Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States
Published: 2009-09-09T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: One significant cost to Medicaid is prescription drugs, which accounted for over $23 billion in fiscal year (FY) 2008, or about 7 percent of total Medicaid outlays. Many of these drugs are susceptible to abuse and include pain relievers and stimulants that are on the Drug Enforcement Administration's (DEA) Schedule of Controlled Substances. As part of the American Recovery and Reinvestment Act of 2009 (ARRA), the Medicaid program will receive about $87 billion in federal assistance based on a greater federal share of Medicaid spending. GAO was asked to determine (1) whether there are indications of fraud and abuse related to controlled substances paid for by Medicaid; (2) if so, examples of fraudulent, improper, and abusive activity; and (3) the effectiveness of internal controls that the federal government and selected states have in place to prevent fraud and abuse related to controlled substances. To meet these objectives, GAO analyzed Medicaid controlled substance claims for fraud and abuse indications for FY 2006 and 2007 from five selected states. GAO also interviewed federal and state officials and performed investigations.
section_title: What GAO Found
paragraphs: GAO found tens of thousands of Medicaid beneficiaries and providers involved in potential fraudulent purchases of controlled substances, abusive purchases of controlled substances, or both through the Medicaid program in California, Illinois, New York, North Carolina, and Texas. About 65,000 Medicaid beneficiaries in the five selected states acquired the same type of controlled substances from six or more different medical practitioners during fiscal years 2006 and 2007 with the majority of beneficiaries visiting from 6 to 10 medical practitioners. Such activities, known as doctor shopping, resulted in about $63 million in Medicaid payments and do not include medical costs (e.g., office visits) related to getting the prescriptions. In some cases, beneficiaries may have justifiable reasons for receiving prescriptions from multiple medical practitioners, such as visiting specialists or several doctors in the same medical group. However, GAO found that other beneficiaries obtained these drugs to support their addictions or to sell on the street. In addition, GAO found that Medicaid paid over $2 million in controlled substance prescriptions during fiscal years 2006 and 2007 that were written or filled by 65 medical practitioners and pharmacies barred, excluded, or both from federal health care programs, including Medicaid, for such offenses as illegally selling controlled substances. Finally, GAO found that according to Social Security Administration data, pharmacies filled controlled substance prescriptions of over 1,800 beneficiaries who were dead at that time. GAO performed in-depth investigations on 25 Medicaid cases and found fraudulent, improper, or abusive actions related to the prescribing and dispensing of controlled substances. These investigations uncovered other issues, such as doctors overprescribing medication and writing controlled substance prescriptions without having required DEA authorization. States are primarily responsible for the fight against Medicaid fraud; however, the selected states did not have a comprehensive fraud prevention framework to prevent fraud and abuse of controlled substances. CMS is responsible for overseeing state fraud and abuse control activities but has provided limited guidance to the states to prevent fraud and abuse of controlled substances.

section_title: Letter
paragraphs: Medicaid is a joint federal-state program that finances health care for  certain categories of low-income individuals, including children, families,  persons with disabilities, and persons who are elderly. The federal  government matches state spending for Medicaid services according to a  formula based on each state’s per capita income in relation to the national  average per capita income. The amount of federal assistance states receive  for Medicaid service expenditures is known as the Federal Medical  Assistance Percentage (FMAP).
As part of the American Recovery and Reinvestment Act of 2009,  Congress recently increased the federal share of the FMAP for eligible  states through December 2010. Generally, for fiscal year 2009 through the  first quarter of fiscal year 2011, the increased FMAP, which is calculated  on a quarterly basis, provides for (1) the maintenance of states’ prior year  FMAPs; (2) a general across-the-board increase of 6.2 percentage points in  states’ FMAPs; and (3) a further increase to the FMAPs for those states  that have a qualifying increase in unemployment rates. The estimated total  increase in the federal share of Medicaid spending is about $87 billion. One  significant cost to the Medicaid program is prescription drugs. During  fiscal year 2008, prescription drugs accounted for over $23 billion of the  costs in the Medicaid program, or about 7 percent of total federal and state  Medicaid outlays.
Prescription drug abuse is a serious and growing public health problem.  According to the Centers for Disease Control and Prevention drug  overdoses, including those from prescription drugs, are the second leading  cause of deaths from unintentional injuries in the United States, exceeded  only by motor vehicle fatalities. Unlike addiction to heroin and other drugs  that have no accepted medical use, addiction to some controlled  substances can be financed by insurance and public programs such as  Medicaid. There are reports and allegations that criminals and drug  abusers are able to illegitimately acquire controlled substances by filing  fraudulent Medicaid claims, seeking treatment from medical practitioners  for feigned injuries and illnesses, and perpetrating other fraudulent  activities. The cost associated with controlled substance fraud and abuse  is more than the cost of drug purchases since there are related medical  services, such as doctor and emergency room visits, that precede the  dispensing of these medications. Several criminal cases highlight Medicaid  fraud and abuse related to controlled substances.
An Ohio physician was convicted in 2006 for filing $60 million in  fraudulent Medicaid, Medicare, and other insurance claims. The  physician, a pain management specialist, prescribed multiple injections  of controlled substances for his patients. He then billed Medicaid and  the other insurance plans for those treatments. The physician was  found to have fostered an addiction to controlled substances in his  patients so that he could profit from their habit and increase the  income he received from their medical claims. Two patients who  regularly saw him died under his care, one from a multiple-drug  overdose in the physician’s office and one from an overdose of  OxyContin taken on the same day that the prescription was written.  The physician was sentenced to life in prison.
In 2006, a Florida physician was sentenced to life in prison following  his conviction on multiple charges, including wire fraud, illegal  distribution of controlled substances, and Medicaid fraud. The  physician, a general practitioner, wrote excessive prescriptions to  patients for controlled substances without giving them physical  examinations or additional follow-up treatments. The physician  directed patients to have their prescriptions filled at specific  pharmacies and warned them against filling their prescriptions at  pharmacies that would ask too many questions about the quantity and  combination of controlled substances prescribed. In fact, the physician  was found to have known some of his patients were addicts feeding  their drug habits. Five of his patients died from taking drugs he  prescribed.
During 2004 to 2005, a pharmacist created false telephone  prescriptions for Vicodin, an addictive narcotic pain reliever that  combines hydrocodone and acetaminophen, and provided thousands  of the pills to at least two purported customers. The pharmacist also  submitted false claims for the drugs to Medicaid and other insurance  companies, stating that they were prescribed for legitimate patients.  The customers were actually friends of the pharmacist who sold the  drugs and split the profits with him. In 2009, the pharmacist was  convicted of health care fraud, Medicaid fraud, and distribution of  dangerous controlled substances.
You asked us to determine whether there is fraud and abuse related to  controlled substances in the Medicaid program. Specifically, this report  discusses (1) continuing indications of fraud and abuse related to  controlled substances paid for by Medicaid; (2) specific case study  examples of fraudulent, improper, and abusive controlled substance  activity; and (3) the effectiveness of internal controls that the federal  government and selected states have in place to prevent and detect fraud  and abuse related to controlled substances.
To identify whether there are continuing indications of fraud and abuse  related to controlled substances paid for by Medicaid, we obtained and  analyzed Medicaid claims paid in fiscal years 2006 and 2007 from five  states: California, Illinois, New York, North Carolina, and Texas.  Prescription drug payments to these states constituted over 40 percent of  all Medicaid prescription drug payments made during fiscal years 2006 and  2007. These states were primarily selected based on the magnitude of  Medicaid payments for prescription drugs. To identify indications of fraud  and abuse related to controlled substances paid for by Medicaid, we  obtained Medicaid prescription claims data for these five states from the  Centers for Medicare & Medicaid Services (CMS). For indications of  doctor shopping, we selected 10 types of controlled substances and the  criteria of using at least six different medical practitioners based on our  review of drug diversion literature and discussions with a criminal  investigator whose recognized expertise is drug diversion. To determine  the total number of different prescribers a beneficiary visited, we  identified and totaled the number of different prescribers shown on each  beneficiary’s claims data. Because the Medicaid prescription claims  databases did not track doctors who practiced in groups, we could not  determine the amount of duplication caused by this factor. To identify  other potential fraud and improper payments, we compared the  beneficiary and prescriber shown in the Medicaid claims data to the death  master files from the Social Security Administration (SSA) to identify  deceased beneficiaries and prescribers. To identify claims that were  improperly processed and paid by the Medicaid program because the  federal government had banned these prescribers and pharmacies from  prescribing or dispensing to Medicaid beneficiaries, we compared the  Medicaid prescription claims to the exclusion and debarment files from  the Department of Health and Human Services’ (HHS) Office of Inspector  General (OIG) and the General Services Administration (GSA).
To develop specific case study examples in selected states, we identified  25 cases that illustrate the types of fraudulent, improper, and abusive  controlled substance activity we found in the Medicaid program. To  develop these cases, we interviewed pharmacy employees, prescribers,  law enforcement officials, and beneficiaries, as appropriate. We also  obtained and reviewed registration and enforcement action reports from  the Drug Enforcement Administration (DEA) and HHS.
To identify the effectiveness of internal controls that the federal  government and selected states have in place to prevent and detect fraud  and abuse related to controlled substances, we interviewed Medicaid  officials from the selected state offices and CMS. In addition, we obtained  and reviewed the appropriate policies and procedures related to  controlled substances at the selected states. As part of this review, we  identified the types of investigations and audits performed by the state  Medicaid Fraud Control Units (MFCU) and the state Medicaid offices of  inspector general.
To determine the reliability of the data in Medicaid claims and exclusion  and debarment files from HHS OIG and GSA, we interviewed officials  responsible for their respective databases. In addition, we performed  electronic testing to determine the validity of specific data elements in the  databases that we used to perform our work. Based on our discussions  with agency officials and our own testing, we concluded that the data  elements used for this report were sufficiently reliable for our purposes.
We conducted this forensic audit from July 2008 to September 2009 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives. We conducted our related investigative  work in accordance with standards prescribed by the Council of the  Inspectors General on Integrity and Efficiency.
subsections: section_title: Background
subsections: section_title: Medicaid
paragraphs: Title XIX of the Social Security Act establishes Medicaid as a joint federal- state program to finance health care for certain low-income, aged, or  disabled individuals. Medicaid is an entitlement program, under which the  federal government is obligated to pay its share of expenditures for  covered services provided to eligible individuals under each state’s  federally approved Medicaid plan. States operate their Medicaid programs  by paying qualified health care providers for a range of covered services  provided to eligible beneficiaries and then seeking reimbursement for the  federal share of those payments.
Although the federal government establishes broad federal requirements  for the Medicaid program, states can elect to cover a range of optional  populations and benefits. CMS, within HHS, is responsible for  administering legislation and regulations affecting the Medicaid program,  including disbursement of federal matching funds. CMS also provides  guidelines, technical assistance, and periodic assessments of state  Medicaid programs.
Title XIX of the Social Security Act allows flexibility in the states’ Medicaid  plans. Guidelines established by federal statutes, regulations, and policies  allow each state some flexibility to (1) broaden its eligibility standards;   (2) determine the type, amount, duration, and scope of services; (3) set the  rate of payment for services; and (4) administer its own program,  including enrollment of providers and beneficiaries, processing and  monitoring of medical claims, payment of claims, and maintenance of  fraud prevention programs.
Controlled Substances Act  The Controlled Substances Act of 1970 (CSA) established a classification  structure for certain drugs and chemicals used in drug manufacturing.  Controlled substances are classified into five schedules on the basis of  their currently accepted medical use and potential for abuse and  dependence. Schedule I drugs—including heroin, marijuana, and  hallucinogens such as LSD—have a high potential for abuse, no currently  accepted medical uses in treatment in the United States, and a lack of  accepted safety for use under medical supervision. Schedule II drugs— including methylphenidate (Ritalin) and opiates such as morphine and  oxycodone—have high potential for abuse and abuse may lead to severe  psychological or physical dependence, but have currently accepted  medical uses. Drugs on Schedules III through V have medical uses and  successively lower potentials for abuse and dependence. Schedule III  drugs include anabolic steroids, codeine, hydrocodone in combination  with aspirin or acetaminophen, and some barbiturates. Schedule IV  contains such drugs as the anti-anxiety medications diazepam (Valium)  and alprazolam (Xanax). Schedule V includes preparations such as cough  syrups with codeine. All drugs but those in Schedule I are legally available  to the public with a prescription.
CSA mandates that DEA establish a closed system of control for  manufacturing, distributing, and dispensing controlled substances. Any  person who manufactures, dispenses, imports, exports, or conducts  research with controlled substances must register with DEA (unless  exempt), keep track of all stocks of controlled substances, and maintain  records to account for all controlled substances received, distributed, or  otherwise disposed of. Although all registrants, including pharmacies, are  required to maintain records of controlled substance transactions, only  manufacturers and distributors are required to report their Schedule I and  II drugs and Schedule III narcotics drug transactions,  including sales to  the retail level, to DEA. The data provided to DEA are available for use in  investigations of illegal diversions. The act does not require pharmacies to  report dispensing information at the patient level to DEA.
section_title: Fraud, Waste, and Abuse of Controlled Substances in Medicaid Program in Selected States
paragraphs: We found tens of thousands of Medicaid beneficiaries and providers  involved in potential fraudulent, wasteful, and abusive purchases of  controlled substances through the Medicaid program in the selected states  during fiscal years 2006 and 2007. The fraud, waste, and abuse activities  that we examined in our analysis include the following: beneficiaries  acquiring addictive medication from multiple medical practitioners,  known as doctor shopping, to feed their habits, sell on the street, or both;  medical practitioners and pharmacies barred from receiving federal funds  nevertheless writing and filling Medicaid prescriptions; and prescriptions  being paid for with Medicaid funds for dead beneficiaries and for  prescriptions attributed to dead doctors by pharmacies.
subsections: section_title: Tens of Thousands of Medicaid Beneficiaries Visit Multiple Medical Practitioners to Obtain Controlled Substances
paragraphs: Approximately 65,000 Medicaid beneficiaries in the five states investigated  visited six or more doctors to acquire prescriptions for the same type of  controlled substances in the selected states during fiscal years 2006 and  2007. These individuals incurred approximately $63 million in Medicaid  costs for these drugs, which were painkillers, sedatives, and stimulants.  In some cases, beneficiaries may have justifiable reasons for receiving  prescriptions from multiple medical practitioners, such as visiting  specialists or several doctors in the same medical group. However, our  analysis of Medicaid claims found that at least 400 of them visited 21 to  112 medical practitioners and up to 46 different pharmacies for the same  controlled substances. In these situations, Medicaid beneficiaries were  likely seeing several medical practitioners to support and disguise their  addiction or to obtain drugs to fraudulently sell.
Our analysis understates the number of instances and dollar amounts  involved in the potential abuse related to multiple medical practitioners.  First, the total we found does not include related costs associated with  obtaining prescriptions, such as visits to the doctor’s office and emergency  room. Second, the selected states did not identify the prescriber for many  Medicaid claims submitted to CMS. Without such identification, we could  not always identify and thus include the number of unique doctors for  each beneficiary who received a prescription. Third, our analysis did not  focus on all controlled substances, but instead targeted 10 types of the  most frequently abused controlled substances, as shown in table 1.
Table 2 shows how many beneficiaries received controlled substances and  the number of medical practitioners who prescribed them the same type of  drug.
section_title: Controlled Substances Prescribed or Filled by Banned Providers
paragraphs: We found that 65 medical practitioners and pharmacies in the selected  states had been barred from federal health care programs, excluded from  these programs, or both, including Medicaid, when they wrote or filled  Medicaid prescriptions for controlled substances during fiscal years 2006  and 2007. Nevertheless, Medicaid approved the claims at a cost of  approximately $2.3 million. The offenses that led to their banishment from  federal health programs included Medicaid fraud and illegal diversion of  controlled substances. Our analysis understates the total number of  excluded providers because the selected states either did not identify the  prescribing medical practitioner for many Medicaid claims (i.e., the field  was blank) or did not provide the taxpayer identification number for the  practitioner, which was necessary to determine if a provider was banned.
The banned providers we identified had been placed on one or both of the  following exclusion lists, which Medicaid officials must check before  paying for a prescription claim: the List of Excluded Individuals/Entities  (LEIE), managed by HHS, and the Excluded Parties List System (EPLS),  managed by GSA. The LEIE provides information on health care providers  that are excluded from participation in Medicare, Medicaid, and other  federal health care programs because of criminal convictions related to  Medicare or state health programs or other major problems related to  health care (e.g., patient abuse or neglect). The EPLS provides information  on individuals or entities that are debarred, suspended, or otherwise  excluded from participating in any other federal procurement or  nonprocurement activity. Federal agencies can place individuals or  entities on the GSA debarment list for a variety of reasons, including fraud,  theft, bribery, and tax evasion.
section_title: Medicaid Paid for Controlled Substance Prescriptions Filled for Dead Beneficiaries or “Written” by Dead Doctors
paragraphs: Our analysis of matching Medicaid claims in the selected states with SSA’s  Death Master File (DMF) found that controlled substance prescription  claims to over 1,800 beneficiaries were filled after they died. Even though  the selected state programs assured us that beneficiaries were promptly  removed from Medicaid following their deaths based on either SSA DMF  matches or third-party information, these same state programs paid over  $200,000 for controlled substances during fiscal years 2006 and 2007 for  postdeath controlled substance prescription claims. In addition, our  analysis also found that Medicaid paid about $500,000 in Medicaid claims  based on controlled substance prescriptions “written” by over 1,200  doctors after they died.
The extent to which these claims were paid because of fraud is not known.  For example, in the course of our work, we found that certain nursing  homes use long-term care pharmacies to fill prescriptions for drugs. One  long-term care pharmacy dispensed controlled substances to over 50  beneficiaries after the dates of their deaths because the nursing homes did  not notify the pharmacy of their deaths before delivery of the drugs. The  nursing homes that received the controlled substances, which included  morphine, Demerol, and Fentanyl, were not allowed to return them  because, according to DEA officials, CSA does not permit such action.  Officials at two selected states said that unused controlled substances at  nursing homes represent a waste of Medicaid funds and also pose risk of  diversion by nursing home staff. In fact, officials from one state said that  the certain nursing homes dispose of these controlled substances by  flushing them “down the toilet,” which also poses environmental risks to  our water supply.
section_title: Examples of Fraud, Waste, and Abuse of Controlled Substances in Medicaid
paragraphs: In addition to performing the aggregate-level analysis discussed above, we  also performed in-depth investigations for 25 cases of fraudulent,  improper, and abusive actions related to the prescribing and dispensing of  controlled substances through the Medicaid program in the selected  states. Table 3 shows a breakdown of the types of cases that we identified  from our analysis and confirmed through our investigations.
In the course of our investigation, as we pursued leads produced from our  data mining, we also found two other types of fraudulent, improper, and  abusive actions, as shown in table 4.
As noted in table 4, we are highlighting six examples where a doctor’s  DEA registration did not authorize the doctor to prescribe a particular  schedule of controlled substance. Under CSA, controlled substances are  classified into five schedules based on the extent to which the drugs have  an accepted medical use and their potential for abuse and degree of  psychological or physical dependence. Schedule II includes what are  considered by DEA to be the most addictive and abused drugs that legally  can be prescribed. Schedule V, meanwhile, covers those that are least  likely to cause such problems.
Each provider must obtain a valid registration from DEA that reflects the  schedule(s) of controlled substances the provider is authorized to store,  dispense, administer, or prescribe. For example, if a physician wants the  authority to prescribe Schedule II drugs, the physician must register and  be granted authority by DEA to do so.
As noted in table 4, we also found two cases where the physician  prescribed controlled substances in excess of medical need. In one of  these cases, our investigators found that the physician prescribed a  controlled substance in a manner intended to circumvent Medicaid’s  dosage limitations. In the other, the beneficiary sold excess controlled  substances (in this case, painkillers).
Table 5 summarizes 15 of the 25 cases we developed of fraudulent,  improper, and abusive controlled substance activities in the Medicaid  program. Appendix I provides details on the other 10 cases we examined.  We have referred certain cases to DEA and the selected states for further  criminal investigation.
The following provides illustrative detailed information on four cases we  investigated.
Case 2: The beneficiary used the identity of an individual who was  killed in 1980 to receive Medicaid benefits. According to a state  Medicaid official, he originally applied for Medicaid assistance at a  California county in January 2004. During the application process, the  man provided a Social Security card to a county official. When the  county verified the SSN with SSA, SSA responded that the SSN was not  valid. The county enrolled the beneficiary into Medicaid provisionally  for 90 days under the condition that the beneficiary resolve the SSN  discrepancy with SSA within that time frame. Although the beneficiary  never resolved the issue, he remained in the Medicaid program until  April 2007. From 2004 through 2007, the Medicaid program paid for  over $200,000 in medical services. This included at least $2,870 for  controlled substances that he received from the pharmacies. We  attempted to locate the beneficiary but could not locate him.
Case 8: The physician prescribed controlled substances to the  beneficiary after she died in February 2006. The physician stated that  the beneficiary had been dying of a terminal disease and became  unable to come into the office to be examined. The physician stated  that in instances where a patient is compliant and needs pain  medication, physicians will sometimes prescribe it without requiring  an examination. A pharmacy eventually informed the physician that  the patient had died and the patient’s spouse had continued to pick up  her prescriptions for Methadone, Klonopin, and Xanax after her death.  According to the pharmacy staff, the only reason they became aware  of the situation was when an acquaintance of the spouse noticed him  picking up prescriptions for a wife who had died months ago. The  acquaintance informed the pharmacy staff of the situation. They  subsequently contacted the prescribing physician. Since this incident,  the pharmacy informed us that it has not filled another prescription for  the deceased beneficiary.
Case 9: A mother with a criminal history and Ritalin addiction used  her child as a means to doctor shop for Ritalin and other similar  controlled stimulants used to treat ADHD. Although the child received  overlapping prescriptions of methylphenidate and amphetamine  medications during a 2-year period and was banned (along with his  mother) from at least three medical practices, the Illinois Medicaid  Program never placed the beneficiary on a restricted recipient  program. Such a move would have restricted the child to a single  primary care, pharmacy, or both thus preventing him (and his mother)  from doctor shopping. Over the course of 21 months, the Illinois  Medicaid Program paid for 83 prescriptions of ADHD controlled  stimulants for the beneficiary, which totaled approximately 90,000 mg  and cost $6,600.
Case 11: Claims indicated that a deceased physician “wrote”  controlled substance prescriptions for several patients in the Houston  area. Upon further analysis, we discovered that the actual  prescriptions were signed by a physician assistant who once worked  under the supervision of the deceased physician. The pharmacy  neglected to update its records and continued filling prescriptions  under the name of the deceased prescriber. The physician assistant has  never been a DEA registrant. The physician assistant told us that the  supervising physicians always signed prescriptions for controlled  substances. After informing her that we had copies of several Medicaid  prescriptions that she had signed for Vicodin and lorazepam, the  physician assistant ended the interview.
section_title: Improved Fraud Controls Could Better Prevent Abuse and Unnecessary Medicaid Program Expenditures
subsections: section_title: CMS Conducts Limited Oversight of Controlled Substances in Medicaid Program
paragraphs: Although states are primarily responsible for the fight against Medicaid  fraud and abuse, CMS is responsible for overseeing state fraud and abuse  control activities. CMS has provided limited guidance to the states on how  to improve their control measures to prevent fraud and abuse of  controlled substances in the Medicaid program. Thus, for the five state  programs we reviewed, we found different levels of fraud prevention  controls. For example, the Omnibus Budget Reconciliation Act of 1990  encourages states to establish a Drug Utilization Review (DUR) Program.  The main emphasis of the program is to promote patient safety through an  increased review and awareness of prescribed drugs. States receive  increased federal funding if they design and install a point-of-sale  electronic prescription claims management system to interact with their  Medicaid Management Information Systems (MMIS), each state’s Medicaid  computer system. Each state was given considerable flexibility in how to  identify prescription problems, such as therapeutic duplication and  overprescribing by providers, and how to use MMIS to prevent such  problems. The level of screening, if any, states perform varies because  CMS does not set minimum requirements for the types of reviews or edits  that are to be conducted on controlled substances. Thus, one state  requires prior approval when ADHD treatments like Ritalin and Adderall  are prescribed outside age limitations, while another state had no such  controlled substance requirement at the time of our review.
Recently, under the Deficit Reduction Act of 2005 (DRA), CMS is  required to initiate the Medicaid Integrity Program (MIP) to combat  Medicaid fraud, waste, and abuse. DRA requires CMS to enter intocontracts with Medicaid integrity contractors (MIC) to review provideractions, audit provider claims and identify overpayments, and cond uct  provider education.
To date, CMS has awarded umbrella contracts to several contractors to perform the functions outlined above. According to CMS, these contractors cover 40 states, 5 territories, and the Distri Columbia. CMS officials stated that CMS will award task orders to cover  the rest of the country by the end of fiscal year 2009. CMS officials stated  that MIC audits are currently under way in 19 states. CMS officials stated  that most of the MIP reviews will focus on Medicaid providers and that the  state Medicaid programs will handle beneficiary fraud. Because the  Medicaid program covers a full range of health care services and the  prescription costs associated with controlled substances is relatively  small, the extent to which MICs focus on controlled substances is likely to  be relatively minimal.
section_title: Selected States Lack a Comprehensive Fraud Prevention Framework for Controlled Substances
paragraphs: In addition, CMS is required to provide effective support and assistance to states in their  efforts to combat Medicaid provider fraud and abuse. investigations and prosecutions to design more effective preventive  controls.
Preventive controls: Fraud prevention is the most efficient and effective  means to minimize fraud, waste, and abuse. Thus, controls that prevent  fraudulent health care providers and individuals from entering the  Medicaid program or submitting claims are the most important element in  an effective fraud prevention program. Effective fraud prevention controls  require that where appropriate, organizations enter into data-sharing  arrangements with organizations to perform validation. System edit  checks (i.e., built-in electronic controls) are also crucial in identifying and  rejecting fraudulent enrollment applications, fraudulent claims, or both  before payments are disbursed. Some of the preventive controls and their  limitations that we observed at the selected states include the following.
Federal debarment and exclusion: Federal regulation requires  states to ensure that no payments are made for any items or services  furnished, ordered, or prescribed by an individual or entity that has  been debarred from federal contracts, excluded from Medicare and  Medicaid programs, or both. Officials from all five selected states said  that they do not screen prescribing providers or pharmacies against  the federal debarment list, also known as the EPLS. Further, officials  from four states said that when a pharmacy claim is received, they do  not check to see if the prescribing provider was excluded by HHS OIG  from participating in the Medicaid program.
DEA registration: DEA, on behalf of the Attorney General of the  United States, is the agency primarily responsible for enforcing CSA.  Federal regulations require physicians and pharmacies to be registered  with DEA for the controlled substance schedule(s) that they are  authorized to prescribe or dispense. According to DEA officials, DEA  can take administrative action against a provider who violates CSA or  its implementing regulations, such as revoking DEA registration. Legal  action against the provider is also a possibility. Although DEA’s  registrant database is available for purchase by the public through the  Department of Commerce’s National Technical Information Service,  none of the five state Medicaid offices obtained the database at the  time of our study to determine if physicians are authorized to prescribe  particular controlled substances. Thus, the selected state Medicaid  programs do not screen prescription claims for controlled substances  to ensure that a health care provider is authorized to prescribe the  particular drug(s). Further, DEA officials stated that pharmacies have  corresponding responsibility to determine if a prescription is  legitimate, which includes determining whether a health care provider  is authorized to prescribe the particular schedule of controlled  substance before filling a prescription. However, none of the pharmacy  boards of the selected states said that this is a requirement they  monitor. In fact, four pharmacy boards stated that the states only  require that their pharmacists check to see if the DEA number on the  prescription appears to be a valid DEA number, without verifying it  with the DEA registration database.
Duplicate enrollment: Medicaid officials in two states said that they  did not have pre-enrollment checks in place to provide assurance that  duplicate applications are not approved. One state does not even  require the beneficiary to furnish an SSN when applying for the  Medicaid program, thus making this fraud difficult to identify. In fact,  during the period covered by our work, this state had 4,296 Medicaid  beneficiaries who were enrolled without SSNs. These beneficiaries  were approved for about 8,300 controlled substances claims, totaling  $193,500. We did not investigate these beneficiaries for fraud or abuse.
DUR: As mentioned earlier, states perform DURs and other controls  during the prescription claims process to promote patient safety,  reduce costs, and prevent fraud and abuse. The DURs include  prospective screening and edits for potential inappropriate drug  therapies, such as overutilization, drug-drug interaction, or therapeutic  duplication. In addition, selected states also require health care  providers to submit prior authorization forms for certain prescriptions  of drugs because those medications have public health concerns, are  considered high risk for fraud and abuse, or both. Each state has  developed its DUR differently, and some of the differences that we saw  from the selected states include the following:
Officials from certain states said that they use the results of  prospective screening (e.g., findings of overutilization,  overlapping controlled substance prescriptions, etc.) as an  automatic denial of the prescription. Officials from the  other states generally use the prospective screening as  more of an advisory tool for pharmacies, which pharmacies  can override by entering a reason code. As such, the  effectiveness of the tool for preventing fraud and abuse in  these states is more limited.
The types of drugs that require prior authorization vary  greatly between the selected states. In states where it is  used, health care providers may be required to obtain prior  authorization if a specific brand name is prescribed (e.g.,  OxyContin) or if a dosage exceeds a predetermined amount  for a therapeutic class of controlled substances (e.g.,  hypnotics, narcotics).
Detection and monitoring: Even with effective preventive controls,  there is risk that fraud and abuse will occur in Medicaid regarding  controlled substances. States must continue their efforts to monitor the  execution of the prescription program, including periodically matching  their beneficiary files to third-party databases to determine continued  eligibility, monitor controlled substance prescriptions to identify abuse,  and make necessary corrective actions. Such actions include the  following.
Checking death files: After enrolling beneficiaries, Medicaid offices  in the selected states generally did not periodically compare their  information against death records. Specifically, two of the five selected  states said that they did not obtain death records from SSA or the state  vital statistics office to determine if a Medicaid beneficiary was still  alive. Officials from two states said that Medicaid offices primarily rely  on obituaries, providers, family members, or others to report the status  change of the beneficiary.
Increasing the use of the restricted recipient program: In the  course of DURs or audits, the state Medicaid offices may identify  beneficiaries who have abused, the Medicaid prescription drug  program, defrauded the program, or both. In those cases, the selected  states may place the beneficiaries into a restricted recipient program.  Under this program, the state Medicaid office restricts the  beneficiaries to one health care provider, one pharmacy, or both for  receiving prescriptions. This program only applies to those  beneficiaries in a fee-for-service arrangement since managed care  organizations are responsible for determining the quality of care  treatments for their enrollees. Thus, a significant portion of the  Medicaid recipients for some of the selected states are not subject to  this program.
Fully utilizing the prescription drug monitoring program:  Beginning in fiscal year 2002, Congress appropriated funding to the  Department of Justice to support prescription drug monitoring  programs (PDMP). These programs help prevent and detect the  diversion and abuse of pharmaceutical controlled substances,  particularly at the retail level where no other automated information  collection system exists. States that have implemented PDMPs have  the capability to collect and analyze data on filled and paid  prescriptions more efficiently than those without such programs,  where the collection of prescription information can require a time- consuming manual review of pharmacy files. If used properly, PDMPs  are an effective way to identify and prevent diversion of the drugs by  health care providers, pharmacies, and patients. The PDMPs at the  selected states have the following limitations:
For PDMPs to be useful, health care providers and  pharmacies must use the data. Officials from the five  selected states said that physician participation in the  PDMP is not widespread and not required. In fact, one state  did not have a Web-based PDMP; a health care provider has  to put in a manual request to the agency to have a  controlled substance report generated.
Program officials at the selected states said that their  systems were primarily used to respond to requests for  controlled substance information on specific patients from  medical practitioners. None of the selected states  compared all the prescribers of controlled substances to  the DEA authorization list to identify medical practitioners  who are illegally prescribing drugs that they are not  authorized to prescribe.
Although the PDMPs generally capture the name and  address of the patient, the controlled substance prescribed,  the date of the prescription, and the identity of the  prescriber, they generally do not capture the method of  payment that the patient used. Thus, the system will not  differentiate between prescriptions paid in cash and those  paid using health insurance.
One state restricts law enforcement access to the PDMP to  only the state bureau of investigation. As such, local police  and sheriff’s departments cannot access the data, which  impedes their ability to conduct prescription drug diversion  investigations. According to state officials, the limitation  was enacted because of privacy concerns.
No nationwide PDMP exists, and only 33 states had  operational PDMPs as of June 2009. According to an official  in one of the selected states, people would sometimes cross  state borders to obtain prescription drugs in a state without  a program.
Investigations and prosecutions: Another element of a fraud  prevention program is the aggressive investigation and prosecution of  individuals who defraud the federal government. Prosecuting perpetrators  serves as a preventive measure; it sends the message that the government  will not tolerate individuals stealing money. Schemes identified through  investigations and prosecution also can be used to improve the fraud  prevention program. The MFCU serves as the single identifiable entity  within a state government that investigates and prosecutes health care  providers who defraud the Medicaid program. In the course of our  investigation, however, we found several factors that may limit its  effectiveness.
Federal regulations generally limit MFCUs from pursuing beneficiary  fraud. According to MFCU officials at one selected state, this limitation  impedes investigations because agents cannot use the threat of  prosecution as leverage to persuade beneficiaries to cooperate in  criminal probes of Medicaid providers. In addition, the MFCU officials  in this selected state said that this limitation restricts the agency’s  ability to investigate organized crime related to controlled substances  when the fraud is perpetrated by the beneficiaries.
Federal regulations do not permit federal funding for MFCUs to engage  in routine computer screening activities that are the usual monitoring  function of the Medicaid agency. According to MFCU officials in one  selected state, this issue has caused a strained working relationship  with the state’s Medicaid OIG, on whom the MFCU relies for claims  information. The MFCU official stated that based on fraud trends in  other states, the state MFCU wanted the Medicaid OIG to provide  claims information on providers who had similar trends in that state.  The Medicaid OIG cited this prohibition on routine computer screening  activities when refusing to provide these data. In addition, this MFCU  official also stated that the state Medicaid office and its OIG did not  promptly incorporate improvements that the MFCU suggested  regarding preventing the abuse of controlled substances.
section_title: DEA Monitoring of Pharmacy and Physician Prescription Practices Related to Controlled Substances
paragraphs: DEA officials stated that although DEA monitors purchases of certain  Schedule II and III controlled substances by pharmacies, it does not  routinely receive information regarding written or dispensed controlled  substance prescriptions. In states with PDMPs, a state agency collects and  maintains data relating to dispensed controlled substance prescriptions. In  the course of an investigation regarding the diversion or abuse of  controlled substances, DEA may request information from a PDMP. In  those states without PDMPs, DEA may obtain controlled substance  prescription information from an individual pharmacy’s records during the  course of an inspection or investigation.
section_title: Conclusions
paragraphs: Fraud and abuse related to controlled substances paid for by Medicaid  exist in the five selected states. Given that states are responsible for  administering Medicaid and investigating and prosecuting any fraudulent  activities, each state must set its own course to ensure the integrity of its  Medicaid program, including its monitoring of the dispensing and use of  controlled substances. CMS is also responsible for actively partnering with  and providing guidance to the states to ensure that they succeed in  minimizing fraud and abuse in the Medicaid program.
section_title: Recommendations for Executive Action
paragraphs: To establish an effective fraud prevention system for the Medicaid  program, we recommend that the Administrator of CMS evaluate our  findings and consider issuing guidance to the state programs to provide  assurance that  claims processing systems prevent the processing of claims from  providers and pharmacies debarred from federal contracts (i.e., on the  EPLS), excluded from the Medicare and Medicaid programs (i.e., on  the LEIE), or both;    DUR and restricted recipient program requirements adequately  identify and prevent doctor shopping and other abuses of controlled  substances;  effective claims processing system are in place to periodically identify  both duplicate enrollments and deaths of Medicaid beneficiaries and to  prevent the approval of claims when appropriate; and  effective claims processing systems are in place to periodically identify  deaths of Medicaid providers and prevent the approval of claims when  appropriate.
section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to DEA and CMS for comment. DEA  provided us technical comments by e-mail. CMS comments are reprinted  in appendix II. CMS stated that it generally agrees with the four  recommendations. CMS stated that it will continue to evaluate its  programs and will work to develop methods to address the identified  issues found in this report.
CMS provided us two comments regarding our recommendations. First,  CMS stated that we should be more specific as to the databases that the  states should access in screening for debarred providers. Second, CMS  also stated that we recommend that DEA make its registrant database  available to the states without a fee. Third, CMS stated that information on  deceased providers and beneficiaries could be provided by a feed from  SSA. CMS also provided us two technical comments to the report.
In response to CMS comment on the specificity of databases, we revised  the recommendation to specify the two databases that should be used in  screening claims: (1) the EPLS on federal debarments and (2) Medicare  and Medicaid exclusions (i.e., the LEIE) maintained by HHS OIG. As stated  in the report, both of these databases are required to be used by the states  before they pay prescription claims. We did not recommend that states use  the DEA registration database in the processing of Medicaid controlled  substance claims, and thus we do not make any recommendations to DEA  at this time. In response to CMS’s comment about screening for deceased  providers and beneficiaries, we agree with CMS that SSA data can be used  in determining the eligibility of Medicaid beneficiaries and providers. In  developing its guidance to the states, we believe that CMS should consider  SSA death records and other sources to identify deceased Medicaid  providers and beneficiaries. We incorporated the technical comments  made by DEA and CMS into the report as appropriate.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  date of this letter. We will then send copies of this report to interested  congressional committees and the Acting Administrators of CMS and DEA.  The report also will be available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff members have any questions about this report, please  contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on the  last page of this report. GAO staff who made major contributions to this  report are listed in appendix III.
section_title: Appendix I: Additional Examples of Fraud, Waste, and Abuse of Controlled Substances in Medicaid
paragraphs: Table 5, in the main portion of the report, provides data on 15 detailed  case studies. Table 6 provides details of the remaining 10 cases we  selected. As with the 15 cases discussed in the body of this report, we also  found fraudulent, improper, and abusive controlled substances activities  in Medicaid for these 10 cases.
section_title: Appendix II: Comments from the Centers for Medicare & Medicaid Services
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, the following individuals made  major contributions to this report: Matthew Harris, Assistant Director;  Matthew Valenta, Assistant Director; Erika Axelson; Paul Desaulniers; Eric  Eskew; Dennis Fauber; Alberto Garza; Robert Graves; Barbara Lewis;  Olivia Lopez; Steve Martin; Vicki McClure; Kevin Metcalfe; Gloria Proa;  Chris Rodgers; Ramon Rodriguez; and Barry Shillito.