applications, (3) the number of deactivated or  revoked existing enrollment records, and (4) the number of enrollment  records associated with providers and suppliers eligible to bill Medicare.  We did not independently  verify the accuracy of the PECOS data;  however, we checked the PECOS data for obvious errors and omissions,  compared analysis results to CMS publicly reported information on  screening process outcomes, and interviewed CMS officials to resolve  any identified discrepancies. On the basis of this review, we determined  that the PECOS data were sufficiently reliable for the purposes of this  report, and we accounted for any limitation in these data during our  analyses, such as removing certain outcomes from our analysis of initial  enrollment applications and removing enrollment records that did not  have a risk category assigned in PECOS from our analysis of the  percentages of deactivated and revoked enrollment records in each risk  category.
To determine the number of enrollment records and enrollment  applications to which CMS applied the revised enrollment screening  process during the time period we reviewed, we analyzed PECOS data to  identify which one of three distinct groups each enrollment record  belonged. Specifically, we identified (1) the number of new enrollment  application decisions made, (2) the number of enrollment records with a  change in enrollment status, for example, from approved to deactivated,  and (3) the number of approved enrollment records as of March 25, 2011,  that did not have an enrollment status change during the time period.  Each enrollment record could only fall in to a single group and we  excluded from our analysis deactivated or revoked enrollment records  that did not have an enrollment status change during the time period  since CMS would not have applied the enrollment screening process to  these enrollment records.
To determine the number of approved, denied, and rejected new  enrollment applications during the time period we reviewed, we analyzed  PECOS data to calculate the number of enrollment applications by  outcome. For the denied and rejected new enrollment applications, we  analyzed the PECOS recorded reasons for the denial or rejection and  calculated the number of denials and rejections by recorded reason and  by provider and supplier risk category during that time period. CMS  officials reported that there could be multiple reasons for a denial or  rejection, but due to PECOS system limitations, the Medicare  Administrative Contractors (MAC) responsible for enrolling providers and  suppliers can only record one reason. In addition, the reason codes that  can be recorded in PECOS changed during the time frame covered by  our analysis.
To determine the number of existing enrollment records deactivated or  revoked during the time period we reviewed, we analyzed PECOS data to  identify enrollment record statuses that changed to deactivated or  revoked during the time period. We identified both the total number of  status changes, as well as the number of unique enrollment records  deactivated or revoked. The total number of deactivations or revocations  is greater than the number of unique enrollment records deactivated or  revoked because a provider’s or supplier’s enrollment record could have  been deactivated or revoked more than once during that time. For  enrollment records with deactivated or revoked statuses, we analyzed the  PECOS recorded reason for the deactivation or revocation and calculated  the number of deactivations and revocations by recorded reason and by  provider and supplier risk category during that time period. As with new  enrollment application decisions, the reason codes that can be recorded  in PECOS for existing enrollment records changed during the time period  of our analysis.
To determine the number of enrollment records associated with providers  and suppliers eligible to bill Medicare during the time period we reviewed,  we analyzed PECOS data to calculate the total number of approved  enrollment records on March 25, 2011, and on December 31, 2015.
section_title: Appendix II: Examples of Operational Modifications to Revalidation
paragraphs: The Centers for Medicare & Medicaid Services (CMS) has made  operational modifications to revalidation since 2011. For example, in  September 2014, CMS modified its guidelines so that the Medicare  Administrative Contractors (MAC) need not obtain data missing from a  provider’s or supplier’s application elsewhere if the information is  disclosed in another place on the application or in the supporting  documentation in the enrollment application submitted for revalidation. In  addition, CMS made several modifications in preparation for the second  program-wide enrollment record revalidation effort which began March  2016. Table 7 provides examples of these operational modifications, as  described in CMS instructions to the MACs.
section_title: Appendix III: Comments from the Department of Health and Human Services
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Kathleen M. King, (202) 512-7114 or kingk@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Karen Doran (Assistant Director),  Peter Mangano (Analyst-in-Charge), Cathy Hamann, Colbie Holderness,  Sylvia Diaz Jones, and Daniel Ries made key contributions to this report.  Also contributing were Muriel Brown, Christine Davis, and Jennifer  Whitworth.