Medicare Program: Additional Actions Needed to Improve Eligibility Verification of Providers and Suppliers
Published: 2015-06-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2014, Medicare paid $554 billion for health care and related services. CMS estimates that $60 billion (about 10 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.8 million providers and suppliers were in PECOS as of December 2014, according to CMS.
GAO was asked to assess Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This report examines the extent to which CMS's enrollment-screening procedures are designed and implemented to prevent enrollment of ineligible or potentially fraudulent Medicare providers. GAO reviewed relevant documentation, interviewed CMS officials, and contacted the 12 CMS contractors that evaluate provider applications. GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used 2005–2013 Medicare claims data to verify whether they were paid during this period.
section_title: What GAO Found
paragraphs: GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs. However, GAO identified the following weaknesses in the other two procedures: CMS's verification of provider practice location and physician licensure status.
First, Medicare providers are required to submit the address of the actual practice location from which they offer services. GAO's examination of 2013 data found that about 23,400 of 105,234 (22 percent) of practice location addresses are potentially ineligible. The computer software CMS uses as a method to validate applicants' addresses does not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid addresses. In addition, CMS's March 2014 guidance has reduced the amount of independent verification conducted by contractors, thereby increasing the program's vulnerability to potential fraud. For example, the figure below shows a mailbox located within a UPS store that an applicant reported as a practice location, which CMS contractors inaccurately verified as an authentic practice location under CMS's new guidance, which allows contractors to use phone calls as the primary means for verifying provider addresses.
Second, physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice and self-report final adverse actions, such as a suspension or revocation by any state licensing authority. CMS requires its contractors to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. In March 2014, CMS began providing a report to its Medicare contractors to improve their oversight of physician license reviews. However, the report only includes the medical license numbers providers use to enroll into the Medicare program, but not adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO found 147 out of about 1.3 million physicians listed as eligible to bill Medicare who, as of March 2013, had received a final adverse action from a state medical board for crimes against persons, financial crimes, and other types of felonies but were either not revoked from the Medicare program until months after the adverse action or never removed.
section_title: What GAO Recommends
paragraphs: GAO recommends that CMS incorporate flags into its software to help identify potentially questionable addresses, revise its 2014 guidance for verifying practice locations, and collect additional license information. The Department of Health and Human Services concurred with two of the three recommendations, but did not agree with the recommendation to revise its guidance. GAO continues to believe the recommendation is valid, as discussed in the report.

section_title: Letter
paragraphs: Medicare is the federally financed health-insurance program for persons  age 65 or over, certain individuals with disabilities, and individuals with  end-stage renal disease. In fiscal year 2014, Medicare paid $554.2  billion for health care and health care–related services. According to the  Centers for Medicare & Medicaid Services (CMS)—the agency within the  Department of Health and Human Services (HHS) that administers the  Medicare program—an estimated $59.9 billion (10.8 percent) of that total  was paid improperly, which is an increase over the 2013 level. Due to  the large dollar amount involved in improper payments, the Office of  Management and Budget has placed Medicare on its list of high-error  programs. Further, because of its size, complexity, and susceptibility to  mismanagement and improper payments, for more than 20 years we  have designated Medicare as a high-risk program.
CMS requires prospective providers and suppliers to be listed in the  Provider Enrollment, Chain and Ownership System (PECOS) to enroll in  Medicare and bill for services provided to Medicare beneficiaries. PECOS is a centralized database designed to contain providers’ and  suppliers’ enrollment information. According to CMS, there were about  1.8 million health-care providers and suppliers enrolled in PECOS as of  December 31, 2014.
CMS is responsible for developing provider and supplier enrollment  procedures to help safeguard the program from fraud, waste, and abuse.CMS contracts with Medicare Administrative Contractors (MAC) and the  National Supplier Clearinghouse (NSC) to manage the enrollment  process. MACs are responsible for verifying provider and supplier  application information in PECOS before the providers and suppliers are  permitted to enroll into Medicare. The NSC is responsible for verifying  information regarding suppliers of durable medical equipment,  prosthetics, orthotics, and supplies (DMEPOS). CMS requires providers  and suppliers to resubmit and recertify the accuracy of their enrollment  information every 5 years in order to maintain billing privileges. DMEPOS  suppliers must revalidate information with the NSC every 3 years.
The term “provider” refers collectively to institutional providers such as hospitals and  health-care facilities, as well as physicians and nonphysician practitioners who provide  health-care services to Medicare beneficiaries. Providers also include organ-procurement  organizations, skilled-nursing facilities, hospice, and end-stage renal disease centers. The  term “supplier” refers to certain Part B entities such as ambulance-service providers,  mammography centers, and portable X-ray facilities. Suppliers also include entities that  supply Medicare beneficiaries with Medicare durable medical equipment, prosthetics,  orthotics, and supplies (DMEPOS) such as walkers and wheelchairs. This report will  specify DMEPOS suppliers when applicable. of these provisions allowed CMS to evaluate providers and suppliers  previously enrolled in the Medicare program under new enrollment criteria  designed to strengthen Medicare’s provider-enrollment standards and  procedures.
We have previously reported that CMS should strengthen Medicare  enrollment standards and procedures as a key strategy for reducing  fraud, waste, abuse, and improper payments. For example, from July  2008 to September 2010 we issued three reports identifying persistent  weaknesses in CMS’s Medicare enrollment standards and procedures  that increased the risk of enrolling entities intent on defrauding the  Medicare program.  As a result, in September 2010, we recommended,  among other things, that CMS monitor more closely the MACs’ provider  and supplier enrollment activities to help ensure the accuracy and  completeness of PECOS data. CMS agreed to implement our  recommendations. Since 2012, CMS has taken several actions to  improve its oversight of the enrollment process, such as conducting an in- depth review of nursing-home chains and reviewing sample applications  once a year rather than every 5 years.
See GAO, Medicare: Covert Testing Exposes Weaknesses in the Durable Medical  Equipment Supplier Screening Process, GAO-08-955 (Washington, D.C.: July 3, 2008);  Medicare: Improvements Needed to Address Improper Payments in Home Health,  GAO-09-185 (Washington, D.C.: Feb. 27, 2009); and Nursing Homes: Complexity of  Private Investment Purchases Demonstrates Need for CMS to Improve the Usability and  Completeness of Ownership Data, GAO-10-710 (Washington, D.C.: Sept. 30, 2010). complete, and consistent. According to the OIG report, addresses are  essential for identifying trends in fraud, waste, and abuse because they  were the source of the most inaccuracies and inconsistencies. The report  found that CMS did not verify most provider information in PECOS or the  National Plan and Provider Enumeration System. The HHS OIG  recommended that CMS require MACs to implement program-integrity  safeguards for Medicare provider enrollment as established in the CMS  Program Integrity Manual. In addition, the OIG found that CMS should  detect and correct inaccurate and incomplete provider enumeration and  PECOS enrollment data for new and established records, among other  things. CMS agreed with the recommendations and as of March 2015  was revalidating 1.5 million enrolled providers and suppliers, which  includes verifying the information contained on the applications.  According to CMS, it sent all revalidation notices by March 23, 2015.
You asked that we assess Medicare’s provider and supplier enrollment- screening procedures to determine whether PECOS was vulnerable to  fraud. This report examines the extent to which CMS’s enrollment- screening procedures are designed and implemented to prevent and  detect the enrollment of ineligible or potentially fraudulent Medicare  providers, suppliers, and DMEPOS suppliers into PECOS.
To assess the extent to which CMS’s enrollment-screening procedures  are designed to prevent and detect the enrollment of ineligible or  potentially fraudulent Medicare providers, suppliers, and DMEPOS  suppliers into PECOS, we reviewed CMS procedural manuals and  directives including the Medicare manual that outlines the procedures that  MACs and the NSC should use to determine provider and supplier  enrollment eligibility. We also interviewed CMS officials about provider  and supplier enrollment-screening procedures, including procedures that  were developed and implemented as a result of the Patient Protection  and Affordable Care Act’s (PPACA) provisions. In addition, we conducted  interviews with 5 of the 12 MACs about enrollment-screening  procedures. We selected the five MACs to include some with larger  numbers of physicians serviced, some that met and some that did not  meet the accuracy threshold in CMS’s provider enrollment performance  evaluation, some that participated in the automated screening process  and some that did not (to capture additional possible checks that some  MACs performed on providers’ enrollment information through this  process), and some that served more than one jurisdiction to maximize  the number of states included in our review. We also interviewed NSC  officials responsible for enrolling DMEPOS suppliers to learn about the  DMEPOS supplier enrollment-screening procedures. We contacted by  e-mail the remaining 7 MACs to obtain additional information on the  provider enrollment-screening procedures to verify applicants’ practice  location addresses and validate applicants’ applicable licensure  information.
To assess the extent to which CMS implemented enrollment-screening  procedures to prevent and detect the enrollment of ineligible or potentially  fraudulent Medicare providers, suppliers, and DMEPOS suppliers into  PECOS, we matched the list of providers and suppliers present in  PECOS, as of March 29, 2013, and the DMEPOS suppliers, as of April 6,  2013 (the most-current data available at the time of our review) to the  following databases: (1) the United States Postal Service (USPS)  Address Matching System Application Program Interface,commercially available USPS software package that standardizes  addresses and provides specific flags, to determine the validity of the  providers’ or suppliers’ practice location address; (2) Federation of State  Medical Boards (FSMB) licensure data, to determine whether enrolled  providers or suppliers had disciplinary actions that might make them  ineligible for Medicare enrollment; (3) the Social Security Administration’s  (SSA) full death file, to determine whether enrolled providers or suppliers   which is a  were deceased;Entities (LEIE), an information source that shows names of providers and  suppliers who have been excluded from doing business with the federal  government, to determine whether enrolled providers or suppliers had  been previously excluded from doing business with the federal  government or health care–related programs.   and (4) the HHS OIG List of Excluded Individuals and  We also contacted those MACs and the NSC responsible for enrolling the  specific individuals or entities that appeared in our four sets of matches.  Since our PECOS data were as of March 29, 2013, for providers and  suppliers and April 6, 2013, for DMEPOS suppliers, we requested  updated information during the months of September 2014 to October  2014. This information included whether the provider or supplier was  revalidated or changed its PECOS profile information. We also requested  providers’ and suppliers’ application files, including site-visit reports from  the MACs when appropriate to corroborate MACs’ responses. In addition,  we obtained Medicare claims data from CMS for all of our matches to  determine how much the providers and suppliers were paid with Medicare  funds, if at all, while they may have been ineligible.
We assessed the reliability of the PECOS data, USPS address- management tool, FSMB licensure data, SSA’s full death file, LEIE, and  Medicare claims data by reviewing relevant documentation, interviewing  knowledgeable agency officials, and performing electronic testing to  determine the validity of specific data elements in the databases and  determined that these databases were sufficiently reliable for the purpose  of our work. Specifically, for the USPS address-management tool, we  selected a generalizable stratified random sample from the addresses  that the USPS address-management tool identified as being a  Commercial Mail Receiving Agency (CMRA), vacant, or invalid and took  additional steps to confirm whether the practice location address was an  eligible address, such as searching Google Maps and providers’  websites, and conducting physical site visits. For the FSMB licensure  data, we selected a random, nongeneralizable sample of 153 licenses  and traced the license information, including disciplinary actions when  applicable, to the appropriate state licensing medical board for  confirmation. Appendix I contains additional details regarding our scope  and methodology.
We conducted this performance audit from January 2014 to June 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Medicare Contractors’ Duties and Responsibilities
paragraphs: Since the Medicare program was created in 1965, it has been  administered largely by private contractors under federal oversight. These  contractors enroll and pay providers and suppliers while also maintaining  the responsibility to help ensure Medicare program integrity. CMS  currently contracts with 12 MACs, each of which is responsible for its own  geographic region, known as a “jurisdiction.” Figure 1 shows the MACs’  jurisdiction areas.
The NSC manages the DMEPOS suppliers’ enrollment, performs site  visits for DMEPOS suppliers, and interacts with the durable medical  equipment MACs, which pay claims for durable medical equipment items.
MACs and the NSC are instructed by CMS to adhere to the processing  guidelines of CMS’s manual to enroll providers, suppliers, and DMEPOS  suppliers into PECOS. PECOS is CMS’s centralized database for  Medicare provider and supplier enrollment information. Entities enrolled in  PECOS are granted Medicare billing privileges and can be reimbursed for  services rendered to Medicare beneficiaries. CMS provides additional  guidance to the MACs and the NSC using directives such as technical  direction letters and, in some cases, has monthly calls with the MACs to  discuss new guidance or process changes. MACs and the NSC are  responsible for updating PECOS after they have approved or revalidated  enrollment for providers and suppliers. CMS requires all enrolled  providers or suppliers to report changes to existing profile information  within a certain period.practice location address, the provider must notify the MAC or the NSC of  this change and the MAC or the NSC is responsible for verifying the new  address information, and updating the provider’s profile in PECOS to  reflect the current practice location address.
section_title: PPACA Provisions for Medicare Providers and Suppliers
paragraphs: PPACA requires all providers and suppliers to be subject to licensure  checks. Applicants must provide copies of all applicable federal and state  licenses and certifications. A licensure check consists of a MAC checking  the provider’s license information with a state licensing board within its  jurisdiction to determine whether the provider has an active license and  any board disciplinary actions. PPACA also gives CMS the authority to  require additional screening procedures beyond those each provider and  supplier must undergo, such as criminal-background checks, depending  on the type of risk presented by the provider or supplier type.
Further, PPACA required new screening procedures based on risk of  fraud, waste, and abuse. As a result of PPACA, CMS now assigns  categories of providers and suppliers to limited-, moderate-, and high-risk  levels; those in the highest level are subject to the most-rigorous  screening. For example, whereas providers and suppliers in all three risk  levels must undergo licensure checks, those in moderate- and high-risk  levels are also subject to unannounced site visits. In addition, the NSC is  required to conduct site visits to all of the DMEPOS suppliers (which are   Table 1 shows the categories of  categorized as moderate or high risk).Medicare providers and suppliers and their associated risk level.
According to CMS, as of January 2015, there were 2,506 high-risk  providers and suppliers, 105,558 moderate-risk providers and suppliers,  and 1,649,779 limited-risk providers in PECOS. In addition, there were  15,885 high-risk DMEPOS suppliers and 74,372 moderate-risk DMEPOS  suppliers.
In 2011, CMS awarded two contracts to assist the MACs with performing  aspects of the provider and supplier enrollment-screening process. The  first was issued to an automated screening contractor that collects and  analyzes license information and then provides the information to CMS  for review. The data are then reviewed by a MAC for further  determination. The second was issued to a site-visit contractor, who is in  charge of performing site visits to all providers and suppliers, except  DMEPOS suppliers. Prior to these awards, MACs were responsible for  conducting all site visits and required to manually review individual state  medical-licensing boards within their respective jurisdictions.
section_title: Four Screening Procedures to Enroll in the Medicare Program
paragraphs: Medicare provider and supplier enrollment entails other screening procedures based on  the type of providers and suppliers. For example, MACs and the NSC need to validate the  identify of individual providers, owners, and authorized/delegated officials using SSA  validation; validate and verify the legal business names for organizations; and validate and  verify the provider’s National Provider Identifier, among other things. For the purposes of  our review, we will focus on the four specific screening procedures outlined in our report.
subsections: section_title: Interactive Graphic
paragraphs: Medicare provider and supplier enrollment entails other screening procedures based on the type of providers and suppliers.
We identified weaknesses in two of the four screening procedures CMS  implemented to prevent and detect ineligible or potentially fraudulent  providers and suppliers from enrolling in PECOS: the verification of  practice location and of licensure status. CMS’s procedures to screen for  providers and suppliers listed as deceased or excluded from participating  in federal programs or health care–related programs appear to be  working, but we identified a few instances of ineligible or potentially  fraudulent providers and suppliers that we referred to CMS for further  review.
section_title: Limitations Exist in CMS Screening Procedures for Verifying Applicants’ Practice Locations
paragraphs: Our examination of practice location addresses of providers and suppliers  listed in PECOS as of March 2013 and DMEPOS as of April 2013  revealed thousands of questionable practice location addresses. We  found limitations with CMS’s Finalist software used to validate practice  location addresses. For example, Finalist does not provide flags to  indicate whether the practice location is potentially ineligible to qualify as  a legitimate location. Additional checks, such as checking for these  addresses in Internet searches of sites such as 411.com, USPS.com, or  Google Maps, or conducting site visits, are at times required to determine  whether a practice location is legitimate. However, the revised screening  procedures that CMS issued in March 2014 require MACs to do less  verification of providers’ practice locations than before.
subsections: section_title: Our Examination of Practice Locations Revealed Thousands of Questionable Addresses
paragraphs: Federal regulations stipulate the type of physical practice location that  applicants must have. Specifically, providers and suppliers must be  “operational” to furnish Medicare covered items or services. Federal  regulations define “operational” as having a qualified physical practice  location, being open to the public for the purpose of providing health  care–related services, being prepared to submit valid Medicare claims,  and being properly staffed, equipped, and stocked to furnish these items   All providers and suppliers are required to list a physical  or services.practice location address in their application, regardless of provider or  supplier type.would be required to supply his or her own home address in the  application.
For example, a provider who renders in-home services  Addresses that generally would not be considered a valid practice  location include post office boxes, and those associated with a certain  type of Commercial Mail Receiving Agency (CMRA), such as a United  Parcel Service (UPS) store. Based on USPS guidance, a CMRA is a  third-party agency that receives and handles mail for a client. Additionally, addresses that can be traced to a virtual office—that is, a  company advertising mailboxes, telephone answering services, and  dedicated workspaces—raise questions about whether the provider or  supplier meets the CMS practice location requirements under CMS  regulations. Vacant or invalid addresses are also ineligible for PECOS  enrollment. A vacancy refers to a provider or supplier that is no longer at  the location provided on the application form. USPS would flag a location  as vacant if it used to deliver mail there and has not delivered mail there  in more than 90 days. An invalid address is when an address is not  recognized by USPS, was incorrectly entered in PECOS, or was missing  a street number. Once enrolled in PECOS, providers and suppliers have  the responsibility to self-report changes to their practice locations. CMS  requires providers, suppliers, and DMEPOS suppliers to report a change  in practice location within 30 days.
Not all CMRAs would disqualify an applicant from the PECOS enrollment. For example,  a hospital may be legitimately designated as a CMRA if it uses or acts as a third party that  collects and distributes mail to its employees and would be considered an eligible practice  location. Post office boxes and drop boxes are not acceptable except in some cases  where the provider is located in rural areas. sites like 411.com and USPS.com, calling the official business  telephone number listed on the application, and using software called  Finalist to validate the practice location address.issued additional guidance to MACs that requires fewer verification  techniques to verify a practice location. This new guidance is discussed  later in the report.
In March 2014, CMS  Our examination of practice location addresses of the providers and  suppliers listed in PECOS as of March 2013 and DMEPOS as of April  2013 (the most-current data available at the time of our review) revealed  thousands of questionable addresses. Specifically, we checked PECOS  practice location addresses for all records that contained an address  using the USPS address-management tool, a commercially available  software package that standardizes addresses and provides specific flags  on the address such as CMRA, vacant, and invalid. The USPS address-management tool includes addresses as of December 15, 2013. This  software is not currently being used by CMS. Instead, CMS uses the  Finalist software to standardize practice location addresses.
As part of our initial analysis using the USPS address-management tool,  we identified 105,234 (about 11 percent) of the 980,974 addresses listed  in PECOS appeared in the USPS address-management tool as a CMRA,  a vacant address, or an invalid address.
We took further steps to determine the number of these questionable  addresses that could be determined to be ineligible for Medicare  providers and suppliers. Specifically, we selected a generalizable  stratified random sample of 496 addresses from the population of  105,234 that appeared in the USPS address-management tool as a  CMRA, a vacant address, or an invalid address. For each selected   or physical site  address, we used Google Maps, Internet searches,visits to confirm whether the practice location address was an eligible  address.
On the basis of our additional analysis of the generalizable sample of 496  addresses, we estimate the following:
About 23,400 (22 percent) of the 105,234 addresses that we initially  identified as a CMRA, vacant, or invalid address are potentially  ineligible for Medicare providers and suppliers. About 300 of the  addresses were CMRAs, 3,200 were vacant properties, and 19,900  were invalid. Of the 23,400 potentially ineligible addresses, we  estimate that, from 2005 to 2013, about 17,900 had no claims  associated with the address, 2,900 were associated with providers  that had claims that were less than $500,000, and 2,600 were  associated with providers that had claims that were $500,000 or more  per address.
About 39,900 (38 percent) of the 105,234 addresses that we initially  identified as a CMRA, vacant, or invalid address are potentially valid  addresses and thus eligible for Medicare providers and suppliers.For example, in some instances, the USPS address-management tool  flagged an address as a CMRA that we subsequently identified as a  hospital, based on our Google Maps or related searches. A hospital  may be considered a CMRA if it acts as a third party distributing mail  to its staff. Although the hospital was correctly flagged as a CMRA, for  the purposes of our review we considered these addresses to be  valid, since they are likely practice locations.
About 42,000 (40 percent) of the 105,234 addresses could not be  identified as either eligible or ineligible using the methods described  above, and may warrant further review to make an eligibility  determination. Among those for whom we could not verify an  address, we estimate that about 25,500 had no claims associated with  the address, 9,500 were associated with providers that had claims  that were less than $500,000, and 7,000 were associated with  providers that had claims that were $500,000 or more per address,  from 2005 to 2013. Some of these claims could be at risk of being  ineligible Medicare payments. See figure 3 below for a breakdown of  the identified addresses and our estimates of the number of ineligible  addresses.
During our review of the CMS internal controls intended to prevent and  detect these potentially ineligible providers from enrolling or remaining in  PECOS, we found limitations with the Finalist software being used to  validate the addresses. As previously noted, the Finalist software is one  of the techniques used by the MACs and the NSC to validate a practice  location. According to CMS, Finalist is integrated into PECOS to  standardize addresses and does so by comparing the address listed on  the application to USPS records and correcting any misspellings in street  and city names, standardizing directional markers (NE, West, etc.) and  suffixes (Ave, Lane, etc.), and correcting errors in the zip code.  However, the Finalist software does not indicate whether the address is a  CMRA, vacant, or invalid—in other words, whether the location is  potentially ineligible to qualify as a legitimate practice location.
CMS  does not have these flags in Finalist because the agency added coding in  PECOS that prevents post office box addresses from being entered, and  believed that this step would prevent these types of ineligible practice  locations from being accepted. CMS officials agreed, however, that  adding flags to the Finalist software to identify any potential issues that  might make the practice location address ineligible, such as a CMRA,  could be of value.
Some CMRA addresses are not listed as post office boxes. For example,  during our review of the practice location addresses in PECOS, we  identified 46 out of the 496 sample addresses that were allowed to enroll  in Medicare with a practice location that was inside a mailing store similar  to a UPS store. These providers’ addresses did not appear in PECOS as  a post office box, but instead were listed as a suite or other number,  along with a street address. Businesses can purchase a post office box  that is listed to the public as a suite number in a business district from  some commercial mailing businesses. By doing so, businesses can mask  the identity of the address as a post office box. Figure 4 shows an  example of one of the providers that we identified through our search and  site visits as using a mailbox-rental store as its practice location and  where services are not actually rendered. This provider’s address  appears as having a suite number in PECOS and was continuing to be  used in the system as of January 2015. According to our analysis of CMS  records, this provider was paid approximately $592,000 by Medicare from  the date it enrolled in PECOS with this address to December 2013, which  is the latest date for which CMS has claims data.
Our review also found locations that were vacant addresses. For  example, we identified a provider who used a hospital’s address as its  practice location, but the hospital no longer exists. The USPS address- management tool flagged this address as vacant as of September 2013.  When we conducted a site visit to this address in December 2014, we  found that the hospital had been demolished (see fig. 5). According to the  MAC, however, the provider went through the revalidation process using  the demolished hospital address and was approved in January 2015. As  of January 2015, therefore, this provider continued to use the vacant  address as one of its practice locations. If the provider moved to another  location, it was required to report the change of its practice location to the  MAC within 30 days. This provider was not paid by Medicare from  September 2013 through December 2013 data. However, by remaining in  PECOS, this provider may be eligible to bill Medicare in the future.
In another example in which we identified an address as vacant, we  visited a provider’s stated practice location in December 2014 and found  a fast-food franchise there (see fig. 6). Workers from the fast-food  franchise said that they have been in the location for about 3 years. In  addition, we found a Google Maps image dated September 2011 that  shows this specific location as vacant. According to the MAC in charge of  enrolling this provider, the provider was enrolled in PECOS in March  2010. As of January 2015, this provider had not updated its address in  PECOS and continued to use the fast-food franchise as its practice  location. As previously noted, CMS requires providers to report changes  in practice locations within 30 days. Currently, this provider is enrolled in  Medicare with an ineligible practice location because services can no  longer be rendered at this address. This provider was not paid by  Medicare from the date this practice location address was flagged as  vacant in the USPS address-management tool to December 2013.  However, by being enrolled in PECOS, this provider may be eligible to bill  Medicare in the future.
Providers’ submission of addresses that do not appear to be actual  practice locations are an indicator of potential fraud. Without having flags  in Finalist to better indicate the validity of the providers or suppliers’  practice locations, CMS misses an opportunity to focus on addresses that  may be potentially illegitimate practice locations at enrollment or after  enrollment.
section_title: Additional Checks Can Help to Verify Addresses
paragraphs: Using software that flags potentially ineligible addresses can help to  identify potentially ineligible practice locations, but conducting additional  research on addresses, including site visits, may be additionally helpful to  determine whether the provider or supplier is located at the address  provided at enrollment. As mentioned previously, MACs are only required  to conduct a site visit to providers and suppliers that are listed as  moderate or high risk, which is a cost-effective and practical option.  However, there are more than 1.6 million limited-risk providers—which  make up the vast majority of providers in PECOS—that will likely never  receive a site visit to confirm the practice location unless their risk status  changes. Of the 496 addresses in our sample that were flagged as  potentially ineligible, 252 were categorized as limited risk. In specific  instances where a limited-risk provider’s address is flagged as a CMRA,  vacant, or invalid address, additional checks on these particular providers  may be warranted.
For example, when searching addresses in Google Maps, we could  sometimes identify the building of the practice location, but not always  visually confirm whether the suite number that the provider or supplier  listed existed in the location. We visited 30 practice locations that the  USPS address-management tool flagged as vacant or located at a  CMRA. provider or supplier. According to our physical observation, 11 of the 30  locations appeared to be vacant; 6 appeared to be ineligible CMRAs; and  11 locations were inconclusive because we were not able to find the  providers or suppliers at the address.
Of these 30, we were able to confirm that 2 housed a legitimate  We also identified 25 applicants out of our generalizable sample of 496  addresses that the USPS address-management tool flagged as a CMRA  and that our additional research found to be located in places advertised  as “virtual offices.” mailboxes, telephone-answering services, and a dedicated workspace to  clients who are not physically located on the premises. While, according  to CMS, a virtual office may be appropriate for some suppliers, it may not  be appropriate for other types of providers and suppliers, since CMS  requires the practice location to be open to the public for purposes of  providing health care–related services and properly staffed, equipped,  and stocked to furnish services or items.
The 30 locations were selected based on the geographic proximity to the three MACs  and the NSC we visited, and to GAO offices. These locations were selected independently  of our generalizable sample of 496 addresses, and this selection is not generalizable to  any set of addresses.
These addresses were flagged as CMRA because they serve as a third party that  handles their customers’ mail.
We visited 5 of the 25 providers and suppliers in Maryland, Texas, and  California that our research indicated were located in places advertised  as virtual offices. Based on our observational visits, the 5 providers and  suppliers were located in places that were advertised as virtual offices.  In one instance, we took pictures of an office space in Texas that a  provider had listed as its practice location. As previously noted, CMS  requires the practice location to be open to the public for purposes of  providing health care–related services and properly staffed, equipped,  and stocked to furnish services or items. As shown in figure 7, at the time  of our visit there was no actual office operating at the practice location  address provided to CMS. As of May 2015, this provider had not updated  its practice location address in PECOS or received a site visit because  the provider falls into the limited-risk category. Without conducting  additional reviews or a site visit, the MAC or CMS will not be able to  confirm whether this provider is located at the practice location address  listed in PECOS or whether this virtual office meets CMS’s eligibility  requirements.
In light of the advertised characteristics of many virtual office spaces,  which may not meet practice location requirements, and what we  observed about these addresses, virtual office practice locations may  warrant a site visit or other detailed address check. However, 17 of the 25  provider or supplier applicants our research indicated were located in  places advertised as virtual offices had not received site visits, primarily  because most of these providers or suppliers were not classified as high  or moderate risk. We referred the 25 cases of providers and suppliers  with virtual office locations that we identified to CMS for further review.
section_title: Revised Screening Procedures Issued in March 2014 Require Less Verification of Practice Locations
paragraphs: As previously noted, for the practice location addresses found in the  PECOS data we obtained as of March 2013, CMS required MACs to  verify practice location addresses using various techniques to obtain  information about the practice location, such as searching the Internet  using sites like 411.com and USPS.com, calling the official business  telephone number listed on the application, and using Finalist to  standardize the practice location address. In March 2014, however, CMS  issued guidance to the MACs that revised the practice location verification  methods.required to contact the person listed in the application to verify the  practice location address and use the Finalist software that is integrated  in PECOS to standardize the practice location address. Additional  verification, such as using 411.com and USPS.com, which was required  under the previous guidance, is only needed if Finalist cannot standardize  the actual address. According to CMS officials, they revised the screening  procedures to verify the practice location to reduce application processing  time frames.
Specifically, under the March 2014 guidance, MACs are  Our findings suggest that the revised screening procedure of contacting  the person listed in the application to verify all of the practice location  addresses may not be sufficient to verify such practice locations. For  example, we found two providers in our sample of 496 addresses that the  USPS address-management tool flagged as CMRA, invalid, or vacant  that underwent the revalidation process in 2014. The MAC used the new  procedure of calling the contact person to verify the practice location. We  found that each of these two providers had a UPS or similar store as its  practice location. practice location by one of the providers that the MAC verified by  contacting the provider by telephone. As we stated earlier in this report,  conducting additional address-verification steps may be helpful to identify  ineligible practice locations. Federal internal-control standards require  management to identify risks that could impede an agency’s ability to  achieve its objectives and then take appropriate steps to manage those  risks. By using the new procedure of only calling the contact person  listed in the application to verify the practice location, CMS has weakened  its internal controls in this process and has increased the likelihood that it  could miss identifying some potentially ineligible practice locations and  could allow potentially ineligible providers and suppliers to enroll in  Medicare.
We identified these two providers by conducting Internet searches and also conducting  a site visit to one of the two providers.
section_title: Limitations Exist in Verifying Applicants’ Licensure Information
paragraphs: All physicians applying to enroll in the Medicare program must hold an  active license in the state in which they plan to practice. They must  include that licensing information on their applications; however, CMS  does not require that physicians also report licenses they might hold in   They must also self-report any final adverse actions they  other states.have received by any state licensing authority regardless of the state in  which they plan to practice. Under federal law, a final adverse action can  be a suspension or revocation of a license to provide health care by any  state licensing authority due to a conviction for a federal or state  felony offense that CMS has determined to be detrimental to the best  interest of the program or  revocation or suspension by an accreditation organization, among  other actions.
Applicants with an active license and a final adverse-action history may  still enroll into the Medicare program depending on the severity of the  actions and whether the applicant self-reported the action on his or her  application. According to CMS guidance, when an applicant first enrolls  into Medicare, MACs must corroborate adverse legal actions and  licensure information directly with state medical boards using information  located on the respective state medical board website and conduct follow- up research to ensure that the applicant retains an active license, as  applicable, before allowing applicants to enroll in Medicare.
CMS does not require MACs to independently identify and verify an  applicant’s license status in areas other than the state where the  applicant is enrolling. Further, CMS only requires MACs to verify final  adverse actions that the applicant self-reported on the application.
To improve oversight of the provider-license review process, in March  2014 CMS began providing the License Continuous Monitoring (LCM)  report to MACs. CMS officials explained that because MACs must  research all enrolled providers each month using multiple state medical  board websites in their respective jurisdictions, CMS established the LCM  report to provide consistency over the review process. It is designed to be  used in a monitoring capacity to evaluate changes in current license   The LCM report is generated from an  information, according to CMS.external vendor that obtains license information directly from individual  state medical boards. Each report is compiled monthly into an Excel  spreadsheet and provides a nationwide snapshot of PECOS provider  licensure status such as “suspended,” “surrendered,” “probation,” or  “deceased.” The report does not change the overall review process;  MACs are still required to access the state medical board website of each  provider to verify licensure status.
The LCM report that CMS provides to MACs includes the current provider  license status but not the adverse-action history. MACs therefore cannot  use the report to review a provider’s adverse-action history, but can use  the report to research current changes in the provider’s license status on  state medical websites and determine whether an adverse action was the  cause.
Further, the LCM report is limited to only those license numbers used to  enroll into the Medicare program. Some licenses of providers with  multiple medical licenses would not appear in the LCM report because  they were not used to enroll into Medicare. A provider may be associated  with various license numbers because of licenses in different states.
We found instances in which providers could have been denied  enrollment, based on our analysis of providers’ adverse-action histories.  We used data from the Federation of State Medical Boards (FSMB) to  examine physician license information and disciplinary actions. FSMB is  a nonprofit organization that serves state medical boards in all U.S.  states, Puerto Rico, Guam, and the Northern Mariana Islands; and 14  state boards of osteopathic medicine. FSMB data differ from the database  that CMS uses in that the FSMB database includes a provider’s entire  history of license revocations and suspensions, for all medical licenses,  while the LCM report only includes the current license status of the  licenses reported by providers in PECOS. We found that 321 out of about  1.3 million physicians with active PECOS profiles as of March 29, 2013  (the most-current data available at the time of our review) had received  an adverse action from a state medical board related to conduct such as  crimes against persons (e.g., battery, rape, or assault), financial or related  crimes (e.g., extortion, embezzlement, income-tax evasion, or insurance  fraud), and felony crimes outlined in section 1128 of the Social Security  Act (e.g., substance abuse, health-care fraud, or patient abuse) that  resulted in a revocation or suspension of their licenses sometime  between March 29, 2003, and March 29, 2013. See appendix V for a  breakdown of adverse actions identified in our review.
We followed up with the MACs to determine whether these physicians  self-reported final adverse actions or whether MACs had identified any  actions and revoked these physicians from the Medicare program. For  174 of the 321 physicians we identified as having adverse actions, MACs  either revoked and later reinstated the physician into the Medicare  program after meeting eligibility requirements or determined that the  adverse action did not affect the physician’s enrollment and allowed the  physician to remain in the Medicare program. The remaining 147  physicians were either not revoked from the Medicare program until  months after the adverse action or never removed. highlighted that delays in removing physicians from Medicare may occur  due to MAC backlogs, delays in receipt of data from primary sources, or  delays in the data-verification process. Figure 9 provides a breakdown of  adverse actions related to the 147 physicians.
We referred the 147 physicians to CMS for further review and action.
section_title: Few Instances of Providers and Suppliers in PECOS Listed as Deceased
paragraphs: To help ensure that Medicare maintains current enrollment information  and to prevent others from utilizing the enrollment data of deceased  providers and suppliers, MACs are required to check that providers and  suppliers in PECOS are not deceased. Since January 2009, CMS sends  the MACs a file containing a list of individuals who have been reported as  deceased to the SSA, and MACs review the file monthly. For individual  providers, CMS automatically applies the date of death to the PECOS  enrollment record and deactivates the enrollment. For owners, authorized  officials, and managing employees, MACs are required to manually  update the enrollment record, according to CMS.
We compared the list of about 1.7 million unique providers and suppliers  in PECOS as of March 2013 and DMEPOS suppliers as of April 2013 with  SSA’s full death file and found 460 (about 0.03 percent) who were  identified as deceased. In September and October 2014, we followed up  with the MACs to obtain additional information on these providers and  suppliers. Of the 460 providers and suppliers our analysis had identified  as deceased, CMS or the MACs found 409 (89 percent) to be deceased  between March 2013 to February 2015. According to the MACs’  responses, the remaining 51 of the 460 deceased providers and suppliers  were not identified as deceased by the MACs or CMS. Some MACs noted  that due to our work they confirmed that the provider or supplier was  deceased and will take further action. Even though the MAC or CMS  identified 409 of the 460 providers and suppliers that were deceased from  March 2013 to February 2015, there were some instances when much  more time elapsed before the MAC or CMS identified the provider as  deceased. For example, we found that a provider died in April 2008, but  the MAC identified the provider as deceased and duly updated the  PECOS record in July 2014. Further, we found that for 162 of the 409  providers, CMS or the MAC took a year or more to identify the provider as  deceased. According to CMS, some of the delays in identifying the  deceased providers occurred because SSA may take a long time to  report an individual as deceased.
Not identifying a provider or supplier as deceased exposes the Medicare  program to fraud. A provider or supplier can be paid after the date of  death for services performed before the date of death. Therefore, CMS is  required to check that no claims are paid for services provided after the  date of death. We found that the 38 out of the 460 providers and suppliers  we found to be deceased were paid about $80,700 by Medicare for  services performed after their date of death until December 2013, which  is the date CMS had Medicare claims data available. It is unclear what  caused the delay or omission by CMS and the MACs in identifying these  individuals as deceased or how many overpayments they are in the  process of recouping. We referred these cases to CMS for further review.
section_title: Few Instances of Providers and Suppliers in PECOS Excluded from Participating in Federal Programs or Health Care– Related Programs
paragraphs: MACs are required to check the Medicare Exclusion Database and the  General Services Administration debarment list known as System for  Award Management to ensure that the applicant and other individuals  listed in an application have not been suspended or debarred from  participating in a federal contract or a Medicare or Medicaid program. If a  MAC identifies the applicant as debarred or suspended, it is required to  document the finding and confirm whether it is an accurate match.  Applicants found on the System for Award Management website are not  automatically excluded; the MAC needs to contact the agency that issued  the exclusion or suspension action and confirm that the applicant is the  same person. In addition, the applicants can be excluded or suspended  for a certain period, but once the suspension period expires, the applicant  can apply to enroll in Medicare. According to CMS, in April 2010, it began  providing the MACs a report each month on any providers and suppliers  that have been sanctioned on the Medicare Exclusion Database.
On the basis of our analysis of relevant data, we found about 0.002  percent (40) of providers and suppliers listed in the HHS OIG List of  Excluded Individuals and Entities (LEIE), which feeds into the Medicare  Exclusion Database and PECOS, as of March 2013. These individuals  were excluded from participating in health care–related programs. We  found that 16 of the 40 excluded providers and suppliers were paid  approximately $8.5 million by Medicare for services rendered after their  exclusion date until the MAC or the NSC found them to be excluded. In  September and October 2014, we followed up with the MACs to  determine the status of these providers and suppliers in PECOS. Of the  40 providers we found, MACs had removed 38 providers and suppliers  from PECOS from March 2013 to October 2014. However, for two  matches that we identified, the MACs did not take any action. According  to CMS, one of two providers was not found in the Medicare Exclusion  Database or LEIE using specific identifiers such as National Provider  Identifier, last name, and Social Security number. This provider is  currently approved in PECOS. According to CMS, the other provider was  found in LEIE using the specific identifiers, but the middle initial did not  match. Because the MAC could not determine an exact match to the  excluded provider, it did not take any action. Since May 2014, this  provider was deactivated due to requesting to be withdrawn from the  Medicare program. However, this provider billed Medicare about $22,000  during the period for which she should have been ineligible to participate  in the Medicare program. We referred these two providers to CMS for  further review and action.
section_title: Conclusions
paragraphs: As part of an overall effort to enhance program integrity and reduce fraud  risk, effective enrollment-screening procedures are essential to ensure  that ineligible or potentially fraudulent providers or suppliers do not enroll  in the Medicare program. CMS has taken steps to develop and implement  such procedures, but our analysis found limitations in two key areas that  have allowed potentially ineligible providers and suppliers to enroll in  Medicare. First, CMS software to validate the applicant’s practice location  address does not contain specific flags that can help identify questionable  practice locations. Without those flags, CMS misses an opportunity to  identify questionable practices that might warrant further review. In  addition, the absence of those flags along with CMS’s recently revised  guidance—in which the MACs contact the person listed in a provider’s or  supplier’s application to verify an address—call into question the overall  effectiveness of CMS’s procedures to ensure that applicants have a  legitimate practice address.
Similarly, CMS’s efforts to improve the oversight of physician license  reviews by providing the MACs with the License Continuous Monitoring  (LCM) report are a good first step. However, the report only provides  MACs with the current status of the license that the provider used to  enroll in the Medicare program. Without collecting license information on  all medical licenses, regardless of the state the provider enrolled in, CMS  may be missing an opportunity to identify potentially ineligible providers  who have license revocations or suspensions in other states, which can  put Medicare beneficiaries at risk. Utilizing additional resources, such as  the Federation of State Medical Boards (FSMB), could help CMS identify  whether providers or suppliers have additional licenses in other states  that have ever been revoked or suspended. These resources would  enable CMS and the MACs to access a provider’s entire adverse-action  history and could provide the MACs with a more-complete picture when  enrolling or revalidating a Medicare provider.
section_title: Recommendations for Executive Action
paragraphs: To help improve the Medicare provider and supplier enrollment-screening  procedures, we recommend that the Acting Administrator of CMS take the  following three actions:  1.  modify the CMS software integrated into PECOS to include specific  flags to help identify potentially questionable practice location  addresses, such as Commercial Mail Receiving Agency (CMRA),  vacant, and invalid addresses;  2.  revise CMS guidance for verifying practice locations to include, at a  minimum, the requirements contained in CMS’s guidance in place  prior to March 2014 so that MACs conduct additional research,  beyond phone calls to applicants, on the practice location addresses  that are flagged as a CMRA, vacant, or invalid to better ensure that  the address meets CMS’s practice location criteria; and  3.  collect information on all licenses held by providers that enroll in  PECOS by using data sources that contain this information, including  licenses obtained from other states, and expand the License  Continuous Monitoring (LCM) report to include all licenses, and at  least annually review databases, such as that of the Federation of  State Medical Boards (FSMB), to check for disciplinary actions.
section_title: Agency and Third- Party Comments and Our Evaluation
paragraphs: We provided a draft of this report for review to HHS and received written  comments that are summarized below and reprinted in appendix VI. HHS  also provided technical comments, which we incorporated as appropriate.  In addition, we provided excerpts of this draft report to the 12 MACs,  NSC, SSA, USPS, and FSMB to help ensure the accuracy of our report.  We received technical comments from these parties, which we have  incorporated, as appropriate.
In its comments, HHS concurred with two of our three recommendations,  but disagreed with the recommendation to revise its guidance. We  continue to believe this action is needed, as discussed below.
Specifically, HHS concurred with our recommendation to modify CMS’s  software already integrated into PECOS to include specific flags to help  identify potentially questionable practice location addresses, such as  CMRA, vacant, and invalid addresses. HHS stated that it will configure  the provider and supplier address-verification system in PECOS to flag  CMRAs, vacancies, invalid addresses, and other potentially questionable  practice locations.
HHS did not agree with the recommendation to revise its guidance for  verifying practice locations to include, at a minimum, the requirement  contained in CMS’s guidance in place prior to March 2014 so that MACs  conduct additional research, beyond phone calls to applicants, on the  practice location addresses that are flagged as a CMRA, vacant, or  invalid. In its written comments, HHS stated that the March 2014  guidance was updated to remove redundant practices, such as the use of  411.com and USPS.com to verify practice locations because the provider  and supplier address-verification system in PECOS performed the same  checks. Further, HHS noted that removing these requirements allowed  HHS to reduce provider and supplier burden and eliminate duplication of  effort without reducing the effectiveness of its program-integrity efforts.  The agency noted that, if a MAC is unable to validate the practice location  using the software incorporated in PECOS, it is permitted to request  clarifying information from the provider/supplier or request an  unannounced site visit.
However, our audit work shows that additional checks on addresses  flagged by the address matching software as a CMRA, vacant, or invalid  address can help to verify whether the addresses are ineligible. For  example, when the USPS address-management tool flagged a practice  location address as a CMRA, we took further steps, such as conducting  Google Maps searches or physical site visits, to determine whether the  address was ineligible. On the basis of these steps, we were able to  confirm that the addresses were legitimate in some cases, while in other  cases the practice locations in PECOS were ineligible addresses, such as  a UPS store or similar establishments. We continue to believe that our  recommendation will help ensure that HHS conducts this type of  additional research on practice location addresses, when necessary. This  additional research can include Google Map searches, Internet searches,  site visits, or the additional steps HHS highlighted in its response. We are  concerned that HHS’s 2014 guidance does not describe any of these  specific types of additional methods or techniques, beyond contacting the  person listed in the application, and some of the MACs that we contacted  were no longer taking the types of additional steps outlined above after  issuance of HHS’s 2014 guidance. Further, as our report highlighted, we  identified providers with potentially ineligible addresses that were  approved by MACs using the process outlined in that guidance.  Therefore, we continue to believe that the agency should update its 2014  guidance to reflect the need to conduct the types of additional address  research that we cite in our report and that the agency cites in its  response, on addresses that are flagged as potentially ineligible practice  locations.
HHS also concurred with our draft recommendation to require applicants  to report all license information including those obtained from other states  and expand the LCM report to include all licenses, and at least annually  review databases, such as that of FSMB, to check for disciplinary actions.  HHS noted that it will take steps to make certain that all applicants’  licensure information is evaluated as part of the screening process by  MACs and the LCM report as appropriate and will regularly review other  databases for disciplinary actions against enrolled providers.
HHS further stated, however, that it does not have the authority to require  providers to report licenses for states in which they are not enrolled. As  shown in our report, having a provider’s complete licensing history is a  way to determine whether a provider has a history of final adverse  actions. Without obtaining all licenses from a provider, as we did, CMS  does not have the ability to verify whether all final adverse actions were  reported. Without collecting license information on all medical licenses,  regardless of the state the provider enrolled in, it is unclear how HHS will  obtain the information it needs to identify past disciplinary actions, as the  agency indicated it will do in its response to our report. Instead, HHS may  continue to miss an opportunity to identify potentially ineligible providers  who have license revocations or suspension in other states, which can  put Medicare beneficiaries at risk.
While providers are not currently required to list out-of-state license  information in the enrollment application, CMS can independently collect  this information by using other resources. For example, CMS can  compare the provider’s information to license databases, such as  FSMB’s, that identify all licenses associated with an individual. For the  purposes of our work, we compared the provider’s SSN and name with  FSMB’s data to determine whether enrolled providers had disciplinary  actions that might make them ineligible for Medicare enrollment and  found instances in which providers could have been denied enrollment.
Therefore, we clarified our recommendation to state that CMS should  collect information on all licenses held by providers that enroll in PECOS  by using data sources that contain this information. Doing so will help  HHS to develop a more-complete picture of individual providers.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees, the Acting Administrator of CMS,  and other interested parties. In addition, the report is available at no  charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix VII.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: GAO was asked to assess Medicare’s provider and supplier enrollment- screening procedures to determine whether the Provider Enrollment,  Chain and Ownership System (PECOS) was vulnerable to fraud. This  report examines the extent to which Centers for Medicare & Medicaid  Services (CMS) enrollment-screening procedures are designed and  implemented to prevent and detect the enrollment of ineligible or  potentially fraudulent Medicare providers; suppliers; and durable medical  equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers into  PECOS.
To assess the extent to which CMS’s enrollment-screening procedures  are designed to prevent and detect the enrollment of ineligible or  potentially fraudulent Medicare providers, suppliers, and DMEPOS  suppliers into PECOS, we reviewed CMS procedural manuals and  directives including the Program Integrity Manual that outlines the  procedures that Medicare Administrative Contractors (MAC) and the  National Supplier Clearinghouse (NSC) should use to determine provider  and supplier enrollment eligibility. We also interviewed CMS officials  about provider and supplier enrollment-screening procedures, including  procedures that were developed and implemented as a result of the  Patient Protection and Affordable Care Act’s (PPACA) provisions. In  addition, we conducted interviews with five MACs, to learn about the  enrollment-screening procedures. We selected the five MACs to include  some with larger numbers of physicians serviced, some that met and  some that did not meet the accuracy threshold in CMS’s provider  enrollment performance evaluation, some that participated in the  automated screening process and some that did not (to capture additional  possible checks that some MACs performed on providers’ enrollment  information through this process), and some that served more than one  jurisdiction to maximize the number of states included in our review. We  also interviewed NSC officials responsible for enrolling DMEPOS  suppliers to learn about the DMEPOS supplier enrollment-screening  procedures. We contacted by e-mail the remaining seven MACs to obtain  additional information on the provider enrollment-screening procedures to  verify applicants’ practice location addresses and validate applicants’  licensure and accreditation information.
To assess the extent to which CMS implemented enrollment-screening  procedures to prevent and detect the enrollment of ineligible or potentially  fraudulent Medicare providers, suppliers, and DMEPOS suppliers into  PECOS, we matched the list of providers and suppliers present in  PECOS on March 29, 2013, and DMEPOS suppliers on April 6, 2013— the most-current data available at the time of our review—to four specific  databases listed below.  1.  The United States Postal Service (USPS) Address Matching  System Application Program Interface, which is a commercially  available USPS software package that standardizes addresses and  provides specific flags such as Commercial Mail Receiving Agency  (CMRA), vacant, or invalid addresses to determine the validity of the  providers’ or suppliers’ practice location addresses. Specifically, we  submitted 980,974 PECOS practice location addresses to the USPS  address-management tool. The USPS address-management tool  contained valid addresses as of December 15, 2013. Of the 980,974  addresses, 105,234 (about 11 percent) appeared in the USPS  address-management tool as a CMRA, a vacant address, or an  invalid address. For those addresses that the tool flagged as a CMRA,  vacant, or invalid, we selected a generalizable stratified random  sample. Specifically, we sampled 496 addresses from the population  of 105,234. We stratified the population addresses by the type of  match (CMRA, vacant, or invalid) and by the type of provider  (individual practitioner, organization, or DMEPOS supplier). This  resulted in nine mutually exclusive strata. We computed sample sizes  to achieve a precision of plus or minus 10 percentage points or fewer,  at the 95 percent confidence level for each of the three types of  matches. Because we followed a probability procedure based on  random selections, our sample is only one of a large number of  samples that we might have drawn. Since each sample could have  provided different estimates, we express our confidence in the  precision of our particular sample’s results as a 95 percent confidence  interval (e.g., plus or minus 10 percentage points). This is the interval  that would contain the actual population value for 95 percent of the  samples we could have drawn. To confirm whether each of the 496  sampled practice location addresses was an eligible address, we  used Google Maps, Internet searches including searching the  provider’s website, or physical site visits. On the basis of the results of  our work on the sample, we produced estimates of how many  addresses were likely to be ineligible, potentially valid, or inconclusive.  The estimates are based on our generalizable stratified random  sample of 496 addresses and have a margin of error at the 95 percent  confidence level of plus or minus 10 percentage points or fewer. To  calculate the amount of Medicare claims paid to providers and  suppliers we confirmed to have an ineligible practice location, we ran  the provider and supplier National Provider Identifier against the  claims paid from 2005 to 2013, the period for which CMS has claims  data. For addresses that were located at an ineligible CMRA, we  calculated the claims data from the date the provider or supplier  enrolled into PECOS using the address to December 2013. For  addresses flagged as vacant by the USPS address-management tool,  we calculated the claims data from September 2013 to December  2013.at least 90 days to be flagged as vacant in the USPS address- management tool. For the invalid addresses, we calculated the claims   According to USPS guidance, an address must be vacant for  data from the date the provider or supplier enrolled into PECOS using  the address to December 2013. The Medicare claims paid to  providers and suppliers with ineligible addresses may be understated  because some of the providers and suppliers enrolled in PECOS with  a potential ineligible address prior to 2005.  2.  The Federation of State Medical Boards (FSMB) licensure data  from March 31, 2014, to determine whether enrolled providers or  suppliers had disciplinary actions that might make them ineligible for  Medicare enrollment. We matched the providers and suppliers in  PECOS with the FSMB licensure data by Social Security number and  provider name. We then validated the FSMB licensure information  against individual state medical licensing boards. We then calculated  Medicare claims for those physicians that received a suspension or  revocation of their medical license while enrolled in PECOS. This  included the time the physician was actively suspended or revoked  and in some cases the time when the provider could have been  barred from the Medicare program for not reporting an adverse action.  We calculated the Medicare claims data paid from 2005 to 2013,  which are the years CMS had the claims data available.  3.  The Social Security Administration’s (SSA) full death file  containing updates through April 2013, to determine whether enrolled  providers or suppliers were deceased. We matched the providers  and suppliers with the SSA full death file by Social Security number  and provider’s last name. We also matched the providers and  suppliers we identified as deceased with the Medicare claims by  National Provider Identifier. We calculated the Medicare claims data  paid from 2005 to 2013, which are the years CMS had the claims data  available, to the deceased providers by considering only claims paid  for services rendered after the date of death.  4.  The Department of Health and Human Services (HHS) Office of  Inspector General (OIG) List of Excluded Individuals and Entities  (LEIE) as of September 17, 2012, to determine whether providers or  suppliers were excluded from doing business with the federal  government or health care–related programs.match by comparing the provider’s Social Security number and  provider’s last name. We also matched the providers and suppliers we  identified as being excluded with the Medicare claims data by using  the provider and supplier National Provider Identifier. We calculated  the Medicare claims data paid from 2005 to 2013, which are the years  CMS had the claims data available, to the excluded providers and  suppliers by considering only claims paid for services rendered after  the exclusion date through the date the MAC or CMS found the  provider to be excluded. The Medicare claims paid to excluded  providers and suppliers may be understated in cases where these  providers and suppliers were excluded prior to 2005.
We also contacted the NSC and those MACs responsible for enrolling  any of the individuals and entities that appeared in our four sets of  matches. Since our PECOS data were as of March 29, 2013, for  providers and suppliers and April 6, 2013, for DMEPOS suppliers, we  requested updated information during the months of September 2014 to  October 2014. This information included whether the providers or  suppliers were revalidated or changed their PECOS profile information.  We also requested providers’ and suppliers’ application files including  site-visit reports from the MACs when appropriate to corroborate MACs’  responses. We also selected 30 locations for a physical site visit to  confirm whether the practice location address was an eligible address.  The 30 locations were selected based on the geographic proximity to the  five MACs and the NSC we visited, and to GAO offices. These locations  were selected independently of our generalizable sample of 496  addresses and this selection is not generalizable to any set of addresses.
We assessed the reliability of the PECOS data, USPS address- management tool, FSMB licensure data, SSA full death file, HHS LEIE,  and Medicare claims data by reviewing relevant documentation,  interviewing knowledgeable agency officials, and performing electronic  testing to determine the validity of specific data elements in the data.  Specifically, for the USPS address-management tool, we selected a  generalizable stratified random sample of 496 addresses that the tool  flagged as a CMRA, vacant, or invalid and used Google Maps, Internet  searches, or physical site visits to confirm the address. For the FSMB  licensure data, we selected a random, nongeneralizable sample of 153  licenses and traced the license information, including disciplinary actions  when applicable, to the appropriate state licensing medical board for  confirmation. We determined that these databases were sufficiently  reliable for the purpose of our work.
We conducted this performance audit from January 2014 to June 2015 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
section_title: Appendix II: Processes within Each Provider and Supplier Enrollment-Screening Procedure to Determine Medicare Program Eligibility
paragraphs: The following table outlines the steps in the enrollment-screening process  depicted in figure 2.
section_title: Appendix III: Practice Locations Allowed Based on the Type of Services the Provider or Supplier Renders
paragraphs: Federal regulations require that applicants have a physical practice  location that is open to the public for providing health care–related  services that is properly staffed, equipped, and stocked to furnish the  services for which they will be receiving Medicare funds. Providers and  suppliers are required to list a physical practice location address in the  enrollment application regardless of their provider or supplier type. The  practice location address provided in the application depends on the type  of services the provider or supplier renders. Table 3 describes the type of  practice locations allowed based on the services the provider or supplier  renders.
section_title: Appendix IV: Breakdown of the Sample of 496 Addresses
paragraphs: We selected a generalizable stratified random sample of 496 addresses  from the population of 105,234 that appeared in the United States Postal  Service (USPS) address-management tool as a Commercial Mail  Receiving Agency (CMRA), a vacant address, or invalid address. For  each selected address, we used Google Maps, Internet searches, or  physical site visits to confirm whether the practice location address was  an eligible address. For the 496 addresses we reviewed, we confirmed  the following:
120 of the 496 addresses had an ineligible address, of which 46  addresses were determined to be CMRAs, 29 were vacant properties,  and 45 were invalid.
We contacted the Medicare Administrative Contractors (MAC) and  the National Supplier Clearinghouse (NSC) to determine whether  the 120 addresses were updated, because providers and  suppliers can submit changes to their addresses or update them  during the revalidation process, since the time we obtained the list  of providers and suppliers in the Provider Enrollment, Chain and  Ownership System (PECOS).
The MACs and the NSC noted that 92 of the 120 addresses we  found to be ineligible have not been updated in PECOS from  March 30, 2013, to October 2014. We found that from the time a  provider enrolled in PECOS with the ineligible practice location  through December 2013 or the date the provider updated the  address, the Medicare program has paid providers associated  with these 120 addresses approximately $122.4 million.
162 of the 496 addresses were determined to be valid addresses and  thus eligible for Medicare.
214 of the 496 addresses cannot be determined as either eligible or  ineligible using these methods.
The numbers of addresses presented in this appendix are unweighted  counts of results obtained from the stratified random sample of 496  cases. These numbers do not represent estimates of the population. The  estimated percentages included in the body of the report were computed  using methods appropriate for a stratified random sample and have been  weighted to account for the sample design. As a result, percentages  computed from the numbers presented in this appendix are not expected  to match the estimated percentages included in the body of the report.
section_title: Appendix V: Actions Resulting in Revocations and Suspensions
paragraphs: During our review, we found that 321 physicians in the Provider  Enrollment, Chain and Ownership System (PECOS) have received some  type of revocation or suspension from March 29, 2003, to March 29,  2013. Of the 321 physicians, 147 were either not revoked from the  Medicare program until months after the adverse action or never  removed. Below in table 4 is a breakdown of the adverse actions  identified in our review.
section_title: Appendix VI: Comments from the Department of Health and Human Services
section_title: Appendix VII: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to those mentioned above, the following staff members made  significant contributions to this report: Latesha Love, Assistant Director;  Gloria Proa, Analyst-in-Charge; Ariel Vega; and Georgette Hagans.  Additionally, Colin Fallon, Maria McMullen, and Marcus Corbin provided  technical support; Shana Wallace and James Ashley provided  methodological guidance; and Brynn Rovito and Barbara Lewis provided  legal counsel.