Medicare: Progress Made to Deter Fraud, but More Could Be Done
Published: 2012-06-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: GAO has designated Medicare as a high-risk program. Since 1990, every two years GAO has provided Congress with an update on this program, which highlights government operations that are at high risk for waste, fraud, abuse mismanagement or in need of broad reform. Medicare has been included in this program in part because its complexity makes it particularly vulnerable to fraud. Fraud involves an intentional act or representation to deceive with the knowledge that the action or representation could result in gain. The deceptive nature of fraud makes its extent in the Medicare program difficult to measure in a reliable way, but it is clear that fraud contributes to Medicares fiscal problems. Reducing fraud could help rein in the escalating costs of the program.
This statement focuses on the progress made and important steps to be taken by CMS and its program integrity contractors to reduce fraud in Medicare. These contractors perform functions such as screening and enrolling providers, detecting and investigating potential fraud, and identifying improper payments and vulnerabilities that could lead to payment errors. This statement is based on relevant GAO products and recommendations issued from 2004 through 2012 using a variety of methodologies, such as analyses of Medicare claims, review of relevant policies and procedures, and interviews with officials.
section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services (CMS)the agency that administers Medicarehas made progress in implementing several key strategies GAO identified in prior work as helpful in protecting Medicare from fraud; however, important actions that could help CMS and its program integrity contractors combat fraud remain incomplete.
Provider Enrollment : GAOs previous work found persistent weaknesses in Medicares enrollment standards and procedures that increased the risk of enrolling entities intent on defrauding the program. CMS has strengthened provider enrollmentfor example, in February 2011, CMS designated three levels of riskhigh, moderate, and limitedwith different screening procedures for categories of providers at each level. However, CMS has not completed other actions, including implementation of some relevant provisions of the Patient Protection and Affordable Care Act (PPACA). Specifically, CMS has not (1) determined which providers will be required to post surety bonds to help ensure that payments made for fraudulent billing can be recovered, (2) contracted for fingerprint-based criminal background checks, (3) issued a final regulation to require additional provider disclosures of information, and (4) established core elements for provider compliance programs.
Pre- and Post-payment Claims Review : GAO had previously found that increased efforts to review claims on a prepayment basis can prevent payments from being made for potentially fraudulent claims, while improving systems used by CMS and its contractors to review claims on a post-payment basis could better identify patterns of potentially fraudulent billing for further investigation. CMS has controls in Medicares claims-processing systems to determine if claims should be paid, denied, or reviewed further. These controls require timely and accurate information about providers that GAO has previously recommended that CMS strengthen. GAO is currently examining CMSs new Fraud Prevention System, which uses analytic methods to examine claims before payment to develop investigative leads for Zone Program Integrity Contractors (ZPIC), the contractors responsible for detecting and investigating potential fraud. Additionally, CMS could improve its post-payment claims review to identify patterns of fraud by incorporating prior GAO recommendations to develop plans and timelines for fully implementing and expanding two information technology systems it developed.
Robust Process to Address Identified Vulnerabilities : Having mechanisms in place to resolve vulnerabilities that lead to erroneous payments is critical to effective program management and could help address fraud. Such vulnerabilities are service- or system-specific weaknesses that can lead to payment errorsfor example, providers receiving multiple payments as a result of incorrect coding. GAO has previously identified weaknesses in CMSs process for addressing identified vulnerabilities and the Department of Health and Human Services Office of Inspector General recently reported on CMSs inaction in addressing vulnerabilities identified by its contractors, including ZPICs. GAO is evaluating the current status of the process for assessing and developing corrective actions to address vulnerabilities.

section_title: Letter
paragraphs: I am pleased to be here today to discuss our work regarding fraud in the  Medicare program, Medicare contractors’ roles in detecting and  preventing fraud, and provisions in recent laws and agency actions that  may help address this problem. Fraud involves an intentional act or  representation to deceive with the knowledge that the action or  representation could result in gain. Although there have been convictions  for multi-million dollar schemes that defrauded the Medicare program, the  extent of the problem is unknown. There are no reliable estimates of the  extent of fraud in the Medicare program or for the health care industry as  a whole. By its very nature, fraud is difficult to detect, as those involved  are engaged in intentional deception. For example, fraud may involve  providers submitting a claim with false documentation for services not  provided, while the claim on its face may appear valid. Fraud also can  involve efforts to hide ownership of companies or kickbacks to obtain  beneficiary information. Although the full extent of the problem is  unknown, it is clear that the Medicare program is vulnerable to fraud,  which contributes to Medicare’s fiscal problems. Reducing fraud could  help rein in the escalating costs of the program.
We have repeatedly designated Medicare as a high-risk program, as its  complexity and susceptibility to payment errors from various causes,  added to its size, have made it vulnerable to loss. As one example, the  fee-for-service (FFS) portion of the Medicare program processes over a  billion claims a year from about 1.5-million providers and suppliers;  working to ensure that those payments are accurate is a complex,  ongoing task. Medicare has many individual vulnerabilities, which are  service- or system-specific weaknesses that can lead to payment errors,  including those due to fraud. If the Centers for Medicare & Medicaid  Services (CMS), the agency within the Department of Health and Human  Services (HHS) that administers the program, suspects that providers or  suppliers are billing fraudulently, it can take action, including suspending  claims payment, revoking billing privileges, or referring cases to law  enforcement for investigation. Further, it can impose a moratorium on  new enrollment of providers or suppliers. Since 1997, Congress has  provided funds specifically for activities to address fraud, as well as waste  and abuse, in Medicare and other federal health care programs. In  addition, Congress created the Medicare Integrity Program to conduct  activities to reduce fraud, waste, abuse, and improper payments. In  2010, Congress passed the Patient Protection and Affordable Care Act  (PPACA), which provided additional funding for such efforts and set a  number of new requirements specific to Medicare. Furthermore, the  Small Business Jobs Act of 2010service claims review requirements and provided funding to implement  these requirements.
My testimony today focuses on the progress made and steps that remain  to be taken by CMS and its program integrity contractors to reduce fraud  in Medicare. CMS contractors perform a number of key program integrity  functions, such as screening and enrolling providers, detecting and  investigating potential fraud, and identifying improper payments and  vulnerabilities that could lead to payment errors. This testimony is  informed by 8 years of our work on Medicare fraud, waste, abuse, and  improper payments. I will focus on several key strategies CMS can  undertake to help reduce fraud discussed in our prior work from 2004 to  2012, specifically:  strengthening provider enrollment standards and procedures, improving pre- and post-payment claims review, and developing a robust process for addressing identified vulnerabilities.
The products on which this statement is based were developed by using  a variety of methodologies, including analyses of Medicare claims, review  of relevant policies and procedures, interviews with agency officials and  other stakeholders, and site visits. The work on which these products  were based was conducted in accordance with generally accepted  government auditing standards. Those standards require that we plan  and perform the audit to obtain sufficient, appropriate evidence to provide  a reasonable basis for our findings and conclusions based on our audit  objectives. We believe that the evidence obtained provides a reasonable  basis for our findings and conclusions based on our audit objectives.
subsections: section_title: CMS Has Made Progress in Strengthening Provider Enrollment, but Further Actions Are Needed
paragraphs: CMS has made progress strengthening provider enrollment to try to better  ensure that only legitimate providers and suppliers are allowed to bill  Medicare. However, CMS has not completed other actions that could help  prevent individuals intent on fraud from enrolling, including  implementation of some relevant PPACA provisions.
subsections: section_title: Past CMS Efforts to Strengthen Provider Enrollment
paragraphs: Our previous work found persistent weaknesses in Medicare’s enrollment  standards and procedures that increased the risk of enrolling entities  intent on defrauding the Medicare program. We, CMS, and the HHS  Office of Inspector General (OIG) have previously identified two types of  providers whose services and items are especially vulnerable to improper  payments and fraud—home health agencies (HHA) and suppliers of  durable medical equipment, prosthetics, orthotics, and supplies  (DMEPOS). We found weaknesses in oversight of these providers’ and  suppliers’ enrollment. For example, in 2008, we identified weaknesses  when we created two fictitious DMEPOS companies, which were  subsequently enrolled by CMS’s contractor and given permission to begin  billing Medicare. In 2009, we found that CMS’s contractors were not  requiring HHAs to resubmit enrollment information for re-verification every  5 years as required by CMS.
To strengthen the Medicare enrollment process, in 2006 CMS began  requiring all providers and suppliers—including those that order HHA  services or DMEPOS for beneficiaries to be enrolled in Medicare. The  agency also required all providers and suppliers to report their National  Provider Identifiers (NPI) on enrollment applications, which can help  address fraud because providers and suppliers must submit either their  Social Security Number or their employer identification number and state  licensing information to obtain an NPI. In 2007, CMS initiated the first   This  phase of a Medicare competitive-bidding program for DMEPOS.program requires suppliers’ bids to include new financial documentation  for the year prior to submitting the bids. Because CMS can now disqualify  suppliers based in part on new scrutiny of their financial documents,  competitive bidding can help reduce fraud. Finally, in 2010, CMS also  required that all DMEPOS suppliers be accredited by a CMS-approved  accrediting organization to ensure that they meet certain quality  standards. Such accreditation also increased scrutiny of these  businesses.
section_title: CMS Has Taken Action on Certain PPACA Provider Enrollment Provisions
paragraphs: PPACA authorized CMS to implement several actions to strengthen  provider enrollment. As of April 2012, the agency has completed some of  these actions.
Screening Provider Enrollment Applications by Risk Level: CMS and OIG  issued a final rule with comment period in February 2011 to implement  some of the new screening procedures required by PPACA. CMS  designated three levels of risk—high, moderate, and limited—with  different screening procedures for categories of Medicare providers at  each level. Providers in the high-risk level are subject to the most rigorous  screening. To determine which providers to place in these risk levels,  CMS considered issues such as past occurrences of improper payments  and fraud among different categories of providers. Based in part on our  work and that of the OIG, CMS designated newly enrolling HHAs and  DMEPOS suppliers as high risk and designated other providers at lower  levels. (See table 1.) Providers at all risk levels are screened to verify that  they meet specific requirements established by Medicare such as having  current licenses or accreditation and valid Social Security numbers.  High- and moderate-risk providers are additionally subject to  unannounced site visits. Further, depending on the risks presented,  PPACA authorizes CMS to require fingerprint-based criminal history  checks, and the posting of surety bonds for certain providers. CMS may  also provide enhanced oversight for specific periods for new providers  and for initial claims of DMEPOS suppliers.
CMS indicated that the agency will continue to review the criteria for its  screening levels on an ongoing basis and would publish changes if the  agency decided to update the assignment of screening levels for  categories of Medicare providers. This may become necessary because  fraud is not confined to HHAs and DMEPOS suppliers. We are currently  examining the types of providers involved in fraud cases investigated by  the OIG and the Department of Justice (DOJ), which may help illuminate  risk to the Medicare program from different types of providers. Further, in  their 2011 annual report on the Health Care Fraud and Abuse Control  Program, DOJ and HHS reported convictions or other legal actions, such  as exclusions or civil monetary penalties, against several types of  Medicare providers other than DMEPOS suppliers and HHAs, including  pharmacists, orthopedic surgeons, infusion and other types of medical  clinics, and physical therapy services. CMS also has established  triggers for adjustments to an individual provider’s risk level. For example,  CMS regulations state that an individual provider or supplier at the  limited- or moderate-risk level that has had its billing privileges revoked by  a Medicare contractor within the last 10 years and is attempting to re- enroll, would move to the high-risk level for screening.
New National Enrollment Screening and Site Visit Contractors: In a  further effort to strengthen its enrollment processes, CMS contracted with  two new entities at the end of 2011 to assume centralized responsibility  for automated screening of provider and supplier enrollment and for  conducting site visits of providers.
Automated-screening contractor. In December 2011, the new  contractor began to establish systems to conduct automated  screening of providers and suppliers to ensure they meet Medicare  eligibility criteria (such as valid licensure, accreditation, a valid NPI,  and no presence on the OIG list of providers and suppliers excluded  from participating in federal health care programs). Prior to the  implementation of this new automated screening, such screening was  done manually for the 30,000 enrollees each month by CMS’s  Medicare Administrative Contractors (MAC), which enroll Medicare  providers, and the National Supplier Clearinghouse (NSC), which  enrolls DMEPOS suppliers. According to CMS, the old screening  process was neither efficient nor timely. CMS officials said that in  2012, the automated-screening contractor began automated  screening of the licensure status of all currently enrolled Medicare  providers and suppliers. The agency said it expects the automated- screening contractor to begin screening newly enrolling providers and  suppliers later this year. CMS expects that the new, national  contractor will enable better monitoring of providers and suppliers on  a continuous basis to help ensure they continue to meet Medicare  enrollment requirements. The new screening contractor will also help  the MACs and the NSC maintain enrollment information in CMS’s  Provider Enrollment Chain and Ownership System (PECOS)—a  database that contains details on enrolled providers and suppliers. In  addition, CMS officials said the automated-screening contractor is  developing an individual risk score for each provider or supplier,  similar to a credit risk score. Although these individual scores are not  currently used to determine an individual provider’s placement in a  risk level, CMS indicated that this risk score may be used eventually  as additional risk criteria in the screening process.
Site visits for all providers designated as moderate and high risk.
Beginning in February 2012, a single national site-visit contractor  began conducting site visits of moderate- and high-risk providers to  determine if sites are legitimate and the providers meet certain  Medicare standards. The contractor collects the same information  from each site visit, including photographic evidence that will be  available electronically through a Web portal accessible to CMS and  its other contractors. The national site-visit contractor is expected to  validate the legitimacy of these sites. CMS officials told us that the  contractor will provide consistency in site visits across the country, in  contrast to CMS relying on different MACs to conduct any required  site visits.
section_title: CMS Has Not Completely Implemented Some PPACA Enrollment Provisions
paragraphs: Implementation of other enrollment screening actions authorized by  PPACA that could help CMS reduce the enrollment of providers and  suppliers intent on defrauding the Medicare program remains incomplete,  including:
Surety bond—PPACA authorizes CMS to require a surety bond for  certain types of at-risk providers, which can be helpful in recouping  erroneous payments. CMS officials expect to issue a proposed rule to  require surety bonds as conditions of enrollment for certain other  types of providers. Extending the use of surety bonds to these new  entities would augment a previous statutory requirement for DMEPOS  suppliers to post a surety bond at the time of enrollment. CMS  issued final instructions to its MACs, effective February 2012, for  recovering DMEPOS overpayments through surety bonds. CMS  officials reported that as of April 19, 2012, they had issued notices to  20 surety bond companies indicating intent to collect funds, but had  not collected any funds as of that date.
Fingerprint-based criminal background checks—CMS officials told  us that they are working with the Federal Bureau of Investigation to  arrange contracts to help conduct fingerprint-based criminal  background checks of high-risk providers and suppliers. On April 13,  2012, CMS issued a request for information regarding the potential  solicitation of a single contract for Medicare provider and supplier  fingerprint-based background checks. The agency expects to have  the contract in place before the end of 2012.
Providers and suppliers disclosure—CMS officials said the agency  is reviewing options to include in regulations for increased disclosures  of prior actions taken against providers and suppliers enrolling or  revalidating enrollment in Medicare, such as whether the provider or  supplier has been subject to a payment suspension from a federal  health care program. In April 2012, agency officials indicated that  they were not certain when the regulation would be published. CMS  officials noted that the additional disclosure requirements are  complicated by provider and supplier concerns about what types of  information will be collected, what CMS will do with it, and how the  privacy and security of this information will be maintained.
Compliance and ethics program—CMS officials said that the  agency was studying criteria found in OIG model plans as it worked to  address the PPACA requirement that the agency establish the core  elements of compliance programs for providers and suppliers.April 2012, CMS did not have a projected target date for  implementation.
section_title: Additional Action May Help Better Identify Potential Fraud through Pre- and Post- Payment Claims Review
paragraphs: Increased efforts to review claims on a prepayment basis can better  prevent payments that should not be made, while improving systems  used to review claims on a post-payment basis could better identify  patterns of fraudulent billing for further investigation.
subsections: section_title: Additional Efforts to Improve Prepayment Claims Review May Help Reduce Fraud
paragraphs: Having robust controls in claims payment systems to prevent payment of  problematic claims can help reduce loss. As claims go through  Medicare’s electronic claims payment systems, they are subjected to  automated prepayment controls called “edits,” instructions programmed in  the systems to prevent payment of incomplete or incorrect claims. Some  edits use provider enrollment information, while others use information on  coverage or payment policies, to determine if claims should be paid. Most  of these controls are fully automated; if a claim does not meet the criteria  of the edit, it is automatically denied. Other prepayment edits are manual;  they flag a claim for individual review by trained staff who determine if it  should be paid. Due to the volume of claims, CMS has reported that less  than 1 percent of Medicare claims are subject to manual medical record  review by trained staff.
Having effective pre-payment edits that deny claims for ineligible  providers and suppliers depends on having timely and accurate  information about them, such as whether the providers are currently  enrolled and have the appropriate license or accreditation to provide  specific services. We previously recommended that CMS take action to  ensure the timeliness and accuracy of PECOS—the database that  maintains Medicare provider and supplier enrollment information. We  noted that weaknesses in PECOS data may result in CMS making  improper payments to ineligible providers and suppliers. These  weaknesses are related to the frequency with which CMS’s contractors  update enrollment information and the timeliness and accuracy of  information obtained from outside entities, such as state licensing boards,  the OIG, and the Social Security Administration’s Death Master File,  which contains information on deceased individuals that can be used to  identify deceased providers in order to terminate those providers’  Medicare billing privileges. These sources vary in the ease in which CMS  contractors have been able to access their data and the frequency with  which they are updated. CMS has indicated that its new national- screening contractor should improve the timeliness and accuracy of the  provider and supplier information in PECOS by centralizing the process,  increasing automation of the process, continuously checking databases,  and incorporating new sources of data, such as financial, business, tax,  and geospatial data. However, it is too soon to tell if these efforts will  better prevent payments to ineligible providers and suppliers.
Having effective edits to implement coverage and payment policies before  payment is made can also help to deter fraud. The Medicare program has  defined categories of items and services eligible for coverage and  excludes from coverage items or services that are determined not to be  “reasonable and necessary for the diagnosis and treatment of an illness  or injury or to improve functioning of a malformed body part.” its contractors set policies regarding when and how items and services  will be covered by Medicare, as well as coding and billing requirements  for payment, which also can be implemented in the payment systems  through edits. We have previously found Medicare’s payment systems did  not have edits for items and services unlikely to be provided in the normal  course of medical care. CMS has since implemented edits to flag such  claims—called Medically Unlikely Edits. We are currently assessing  Medicare’s prepayment edits based on coverage and payment policies,  including the Medically Unlikely Edits.
42 U.S.C. § 1395y(a)(1)(A).
Additionally, suspending payments to providers suspected of fraudulent  billing can be an effective tool to prevent excess loss to the Medicare  program while suspected fraud is being investigated. For example, in  March 2011, the OIG testified that payment suspensions and pre- payment edits on 18 providers and suppliers stopped the potential loss of  more than $1.3 million submitted in claims by these individuals.  Furthermore, HHS recently reported that it imposed payment suspensions  on 78 home health agencies in conjunction with arrests related to a  multimillion-dollar health care fraud scheme. While CMS had the authority  to impose payment suspensions prior to PPACA, the law specifically  authorized CMS to suspend payments to providers pending the   CMS officials reported that  investigation of credible allegations of fraud.the agency had imposed 212 payment suspensions since the regulations  implementing the PPACA provisions took effect. Agency officials  indicated that almost half of these suspensions were imposed this  calendar year, representing about $6 million in Medicare claims.
CMS is replacing its legacy Program Safeguard Contractors (PSC) with seven ZPICs.  While the PSCs were responsible for program integrity for specific parts of Medicare, such  as Part A, the ZPICs are responsible for Medicare’s fee-for-service program integrity in  their geographic zones. For simplicity, we refer to these program integrity contractors as  ZPICs throughout the testimony. suspicious patterns or abnormalities in Medicare provider networks,  claims billing patterns, and beneficiary utilization. According to CMS, FPS  may enhance CMS’s ability to identify potential fraud because it analyzes  large numbers of claims from multiple data sources nationwide  simultaneously before payment is made, thus allowing CMS to examine  billing patterns across geographic regions for those that may indicate  fraud. The results of FPS are used by the ZPICs to initiate investigations  that could result in payment suspensions, implementation of automatic  claim denials, identification of additional prepayment edits, or the  revocation of Medicare billing privileges. CMS began using FPS to screen  all FFS claims nationwide prior to payment as of June 30, 2011, and CMS  has been directing the ZPICs to investigate high priority leads generated  by the system. Because FPS is relatively new and we have not completed  our work, it is too soon to determine whether FPS will improve CMS’s  ability to address fraud. Questions have also been raised about CMS’s  ability to adequately assess ZPICs’ performance and we have been  asked to examine CMS’s management of the ZPICs, including criteria  used by CMS to evaluate their effectiveness.  “Bust-out” fraud schemes in which providers or suppliers suddenly bill  very high volumes of claims to obtain large payments from Medicare  could be addressed by adding a prepayment edit. Such an edit would set  thresholds to stop payment for atypically rapid increases in billing thus  helping them to stem losses from these schemes. In our prior work on  DMEPOS, we recommended that CMS require its contractors to develop  thresholds for unexplained increases in billing and use them to develop  pre-payment controls that could suspend these claims for further review  before payment. CMS officials told us that they are currently considering  developing analytic models in FPS that could help CMS and ZPICs  identify and address billing practices suggestive of bust outs.
section_title: Actions Needed to Improve Use of Systems Intended for Post-payment Claims Review
paragraphs: Further actions are needed to improve use of two CMS information  technology systems that could help CMS and program integrity  contractors identify fraud after claims have been paid.
The Integrated Data Repository (IDR) became operational in  September 2006 as a central data store of Medicare and other data  needed to help CMS’s program integrity staff, ZPICs, and other  contractors prevent and detect improper payments of claims.  However, we found IDR did not include all the data that were planned  to be incorporated by fiscal year 2010, because of technical obstacles  and delays in funding. Further, as of December 2011 the agency had  not finalized plans or developed reliable schedules for efforts to  incorporate these data, which could lead to additional delays.
One Program Integrity (One PI) is a Web portal intended to provide  CMS staff, ZPICs, and other contractors with a single source of  access to data contained in IDR, as well as tools for analyzing those  data. While One PI is operational, we reported in December 2011 that  CMS had trained few program integrity analysts and that the system  was not being widely used.
GAO recommended that CMS take steps to finalize plans and reliable  schedules for fully implementing and expanding the use of both IDR and  One PI. Although the agency told us in April 2012 that it had initiated  activities to incorporate some additional data into IDR and expand the use  of One PI, such as training more ZPIC and other staff, it has not fully  addressed our recommendations.
section_title: A Robust Process to Address Identified Vulnerabilities Could Help Reduce Fraud
paragraphs: Having mechanisms in place to resolve vulnerabilities that lead to  improper payments is critical to effective program management and could  help address fraud. A number of different types of program integrity  contractors are responsible for identifying and reporting vulnerabilities to  CMS. However, our work and the work of OIG have shown weaknesses  in CMS’s processes to address vulnerabilities identified by these  contractors.
CMS’s Recovery Audit Contractors (RAC) are specifically charged with  identifying improper payments and vulnerabilities that could lead to such  payment errors. However, in our March 2010 report on the RAC  demonstration program, we found that CMS had not established an  adequate process during the demonstration or in planning for the national  program to ensure prompt resolution of such identified vulnerabilities in  Medicare; further, the majority of the most significant vulnerabilities  identified during the demonstration were not addressed. recommended that CMS develop and implement a corrective action  process that includes policies and procedures to ensure the agency  promptly (1) evaluates findings of RAC audits, (2) decides on the  appropriate response and a time frame for taking action based on  established criteria, and (3) acts to correct the vulnerabilities identified.
GAO, Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing  Vulnerabilities to Improper Payments, Although Improvements Made to Contractor  Oversight, GAO-10-143 (Washington, D.C.: Mar. 31, 2010). by other contractors were resolved. CMS had not resolved or taken  significant action to resolve 38 of 44 vulnerabilities (86 percent) reported  in 2009 by ZPICs. Only 1 vulnerability had been fully resolved by January  2011. The OIG made several recommendations, including that CMS  have written procedures and time frames to assure that vulnerabilities  were resolved. CMS has indicated that it is now tracking vulnerabilities  identified from several types of contractors through a single vulnerability  tracking process. We are currently examining aspects of CMS’s  vulnerability tracking process and will be reporting on it soon.
section_title: Concluding Observations
paragraphs: Although CMS has taken some important steps to identify and prevent  fraud, including implementing provisions in PPACA and the Small  Business Jobs Act, more remains to be done to prevent making  erroneous Medicare payments due to fraud. In particular, we have found  CMS could do more to strengthen provider enrollment screening to avoid  enrolling those intent on committing fraud, improve pre- and post- payment claims review to identify and respond to patterns of suspicious  billing activity more effectively, and identify and address vulnerabilities to  reduce the ease with which fraudulent entities can obtain improper  payments. It is critical that CMS implement and make full use of new  authorities granted by recent legislation, as well as incorporate  recommendations made by us, as well as the OIG in these areas. Moving  from responding once fraud has already occurred to preventing it from  occurring in the first place is key to ensuring that federal funds are used  efficiently and for their intended purposes.
As all of these new authorities and requirements become part of  Medicare’s operations, additional evaluation and oversight will be  necessary to determine whether they are implemented as required and  have the desired effect. We have several studies underway that assess  efforts to fight fraud in Medicare and that should continue to help CMS  refine and improve its fraud detection and prevention efforts. Notably, we  are assessing the effectiveness of different types of pre-payment edits in  Medicare and of CMS’s oversight of its contractors in implementing those  edits to help ensure that Medicare pays claims correctly the first time. We  are also examining the use of predictive analytics by CMS and the ZPICs  to improve fraud prevention and detection. ZPICs play an important role  in detecting and investigating fraud and identifying vulnerabilities, and  FPS will likely play an increasing role in how ZPICs conduct their work.  Additionally, we have work under way to identify the types of providers  and suppliers currently under investigation and those that have been  found to have engaged in fraudulent activities. These studies may enable  us to point out additional actions for CMS that could help the agency  more systematically reduce fraud in the Medicare program.
Due to the amount of program funding at risk, fraud will remain a  continuing threat to Medicare, so continuing vigilance to reduce  vulnerabilities will be necessary. Individuals who want to defraud  Medicare will continue to develop new approaches to try to circumvent  CMS’s safeguards and investigative and enforcement efforts. Although  targeting certain types of providers that the agency has identified as high  risk may be useful, it may allow other types of providers committing fraud  to go unnoticed. We will continue to assess efforts to fight fraud and  provide recommendations to CMS, as appropriate, that we believe will  assist the agency and its contractors in this important task. We urge CMS  to continue its efforts as well.
Mr. Chairman, this concludes my prepared statement. I would be happy  to answer any questions you or other members of the committee may  have.
For further information about this statement, please contact Kathleen M.  King at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this statement. Thomas Walke, Assistant Director; Michael  Erhardt; Eden Savino; and Jennifer Whitworth were key contributors to  this statement.
section_title: Related GAO Products
paragraphs: Medicare Program Integrity: CMS Continues Efforts to Strengthen the  Screening of Providers and Suppliers. GAO-12-351. Washington, D.C.:  April 24, 2012.
Improper Payments: Remaining Challenges and Strategies for  Governmentwide Reduction Efforts. GAO-12-573T. Washington, D.C.:  March 28, 2012.  2012 Annual Report: Opportunities to Reduce Duplication, Overlap   and Fragmentation, Achieve Savings, and Enhance Revenue.   GAO-12-342SP. Washington, D.C.: February 28, 2012.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Expand Efforts to Support Program Integrity Initiatives.   GAO-12-292T. Washington, D.C.: December 7, 2011.
Medicare Part D: Instances of Questionable Access to Prescription  Drugs. GAO-12-104T. Washington, D.C.: October 4, 2011.
Medicare Part D: Instances of Questionable Access to Prescription  Drugs. GAO-11-699. Washington, D.C.: September 6, 2011.
Medicare Integrity Program: CMS Used Increased Funding for New  Activities but Could Improve Measurement of Program Effectiveness.  GAO-11-592. Washington, D.C.: July 29, 2011.
Improper Payments: Reported Medicare Estimates and Key Remediation  Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011.
Fraud Detection Systems: Additional Actions Needed to Support   Program Integrity Efforts at Centers for Medicare and Medicaid Services.  GAO-11-822T. Washington, D.C.: July 12, 2011.
Fraud Detection Systems: Centers for Medicare and Medicaid Services  Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.:  June 30, 2011.
Medicare and Medicaid Fraud, Waste, and Abuse: Effective  Implementation of Recent Laws and Agency Actions Could Help Reduce  Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011.
Medicare: Program Remains at High Risk Because of Continuing  Management Challenges. GAO-11-430T. Washington, D.C.:   March 2, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.:   February 2011.
Medicare Part D: CMS Conducted Fraud and Abuse Compliance Plan  Audits, but All Audit Findings Are Not Yet Available. GAO-11-269R.  Washington, D.C.: February 18, 2011.
Medicare Fraud, Waste, and Abuse: Challenges and Strategies for  Preventing Improper Payments. GAO-10-844T. Washington, D.C.:   June 15, 2010.
Medicare Recovery Audit Contracting: Weaknesses Remain in  Addressing Vulnerabilities to Improper Payments, Although  Improvements Made to Contractor Oversight. GAO-10-143.   Washington, D.C.: March 31, 2010.
Medicare Part D: CMS Oversight of Part D Sponsors’ Fraud and Abuse  Programs Has Been Limited, but CMS Plans Oversight Expansion.  GAO-10-481T. Washington, D.C.: March 3, 2010.
Medicare: CMS Working to Address Problems from Round 1 of the  Durable Medical Equipment Competitive Bidding Program. GAO-10-27.  Washington, D.C.: November 6, 2009.
Improper Payments: Progress Made but Challenges Remain in  Estimating and Reducing Improper Payments. GAO-09-628T.  Washington, D.C.: April 22, 2009.
Medicare: Improvements Needed to Address Improper Payments in  Home Health. GAO-09-185. Washington, D.C.: February 27, 2009.
Medicare Part D: Some Plan Sponsors Have Not Completely  Implemented Fraud and Abuse Programs, and CMS Oversight Has Been  Limited. GAO-08-760. Washington, D.C.: July 21, 2008.
Medicare: Covert Testing Exposes Weaknesses in the Durable Medical  Equipment Supplier Screening Process. GAO-08-955. Washington, D.C.:  July 3, 2008.
Medicare: Thousands of Medicare Providers Abuse the Federal Tax  System. GAO-08-618. Washington, D.C.: June 13, 2008.
Medicare: Competitive Bidding for Medical Equipment and Supplies  Could Reduce Program Payments, but Adequate Oversight Is Critical.  GAO-08-767T. Washington, D.C.: May 6, 2008.
Improper Payments: Status of Agencies’ Efforts to Address Improper  Payment and Recovery Auditing Requirements. GAO-08-438T.  Washington, D.C.: January 31, 2008.
Improper Payments: Federal Executive Branch Agencies’ Fiscal   Year 2007 Improper Payment Estimate Reporting. GAO-08-377R.   Washington, D.C.: January 23, 2008.
Medicare: Improvements Needed to Address Improper Payments   for Medical Equipment and Supplies. GAO-07-59. Washington, D.C.:  January 31, 2007.
Medicare: More Effective Screening and Stronger Enrollment   Standards Needed for Medical Equipment Suppliers. GAO-05-656.  Washington, D.C.: September 22, 2005.
Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending  for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17,  2004.
Medicare: CMS Did Not Control Rising Power Wheelchair Spending.  GAO-04-716T. Washington, D.C.: April 28, 2004.
This is a work of the U.S. government and is not subject to copyright protection in the  United States. The published product may be reproduced and distributed in its entirety  without further permission from GAO. However, because this work may contain  copyrighted images or other material, permission from the copyright holder may be  necessary if you wish to reproduce this material separately.