Medicare Program: Continued Action Required to Address Weaknesses in Provider and Supplier Enrollment Controls
Published: 2016-05-24T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2015, Medicare paid $568.9 billion for health care and related services. CMS estimates that $59.6 billion (about 10.5 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.9 million providers and suppliers were in PECOS as of December 2015, according to CMS.
GAO published reports in June 2015 and April 2016 that examined Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This testimony discusses the extent to which selected enrollment-screening procedures are designed and implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers and suppliers into PECOS.
In its reports, GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used Medicare claims data to verify whether they were paid during this period. GAO also examined relevant documentation, interviewed CMS officials, and obtained information from the CMS contractors that evaluate provider applications. From August 2015 through May 2016, GAO obtained updated information from CMS staff and reviewed documents related to actions.
CMS has taken or has plans to take some actions to address all of GAO's recommendations and referrals of potentially ineligible providers and suppliers.
section_title: What GAO Found
paragraphs: In June 2015 and April 2016, GAO reported on CMS's implementation of enrollment-screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). GAO identified weaknesses in CMS's verification of provider practice location, physician licensure status, and criminal-background histories. These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers.
Specifically, in June 2015, GAO's examination of 2013 data found that about 23,400 (22 percent) of 105,234 of practice location addresses were potentially ineligible. The computer software CMS used as a method to validate applicants' addresses did not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid. GAO recommended that CMS incorporate flags into its software to help identify potentially questionable addresses, among other things. CMS concurred with this recommendation and has replaced the PECOS address verification software.
Also, in June 2015, GAO found that, as of March 2013, 147 out of about 1.3 million physicians listed in PECOS had received a final adverse action against their medical license from a state medical board for various felonies that may have made them ineligible to bill Medicare. However, they were either not revoked from the Medicare program until months after the adverse action or never removed because CMS only collected information on the medical license numbers providers used to enroll into the Medicare program. CMS also did not collect adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO recommended that CMS collect and review additional license information. CMS has incorporated a new database to obtain additional license history.
In April 2016, GAO reported on CMS's process to conduct criminal-background checks on Medicare providers and suppliers and found that opportunities exist for CMS to recover about $1.3 million in potential overpayments made to 16 out of 66 potentially ineligible providers with criminal backgrounds. In April 2014, CMS implemented procedures to obtain greater access to data to verify criminal backgrounds of existing and prospective Medicare providers and suppliers than it obtained previously; however, the results of GAO's review of the 2013 data identified an opportunity for CMS to recover potential overpayments that were made prior to putting the revised procedures in place.
In addition to its actions in response to GAO's recommendations, CMS has taken some actions to remove or recover overpayments from potentially ineligible providers and suppliers that GAO referred to it in April 2015 and April 2016, but its review and response to the referrals are ongoing.

section_title: Letter
paragraphs: I am pleased to appear before you today to discuss our previous work on  the controls used to verify the eligibility of Medicare providers and  suppliers and potential opportunities to recover overpayments to  providers with criminal backgrounds. Medicare is the federally financed  health-insurance program for persons age 65 or over, certain individuals  with disabilities, and individuals with end-stage renal disease. In fiscal  year 2015, Medicare paid $568.9 billion for health care and health care– related services. According to the Centers for Medicare & Medicaid  Services (CMS)—the agency within the Department of Health and Human  Services (HHS) that administers the Medicare program—an estimated  $59.6 billion (10.5 percent) of that total was paid improperly. Due to the  large dollar amount involved in improper payments, the Office of  Management and Budget has placed Medicare on its list of high-error  programs. Further, because of its size, complexity, and susceptibility to  mismanagement and improper payments, we have designated Medicare  as a high-risk program.
To enroll in Medicare and bill for services provided to Medicare  beneficiaries, CMS requires prospective providers and suppliers to be  listed in the Provider Enrollment, Chain and Ownership System (PECOS).  PECOS is a centralized database designed to contain providers’ and  suppliers’ enrollment information. According to CMS, there were about  1.9 million health-care providers and suppliers enrolled in PECOS as of  December 31, 2015.
My remarks today highlight the key findings of our June 2015 report on  CMS’s Medicare provider and supplier enrollment-screening procedures  and our April 2016 report on potential overpayments to providers with  criminal backgrounds. Accordingly, this testimony discusses the extent to  which selected enrollment-screening procedures are designed and  implemented to prevent and detect the enrollment of ineligible or  potentially fraudulent Medicare providers and suppliers into PECOS.
In June 2015, we reported on the implementation of four enrollment- screening procedures that CMS uses to prevent and detect ineligible or  potentially fraudulent providers and suppliers from enrolling into PECOS,  including verifying provider practice locations and physician licensure  status, and screening for providers and suppliers listed as deceased or  excluded from participating in federal programs or health care–related  programs. To assess the extent to which CMS had controls to verify the  eligibility of Medicare providers and suppliers, we reviewed CMS  procedural manuals and directives, and interviewed CMS officials about  provider and supplier enrollment-screening procedures. We matched the  list of providers and suppliers present in PECOS, as of March 29, 2013,  and durable medical equipment, prosthetics, orthotics, and supplies  (DMEPOS) suppliers, as of April 6, 2013 (the most-current data available  at the time of our review) to the following databases: (1) the United States  Postal Service (USPS) Address Matching System Application Program  Interface; (2) Federation of State Medical Boards (FSMB) licensure data;  (3) the Social Security Administration’s (SSA) full death file; and (4) the  HHS Office of Inspector General’s (OIG) List of Excluded Individuals and  Entities (LEIE) to determine whether ineligible or potentially fraudulent  Medicare providers, suppliers, and DMEPOS suppliers were in PECOS.  For the USPS address-management tool, we selected a generalizable  sample from the addresses that the USPS address-management tool  identified as being a Commercial Mail Receiving Agency (CMRA), vacant,  or invalid and took additional steps to confirm whether the practice  location address was an eligible address. In addition, we obtained  Medicare claims data from 2005 through 2013 from CMS for all of our  matches to determine how much the providers and suppliers were paid  with Medicare funds, if at all, while they may have been ineligible. On the  basis of our discussions with agency officials and our own testing, we  concluded that the data elements used for this report were sufficiently  reliable for our purposes. In November 2015, February 2016, and May  2016, CMS officials provided us with updates on actions taken to address  our three recommendations made in the June 2015 report. From August  2015 through May 2016, CMS officials also provided updates on the  actions taken on the cases we referred.
In April 2016, we reported on a fifth enrollment-screening process CMS  used to conduct criminal-background checks on Medicare providers and  suppliers. To assess the extent to which CMS had controls in place to  verify criminal-background information for providers and suppliers in  PECOS, we matched the PECOS data of approximately 1.2 million  unique physicians and nonphysicians as of March 2013 to data from the  Federal Bureau of Prisons and the National Sex Offender Registry as of  February 2014, by Social Security number, name, and date of birth, to  identify potentially ineligible providers. We also reviewed CMS  supporting documentation and interviewed agency officials. We also  calculated Medicare claims that were paid to providers while they were  potentially ineligible. We assessed the reliability of data and determined  that these databases were sufficiently reliable for the purpose of our  review. More details on our scope and methodology can be found in the  issued reports. In May 2016, CMS officials provided us with an update  on the 66 providers we referred to CMS for further review. We conducted  the work on which this statement is based in accordance with generally  accepted government auditing standards.
subsections: section_title: Limitations Exist in Certain CMS Screening Procedures for Preventing and Detecting Enrollment of Ineligible or Potentially Fraudulent Medicare Providers and Suppliers
paragraphs: In our June 2015 and April 2016 reports examining CMS screening  procedures, we found weaknesses in CMS’s verification of provider  practice location, physician licensure status, providers listed as deceased  or excluded from participating in federal programs or health care–related  programs, and criminal-background histories. These weaknesses may  have resulted in CMS improperly paying thousands of potentially ineligible  providers and suppliers. We made recommendations to address these  weaknesses, which CMS has indicated it has implemented or is taking  steps to address. Additionally, as a result of our work, we referred 597  unique providers and suppliers to CMS. According to CMS officials, they  have taken some actions to remove or recover overpayments from the  potentially ineligible providers and suppliers we referred to them in April  2015 and April 2016, but CMS’s review and response to the referrals are  ongoing.
subsections: section_title: Practice Location Verification Procedures
paragraphs: In our June 2015 report, we found thousands of questionable practice  location addresses for providers and suppliers listed in PECOS, as of  March 2013, and DMEPOS suppliers, listed as of April 2013. Under  federal regulations, providers and suppliers must be “operational” to  furnish Medicare covered items or services, meaning that they have a  qualified physical practice location that is open to the public for the  purpose of providing health care–related services. The location must be  properly staffed, equipped, and stocked to furnish these items or services.  Addresses that generally would not be considered a valid practice  location include post office boxes, and those associated with a certain  type of CMRA, such as a United Parcel Service (UPS) store. We  checked PECOS practice location addresses for all records that  contained an address using the USPS address-management tool, a  commercially available software package that standardizes addresses  and provides specific flags on the address such as a CMRA, vacant, or  invalid address. As illustrated in figure 1, on the basis of our analysis of  a generalizable stratified random sample of 496 addresses, we estimate  that about 23,400 (22 percent) of the 105,234 addresses we initially  identified as a CMRA, vacant, or invalid address are potentially ineligible  addresses. About 300 of the addresses were CMRAs, 3,200 were  vacant properties, and 19,900 were invalid.
Of the 23,400 potentially ineligible addresses submitted as practice  locations, we estimate that, from 2005 to 2013, about 17,900 had no  claims associated with the address, 2,900 were associated with providers  that had claims that were less than $500,000 per address, and 2,600  were associated with providers that had claims that were $500,000 or  more per address. Because some providers are associated with more  than one address, it is possible that some of the claim amounts reported  may be associated with a different, valid practice location. Due to how we  compiled claims by the National Provider Identifier, we were unable to  determine how much, if any, of the claim amount may be associated with  a different, valid address.
In our June 2015 report, we found limitations with CMS’s Finalist software  used to validate practice location addresses. The Finalist software is one  technique used by the Medicare Administrative Contractors (MAC) and  the National Supplier Clearinghouse (NSC) to validate a practice  location. According to CMS, Finalist is integrated into PECOS to  standardize addresses and does so by comparing the address listed on  the application to USPS records and correcting any misspellings in street  and city names, standardizing directional markers (such as NE or West)  and suffixes (such as Ave. or Lane), and correcting errors in the zip code.  However, the Finalist software does not indicate whether the address is a  CMRA, vacant, or invalid address—in other words, whether the location is  potentially ineligible to qualify as a legitimate practice location. CMS does  not have these flags in Finalist because the agency added coding in  PECOS that prevents post office box addresses from being entered, and  believed that this step would prevent these types of ineligible practice  locations from being accepted.
Further, some CMRA addresses are not listed as post office boxes. For  example, in our June 2015 report we identified 46 out of the 496 sample  addresses that were allowed to enroll in Medicare with a practice location  that was inside a mailing store similar to a UPS store. These providers’  addresses did not appear in PECOS as a post office box, but instead  were listed as a suite or other number, along with a street address. Figure  2 shows an example of one provider we identified through our search and  site visits as using a mailbox-rental store as its practice location and  where services are not actually rendered. This provider’s address  appears as having a suite number in PECOS and remained in the system  as of January 2015. According to our analysis of CMS records, this  provider was paid approximately $592,000 by Medicare from the date it  enrolled in PECOS with this address to December 2013, which was the  latest date for which CMS had claims data at the time of our review.
Our June 2015 report also found locations that were vacant or addresses  that belonged to an unrelated establishment. For example, we visited a  provider’s stated practice location in December 2014 and instead found a  fast-food franchise there (see fig. 3—the name of the franchise has been  blurred). In addition, we found a Google Maps image dated September  2011 that shows this specific location as vacant. Although the provider  was not paid by Medicare from the date this practice location address  was flagged as vacant, by remaining actively enrolled into PECOS, the  provider may be eligible to bill Medicare in the future.
In March 2014, CMS issued guidance to the MACs that revised the  practice location verification methods by requiring MACs to only contact  the person listed in the application to verify the practice location address  and use the Finalist software that is integrated in PECOS to standardize  the practice location address. Additional verification, such as using  411.com and USPS.com, which was required under the previous  guidance, is only needed if Finalist cannot standardize the actual  address. In our June 2015 report, we noted that our findings suggest  that the revised screening procedure of contacting the person listed in the  application to verify all of the practice location addresses may not be  sufficient to verify such practice locations. For example, two providers in  our sample of 496 addresses that the USPS address-management tool  flagged as CMRA, invalid, or vacant successfully underwent a MAC  revalidation process in 2014. The MAC used the new procedure of calling  the contact person to verify the practice location. Each of these two  providers had a UPS or similar store as its practice location.
To help further improve CMS’s enrollment-screening procedures to verify  applicants’ practice location, we made two recommendations to CMS in  our June 2015 report. First, we recommended that CMS modify the CMS  software integrated into PECOS to include specific flags to help identify  potentially questionable practice location addresses, such as CMRA,  vacant, and invalid addresses. The agency concurred with this  recommendation. On May 16, 2016, CMS provided us with supporting  documentation that shows that the agency replaced its current PECOS  address verification software to include Delivery Point Verification  (DPV)—which is similar to the software we used when conducting the  work in the June 2015 report—as an addition to the existing functionality.  According to CMS officials, this new DPV functionality flags addresses  that may be CMRA, vacant, or invalid. By updating the address  verification software, CMS can ensure that providers with ineligible  practice location are not listed in PECOS.
Second, we recommended in our June 2015 report that CMS revise its  guidance for verifying practice locations to include, at a minimum, the  requirements contained in the guidance in place prior to March 2014.  Such a revision would require that MACs conduct additional research,  beyond phone calls to applicants, on the practice location addresses that  are flagged as a CMRA, vacant, or invalid address to better ensure that  the address meets CMS’s practice location criteria. The agency did not  concur with this recommendation, stating that the March 2014 guidance  was sufficient to verify practice locations. However, our audit work shows  that additional checks on addresses flagged by the address-matching  software as a CMRA, vacant, or invalid can help verify whether the  addresses are ineligible. As our report highlighted, we identified providers  with potentially ineligible addresses that were approved by MACs using  the process outlined in the existing guidance. Therefore, we continue to  believe that the agency should update its guidance for verifying potentially  ineligible practice locations. In February 2016, CMS officials told us that,  as part of configuring the PECOS address verification software to include  the DPV functionality and flag CMRAs, vacancies, invalid addresses, and  other potentially questionable practice locations, the agency plans to  validate the DPV through site visits and follow its current process to take  administrative action if the results are confirmed. CMS officials told us  that they believe that by implementing the first recommendation by  incorporating software flags and revising its guidance for verifying  potentially ineligible practice location, if necessary, the second  recommendation will be addressed. As of May 17, 2016, CMS had not  provided us with details and supporting documentation of how it will  revise its guidance. Accordingly, it is too early for us to determine whether  the agency’s actions would fully address the intent of the  recommendation. We plan to continue to monitor the agency’s efforts in  this area.
CMS has taken some actions to remove or recover overpayments from  potentially ineligible providers and suppliers that we referred to it, based  on our June 2015 report. On April 29, 2015, we referred 286 unique  providers to CMS for further review and action as a result of our  identification of providers with potentially ineligible practice location  address. From August 2015 to May 2016, CMS has provided updates on  these referrals. On the basis of our analysis of CMS’s updates, CMS has  taken the following actions:  taken administrative action to remove the provider or collect funds for  29 of the providers,  corrected the invalid addresses for 70, determined that the questionable location was actually valid for 84, determined that the provider had already been removed from the  program for 102.
However, CMS did not take action on 1 provider because it was unable to  find the practice location for this provider.
section_title: Applicants’ Licensure Information Verification
paragraphs: In our June 2015 report, we found 147 out of about 1.3 million physicians  with active PECOS profiles had received a final adverse action from a  state medical board, as of March 2013. Adverse actions include crimes  against persons, financial crimes, and other types of health care–related  felonies. These individuals were either not revoked from the Medicare  program until months after the adverse action or never removed (see fig.  4).
All physicians applying to participate in the Medicare program must hold  an active license in the state they plan to practice in and also to self- report final adverse actions, which include a license suspension or  revocation by any state licensing authority. CMS requires MACs to verify  final adverse actions that the applicant self-reported on the application  directly with state medical board websites. We found that because  physicians are required to self-report adverse actions, the MACs did not  always identify unreported actions when enrolling, revalidating, or  performing monthly reviews of the provider. As a result, 47 physicians  out of the 147 physicians we identified as having adverse actions have  been paid approximately $2.6 million by the Medicare program during the  time CMS could have potentially barred them from the Medicare program  between March 29, 2003, and March 29, 2013.
Some of the adverse actions that were unreported by physicians occurred  within the state where the provider enrolled in PECOS, while others  occurred in different states. For example, we identified a physician who  initially enrolled into Medicare in 1985 and was suspended for about 5  months in 2009 by the Rhode Island medical board. In 2011, his  information was revalidated by the MAC. This provider did not self-report  the adverse action, and the MAC did not identify it during its monthly  reviews or when revalidating the provider’s information. CMS bars  providers that are already enrolled in Medicare who do not self-report  adverse actions for 1 year. This individual billed Medicare for about  $348,000 during the period in which he should have been deemed  ineligible. CMS officials highlighted that delays in removing physicians  from Medicare may occur due to MAC backlogs, delays in receipt of data  from primary sources, or delays in the data-verification process.
In March 2014, CMS began efforts to improve the oversight of physician  license reviews by providing the MACs with a License Continuous  Monitoring report, which was a good first step. However, the report only  provides MACs with the current status of the license that the provider  used to enroll in the Medicare program. Without collecting license  information on all medical licenses, regardless of the state the provider  enrolled in, we concluded that CMS may be missing an opportunity to  identify potentially ineligible providers who have license revocations or  suspensions in other states, which can put Medicare beneficiaries at risk.
To help improve the Medicare provider enrollment-screening procedures,  in our June 2015 report we recommended that CMS require applicants to  report all license information including that obtained from other states,  expand the License Continuous Monitoring report to include all licenses,  and at least annually review databases, such as that of FSMB, to check  for disciplinary actions. The agency concurred with the recommendation,  but stated it does not have the authority to require providers to report  licenses for states in which they are not enrolled. While providers are not  currently required to list out-of-state license information in the enrollment  application, CMS can independently collect this information by using other  resources. Therefore, we clarified our recommendation to state that CMS  should collect information on all licenses held by providers that enroll into  PECOS by using data sources that contain this information, which is  similar to the steps that we took in our own analyses.
In February 2016, CMS officials told us that CMS will take steps to ensure  that all applicants’ licensure information is evaluated as part of the  screening process by MACs and the License Continuous Monitoring  report, as appropriate, and will also regularly review other databases for  disciplinary actions against enrolled providers and suppliers. In May 2016,  CMS officials stated that CMS has established a process to annually  review databases and has incorporated the FSMB database into its  screening process. On May 19, 2016, CMS officials provided us with  supporting documentation that shows that the FSMB database was  incorporated into its automatic screening process. By incorporating the  FSMB database into its automatic screening process, CMS will be able to  regularly check this database for licensure updates and disciplinary  actions against enrolled providers and suppliers, as well as to collect all  license information held by providers that apply to enroll in PECOS.
On April 29, 2015, we referred the 147 unique providers to CMS for  further review and action as a result of our identification of revoked  licenses. On the basis of our analysis of CMS’s updates as of May 2016,  CMS has taken the following actions:  taken administrative action to remove the provider or collect funds for  21 providers, determined that the provider had already been removed from the determined that the adverse actions were disclosed or partially  disclosed for 71, and has ongoing reviews of 6.
CMS did not take action on 1 provider because it was unable to find the  adverse action for this provider.
section_title: Deceased and Exclusion Verification Procedures
paragraphs: In our June 2015 report, we found that about 460 (0.03 percent) out of the  1.7 million unique providers and suppliers in PECOS as of March 2013  and DMEPOS suppliers as of April 2013 were identified as deceased at  the time of the data we reviewed. The MAC or CMS identified 409 of the  460 providers and suppliers as deceased from March 2013 to February  2015. Additionally, 38 out of the 460 providers and suppliers we found to  be deceased were paid a total of about $80,700 by Medicare for services  performed after their date of death until December 2013, which was the  most-recent date CMS had Medicare claims data available at the time of  our review. Not identifying a provider or supplier as deceased in a timely  manner exposes the Medicare program to potential fraud. It is unclear  what caused the delay or omission by CMS and the MACs in identifying  these individuals as deceased or how many overpayments they are in the  process of recouping.
On April 29, 2015, we referred 82 unique providers to CMS for further  review and action as a result of our identification of providers whose  status was deceased. From August 2015 to May 2016, CMS has provided  updates on these referrals. On the basis of our analysis of CMS’s  updates, CMS has taken the following actions:  taken administrative action to remove the provider for 4 of the  providers, determined that the provider had already been removed from the determined that the provider had already been removed from the  program but updated the provider’s PECOS profile to reflect the date  of death for 22, and  started but not completed the review on 31 providers that were  reported to be deceased and had submitted claims for payments.
We found in our June 2015 report that about 40 (0.002 percent) out of the  1.7 million unique providers and suppliers enrolled in PECOS were listed  in LEIE, as of March 2013. These individuals were excluded from  participating in health care–related programs. Of those 40 excluded  providers and suppliers, 16 were paid approximately $8.5 million by  Medicare for services rendered after their exclusion date until the MAC or  the NSC found them to be excluded. When we followed up with the  MACs in September and October 2014, we found that the MACs had  removed 38 of the 40 providers and suppliers from PECOS from March  2013 to October 2014. However, for two matches that we identified, the  MACs had not taken any action. Given the small number of cases  identified (40) and the MACs’ removal of 38 out of these 40 providers  during our review, we did not make a recommendation to CMS. On April  29, 2015, we referred the two providers that the MACs did not remove, as  well as the 16 providers that were paid $8.5 million by Medicare for  services rendered after their exclusion date, to CMS for further review  and action. From August 2015 to May 2016, CMS has provided updates  on these referrals. On the basis of our analysis of CMS’s updates, CMS  did not take action on 2 providers because CMS deemed the providers  eligible. Further, CMS has not completed the review on 14 providers that  were reported to be excluded and had submitted claims for payments.
section_title: Criminal-Background Screening Procedures
paragraphs: As part of CMS’s enrollment-screening process, CMS has controls in  place to verify criminal-background information for providers and  suppliers in PECOS. CMS may deny or revoke a provider’s or supplier’s  enrollment in the Medicare program if, within the 10 years before  enrollment or revalidation of enrollment, the provider, supplier, or any  owner or managing employee of the provider or supplier was convicted of  a federal or state felony offense, including certain felony crimes against  persons, that CMS has determined to be detrimental to the best interests  of the program and its beneficiaries. In our April 2016 report, we found  that 16 out of 66 potentially ineligible providers we identified with criminal  backgrounds received $1.3 million in potential overpayments. These  providers were convicted of drug and controlled substance, health-care,  mail and wire fraud, or sex-related offenses and were enrolled in  Medicare before CMS had implemented more-extensive background  check processes in April 2014.
Before CMS revised procedures for reviewing the criminal backgrounds of  existing and prospective Medicare providers and suppliers in April 2014,  the agency relied on verifying applicants’ self-reported adverse legal  actions by checking whether providers and suppliers had previously lost  their licenses because of a conviction such as a crime against a person.  CMS also checked whether the HHS OIG had excluded providers and  suppliers from participating in federal health-care programs. According to  CMS, it also relied on Zone Program Integrity Contractors (ZPIC) to  identify providers and suppliers with a conviction history. However, CMS  did not always have access to federal or state offense information that  identified the cause of a provider’s or supplier’s license suspension or  exclusion from participating in federal health-care programs, which could  have led to an earlier ineligibility date.
In our April 2016 report, we found 52 providers whose offenses occurred  before the removal effective date that was provided to us by the MACs  and 14 additional providers that CMS did not remove. As mentioned  earlier, out of these 66 providers, 16 were paid about $1.3 million by  Medicare through the fee-for-service program. Specifically, 10 providers  were paid about $1.1 million between the time they were initially  convicted of a crime and the time that they were officially removed from  the program, and six other providers that were not removed were paid  about $195,000 during the year after their conviction. We referred all 66  cases to CMS for further review and requested an initial status update on  these providers by June 20, 2016. On May 16, 2016, CMS stated that it  determined that 52 of the providers had already been deactivated or  revoked; however, our report indicates that these providers were  deactivated and revoked and the effective removal date needed review.  Further, CMS indicated that it will continue to review these providers to  determine whether additional updates or actions are needed since we  found that theses providers had offenses that occurred before the  removal effective date that was provided by the MACs. Further, CMS  informed us that it will continue to review the remaining 14 providers.
Additionally, in April 2016, we reported that in April 2014 CMS  implemented steps that provide more information on the criminal  backgrounds of existing and prospective Medicare providers and  suppliers than it obtained previously. Specifically, CMS supplemented its  criminal-background controls by screening provider and supplier criminal  backgrounds through an automated screening process. Under this  revised process, MACs are to review an applicant’s self-reported license  information and whether the applicant has been excluded from  participating in federal health-care programs. In addition, CMS receives  information from ZPICs, which provide a conviction history on providers  and suppliers they investigate. The automated-screening contractor is to  supplement these controls by conducting criminal-background checks on  providers, suppliers, and organization principals (i.e., individuals with 5  percent or more ownership in the business). The contractor uses third- party vendor applications available to the public to conduct the criminal- background checks. As a result, CMS and its contractors obtain greater  access to data about federal and state offenses and the ability to conduct  a more-comprehensive review of provider and supplier criminal  backgrounds than in the past.
Chairman Murphy, Ranking Member DeGette, and Members of the  subcommittee, this concludes my prepared remarks. I look forward to  answering any questions that you may have at this time.
section_title: GAO Contact and Staff Acknowledgments
paragraphs: If you or your staff have any questions about this testimony, please  contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found  on the last page of this statement.
Individuals making key contributions to this testimony were Latesha Love,  Assistant Director; Gloria Proa; Ariel Vega; and Georgette Hagans.  Additionally, Marcus Corbin; Colin Fallon, and Maria McMullen provided  technical support; Shana Wallace, Jim Ashley, and Melinda Cordero  provided methodological guidance; and Brynn Rovito and Barbara Lewis  provided legal counsel.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.