Program Integrity: Views on the Use of Commercial Data Services to Help Identify Fraud and Improper Payments
Published: 2016-06-30T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Federal agencies may use commercial data services in conducting program integrity activities designed to identify fraud and improper payments, which pose a significant risk to the integrity of federal programs. For example, federal agencies may obtain commercial data—subject to applicable laws and protections—that identifies individuals' deaths, income and assets, or other information that may help the agency determine whether individuals or entities are eligible for a government program or benefit.
GAO was asked to review issues surrounding the use of commercial data in conducting program integrity activities. This report identifies and describes the views of selected agency officials and commercial data service providers regarding (1) reasons selected agencies have used commercial data services in conducting program integrity activities; and (2) factors agencies may consider in determining whether commercial data services meet their information requirements for conducting program integrity activities.
To do this, GAO reviewed documents and conducted interviews with federal agency officials and representatives of commercial data service providers selected as part of a nonprobability sample of 12 entities selected to represent a range of program integrity activities and commercial data services. The information and perspectives that GAO obtained are not generalizable to other agencies and providers.
GAO is making no recommendations in this report, which incorporates various technical comments from the agencies.
section_title: What GAO Found
paragraphs: Officials from selected federal agencies told GAO that using commercial data services can help their agencies improve the efficiency of program integrity activities. For example, Internal Revenue Service (IRS) officials told GAO that using commercial data service providers to provide web and phone-based services to help authenticate certain taxpayer's identities likely allowed their staff to focus on other work rather than deal with large volumes of in-person requests for identity authentication. Commercial data services can also provide federal agencies access to private sector data, such as bank deposit information, that is not available from federal government sources. This financial information may help agencies to determine whether individuals have income from work or assets that indicate they are not eligible for certain programs, such as disability programs. Applicable laws generally require that agencies independently verify instances of matching data identified by computer matching programs before taking action and provide minimum notice to affected individuals. The figure below shows examples of the types of data that agencies may obtain from data service providers.
Federal agencies may consider various factors in determining whether data from commercial data services meet their information requirements for conducting program integrity activities. These factors include the accuracy of data; the currency and timeliness of data; the completeness of data; and technical aspects of using the data for these purposes, according to officials from agencies in GAO's nonprobability sample. For example, Department of Labor (DOL) officials told GAO that state Unemployment Insurance (UI) agencies could likely improve their ability to identify and prevent improper UI payments to claimants who return to work by obtaining commercially available wage data from a data service provider that are generally more recent than quarterly wage data that UI agencies receive directly from employers. DOL officials also told GAO that the agency is currently working with three states and a provider to conduct a pilot project to examine the use of the provider's payroll data to identify improper payments to UI recipients with disqualifying income from work. DOL expects the pilot to last up to 4 months.

section_title: Letter
paragraphs: Federal agencies may use commercial data services in conducting  program integrity activities designed to identify fraud and improper  payments, which pose a significant risk to the integrity of federal  programs. For example, federal agencies may obtain commercial data  services—subject to applicable laws and protections—that identify  individuals’ deaths, income and assets, identity theft, or other information  that may help the agency determine whether individuals or entities are  eligible for a government program or benefit. These program integrity  activities can help federal agencies to identify improper payments or  improper access to government programs, contracts, grants, awards, or  other government benefits. Agencies may pay for commercial data and  data services in different ways, such as through contracts for a set  amount or through rates based on usage. The commercial entities that  provide these data services include private companies and nonprofit  entities that gather and maintain such data and provide a variety of  analytical and consulting support to federal agencies as part of their data  services. Given that federal agencies are expanding their use of  commercial data services and the costs of these data services, you asked  us to review issues surrounding federal agencies’ use of commercial data  in conducting program integrity activities.
This report identifies and describes the views of selected agency officials  and data service providers regarding (1) reasons selected agencies have  used commercial data services in conducting program integrity activities;  and (2) factors agencies may consider in determining whether  commercial data services meet their information requirements for  conducting program integrity activities.
To identify and describe the views of selected agency officials and data  service providers regarding reasons selected agencies have used  commercial data services in conducting program integrity activities, we  reviewed documents and conducted interviews with federal agency  officials and representatives of commercial data service providers  selected as part of a nonprobability sample. To select our nonprobability  sample of federal agencies and commercial data service providers, we  reviewed prior GAO reports that describe federal agencies’ use of  commercial data in conducting program integrity activities. We then  selected 12 entities that represent a range of program integrity activities  and commercial data and data services. These entities include 7 federal  agencies and 5 commercial data service providers. While this report  presents details on various commercial data services and agencies’ use  of those services, the information we obtained and present in this report  should not be regarded as exhaustive because our work was based on a  nonprobability sample of agencies and commercial entities. Further, the  information and perspectives that we obtained from these federal  agencies and commercial data service providers are not generalizable to  other federal agencies and data service providers.
To identify and describe the views of selected agency officials and data  service providers regarding factors agencies may consider in determining  whether commercial data meet their information requirements for  conducting program integrity activities, we reviewed documents and  conducted interviews with federal agency officials and representatives of  commercial data service providers selected as part of the nonprobability  sample described above. We also reviewed one example of an agency’s  use of commercial data described in a more recently issued GAO report.  Because our work was based on a nonprobability sample of agencies and  commercial entities, the information we obtained and present in this  report should not be regarded as an exhaustive list of factors agencies  may consider in determining whether commercial data meet their  information requirements for conducting program integrity activities.  Similarly, the information and perspectives that we obtained from these  federal agencies and commercial data service providers are not  generalizable to other federal agencies and data service providers.
We conducted this performance audit from September 2015 to June 2016  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Program Integrity Activities
paragraphs: Throughout this report, we refer to program integrity activities as those  activities designed to prevent fraud, waste, and abuse of government  resources. Program integrity activities may encompass a broad range of  activities, such as identifying improper payments or improper access to  federal programs or benefits. An improper payment is defined by statute  as any payment that should not have been made or that was made in an  incorrect amount (including overpayments and underpayments) under  statutory, contractual, administrative, or other legally applicable  requirements. Among other things, it includes payment to an ineligible  recipient, payment for an ineligible good or service, and any duplicate  payment. In the context of this report, improper access to a federal  program or benefit refers to access that should not have occurred under  statutory, contractual, administrative, or other legally applicable  requirements.
Additionally, Standards for Internal Control in the Federal Government  states that management should use information that is appropriate,  current, complete, accurate, and provided on a timely basis to achieve an  entity’s objectives. To do this, management obtains relevant data from  reliable internal and external sources in a timely manner based on the  identified information requirements, which may vary depending on the  program’s objectives. Management uses the quality information to make  informed decisions and evaluate the entity’s performance in achieving key  objectives and addressing risks, such as the risk of fraud, waste, and  abuse. As such, information and communication are a key component of  agencies’ internal control over their programs. Commercial data may or  may not help agencies meet these information needs.
section_title: Commercial Data and Data Services
paragraphs: Throughout this report, we refer to commercial data and data service  providers. These include private companies and nonprofit entities that  gather and maintain data as well as provide a variety of analytical and  consulting support to federal agencies as part of their data services. The  types of data these entities provide access to may include data from  federal government entities, such as death information from the Social  Security Administration (SSA); data from state and local government  entities, such as real estate and personal property ownership records;  and data from commercial entities, such as the name and address of a  private business that the data service provider collects, maintains, and  updates through its own efforts. Figure 1 shows examples of the types of  data that agencies may obtain from data service providers.
In addition to aggregating information from multiple data sources and  providing access to various databases, commercial data service providers  may provide technical and analytical support to federal agencies, such as  by developing user-friendly interfaces for agency staff and producing  analytical reports that agencies can use to identify potential fraud. As  mentioned, agencies may pay for commercial data and data services in  different ways, such as through contracts for a set amount or through  rates based on usage. Additional background information on each of the  five commercial data service providers we selected as part of our  nonprobability sample appears later in this report.
section_title: RELX Group
paragraphs: RELX Group is a public company that provides data services to private  sector and government agencies. These data services include those  provided through LexisNexis Risk Solutions and the Accuity Asset  Verification Solution. LexisNexis Risk Solutions can provide access to  public, proprietary, and third-party data—such as data on an individual’s  name, current address, and criminal history information—as well as data  analytics as part of a data service. The Accuity Asset Verification Solution  allows federal agencies to obtain information from the U.S. banking  community to verify applicants’ financial assets as part of program  eligibility determinations, such as through SSA’s Access to Financial  Institutions initiative.
subsections: section_title: Equifax Inc.
paragraphs: Equifax Inc. is a public company that provides data services that include  consumer and commercial information as well as workforce information.  For example, Equifax provides automated verification of employment and  income to both the public and private sectors through its proprietary The  Work Number® database. According to Equifax officials, Equifax  performed 74 million employment verifications through The Work  Number® in 2015. In addition to The Work Number, Equifax provides its  eIDVerifier product to the Internal Revenue Service (IRS), which IRS uses  to support the authentication of taxpayers in a call center environment as  part of its Taxpayer Protection Program.
section_title: National Association for Public Health Statistics and Information Systems (NAPHSIS)
paragraphs: NAPHSIS is a nonprofit membership organization representing the 57  vital records jurisdictions that collect, process, and issue vital records in  the United States. Vital records jurisdictions review, edit, process, and  officially register births and deaths based on information submitted to  them by various parties. The jurisdictions are then responsible for  maintaining registries of such vital events and for issuing certified copies  of birth and death records. NAPHSIS has worked to promote the adoption  of electronic death registration systems and is developing an online tool  that federal agencies and others may use to verify birth and death  certificate information.
section_title: Thomson Reuters Corporation
paragraphs: Thomson Reuters Corporation is a public company and a multinational  media and information firm that sells data services to its customers.  Among these data services is the Thomson Reuters CLEAR data product,  which allows users to search both public and proprietary records as part  of research or investigations. According to representatives from Thomson  Reuters, the CLEAR data service is used predominately in the law  enforcement and inspector general communities for investigative  purposes.
section_title: Dun & Bradstreet Corporation (D&B)
paragraphs: D&B is a public company that provides both public and commercial data  and data analytics services to its customers. The federal government  has contracted with D&B since 1978 to provide Data Universal  Numbering System (DUNS) identification numbers for all government  contractors. A DUNS number is a unique nine-digit number that is  assigned to every business entity in D&B’s global business database,  which according to D&B contains more than 240 million records. In  addition to the right to use DUNS numbers as a unique identification  number, the General Services Administration (GSA) also contracts with  D&B to provide business information and related services on all existing  and potential government contractors and awardees. This information is  linked to the business entity through the DUNS number. The DUNS  number and associated business information are owned and controlled by  D&B, but licensed to the government to be used for selected federal  award management purposes.
section_title: Selected Federal Agencies Report Using Commercial Data Services to Access Data and Improve the Efficiency of Program Integrity Activities
paragraphs: Officials from SSA, the Department of Labor (DOL), the U.S. Department  of Homeland Security (DHS), GSA, and IRS told us that using commercial  data services can help their agencies to access proprietary private sector  data that are not available from government sources and improve the  efficiency of program integrity activities. Commercial bank account  information from private financial institutions may not be available from  government sources, and this proprietary private sector information may  help a federal agency to identify improper payments. For example, as part  of SSA’s Access to Financial Institutions initiative, SSA contracts with  Accuity to use its Asset Verification Solution to electronically search for  account ownership and balances at financial institutions, such as  commercial bank accounts where Supplemental Security Income (SSI)  program recipients have a direct deposit account. These searches can  provide SSA with independent data on a recipient’s financial institution  accounts when a new SSI claim is filed or when the agency periodically  redetermines program eligibility for some SSI recipients.
Similarly, in August 2012 DOL contracted with Accuity for a pilot project  that explored how accessing data from commercial financial institutions,  which are not available from a government source, could help detect and  prevent overpayments in the Unemployment Insurance (UI) program. The  pilot project tested whether obtaining financial transaction data—such as  deposits that could represent wages from work—through a data match  with commercial financial institutions would allow three states to more  accurately determine whether UI claimants had returned to work and  therefore may no longer have been eligible for UI benefits. The results of  this pilot indicated a significant increase in the number of UI claimants  detected with unreported income, translating into a more than $80 million  increase in the amount of potential improper payments identified during  the 15-month period of the pilot project. However, in January 2015,  Accuity and its project partner informed DOL that it no longer wished to  participate in the project, absent legislation compelling the financial  institutions to do so. DOL officials we spoke with during our review  indicated that they are currently exploring a new pilot to use wage data  from another commercial data service provider to identify improper UI  payment stemming from unreported income from work.
Additionally, officials from DOL, DHS, and GSA as well as representatives  of the commercial data service providers told us that, while some data  sets they obtain are available from federal agencies, some federal  agencies likely could not provide the level of data service they receive  from commercial data service providers without making significant  investments in various data service activities. These various data service  activities include collecting, maintaining, and verifying data from both  public and proprietary sources; providing IT infrastructure; providing  data analytics services; and providing user-friendly interfaces and output,  among other activities. Consequently, officials from these agencies  speculated that relying on these commercial data service providers likely  costs their agencies less than if they attempted to provide a similarly  extensive data service using only agency resources.
Using commercial data may also help realize efficiencies by freeing up  agency staff to perform other mission-oriented work. For example, IRS  officials told us that using commercial data service providers to provide  web and phone-based services to help authenticate certain taxpayers’  identities allowed their staff to focus on other work rather than deal with  large volumes of in-person requests for identity authentication. IRS’s  Taxpayer Protection Program reviews suspicious returns flagged by IRS’s  identity theft filters and requires taxpayers to confirm their identities  before IRS issues a refund. To do this, IRS asks authentication questions  about personal information that only the taxpayer should know, such as:  “Who is your mortgage lender?” or “Which of the following is your  previous address?” IRS’s Taxpayer Protection Program database  includes data from LexisNexis and Equifax. If the individual’s identity  cannot be authenticated, IRS removes the tax return from processing, an  action designed to prevent the agency from issuing a fraudulent tax  refund. The IRS officials we spoke with indicated that using these web  and phone based services likely required fewer IRS resources than  authenticating identities in person at an IRS office. Further, the IRS  officials we spoke with as part of this review also stated that using  commercial data services to provide web and phone-based services to  authenticate taxpayers’ identities may reduce the burden on taxpayers  who live far from an IRS office or are otherwise unable to visit an office in  person.
section_title: Selected Agencies Consider Factors Such as Completeness and Accuracy When Determining Whether Data from Commercial Data Services Meet Information Requirements for Program Integrity Activities
paragraphs: Factors agencies may consider in determining whether data from  nongovernmental data services meet their information requirements for  conducting program integrity activities include the accuracy of data; the  currency and timeliness of data; the completeness of data; and technical  aspects of using the data for these purposes, according to officials we  spoke with. As mentioned, our work was based on a nonprobability  sample of agencies and nongovernmental entities, and the information  and perspectives that we obtained are not generalizable to other federal  agencies and data service providers.
subsections: section_title: Agencies May Consider the Accuracy of Data and Related Laws and Policies When Conducting Program Integrity Activities
paragraphs: Officials from DOL, SSA, and DHS told us that these federal agencies  consider the accuracy of data and related laws and policies when  determining whether commercial data meet their information  requirements for conducting program integrity activities. For example,  DOL officials noted that individuals who are legitimately eligible for federal  programs could be unfairly denied program benefits if agencies rely on  inaccurate data to make a determination about their eligibility for a  program. SSA officials stated that using less accurate data in making  eligibility and payment determinations could also place undue burdens on  applicants and payment recipients and increase the agency’s appeals  workload, which could create inefficiencies in the agency’s program  integrity efforts. At the same time, representatives of some commercial  data service providers we spoke with stated that they work continuously  to ensure the accuracy of their data, but also acknowledged that it is  unreasonable to expect all data to be perfectly accurate.
As part of our review, OMB staff described provisions of the Computer  Matching and Privacy Protection Act of 1988 (“Computer Matching Act”)  designed to mitigate the risk of agencies using inaccurate data in  conducting program integrity activities. Specifically, OMB staff noted that  the Computer Matching Act generally requires that agencies  independently verify information produced through data matching and  provides due process rights to individuals whose benefits may be affected  by the data obtained through computer matching activities. OMB staff  emphasized that agencies must consider relevant provisions of the  Computer Matching Act when using commercial data to conduct program  integrity activities.
Additionally, DHS and DOL officials cited agency policies designed to  ensure that officials verify data obtained from commercial data sources  before making final program determinations. For example, officials from  DHS’s United States Citizenship and Immigration Services provided us  with a document of their standard operating procedure that requires  officers investigating immigration benefit fraud—such as fraud committed  to obtain a visa—to provide adjudicators with original source documents  rather than summarizing information contained in commercial databases.  These DHS officials stated that they use information from commercial  data sources such as LexisNexis and Thomson Reuters CLEAR as  “leads” to original or primary sources rather than as the basis for making  final program determinations. Similarly, DOL officials told us that they  issued an advisory to the state workforce agencies that administer UI  payments citing the need to independently verify information received  through various analytic techniques before suspending, terminating,  reducing, or making a final denial of UI benefits.
section_title: Agencies May Consider How the Currency and Timeliness of Data Affect Their Program Integrity Activities
paragraphs: Officials from DHS, DOL, and SSA told us these federal agencies  consider how the currency and timeliness of data obtained through  commercial data services meet their information requirements for  conducting program integrity activities. For example, DHS officials told us  that outdated information, such as a name or address that may have  been previously, but not currently, associated with an individual, could  hinder the efficiency of tracking down that individual. Similarly,  representatives from some commercial data service providers we spoke  with described the need for data to be up-to-date, such as by continually  updating information on whether entities are still in business or have  changed addresses. These representatives described steps they take to  do so, such as by electronically and manually verifying information in their  databases on a regular basis.
Moreover, the timeliness of data can be an important factor in identifying  and preventing improper payments. For example, DOL officials told us  that state UI agencies could likely improve their ability to identify and  prevent improper UI payments to claimants who return to work by  obtaining wage data from Equifax’s Work Number system, which are  generally more recent than quarterly wage data that UI agencies receive  from employers. Specifically, the officials noted that state UI agencies  currently rely on wage data from employers that are usually reported on a  quarterly basis, while Equifax’s Work Number data can be obtained on a  “real time” basis corresponding to the weekly, biweekly, or monthly pay  period of the employer. Because a significant proportion of overpayments  in the UI program occur because individuals return to work without  notifying the state workforce agency that administers those benefits,  obtaining these data may be an opportunity for UI agencies to improve  their efforts to reduce UI improper payments, according to DOL officials.  In April 2016, DOL officials told us that the agency is currently working  with three states and Equifax to conduct a pilot project to examine the use  of Equifax’s Work Number data to identify improper payments to UI  recipients with disqualifying income from work. The DOL officials expect  the pilot project to last for up to 4 months.
Similarly, a provision of the Social Security Benefit Protection and  Opportunity Enhancement Act of 2015, which goes into effect in  November 2016, authorizes SSA to enter into data exchanges with  payroll providers, such as Equifax’s Work Number system, to help  prevent improper Disability Insurance and SSI payments to individuals  with relevant work and income by helping SSA access timely information  on wages and income. SSA’s preliminary cost estimates, which were  prepared before the enactment of the legislation, suggest that the agency  would realize savings by accessing and using wage data from  commercial databases. However, the SSA officials we spoke with also  stated that because the agency’s savings estimates were completed prior  to actual implementation planning and before the Social Security Benefit  Protection and Opportunity Enhancement Act became law, they expect  the estimates to change as the agency implements provisions of the Act.
section_title: Agencies May Consider the Completeness of Data When Conducting Program Integrity Activities
paragraphs: Officials from SSA told us that they also consider the completeness of  data from various governmental and commercial sources when  determining whether data meet their information requirements for  conducting program integrity activities. For example, death data can help  agencies to prevent improper payments to deceased individuals, but the  completeness of death data varies depending on the source. For  example, SSA receives death reports from multiple sources, including  state vital records agencies, family members, and other federal agencies  in order to administer its programs. During our review, SSA officials told  us that obtaining death data helps them to prevent around $50 million in  improper payments each month. In accordance with the Social Security  Act, SSA shares its full set of death data with certain agencies that pay  federally funded benefits, for the purpose of ensuring the accuracy of  those payments. For other users of SSA’s death data, including  commercial data service providers, SSA extracts a subset of records into  a file called the Death Master File (DMF), which, to comply with federal  law, excludes state-reported death data. Agencies and commercial data  service providers can purchase a DMF subscription through the  Department of Commerce’s National Technical Information Service,  which reimburses SSA for the cost of providing the file. However, the  death information included in the publicly available DMF is less complete  than the death information contained in SSA’s full death file because the  publicly available DMF does not include state-reported death information.  Further, during our review, SSA officials said they expect the percentage  of state-reported deaths as a proportion of all of SSA’s death records to  increase, which over time will lead to a smaller portion of all of SSA’s  death records being included on the DMF. In that scenario, federal, state,  or local agencies that use death data from the DMF will receive  increasingly less complete and therefore less useful information than  agencies that use death data from SSA’s full death file.
While SSA has a role collecting and distributing death records as  described above, SSA officials told us that the most important step in  ensuring the quality and completeness of their death records would be for  all vital records agencies to use electronic death registration systems.  According to SSA officials, electronic death registration systems automate  the death reporting process and allow vital records agencies to verify the  name and Social Security Number of a deceased individual before they  issue the death certificate or transmit a report of death to SSA. As of  November 2015, 46 of 57 vital records agencies have implemented  electronic death registration systems, according to NAPHSIS. NAPHSIS  and SSA officials told us that they are continuing efforts to expand  electronic death record reporting, and NAPHSIS officials cited the need  for additional funding to facilitate the adoption and use of electronic data  registration systems by all 57 jurisdictions. Additionally, NAPHSIS is  developing an online tool that may provide agencies the ability to access  death information maintained by vital statistics agencies, which could  provide federal agencies access to a more complete set of death records  than SSA’s full death file. However, at the time of this report, this tool is  in a preliminary testing phase, and no federal agencies currently access  the system.
section_title: Agencies May Consider Technical Aspects of Commercial Data Services When Conducting Program Integrity Activities
paragraphs: Officials from IRS, SSA, and GSA told us that federal agencies also  consider technical aspects of commercial data services when determining  whether commercial data meet their information requirements for  conducting program integrity activities, such as restrictions on batch  versus manual data processing. For example, IRS officials told us that  large-scale, batch processing can be more efficient than manual, case- by-case processing, which would be unfeasible for analyses involving  large populations or large amounts of data from various sources. The IRS  officials noted that the agency determined that some potential data  service providers could not meet their requirements because the potential  providers’ processing capability was limited to manual or case-by-case  processing. Similarly, SSA officials stated that data providers may place  restrictions on whether agencies can access and process data on a  manual, case-by-case basis or in batches, and these restrictions can  affect the efficiency of their program integrity activities. For example, SSA  officials noted that batch processing could save operational and  administrative resources compared to case-by-case or manual database  searches for its SSI program. The SSA officials stated that their current  process involves staff requesting data on a single case basis, reviewing  the response, and transcribing information into the agency’s case  processing system. According to SSA officials, batch processes would  afford technicians more time to focus on other critical agency workloads.  Additionally, SSA officials stated that routine batch processes would  potentially allow the agency to detect unreported income and resources  before an improper payment is made, which could save administrative  resources on the back end related to processing improper payments.
Commercial data service providers may also place restrictions on how  agencies can use data. For example, D&B’s DUNS—a proprietary,  unique identifier for businesses—helps the federal government track  entities across various data systems, but D&B has placed restrictions on  how GSA can use the data. During our review, officials from GSA noted  that using D&B’s proprietary DUNS number allowed the federal  government to track contracts, grants, awards, and other business with  that entity across various agencies and data systems, which can help  identify “bad actors” that are barred from holding federal contracts.  However, due to the proprietary nature of DUNS numbers, D&B has  placed restrictions on how GSA can use them. These restrictions limit  the purposes for which the government can use the data and hampers  the ability to switch to a new numbering system. The federal government  is currently exploring alternatives to the DUNS, but GSA officials noted  that the costs of switching to a new unique numbering system across all  government information systems were unknown.
Representatives of one data service provider told us that their customers  may also consider issues related to the infrastructure needed to conduct  large-scale, data-intensive program integrity activities when determining  whether commercial data meet its information requirements. Specifically,  NAPHSIS representatives stated that, at the conclusion of their current  testing phase, NAPHSIS may need to expand its infrastructure to  accommodate increased data traffic for its online tool that federal  agencies and others may use to verify death information. The NAPHSIS  officials we spoke with stated that they were partnering with LexisNexis  Risk Solutions on this project, which required significant investments from  both parties. According to NAPHSIS officials, NAPHSIS is also in the  process of upgrading software and hardware at some vital statistics  agencies to support its online tool. As mentioned, this tool is in a  preliminary testing phase and no federal agencies currently access the  system.
Additionally, agency officials may consider the design of software  associated with a data service when determining whether commercial  data meet their information requirements for conducting program integrity  activities, as illustrated by an example from prior GAO work. In June  2015, we reported that we examined practice location addresses of  providers and suppliers listed in Centers for Medicare & Medicaid  Services (CMS) data and found that an estimated 23,400 (22 percent) of  105,234 were potentially ineligible. Potentially ineligible addresses  include those that are associated with a certain type of a Commercial Mail  Receiving Agency (CMRA) or vacant or invalid addresses. To do this,  we used a software package that provides more detailed information on  provider practice location addresses than that used by CMS. To help  improve the Medicare provider and supplier enrollment-screening  procedures, we recommended in June 2015 that that the Acting  Administrator of CMS modify the CMS software integrated into CMS data  to include specific flags to help identify potentially questionable practice  location addresses, such as CMRA, vacant, and invalid addresses. In its  comments on the June 2015 report, the Department of Health and Human  Services (HHS) agreed with our recommendation and noted plans to  configure the provider and supplier address-verification system in CMS  data to flag CMRAs, vacancies, invalid addresses, and other potentially  questionable practice locations. Because HHS has not yet initiated  specific actions to implement our recommendations, it is too early for us  to determine whether the actions the agency outlined in its official  comments on a draft of that report would fully address the intent of the  recommendations. However, if effectively implemented, the actions could  prevent ineligible providers from enrolling into the Medicare program and  obtaining Medicare funds, thus potentially reducing the amount of  improper payments. We plan to continue to monitor the agency’s efforts in  this area.
section_title: Agency Comments
paragraphs: We are not making recommendations in this report. We provided a draft  of this report to OMB, GSA, DOL, IRS, SSA, DHS, and Fiscal Service for  review and comment. OMB provided comments, which are reproduced in  appendix I, that describe ongoing efforts to use data analytics for federal  program integrity efforts. GSA and DOL provided technical comments,  which we incorporated as appropriate. IRS, SSA, DHS, and Fiscal  Service had no comments on this report.
We are sending copies of this report to the Commissioner of the Bureau  of the Fiscal Service, the Administrator of GSA, the Secretary of  Homeland Security, the Commissioner of Internal Revenue, the Secretary  of Labor, the Director of OMB, the Commissioner of Social Security, and  other interested parties. In addition, the report will be available at no  charge on the GAO website at http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-6722 or larink@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix II.
section_title: Appendix I: Comments from the Office of Management and Budget
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above Jennifer Cook, Marcus Corbin,  Gabrielle Fagan (Assistant Director), Colin Fallon, Michele Fejfar, Barbara  Lewis, Maria McMullen, James Murphy, Jonathon Oldmixon, and Anna  Maria Ortiz made key contributions to this report.