Medicare Program Integrity: Increasing Consistency of Contractor Requirements May Improve Administrative Efficiency
Published: 2013-07-23T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2012, CMS estimated that $32.4 billion in Medicare FFS payments were improper. CMS uses several types of contractors to conduct postpayment claims reviews to identify improper payments. Recently, questions have been raised about the efficiency and effectiveness of these contractors' efforts and the administrative burden on providers. This report (1) describes these contractors and (2) assesses the extent to which requirements for postpayment claims reviews differ across the contractors and whether differences, if any, could impede effective and efficient claims reviews. GAO reviewed CMS's requirements for claims reviews in manuals and contracts, interviewed CMS officials and selected provider associations, and assessed the requirements against internal control standards and executive-agency guidance on streamlining service delivery. GAO also obtained data on numbers of claims reviewed, and appealed.
section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services' (CMS) contractors that conduct postpayment reviews on Medicare fee-for-service (FFS) claims were established by different legislative actions; are managed by different offices within CMS; and serve different functions in the program. These contractors include (1) Medicare Administrative Contractors that process and pay claims and are responsible for taking actions to reduce payment errors in their jurisdictions; (2) Zone Program Integrity Contractors (ZPIC) that investigate potential fraud, which can result in referrals to law enforcement or administrative actions; (3) Recovery Auditors (RA) tasked to identify improper payments on a postpayment basis; and (4) the Comprehensive Error Rate Testing (CERT) contractor that reviews a sample of claims nationwide and related documentation to determine a national Medicare FFS improper payment rate. All four types of contractors conduct complex reviews, in which the contractor examines medical records and other documentation sent by providers to determine if the claims meet Medicare coverage and payment requirements. RAs are paid fees contingent on the amount of the claims that are found improper and recouped or adjusted, whereas the other contractors' reimbursement is not dependent on the amount of their claims reviews. The RAs conducted almost five times as many reviews as the other three contractors combined. Overall, compared to over one 1 billion claims processed in 2012, all four types of contractors combined reviewed less than one 1 percent of claims, about 1.4 million reviews, for which providers might be contacted to send in medical records or other documentation.
Although postpayment claims reviews involve the same general process regardless of which type of contractor conducts them, CMS has different requirements for many aspects of the process across these four contractor types. Some of these differences may impede efficiency and effectiveness of claims reviews by increasing administrative burden for providers. There are differences in oversight of claims selection, time frames for providers to send in documentation, communications to providers about the reviews, reviewer staffing, and processes to ensure the quality of claims reviews. For example, while the CERT contractor must give a provider 75 days to respond to a request for documentation before it can find the claim improper due to lack of documentation, the ZPIC is only required to give the provider 30 days. CMS places more limits on the RAs in its requirements for reviews conducted by them than by other contractors. For example, RAs must submit the criteria that they will use to determine if a service is paid improperly to CMS for approval. The additional requirements for RAs are due in part to CMS's experience during an initial demonstration testing the use of RAs. CMS officials indicated that other requirement differences across contractors generally developed due to setting requirements at different times by staff in different parts of the agency. Providers indicated that some differences hindered their understanding of and compliance with the claims review process. Having inefficient processes that complicate compliance can reduce effectiveness of claims reviews, and is inconsistent with executive-agency guidelines to streamline service delivery and with having a strong internal control environment. CMS has begun to examine differences in requirements across contractors, but did not provide information on any specific changes being considered or a time frame for action.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS (1) examine all contractor postpayment review requirements to determine those that could be made more consistent, (2) communicate its findings and time frame for taking action, and (3) reduce differences where it can be done without impeding efforts to reduce improper payments. In its comments, the Department of Health and Human Services concurred with these recommendations, agreed to reduce differences in postpayment review requirements where appropriate, and noted that CMS had begun examining these requirements.

section_title: Letter
paragraphs: In 2012, Medicare covered more than 49 million elderly and disabled  beneficiaries and had estimated outlays of $555 billion. Because of its  size, complexity, and susceptibility to mismanagement and improper  payments, for 23 years we have designated Medicare as a high-risk  program. Improper Medicare payments include payments made for  treatments or services that were not covered by program rules, that were  not medically necessary, or that were not provided to beneficiaries in the  way that they were billed to Medicare. In fiscal year 2012, the  Department of Health and Human Services (HHS) estimated the Centers  for Medicare & Medicaid Services (CMS)—the agency that administers  the Medicare program—made improper payments of $32.4 billion in the  Medicare fee-for-service (FFS) program.
CMS has a goal to reduce improper payments in the Medicare program  and conducts a number of activities in order to protect the integrity of the  program—that is, to ensure that payments are made correctly the first  time and to identify, investigate, and recoup payments made in error. One  such activity, reviewing claims to ensure that claims are paid properly,  can be done before payment (prepayment claims reviews) or after  payment (postpayment claims reviews). Claims reviews may be  automated, relying on computer programming logic, or they may involve  manually examining claims and related documentation, including medical  records, to determine if the claim was billed and paid properly. Currently,  CMS uses several different types of contractors to conduct claims  reviews. Medicare Administrative Contractors (MAC), the contractors  that process and pay claims, also conduct pre- and postpayment claims  reviews and recoup overpayments or remediate underpayments. Zone  Program Integrity Contractors (ZPIC) perform pre- and postpayment  claims reviews as a part of investigating potential fraud. The  Comprehensive Error Rate Testing (CERT) contractors estimate the  Medicare FFS improper payment rate in part by conducting postpayment  claims reviews on a random sample of claims processed by the MACs.  Recovery Auditors (RA) conduct data analysis and postpayment claims  reviews to identify improper payments. These four contractors conduct  postpayment claims reviews using the same general process to examine  whether the claims that have been paid adhere to Medicare’s  requirements and are for medically necessary services and apply the  same Medicare coverage and payment requirements in their reviews.
Recently, questions have been raised about whether CMS’s coordination  and oversight of the different types of Medicare FFS contractors that  perform postpayment claims reviews are effective and efficient and  whether the agency is maintaining an appropriate balance between  detecting improper payments efficiently and adding unnecessary  administrative burden to providers. You asked us to examine CMS’s use  of contractors to review Medicare FFS claims. This report (1) describes  the establishment, functions, and characteristics of four different types of  contractors that conduct postpayment reviews on Medicare FFS claims  (MACs, ZPICs, CERT contractors, and RAs), and (2) assesses the extent  to which CMS’s requirements for postpayment claims reviews differ  across these four contractor types, and whether any differences could  impede effective and efficient postpayment claims reviews.
To describe the contractors’ establishment, functions, and characteristics,  we reviewed each type of contractor’s applicable authority, their most  recent statement of work, and reports about each type of contractor  prepared by CMS, the HHS Office of Inspector General, and others. We  interviewed CMS officials and also obtained 2011 and 2012 data from  CMS on the number of reviews done by each of these types of  contractors. We also obtained data on the RA appeals from CMS. We  assessed the data for reliability through interviews and found the data to  be reliable for our purposes.
To assess the extent of the differences in CMS’s requirements for  contractors’ postpayment reviews and whether any differences could  impede effective and efficient claims reviews, we examined the most  recent statements of work for each contractor type and relevant chapters  from the following CMS Medicare Manuals current as of May 7, 2013:  General Information, Eligibility, and Entitlement Manual; Benefit Policy  Manual; Claims Processing Manual; Financial Management Manual;  Program Integrity Manual; and Contractor Beneficiary and Provider  Communications Manual; along with other materials. We interviewed  CMS officials responsible for management and oversight of the four  contractor types and confirmed our analysis of the differences in  requirements with agency staff. This included obtaining their opinions on  the reasons for the differences, when the differences might be  appropriate, or when they might be reduced. We assessed CMS’s  requirements using the standards outlined in our internal control  documents, Standards for Internal Control in the Federal Government and  Internal Control Management and Evaluation Tool. To assess whether  differences in CMS requirements could impede the efficiency and  effectiveness of claims reviews, we interviewed associations representing  Medicare FFS providers who have experienced postpayment claims  reviews to obtain information on the effect these differences have on  providers. (See app. I for a list of the provider associations.) In addition,  we reviewed white papers sent by health care stakeholders in response  to the Senate Committee on Finance’sMay 2, 2012, letter requesting  suggestions to improve efforts to address Medicare and Medicaid fraud,  waste, and abuse. We also interviewed CMS staff working on an internal  work group charged with reducing provider burden to gain better  understanding of any proposed changes to the requirements. We  assessed the requirements, information from provider associations and  the white papers, and information from CMS’s staff charged with reducing  provider burden against guidance developed by the Office of  Management and Budget (OMB) to help agencies implement Executive  Order 13571—Streamlining Service Delivery and Improving Customer  Services.
We conducted this performance audit from October 2012 to July 2013 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: Contractors have a long-standing and essential role in the Medicare  program. Program integrity activities—particularly postpayment claims  reviews—have been a core component of contractors’ roles.
subsections: section_title: Postpayment Claims Reviews
paragraphs: When conducting postpayment claims reviews, contractors apply the  same criteria—Medicare regulations, and coverage and coding policies— to determine whether or not a claim was paid properly. CMS outlines the  general process and contractor requirements for conducting claims  review in its manuals and contractor statements of work.
Postpayment claims reviews may be automated, semiautomated, or  complex.
Automated reviews use computer programming logic to check claims   Contractors can  for evidence of improper coding or other mistakes. use automated postpayment reviews to analyze paid claims and  identify those that can be determined to be improper without  examining any additional documentation, such as when a durable  medical equipment (DME) supplier bills for items that should have  been included as part of a bundled payment for a skilled nursing  facility stay.
Semiautomated reviews use computer programming logic to check for  possible improper payments, but allow providers to send in  information to rebut the claim denial before it is implemented. Only the  RAs conduct such reviews. If providers send in information, RA staff  review it before making a final determination.
Complex reviews are conducted if additional documentation is needed  to determine whether a payment was made in error. Complex reviews  involve manual examinations of each claim and any related  documentation requested and received from the provider, including  paper files, to determine whether the service was billed properly, and  was covered, reasonable, and necessary. Licensed clinical  professionals, such as licensed practical nurses, and certified coders  typically perform the reviews. Contractors have physician medical  directors on staff who provide guidance about making payment  determinations on the basis of medical records and other  documentation and who may discuss such determinations with  providers.
The postpayment claims review process involves selection of the claims  to be reviewed, the review itself, communicating with providers during and  about the review, and a process for assuring quality of the contractor’s  reviews and decisions. Each contractor establishes its own claims  selection criteria. A contractor may use data analyses, knowledge of  Medicare billing requirements, and clinical expertise to develop its claims  selection criteria to focus on claims with a high likelihood of being  improper. As a part of the review, the contractor may notify the provider  that a claim is under review, or ask for medical records or other  documentation to substantiate the claim. The latter is called an additional  documentation request (ADR). If the contractor requires additional  documentation, the provider must submit the requested documents within  a specified time frame. If the review has determined that the Medicare  payment amount was improper, either the contractor or the MAC for that  jurisdiction will notify the provider that an overpayment was made and will  need to be recouped, or an underpayment was made and the remainder  of the remittance will be paid to the provider. Providers may appeal any  of the contractors’ decisions. The contractors’ quality assurance (QA)  processes may include various steps to assure consistency, reliability,  and quality in claims reviews. The QA process may include some type of  examination of the work that has been done and may be performed  internally, by the contractors themselves, or externally, by CMS or an  independent third party. A contractor’s QA process may include  comparing multiple reviewers’ decisions about the same claim to  determine the extent of their agreement (known as interrater reliability  testing) or reviews to validate the claims review decisions by others who  are either internal or external to the reviewer’s organization. The QA  process may also include staff training, to ensure that the reviewers  understand Medicare program and payment rules so that their  determinations can be consistent. The QA processes followed may also  be outlined in a QA plan.
section_title: Providers’ and CMS’s Experience with the Recovery Audit Demonstration Program
paragraphs: The Medicare Prescription Drug, Improvement, and Modernization Act of  2003 (MMA) directed CMS to establish a demonstration program to test  the use of RAs on a contingency fee basis in the Medicare program.  Other contractors that review claims are given a set amount of funding to  conduct reviews. In the demonstration project, RAs were paid  contingency fees on claims that were identified as improper, including on  claims for which the RA determinations were overturned on appeal at the  second through fifth levels of review. Subsequently, the Tax Relief and  Health Care Act of 2006 required CMS to implement a permanent and  national Medicare recovery audit contractor program to increase efforts to  identify and recoup improper payments.
During the course of the RA demonstration program, providers reported  several specific problems. In providers’ views, the RA’s contingency fee  payment structure created an incentive for these contractors to be too  aggressive in determining that claims were improper. Providers also  faulted CMS for not penalizing RAs for inaccurate claim determinations,  noting that contractor determinations resulted in thousands of provider  appeals that were expensive and burdensome for providers. In addition,  providers stated that during the demonstration project RAs did not have  the necessary medical expertise to make their determinations, because  they were not required to have a physician medical director on staff or  coding experts conducting the claims reviews.
We indicated in a previous report that CMS took a number of steps to  address issues raised by providers about the RA demonstration program  when it implemented the RA national program. For example, CMS put in  place more rigorous staffing requirements and eliminated contingency fee  payments when RAs’ claims determinations are overturned on appeal. In  addition, CMS took steps to improve oversight of the accuracy of RAs’  claims review determinations and the quality of RA service to providers in  the national program. CMS added processes to review the accuracy of  RA determinations and established performance metrics to monitor RA  accuracy and service to providers.
section_title: Assessing Efficient and Effective Operations
paragraphs: Internal control is the component of an organization’s management that  provides reasonable assurance that the organization achieves effective  and efficient operations, reliable financial reporting, and compliance with  applicable laws and regulations.postpayment claims reviews, should provide reasonable assurance that  the Medicare program is appropriately reimbursing for services provided  to beneficiaries, thereby protecting the integrity of the Medicare program.  Ineffective or inefficient claims reviews present the risk of generating false  findings of improper payments and an unnecessary administrative and  financial burden related to provider appeals for Medicare-participating  providers and the Medicare program. CMS requirements for contractors  performing postpayment claims reviews help establish the control  environment and control activities, such as monitoring. The manner in  which the agency delegates authority and responsibility through these  requirements establishes part of the control environment. Contractor  requirements also establish the mechanisms that contractors use to  communicate and interact with providers.
Internal controls, in this case  In addition, Executive Order 13571—Streamlining Service Delivery and  Improving Customer Services—was issued in April 2011 to improve  government services to individuals and entities by requiring agencies to  develop customer service plans in consultation with OMB.
Subsequently, OMB issued implementation guidance for agencies for  those services that the agencies plan to focus on improving. The  guidance calls for improving the customer service experience through  practices such as developing a process for ensuring consistency and  coordinating with others to identify opportunities to use common  processes. Among other things, the guidance also suggests analyzing  customer preferences and redirecting resources from less preferred and  more costly channels—like printed materials—to preferred, less costly  and more widely accessible channels (such as internet communications)  where appropriate.
section_title: The Four Medicare FFS Contractor Types Were Established under Different Laws and Have Different Primary Functions and Characteristics
paragraphs: Over time, Congress provided for CMS to use contractors to carry out  functions in connection with the FFS program, which has resulted in the  use of more types of contractors to conduct postpayment claims reviews.  These contractors also have different primary functions and  characteristics, which affect their use of postpayment claims reviews.
subsections: section_title: Changes in Medicare’s Contracting Authority Resulted in Four Medicare FFS Contractor Types
paragraphs: Although contractors have been used for Medicare since the beginning of  the program, several statutory changes since the 1990’s increased CMS’s  resources and authority to use new types of contractors—MACs, RAs,  ZPICs, and CERT contractors—to conduct postpayment claims reviews in  order to help detect and recoup overpayments or repay underpayments,  and to investigate potential fraud.
In 1965 when Medicare was established, Congress provided for two  types of contractors that could be used to administer the program.  From then until 1996, responsibility for processing and paying  Medicare claims, as well as for the program integrity tasks of  developing potential cases and coordinating with law enforcement  regarding any investigations of suspected Medicare fraud, resided  with contractors called fiscal intermediaries and carriers.
The Health Insurance Portability and Accountability Act of 1996  (HIPAA) established the Medicare Integrity Program (MIP), which  authorized CMS to contract separately for program safeguard  contractors (PSC)—the precursor to the ZPICs—to conduct activities,  such as identifying and investigating potential fraud, that had  previously been conducted by fiscal intermediaries and carriers and  provided funding for MIP.
In 2003, the MMA required CMS to replace the fiscal intermediaries  and carriers with the MACs. (See table 1.) During the  implementation of the MACs, CMS consolidated the number of  contractors that process and pay Medicare FFS claims, enlarged their  geographic jurisdictions compared to the previous contractors, and  combined Part A and Part B claims processing within each  jurisdiction. As part of changes made while implementing MACs,  CMS also transitioned fraud investigation from PSCs to ZPICs in all  but one zone.
The MMA also directed CMS to establish a demonstration project to  test the use of recovery audit contractors in the Medicare program.
Subsequently, the Tax Relief and Health Care Act of 2006 required  CMS to implement a permanent and national Medicare recovery audit  contractor program to increase efforts to identify and recoup improper  payments.
Although HHS had begun estimating the extent of improper payments  in Medicare FFS claims in 1996, the Improper Payments Information  Act of 2002 (IPIA) requires executive-branch federal agencies to  annually review all programs and activities to identify those that are  susceptible to significant improper payments, estimate the annual  amount of improper payments for these programs and activities, and  report these estimates along with actions taken to reduce improper  payments for programs with estimates that exceed $10 million. In  fiscal year 2003 as part of its IPIA compliance efforts, CMS  established the CERT program to measure improper payment rates  for Medicare FFS claims, including one CERT contractor that is  responsible for reviewing a random sample of claims nationwide, with  their related medical records and other documentation to determine if  they are proper.
CMS has established responsibility for overseeing these four types of  contractors in different parts of its matrixed organization (see fig.1). Three  different organizational components within CMS—Center for Medicare  (CM), Office of Financial Management (OFM), and Center for Program  Integrity (CPI)—oversee these four different types of contractors. CM  oversees the MACs, which conduct several program integrity activities,  including postpayment claims review. CMS’s Provider Compliance  Group within OFM oversees the RAs and CERT contractors. The  Provider Compliance Group has overall responsibility for the oversight of  the claims review activity conducted by MACs, RAs, and CERT  contractors and for measurement of the FFS improper payment rate.  CPI oversees the ZPICs and has direct responsibility for program  activities involved in investigating potential fraud.
Four types of CMS contractors conducting postpayment reviews have  different primary functions and characteristics (see table 2.) Postpayment  claims reviews are the main focus of the RA and CERT contractors’  functions, but that is not the case for MACs and ZPICs. The contractors  also vary in the number of states and size of their geographic jurisdictions  and the volume of claims they review.
MACs. Our analysis of MACs’ statement of work indicates that MACs  have primary responsibility for processing and paying Medicare FFS  claims in their geographic jurisdictions. In addition, MACs conduct several  program integrity activities, including prepayment and postpayment  claims review, audits of hospitals and other institutional providers to  ensure the accuracy of payments paid based on institutions’ reported  costs and recoupment of overpayments. They also implement local  coverage determinations (LCD) in their jurisdictions, as long as such  determinations do not conflict with national coverage policy or other  Medicare payment requirements. As of June 2013, there are 12 MACs  that process part A and part B claims (A/B MAC), one for each of   12 jurisdictions, and 4 MACs that process DME claims (DME MAC), one  for each of 4 jurisdictions. Jurisdictions of other contractors, such as  ZPICs and RAs, were designed to align with MAC jurisdictions.
MACs conduct postpayment reviews to help ensure accurate payment  and specifically to identify payment errors. This includes identifying ways  to address future payment errors—for example, through automated  controls that can be added on a prepayment basis and educating  providers with a history of a sustained or high level of billing errors to  ensure that they comply with Medicare billing requirements. In 2012,  MACs performed about 84,000 complex postpayment claims reviews.  Because each jurisdiction has a MAC responsible for claims  administration, if another contractor identifies an improper payment, the  MAC for that jurisdiction is responsible for correcting any underpayments  and recouping any overpayments, and, in some cases, for corresponding  with providers whose claims are under review.
ZPICs. The ZPICs’ primary function is to identify and investigate  potentially fraudulent FFS claims and providers in each of seven  geographic jurisdictions, which are called zones. CMS established  ZPICs in 2008 to investigate potential fraud through a jurisdiction-based  approach similar to that of the MACs. CMS officials indicated that this  approach consolidated responsibility with the ZPICs for investigating  potential fraud for all types of claims and for all parts of Medicare in each  geographic jurisdiction.
The Fraud Prevention System is intended to analyze Medicare claims, provider, and  beneficiary data before claims are paid to identify those that are potentially fraudulent. See  GAO, Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System,  but Needs to Define Measures to Determine Its Effectiveness, GAO-13-104 (Washington,  D.C.: Oct. 15, 2012). reviews generally focus on providers whose billing patterns are unusual  or aberrant in relation to similar providers in order to identify potential  fraud or abuse. When ZPICs identify improper payments, they refer these  to the MACs to be recouped or repaid. ZPICs performed about 108,000  complex postpayment claims reviews in 2012.
CERT contractor. Our analysis of its statement of work indicates that the  primary function of the CERT review contractor is to conduct postpayment  claims reviews used as a basis to estimate the annual FFS Medicare  improper payment rate—the percentage of claims paid improperly. HHS  began to estimate the rate of improper payments in Medicare FFS in  fiscal year 1996. CMS began estimating the FFS Medicare improper  payment rate in fiscal year 2003. Since then, the CERT review  contractor has had the responsibility of reviewing a sample of claims for  the entire nation for this estimate.central part of the CERT review contractor function. CERT reviews also  help identify program integrity vulnerabilities by measuring the payment  accuracy of each MAC, and the Medicare FFS improper payment rate by  type of claim and service.
The CERT claims review sample is pulled semimonthly from MAC processed claims and  encompass those that have been paid, denied, or selected for a MAC claims review. This  report will refer to the CERT claims reviews as “postpayment;” because all of the claims  were processed prior to CERT claims review even though not all were paid. not make recoupments or repayments. If the CERT contractor determines  that an improper payment has been made, the CERT contractor is  required to refer the claim to the appropriate MAC for recoupment of  overpayments or repayment of underpayments. In fiscal year 2012, the  CERT review contractor reviewed just over 41,000 postpayment claims.
RAs. Our analysis of the RA statement of work indicates that conducting  postpayment claims reviews is the RAs’ primary function. Use of RAs was  designed to be an addition to MACs’ existing claims review processes,  since the number of postpayment reviews conducted by the MACs and  other contractors was small relative to the number of claims paid and  amount of improper payments.
To implement the national recovery audit program, CMS contracted with  four RAs to conduct postpayment reviews of Medicare FFS claims to  identify overpayments and underpayments within four geographic  jurisdictions. In part because of issues that were raised during the RA  demonstration program, CMS made changes in the RA’s requirements to  provide more oversight over their activities. As in the demonstration,  under the national program the RAs are paid on a contingency fee basis,  but CMS officials indicated that the percentage is smaller. For the national  program, the fee ranges from 9 to 12.5 percent of the overpayments and  underpayments collected. In contrast to the MACs, ZPICs, and CERT  contractor, which are paid on the basis of the contractually negotiated  costs for the tasks performed, RAs are compensated from the funds that  are recouped. However, if an RA’s overpayment determination is  overturned on appeal, the RA is not paid for that claim. The RAs  conducted nearly five times as many complex reviews in fiscal year 2012  as the other three contractors combined—over 1.1 million complex  postpayment claims reviews and nearly 1 million automated review  denials.
With an increased focus on measuring and reducing Medicare improper  payments and the implementation of RAs, there has been a significant  increase in the number of claims being reviewed postpayment (see   table 3). Our analysis of data from CMS indicates that from 2011 to 2012,  the RA’s complex postpayment reviews increased 77 percent. Except for  the CERT contractor, which reviews a randomly selected sample of  claims each year to estimate the error rates, all contractors increased  their postpayment claims reviews by 16 percent or more. However, the  2.3 million reviews performed by these contractors accounted for less  than 1 percent of the over 1 billion FFS claims paid annually, and about  1.4 million were complex reviews.
section_title: Many CMS Requirements for Postpayment Claims Review Differ across Contractor Types, Which Can Impede Effectiveness and Efficiency
paragraphs: CMS has different requirements for postpayment claims reviews across  different contractor types, and some of these differences can sometimes  impede effectiveness and efficiency by increasing administrative burden  on providers. Due in part to CMS’s experience with the RA demonstration  and issues raised by providers during the demonstration, CMS sets more  limits through claims review requirements on RAs than on other  contractors. CMS officials generally described some other differences as  developing when different requirements were set by different groups  within the agency at different times. CMS has begun an effort to examine  whether its claims reviews activities add administrative burden for  providers.
subsections: section_title: CMS Sets More Limits on RAs through Review Requirements Than on Other Contractors Due to Experience in the Demonstration
paragraphs: As a result of lessons learned during the RA demonstration project and to  establish tighter controls on RAs, CMS imposed certain postpayment  requirements unique to the RAs when it implemented the national  program (see table 4). For example, RAs are required to limit the number  of ADRs made to a single provider during a given period, while the other  contractors do not have such limits. Similarly, unlike the other  contractors, RAs cannot make claim denials for lapses in documentation  standards unrelated to reasonableness or medical necessity, such as  illegible physician signatures or dates. Other requirements unique to the  RAs include  submitting to CMS for review and approval descriptions of the billing  issues that they propose to review and the basis for assessing  whether the claims for those services are proper prior to widespread  use, posting notice of billing issues targeted for postpayment review on  reimbursing certain providers for the expense entailed in providing  requested medical records, making claims reviewers’ credentials available upon provider request, providing access to RA staff physicians for discussion of claim denials  upon provider request, and giving providers 40 days to request an opportunity to provide  additional documentation to the contractor and informally discuss any  revision prior to having to file an appeal.
If the contractor sent the provider an ADR, and the claim is found to be  proper, RAs are the only type of postpayment review contractor required  to notify the provider. This means that providers who have sent in  documentation do not routinely get a definitive answer that a MAC, ZPIC,  or CERT contractor claim review has been concluded—unless an  improper payment has been detected. Representatives of three provider  associations indicated that it was important for financial management  purposes for providers to be informed when a review was concluded and  whether or not funds would be recouped.
Representatives of three provider associations indicated if certain RA  requirements were applied to the other contractors, this could reduce  administrative burden and improve claims reviews efficiency. For  example, representatives from one provider association indicated that it is  valuable to discuss informally any revision to the contractor’s initial claims  determination prior to providers filing an appeal. When such discussion  results in providers being able to properly explain their billing, it can  lessen administrative burden by reducing the number of appeals filed.  However, according to preliminary CMS data, nearly 20 percent of the   1.4 million RA claim overpayment determinations were appealed to the  first level in 2012. Among the appealed overpayment determinations  about 28 percent were overturned at the first level of appeal by MACs,  which suggests that providers may not be having such discussions or the  discussions are not succeeding in resolving issues prior to appeal. Three  provider associations also indicated that having a limit on the number of  medical records that could be requested in a given time period helped  manage the burden of responding to the requests. However, adding such  limits to contractors other than RAs might limit the number of claims  reviews these other contractors could conduct.
section_title: Other Differences in CMS Requirements across Contractors Can Impede Effectiveness and Efficiency by Complicating Providers’ Responses to and Understanding of Claims Reviews
paragraphs: Many of the other requirements CMS developed for postpayment review  activities, including documentation submission, staffing, and quality  assurance, vary across the four contractor types. Some of the differences  in the contractors’ postpayment claims review requirements can impede  effectiveness and efficiency of the claims reviews by complicating  providers’ responses to ADRs or their understanding of claims review  decisions, according to representatives from three provider associations  with whom we spoke. According to CMS officials, differences in  requirements generally developed because the contracts or requirements  were written at different times by staff within different parts of CMS, or the  contractors’ functions and activities have changed over time. However,  some differences were due to other factors, such as cost.
Additional Documentation Requests. Differences in contractors’  requirements for sending ADRs and timelines for providers’ responses to  the contractors are illustrated in table 5. In some cases, in addition to  reviewing documentation from the provider whose claim is under review,  the contractor will also need to review documentation from a third party— such as the provider who referred the beneficiary for the service or item to  the service provider whose claim is being reviewed. For example, while  reviewing a claim for an X-ray, the contractor might want to review  additional documentation from the referring physician, in order to  determine the medical necessity of the X-ray service. The MACs, ZPICs,  and RAs have the discretion to send a separate ADR to a third-party  provider (in the example above, the referring physician) for additional  documentation to support the medical necessity of the service or supply.  If the service provider cannot obtain the necessary third-party  documentation or if the contractor decides that the documentation is  insufficient to support the claim, the claim will be denied, but not the third- party’s claim. The CERT contractor is the only one that is required to  directly contact the third party for an ADR if the provider being reviewed  requests it and the claim exceeds $40. Four provider associations we  interviewed indicated that it can sometimes be difficult for the providers  whose claims were being reviewed to obtain the needed documentation  from third parties in a timely manner. There is no financial incentive for  the third parties to forward requested documentation to the service  providers because the third parties’ claims are not denied as improper if  the documents are not submitted to the contractor. In the view of four  provider associations, requiring providers to obtain documentation not  directly under their own control can hinder their compliance with the ADR,  because they are sometimes unable to provide the documentation.
Providers have 30 days to respond to an ADR sent by a ZPIC, 45 days to  respond to an ADR sent by a MAC or RA, and 75 days to respond to an  ADR sent by the CERT contractor. If the provider does not respond within  the required time frame, the contractor may find the payment improper  and refer the claim for recovery. MACs, ZPICs, and the CERT contractor  also have discretion in setting the number of extensions, if any, whereas   All of the  CMS requires RAs to give providers one extension. contractors have discretion on setting the length of extensions.  Representatives from two provider associations stated that having  different timeframes makes responding to ADRs more challenging. In  addition, ensuring consistency in common processes is consistent with  OMB guidance on streamlining service delivery and a strong control  environment.
CMS officials told us that, in practice, RAs give providers as much time as they need  and the CERT contractor may also extend the time period so as not to unnecessarily deny  the claim for lack of documentation. However, the CERT contractor is constrained by its  schedule to estimate the annual Medicare improper payment rate.
Submission Requirements. Different types of contractors are subject to  different requirements regarding the formats in which they will accept  providers’ documentation, whether paper, fax, or electronic submission  (see table 6). While RAs and the CERT contractor are required to accept  submission of files stored electronically on compact discs or digital video  discs (DVD), the other contractors are not. CMS has developed a system  called electronic submission of medical documentation (esMD) for  providers to transmit medical documentation electronically, which began  to be adopted by contractors in 2011. Though its use is discretionary,  most of the MACs, all of the RAs, the CERT contractor, and about one- third of ZPICs accept electronic submissions through esMD.provider association indicated that having all contractors accept electronic  submissions, such as submissions of e-documents on compact discs and  DVDs could reduce the administrative burden on providers. Further,  making electronic submission acceptable across all contractors would be  consistent with OMB guidance on streamlining service delivery.
Staffing requirements. CMS requirements for staffing, including claims  reviewers’ qualifications, vary depending on the type of contractor (see  table 7). CMS specifies the minimum number of physicians serving as  medical directors that each contractor must have on staff. The minimum  number of medical directors and their responsibilities vary for each of the  four types of contractors. CMS requires that medical directors serve as a  readily available source of medical expertise to provide guidance on  claims reviews for all of the contactors, but their scopes of responsibility  vary across contractors. This could lead to differences in the number of  medical directors needed. For example, the MAC medical directors are  also responsible for oversight of prepayment review, providing provider  outreach and education, developing local coverage policy, and  representing the contractor in appeals. In contrast, while the RA medical  directors do not have some of the other responsibilities of the MAC  medical directors, they have much larger geographic jurisdictions than  MACs. Requirements for the minimum number of medical directors  include the following:
A/B MACs must have at least three full-time equivalent (FTE) medical
RAs are required to have one FTE medical director on staff,
ZPICs are required to have at least one part-time medical director,  the CERT contractor is required to have two FTE medical directors.
Given the variability of the medical directors’ responsibilities and the  differing sizes of their jurisdictions, direct comparisons cannot be made  across the contractors to determine the number of medical directors  needed. CMS officials acknowledged differences in staffing requirements  across contractor types, and differences in expectations for the roles of  medical directors. CMS officials also indicated that they have not required  similar numbers of medical directors or required a certain number of  medical directors to be responsible for oversight of a specific number of  claims reviews because of cost issues.differences, CMS officials indicated that they do not want to incur  additional costs that could be involved in establishing consistent minimum  staffing requirements for conducting claims reviews, if that would increase  the number of medical directors that contractors would have to hire.
Requirements for other staff conducting claims reviews also differ across  contractors. Specifically, CMS requires RAs to use registered nurses or  therapists in making determinations of medical necessity, but the others  may use licensed practical nurses. CMS also requires RAs and the  CERT contractor to employ certified coders to determine compliance with  Medicare coding requirements, but does not require MACs or ZPICs to do  so. CMS has a requirement for ZPICs, that when Medicare policy for a  given service is not clearly articulated, the ZPICs must involve a medical  specialist trained and experienced in providing the type of service being  reviewed. There is no similar requirement for the other contractors.  CMS officials indicated that making claims reviewers’ staffing  requirements more consistent could increase the cost of claims reviews— for example that requiring A/B MACs and ZPICs to hire RNs instead of  LPNs to conduct claims reviews would likely increase the contract costs.  Representatives from six provider associations indicated that on the basis  of some of the claims review results, their members had questioned  whether some reviewers were qualified to review claims, and several  associations indicated that erroneous claims reviews led to appeals that  would not have been needed had the determination been correct.
Quality assurance requirements. While CMS requires QA processes to  ensure the quality of claims reviews, the requirements differ by contractor  type (see table 8). GAO’s Internal Control Management and Evaluation  Tool states that monitoring (such as the monitoring carried out with QA  processes) should be conducted to assess performance and determine  whether controls (such as claims reviews) continue to be effective.
Providers have questioned the quality of contractors’ decision making— specifically that the contractors are not consistently making proper  determinations that appropriately apply Medicare coverage, coding, and  payment rules in evaluating the claims. Having effective QA processes  can help ensure that claims determinations are made properly and  consistently—which is part of having strong internal controls. When asked  about the reason for differences among specific requirements for QA  processes for different contractors, CMS officials responded that different  offices in CMS were responsible for the contract specifications and  contractor management and the contracts were written at different times  and therefore vary.
With regard to internal QA processes, CMS requires that the MACs,  ZPICs, and CERT contractor conduct interrater reliability testing and  participate in annual clinical judgment training in support of postpayment  claims review determinations. CMS also requires that the CERT  contractor’s QA process include internal secondary reviews of any claim  that was determined improper and internal interrater reliability testing.  CMS does not require the RAs to conduct interrater reliability testing or  participate in clinical judgment training. Each contractor type is also  required to have an internal QA plan, but CMS does not require any  specific QA steps regarding consistency and quality of postpayment  claims reviews’ determinations in any of the contractors’ plans.
The different types of contractors also have different requirements for  external QA review processes. While the RAs are not required to have  some of the internal QA processes, CMS has established an external  validation process conducted by a different contractor for the RAs’  postpayment claims reviews. To validate the claims review  determinations for each RA on a monthly basis, the RA validation  contractor reviews a random sample of 400 claims proportional to the  provider types that each RA determined had been paid improperly. Unlike  the RAs, the MACs, ZPICs, and CERT contractor are not subject to  external validation reviews of their postpayment claims reviews.
section_title: CMS Has Begun an Effort to Examine Whether Its Activities Add Administrative Burden for Providers
paragraphs: In 2011, CMS established an internal work group known as the Provider  Burden Reduction Work Group to inventory CMS and contractor activities  that may create administrative burden for providers, to assess providers’  complaints, and identify areas for improving efficiency of processes. As  part of this effort, CMS officials indicated that they found differences in  contractor requirements related to claims reviews. As an example, they  indicated that contractors’ form letters were not standardized; instead  different types of contractors were required to include different information  in their form letters. Representatives of two provider associations had  indicated that having different contractors send out different versions of  the same type of form letters seemed to be confusing to providers. As of  November 2012, CMS officials told us that the work group had briefed  CMS senior management about its work, but this effort was still in  progress. CMS has not publicly announced the results of the work group’s  efforts, whether it would make any requirements more consistent, or a  time frame for any changes. Having less variation in requirements for  providers would be consistent with OMB guidance on streamlining service  delivery. Further, internal control standards indicate the importance of  deciding on corrective actions when needed and setting time frames for  completing them.
CMS officials told us that they have taken steps to increase provider  awareness and reduce confusion about the different review contractors  and their review processes to help providers in complying with review  efforts. These steps include the following:  In July 2012, CMS published a 15-page booklet about Medicare claim  review programs, including claims reviews by MACs, ZPICs, RAs, and  the CERT review contractor on CMS’s website, and the booklet was  announced in an e-newsletter that providers can sign up to receive.
In August 2012, CMS published an interactive map on its website that  allows the public and providers to identify the MACs, ZPICs, and RAs  that perform claims reviews in each state.
In September 2012, CMS published an update to a chart, the original  of which was first published in July 2011, to educate providers about  the definitions and responsibilities of contractors and other entities  involved in various aspects of Medicare and Medicaid claims  determinations. The chart explains why providers may need to  communicate with multiple entities as well as why multiple entities  may contact the same provider.
In January 2013, CMS published a three-page description about the  Medicare FFS Recovery Audit Program process that includes  references to other information, such as appeals.
In addition, CMS officials reported that they are developing web-based  training about the audits done by its contractors.
section_title: Conclusions
paragraphs: Differences in CMS’s postpayment claims review requirements for the  four types of contractors may reduce the efficiency and effectiveness of  claims reviews by complicating providers’ compliance with the  requirements. Some of these differences may be appropriate given the  different functions and responsibilities of the contractors. However, CMS  officials explained that differences in some requirements came about  because the contractors’ requirements were developed at different times  or the contractors’ activities have changed over time. In addition, some of  these differences could have come about because different types of  contractors and associated requirements are managed by different parts  of CMS.
Greater consistency in the claims review requirements across contractors  may improve the efficiency of postpayment reviews by strengthening the  control environment, lessening providers’ confusion, and reducing  administrative burdens. In addition, improving consistency across the  contractors would be consistent with the Executive Order 13571 on  Streamlining Service Delivery and Improving Customer Services and  OMB guidelines for implementing it. Greater consistency could make it  easier for providers to comply with ADR requests and claims  requirements. It could also help reduce claims payment error  determinations based on providers’ inability or failure to provide  documentation in a timely manner. It might also reduce any  inconsistencies in making determinations, which can lead to unneeded  appeals, and might increase providers’ confidence that reviews will also  be consistent and correct.
section_title: Recommendations for Executive Action
paragraphs: In order to improve the efficiency and effectiveness of Medicare program  integrity efforts and simplify compliance for providers, we are making  three recommendations. We recommend that the Administrator of CMS:  1.  examine all postpayment review requirements for contractors to  determine those that could be made more consistent without negative  effects on program integrity,  2.  communicate publicly CMS’s findings and its time frame for taking  3.  reduce differences in postpayment review requirements where it can  be done without impeding the efficiency of its efforts to reduce  improper payments.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS for comment, and received  written comments, which are reprinted in appendix II. In its comments,  HHS concurred with our three recommendations and agreed to take steps  to reduce differences in postpayment review requirements where  appropriate. HHS noted that CMS had begun to examine its requirements  for postpayment claims reviews as discussed in our report.HHS stated  that it is currently examining requirements related to ADRs to see if the  requirements could be standardized across contractor types. HHS  indicated that standardizing the minimum number of days a contractor  must give a provider to respond to an ADR before the contractor has the  authority to deny the claim could help minimize provider confusion. HHS  also agreed to publicly communicate its findings from the review of the  requirements on CMS’s website and include a timeframe for  implementing agreed-upon changes in procedures.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.
If you or your staff has any questions about this report, please contact me  at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff that made key contributions to this report were:  Sheila K. Avruch, Assistant Director; Carrie Davidson; Leslie V. Gordon;  and Laurie Pachter.
section_title: Appendix I: List of Provider Associations GAO Interviewed
section_title: Appendix II: Comments from the Department of Health and Human Services
section_title: Related GAO Products
paragraphs: GAO’s 2013 High-Risk Update: Medicare and Medicaid. GAO-13-433T.  Washington, D.C.: February 27, 2013.
Medicare Program Integrity: Greater Prepayment Control Efforts Could  Increase Savings and Better Ensure Proper Payment. GAO-13-102.  Washington, D.C.: November 13, 2012.
Medicare Fraud Prevention: CMS Has Implemented a Predictive  Analytics System, but Needs to Define Measures to Determine Its  Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012.
Program Integrity: Further Action Needed to Address Vulnerabilities in  Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.:  June 7, 2012.
Medicare Integrity Program: CMS Used Increased Funding for New  Activities but Could Improve Measurement of Program Effectiveness.  GAO-11-592. Washington, D.C.: July 29, 2011.
Improper Payments: Reported Medicare Estimates and Key Remediation  Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.
Improper Payments: Recent Efforts to Address Improper Payments and  Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011.
Status of Fiscal Year 2010 Federal Improper Payments Reporting.   GAO-11-443R. Washington, D.C.: March 25, 2011.
Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.
Medicare: Program Remains at High Risk Because of Continuing  Management Challenges. GAO-11-430T. Washington, D.C.: March 2,  2011.
Medicare Recovery Audit Contracting: Weaknesses Remain in  Addressing Vulnerabilities to Improper Payments, Although  Improvements Made to Contractor Oversight. GAO-10-143.   Washington, D.C.: March 31, 2010.
Medicare Contracting Reform: Agency Has Made Progress with  Implementation, but Contractors Have Not Met All Performance  Standards. GAO-10-71. Washington, D.C.: March 25, 2010.