Medicare Advantage: Fundamental Improvements Needed in CMS's Effort to Recover Substantial Amounts of Improper Payments
Published: 2016-04-08T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In 2014, Medicare paid about $160 billion to MA organizations to provide health care services for approximately 16 million beneficiaries. CMS, which administers Medicare, estimates that about 9.5 percent of its payments to MA organizations were improper, according to the most recent data—primarily stemming from unsupported diagnoses submitted by MA organizations. CMS currently uses RADV audits to recover improper payments in the MA program.
GAO was asked to review the extent to which CMS is addressing improper payments in the MA program. This report examines the extent to which (1) CMS's contract selection methodology for RADV audits facilitates the recovery of improper payments, (2) CMS has completed RADV audits and appeals in a timely manner, and (3) CMS has made progress toward incorporating RACs into the MA program to identify and assist with improper payment recovery. In addition to reviewing research literature and agency documents, GAO analyzed data from ongoing RADV audits of 2007 and 2011 payments—CMS's two initial contract-level RADV audits. GAO also interviewed CMS officials.
section_title: What GAO Found
paragraphs: Medicare Advantage (MA) organizations contract with the Centers for Medicare & Medicaid Services (CMS) to offer beneficiaries a private plan alternative to the original program and are paid a predetermined monthly amount by Medicare for each enrolled beneficiary. These payments are risk adjusted to reflect each enrolled beneficiary's health status and projected spending for Medicare-covered services. CMS conducts risk adjustment data validation (RADV) audits of MA contracts which facilitate the recovery of improper payments from MA organizations that submitted beneficiary diagnoses for payment adjustment purposes that were unsupported by medical records. With a separate national audit, CMS estimated that it improperly paid $14.1 billion in 2013 to MA organizations, primarily because of these unsupported diagnoses.
GAO found that CMS's methodology does not result in the selection of contracts for audit that have the greatest potential for recovery of improper payments. First, CMS's estimate of improper payment risk for each contract, which is based on the diagnoses reported for the beneficiaries in that contract, is not strongly correlated with unsupported diagnoses. Second, CMS does not use other available information to select the contracts at the highest risk of improper payments. As a result, 4 of the 30 contracts CMS selected for its RADV audit of 2011 payments were among the 10 percent of contracts estimated by CMS to be at the highest risk for improper payments. These limitations are impediments to CMS's goal of recovering improper payments and do not align with federal internal control standards, which require that agencies use quality information to achieve their program goals.
CMS's goal of eventually conducting annual RADV audits is in jeopardy because its two RADV audits to date have experienced substantial delays in identifying and recovering improper payments. RADV audits of 2007 and 2011 payments have taken multiple years and are still ongoing for several reasons. First, CMS's RADV audits rely on a system for transferring medical records from MA organizations that has often been inoperable. Second, CMS audit procedures have lacked specified time requirements for completing medical record reviews and for other steps in the RADV audit process. In addition, CMS has not established timeframes for appeal decisions at the first-level of the MA appeal process, as it has done in other contexts.
CMS has not expanded the recovery audit program to MA by the end of 2010, as it was required to do by the Patient Protection and Affordable Care Act. RACs have been used in other Medicare programs to recover improper payments for a contingency fee. In December 2015, CMS issued a request for information seeking industry comment on how an MA RAC could be incorporated into the RADV audit framework. CMS noted in its request that incorporating a RAC into the RADV framework would increase the number of MA contracts audited each year. CMS currently includes 30 MA contracts in each RADV audit, about 5 percent of all MA contracts. Despite the importance of increasing the number of contracts audited, CMS does not have specific plans or a timetable for incorporating RACs into the RADV audit framework, contrary to established project management principles, which stress the importance of developing an overall plan to meet strategic goals.
section_title: What GAO Recommends
paragraphs: GAO is making five recommendations to CMS to improve its processes for selecting contracts to include in the RADV audits, enhance the timeliness of the audits, and incorporate RACs into the RADV audits. HHS concurred with the recommendations.

section_title: Letter
paragraphs: In 2014, the federal government paid approximately $160 billion to  Medicare Advantage (MA) organizations—entities that offer a private plan  alternative to the Medicare fee-for-service (FFS) program. The Centers  for Medicare & Medicaid Services (CMS), an agency within the  Department of Health and Human Services (HHS), administers Medicare,  contracts with MA organizations, and pays them a monthly amount to  provide health care benefits to beneficiaries enrolled in these plans. In  2014, CMS had 570 contracts with MA organizations that served 15.8  million beneficiaries, constituting about 30 percent of all Medicare  beneficiaries.
Improper payments to MA organizations can result from unsupported  information those organizations provide to CMS for the calculation of  payment amounts. The Social Security Act requires that payments to MA  organizations be adjusted for variation in the cost of providing health care  to beneficiaries on the basis of various risk factors, including health  status. Through the risk adjustment process, for example, CMS  increases payments to MA organizations that enroll beneficiaries in  poorer health to compensate the organizations for the expected higher  spending on health care services for those beneficiaries. To risk adjust  payments, CMS first calculates a risk score—a relative measure of  projected Medicare spending based on diagnosis and demographic  information—for every Medicare beneficiary, including those in MA plans  and those in the FFS program. CMS requires MA organizations to submit  diagnosis codes for each beneficiary in a contract in order to calculate  risk scores. CMS has determined that improper payments in the MA  program stem from beneficiary diagnoses submitted for risk adjustment  purposes by MA organizations to CMS that are not supported by medical  documentation. As the MA program continues to grow, safeguarding the  program from loss is critical.
CMS conducts two types of risk adjustment data validation (RADV) audits  to identify and correct MA improper payments: national RADV activities  and contract-level RADV audits. Both types of audits determine whether  the diagnosis codes submitted by MA organizations are supported by a  beneficiary’s medical record documentation. CMS conducts national  RADV activities annually to estimate the national MA improper payment  rate under the Improper Payments Information Act of 2002 (IPIA), as  amended. Based on the most recent national audit, which reviewed 2013  payments, CMS released an MA improper payment estimate of 9.5  percent or $14.1 billion. CMS also estimated that 73 percent of the  improper payments resulted from MA organizations submitting insufficient  medical record documentation to CMS that did not support the diagnoses  those organizations had previously submitted to CMS to determine risk  adjustment payments. The second type of RADV audit, referred to as  contract-level audits, seeks to identify and recover improper payments  from MA organizations and thus to deter MA organizations from  submitting inaccurate beneficiary diagnoses. In 2008, CMS began  contract-level audits of 2007 payments to identify and recover payments  made in error for a sample of enrollees in 32 MA contracts. CMS stated it  had recovered about $14 million in improper payments from these RADV  audits of 2007 payments and may recover additional amounts depending  on the adjudication of appeals filed by MA organizations challenging  some of the audit findings. Since 2010, CMS has spent about $117  million on both types of audits.
CMS’s goal is to annually conduct contract-level audits to recover  improper payments efficiently, among other things. That is, CMS plans to  recoup overpayments by calculating a payment error rate for a sample of  enrollees in each audited contract and then extrapolating that error rate to  estimate the total amount of improper payments made under the  contract. As a first step, CMS officials stated that the agency has begun  contract-level audits of 2011 payments using the same contract selection  and beneficiary sampling methodology as its contract-level audits of 2007  payments. Using this methodology, CMS selected a sample of 30  contracts to audit in November 2013. According to CMS officials, the  agency will offset any overpayments by the amount of any  underpayments the agency discovers, but will not reimburse payments to  MA organizations if estimated underpayments exceed overpayments. MA  organizations have the right to appeal audit results within 60 days of  receiving them. CMS estimates that the contract-level audits of 2011  payments will recover about $370 million (about 3 percent of 2011 MA  improper payments) after extrapolation. In addition, the Patient Protection  and Affordable Care Act required CMS to expand the recovery audit  program into the MA program to identify and assist CMS with improper  payment recovery. Recovery audit contractors (RAC) are entities that  conduct postpayment reviews to identify and correct potential improper  payments.
You asked us to examine the extent to which CMS is addressing  improper payments in MA. In this report, we examine  (1) the extent to which CMS’s contract selection methodology for  contract-level RADV audits facilitates the recovery of improper  payments;  (2) the extent to which CMS has completed contract-level RADV  audits and appeals in a timely manner; and  (3) CMS’s progress toward incorporating RACs into the MA program  to identify and assist with improper payment recovery.
To examine the extent to which CMS’s contract selection methodology for  contract-level RADV audits facilitates the recovery of improper payments,  we reviewed agency documents such as HHS’s Financial Report for fiscal  years 2014 and 2015, which contain CMS’s objectives and goals for the  contract-level audits; analyzed contract-level RADV audit data from CMS;  reviewed research documents; and interviewed CMS officials about MA  contracts. We examined the extent to which CMS’s contract selection  methodology accounts for a contract’s total improper payment recovery  potential in several ways. First, we examined whether the contracts  selected for the contract-level RADV audits of 2007 payments were  among those likely to have had high improper payment rates by  comparing CMS’s estimate of risk for those contracts with the actual rates  of unsupported diagnoses documented in the audit. Second, we  examined the extent to which CMS’s contract selection methodology for  the 2011 contract-level RADV audits successfully identified contracts with  the greatest improper payment risk by comparing the agency’s estimate  of risk of improper payment for its selected contracts with its estimate of  risk for all other MA contracts. Third, because contract-level audits of  2011 payments are ongoing, we analyzed the results of the 2007  contract-level RADV audits of payments to inform our assessment of  CMS’s current measurement of improper payment risk. We reviewed  literature on MA contracts to determine whether CMS’s estimate of  improper payment risk for each contract (referred to as coding intensity)  properly accounted for changes in beneficiary health status. In addition,  we evaluated CMS’s contract selection methodology against applicable  internal control standards for federal agencies.
To examine the extent to which CMS has completed contract-level RADV  audits and appeals in a timely manner, we compared the total time  required for the 2007 and 2011 contract-level RADV audits in light of  CMS’s goal of conducting contract-level RADV audits annually. To do so,  we reviewed agency documents and contract-level RADV audit results  and interviewed CMS officials. We also compared RADV time frames to  those from similar audit processes in Medicare’s FFS program. To  determine the timeliness of one part of the audit process—CMS’s time  frame for the MA organizations to submit medical records—we examined  the percentage of audited diagnoses that were submitted by MA  organizations by CMS’s deadline. We also assessed the prevalence of  RADV appeals for the 2007 contract-level RADV audits, the number of  appeals adjudicated by CMS after MA organizations were notified of  contract-level RADV audit decisions, and how long it has taken to  complete the medical record dispute and appeal process. We evaluated  CMS’s audit activities against established project management  principles. For additional context, we interviewed officials from the  American Medical Association (AMA), American Hospital Association  (AHA), America’s Health Insurance Plans (AHIP), and two MA  organizations with contracts that underwent both 2007 and 2011 contract- level RADV audits. The views of these two MA organizations do not  represent the views of all MA organizations.
To examine CMS’s progress toward incorporating RACs into the MA  program to identify and recover improper payments, we reviewed CMS  documents, including CMS’s 2014 Medicare Part C RAC Statement of  Work and CMS’s proposed 2015 Medicare Part C RAC Statement of  Work, and interviewed CMS officials. We evaluated CMS’s progress  toward incorporating a RAC in the MA program against established  project management principles, which call for developing an overall plan  and monitoring framework to meet strategic goals. We also interviewed  officials representing three of the four RACs that conduct claims review in  Medicare’s FFS program to obtain their perspectives on CMS’s plans for  incorporating RACs into the MA program. For additional context, we  interviewed officials from the AMA, AHA, and AHIP.
We conducted this performance audit from October 2014 to April 2016 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: Contract-Level RADV Audit Process
paragraphs: There are four major steps in the contract-level RADV audit process as  reported by CMS:
MA contract selection. CMS selects 30 MA organization contracts for  contract-level RADV audits, which agency officials stated provides a  sufficient representation of contracts (about 5 percent) without  imposing unreasonable costs on the agency. An MA organization  may have more than one contract selected for a contract-level RADV  audit. CMS selects contracts based on diagnosis coding intensity,  which the agency defines for each contract as the average change in  the risk score component specifically associated with the reported  diagnoses for the beneficiaries covered by the contract. That is,  increases in coding intensity measure the extent to which the  estimated medical needs of the beneficiaries in a contract increase  from year to year; thus, contracts whose beneficiaries appear to be  getting “sicker” at a relatively rapid rate, based on the information  submitted to CMS, will have relatively high coding intensity scores.  Contracts with the highest increases in coding intensity are those with  beneficiaries whose reported diagnoses increased in severity at the  fastest rates. CMS officials stated that the agency adopted this  selection methodology to (1) focus the contract-level RADV audits on  MA organization contracts that might be more likely to have submitted  diagnoses that are not supported by the medical records and (2)  provide additional oversight of contracts with the most aggressive  coding. To be eligible for a contract-level audit, MA contracts must  have had at least three pair-years of data that can be used to  distinguish a change in disease risk scores from one year to the next;  that is, the contract must have been in place for at least 4 years of  continuous payment activity plus the audit year. For each pair year,  CMS’s coding intensity calculation excludes beneficiaries not enrolled  in the same contract or not eligible for Medicare in consecutive years.  CMS ranks contracts by coding intensity and divides them into three  categories: high, medium, and low. CMS then randomly selects  contracts for audit: 20 from the high category, 5 from the medium  category, and 5 from the low category. According to CMS officials,  this strategy ensures contracts with the highest coding intensity— considered high risk for improper payments by CMS—have a higher  probability for audit while keeping all contracts at risk for review.
MA beneficiary sampling. After CMS selects 30 MA contracts to audit,  the agency selects the beneficiaries whose medical records will be the  focus of review. Up to 201 beneficiaries are chosen from each  contract based on the individuals’ risk scores using a stratified random  sample: 67 beneficiaries from each of the three risk score groups  (highest one-third of risk scores, the middle one-third, and the lowest  third).
Medical record collection and review. After selecting beneficiaries for  review, CMS requests supporting medical record documentation for  all diagnoses submitted to adjust risk in the payment year. The MA  organization may submit up to five medical records per audited  diagnosis. CMS contractors review the submitted medical records to  determine if the records support the diagnoses submitted by the MA  organizations. If the initial reviewer determines that a diagnosis is not  supported, a second reviewer reviews the case.
Payment error calculation and extrapolation. When medical record  review is completed, CMS extrapolates a payment error rate to the  entire contract beginning with contract-level audits of 2011 payments.
Each beneficiary’s payment error is multiplied by a sampling weight  and the number of months the beneficiary was enrolled in the MA  contract during the payment year. After these beneficiary-level  payment errors are summed, the amount CMS will seek to recover will  be reduced by (1) using the lower limit of a 99 percent confidence  interval based on the sample and (2) reducing the recovery amount by  a FFS adjuster amount that estimates payment errors that would have  likely occurred in FFS claims data. Once the recovery amount is  finalized, CMS releases contract-level RADV audit finding reports to  each audited MA organization, which may dispute the results of  medical record review or appeal the audit findings. Beginning with the  contract-level RADV audits of 2011 payments, CMS will collect  extrapolated overpayments from MA organizations once all appeals  are final.
section_title: Recovery Audit Contractors
paragraphs: Recovery auditors have been used in various industries, including health  care, to identify and collect overpayments. The Medicare Prescription  Drug, Improvement, and Modernization Act of 2003 directed CMS to test  the use of RACs to identify overpayments and underpayments through a  postpayment review of FFS medical claims and recoup overpayments.  The Tax Relief and Health Care Act of 2006 required CMS to implement a  permanent national recovery audit contractor program by January 1, 2010  and to compensate RACs using a contingency fee structure under which  the RACs are paid from recovered overpayments. The Patient  Protection and Affordable Care Act expanded the recovery audit program  initiated in Medicare FFS to MA plans under Part C, among other things.
section_title: CMS Encounter Data
paragraphs: In future contract-level RADV audits, CMS also will review diagnoses  submitted through MA encounter data. While CMS previously collected  diagnoses from MA organizations, in 2012 the agency also began  collecting encounter data from MA organizations similar to that submitted  on FFS claims. CMS requires MA organizations to submit, via the  Encounter Data System, encounter data weekly, biweekly, or monthly  depending on their number of enrollees. Encounter data include  diagnosis and treatment information recorded by providers for all medical  services and may either originate from claims that providers submit to MA  organizations for payment or from MA organizations’ medical record  review. CMS started including the diagnosis information from MA  encounter data from 2014 dates of service when calculating 2015  enrollee risk scores.
section_title: CMS Does Not Focus MA RADV Audits on Contracts with the Highest Potential for Improper Payments
subsections: section_title: CMS’s Estimate of MA Improper Payment Risk Has Shortcomings
paragraphs: While coding intensity scores can be helpful in assessing the likelihood of  improper payments for MA contracts, results from the CMS contract-level  RADV audits of 2007 payments indicate that the coding intensity scores  CMS calculated were not strongly correlated with the percentage of  unsupported diagnoses within a contract. The fact that this correlation is  not strong reduces the likelihood that contracts selected for audit would  be those most likely to yield large amounts of improper payments and  hampers CMS’s goal of using the audits to recover improper payments.  In addition, internal control standards for federal agencies state that  agencies should use and communicate quality information in achieving  program goals. Figure 1 shows, for example, that CMS reported that the  percentage of unsupported diagnoses (36.0 percent) among the high  coding intensity contracts it audited was nearly identical to the percentage  of unsupported diagnoses (35.7 percent) among the medium coding  intensity contracts audited. In addition, 7 contracts in the high coding  intensity group had unsupported diagnosis rates below 30 percent,  including the contract with the highest coding intensity score.
Several shortcomings in CMS’s methods for calculating coding intensity  could have weakened the correlation between the degree of coding  intensity and the percentage of improper payments. These shortcomings  and their potential effects are as follows.
subsections: section_title: Comparability of Risk Scores across Years
paragraphs: CMS’s coding intensity calculation may be based on noncomparable  coding intensity scores across contracts because (1) the years of data  used for each contract may not be the same and (2) coding intensity  scores are not standardized to control for year-to-year differences. First,  although CMS officials stated that the agency requires at least three pair- years of data for each contract, the agency includes data from all  available years for each contract, which may vary between contracts.  Because the growth in risk scores was lower in the MA program in earlier  years among beneficiaries that continuously enrolled in the program,  CMS’s inconsistent standard of years measured for each contract would  tend to calculate higher coding intensity scores for contracts that entered  the MA market during periods of higher risk score growth. Among  beneficiaries who enrolled in MA in consecutive years, the growth in  average risk scores was 0.106 from 2004 through 2006, 0.119 from 2006  through 2010, and 0.132 from 2010 through 2013. Second, CMS  officials stated that the agency does not standardize its coding intensity  data relative to a measure of central tendency. Because CMS’s coding  intensity calculation does not account for the expected increase in risk  scores during each period of growth, changes in risk scores may be more  volatile from year to year than they would likely be if standardized or  indexed to a measure of central tendency.
section_title: Targeting Diagnoses Most Likely Related to Coding Intensity
paragraphs: CMS’s coding intensity calculation does not distinguish between the  diagnoses that were likely coded by providers and the diagnoses that  were likely revised by MA organizations. MA organizations may receive  diagnoses from providers that are related to services rendered to MA  beneficiaries. Because these diagnoses are submitted by providers, the  medical records they create may be more likely to support these  diagnoses compared with diagnoses that are subsequently coded by the  MA organization through medical record chart reviews. For future years,  CMS has an available method to distinguish between diagnoses likely  submitted by providers to MA organizations and diagnoses that were  likely later added by MA organizations. CMS’s Encounter Data System  provides a way for MA organizations to designate supplemental  diagnoses that the organization added or revised after conducting  medical record review. CMS has not outlined plans for incorporating  encounter data into its contract selection methodology, even though the  encounter data could help target the submitted diagnoses that may be  most likely related to improper payments in the future.
section_title: Contract Consolidation
paragraphs: CMS follows contracts that are renewed or consolidated under a different  existing contract within the same MA organization; however, the agency’s  coding intensity calculation does not include the prior risk scores of the  prior contract in the MA organization’s renewed contract. This may result  in overestimated improper payment risk if MA organizations move  beneficiaries with higher risk scores—such as those with special needs— into one consolidated contract.
section_title: CMS Does Not Always Select Contracts Based on Evidence of the Potential for Improper Payments
paragraphs: CMS’s contract selection methodology did not (1) always target contracts  with the highest coding intensity scores, (2) use results from prior  contract-level RADV audits, (3) account for contract consolidation, and (4)  account for contracts with high enrollment. These shortcomings are  impediments to CMS’s goal of recovering improper payments and are  counter to federal internal control standards, which require that agencies  use quality information to achieve their program goals.
subsections: section_title: Contracts with Highest Coding Intensity
paragraphs: For the 2011 contract-level RADV audits, CMS used a contract selection  methodology that did not focus on contracts with the highest coding  intensity scores. While we found that coding intensity scores are not  strongly correlated with diagnostic discrepancies, they are somewhat  correlated. CMS failed to fully consider that correlation for the 2011  contract-level RADV audit. For that audit, CMS officials stated that 20 of  the 30 contracts were chosen because they were among the top third of  all contracts in coding intensity, but we found that many of the 20  contracts were not at the highest risk for improper payments according to  CMS’s estimate of coding intensity. Only 4 of the 20 contracts ranked  among the highest 10 percent in coding intensity, while 8 of the 20  contracts ranked below the 75th percentile in the coding intensity  distribution (see fig. 2). In addition, CMS chose 5 of the 30 contracts  because they were among the bottom third of all contracts in coding  intensity, even though CMS’s contract-level RADV audits of 2007  payments found that all contracts in the lowest third of the agency’s  coding intensity calculation had a below-average percentage of  unsupported diagnoses. CMS officials stated that the RADV contract  selection methodology includes these contracts to show that all contracts  are at risk of being audited. However, officials also stated that MA  organizations are not informed of their contracts’ coding intensity relative  to all other MA contracts; thus, MA organizations cannot be certain their  contracts will not be audited even if CMS announced it will no longer audit  low coding intensity contracts.
According to agency officials, CMS’s 2011 contract-level RADV contract  selection methodology also did not consider results from the agency’s  prior RADV audits, potentially overlooking information indicating contracts  with known improper payment risk. Thus, contracts with the highest rates  of unsupported diagnoses in the 2007 contract-level RADV audits were  not among those selected for 2011 contract-level RADV audits. While  CMS selected 6 contracts for 2011 that also underwent 2007 contract- level RADV audits, only 1 of these contracts was among the 10 with the  highest rates of unsupported diagnoses in 2007. For the 2011 contract- level RADV audits, CMS officials stated that the agency selected 6 MA  contracts because the HHS Office of Inspector General had conducted  audits of 2007 payments on those contracts, but CMS did not know the  rates of unsupported diagnoses for those contracts and did not determine  which of them were at high risk of improper payments.
section_title: Contract Consolidation
paragraphs: By not considering results from prior contract-level RADV audits, CMS’s  contract selection methodology also did not account for contract  consolidation. An MA organization may have more than one contract in a  service area; further, it may no longer have a contract that underwent a  prior RADV audit but continue to operate another contract within the  same service area. For example, the contract with the highest rate of  unsupported diagnoses in the 2007 contract-level RADV audit is no  longer in place, but the MA organization continues to operate a different  contract that includes the service area from its prior contract. Thus,  without considering all of an MA organization’s contracts in that service  area, CMS cannot audit the beneficiaries affiliated with the highest  percentage of unsupported diagnoses in 2007.
section_title: Contracts with High Enrollment
paragraphs: Although the potential dollar amount of improper payments to MA  organizations with high rates of unsupported diagnoses is likely greater  when contract enrollment is large, CMS officials stated that the 2011  contract-level RADV contract selection methodology did not account for  contracts with high enrollment. In 2011, the median enrollment among MA  contracts was about 5,000, while enrollment at the 90th percentile was  nearly 45,000. Some MA contracts with large enrollment had high rates of  unsupported diagnoses under prior contract-level RADV audits. For  example, 5 of the 10 MA contracts with the highest rates of unsupported  diagnoses for the 2007 contract-level RADV audits had 2011 enrollment  above the 90th percentile.
section_title: CMS’s RADV Process Has Experienced Substantial Delays in Completing Contract- Level RADV Audits and Appeals Prior Contract-Level RADV Audits Have Been Ongoing for Years, and CMS Lacks a Timetable to Annually Conduct and Complete Audits
paragraphs: CMS officials reported that current contract-level RADV audits have been  ongoing for several years, including the appeals associated with the 2007  contract-level RADV audits. (See fig. 3.) For audits of 2007 payments,  CMS notified MA organizations in November 2008 that their contracts  would be audited but did not complete medical record review until  approximately 4-1/2 years later in March 2013. Similarly, 2011 contract- level RADV audits had not been completed as of August 2015. CMS  notified MA organizations of contract audit selection in November 2013  but did not begin medical record review for these contracts until May  2015. CMS officials said the agency will start collecting payments from  the 2011 contract-level RADV audits in fiscal year 2016. As the agency is  in the medical record review phase, appeals have not yet started. This  slow progress in completing audits is contrary to CMS’s goal to conduct  contract-level RADV audits on an annual basis and slows its recovery of  improper payments.
In addition, CMS lacks a timetable that would help the agency to  complete these contract-level audits on an annual cycle. In contrast, the  national RADV audit that calculates the national improper payment  estimate uses a timetable, but this is not applied to the contract-level  audits. The national RADV audits that CMS annually conducts to  estimate the national MA improper payment rate under IPIA provide the  agency with a possible timetable for completing annual contract-level  RADV audits. CMS has not followed established project management  principles in this regard, which call for developing an overall plan to meet  strategic goals and to complete projects in a timely manner.
In addition to the lack of a timetable, other factors have lengthened the  time frame of the contract-level audit process. First, CMS’s sequential  notification to MA organizations—first identifying which contracts had  been selected for audit and then later identifying which beneficiaries  under these contracts would be audited—hinders the agency’s goal of  conducting annual contract-level audits because it creates a time gap.  For example, for the 2011 contract-level audits, CMS officials stated that  the agency notified MA organizations about the beneficiaries whose  diagnoses would be audited 3 months after notifying these same MA  organizations about which contracts had been selected for audit. Both the  selection of contracts and beneficiaries currently require risk score and  beneficiary enrollment data.
Second, ongoing performance issues with the web-based system CMS  uses to receive medical records submitted by MA organizations for  contract-level RADV audits caused CMS to substantially lengthen the  time frame for MA organizations to submit these medical records for the  2011 contract-level RADV audits. According to CMS officials, for the 2007  contract-level RADV audits, MA organizations submitted medical records  for 98 percent of all audited diagnoses within a 16-week time frame.  However, system performance issues with the Central Data Abstraction  Tool (CDAT)—CMS’s web-based system for transferring and receiving  contract-level RADV audit data—led CMS to more than triple the medical  record submission time frame for the 2011 contract-level RADV audits to  over 1 year. Officials from AHIP and the two MA organizations we  interviewed indicated that CDAT often proved inoperable, with significant  delays and errors in uploading files. CMS officials stated that the agency  suspended the use of CDAT for 8 months and implemented steps to  monitor and test CDAT’s performance. CMS officials stated that they  have implemented steps to continue monitoring and testing CDAT’s  performance. However, officials from MA organizations stated that CDAT  continued to experience significant delays in uploading files after CMS  reopened CDAT for use. Officials of one MA organization suspected that  the system may have been overwhelmed because CMS increased the  number of medical records allowed per audited diagnosis from one to five  between the 2007 and 2011 contract-level audits. For future medical  record submissions, CMS officials subsequently told us that they plan to  use a 20-week submission period and did not indicate to us any plans for  an additional medical record submission method if CDAT’s problems  persisted.
CMS’s Medicare FFS program has increasingly used the Electronic  Submission of Medical Documentation System (ESMD) to transfer  medical records reliably from providers to Medicare contractors since  2011. Both ESMD and CDAT allow for the electronic submission of  medical records by securely uploading and submitting medical record  documentation in a portable document format file. CMS officials stated  that the agency did not use ESMD to transfer medical records primarily  because it could not also be used for medical record review like CDAT.  However, medical records could be reviewed without being transferred  through CDAT. The transfer of medical records has been the main source  of delay in completing CMS’s contract-level audits of 2011 payments, and  CMS has not assessed the feasibility of updating ESMD for transferring  medical records in contract-level RADV audits. While ESMD was not  available when CMS began its 2007 contract-level RADV audits, the  system has demonstrated a greater capacity for transferring medical  records than CDAT. In fiscal year 2014, providers used ESMD to transfer  nearly 500,000 medical records—far beyond the capacity necessary for  contract-level RADV audits. In interviews, officials of two FFS RACs  stated that ESMD was very reliable and did not have technical issues that  affected audits.
In addition, CMS has not applied time limits to contract-level RADV  reviewers for completing medical record reviews. These reviews took 3  years for the 2007 contract-level RADV audits. In contrast, CMS generally  requires its Medicare Administrative Contractors (MAC)—a type of FFS  contractor—to make postpayment audit determinations within 60 days of  receiving medical record documentation. Because CMS has not  required that contract-level RADV auditors complete medical record  reviews within a specific time period, the agency is hindering its ability to  reach its goal of conducting annual contract-level RADV audits.
section_title: Disputes and Appeals of Contract-Level RADV Audits Have Been Ongoing for Years, and CMS Has Not Incorporated Measures to Expedite the Process
paragraphs: Disputes and appeals stemming from the 2007 contract-level RADV audit  findings have been ongoing for years and the lack of time frames at the  first level of the appeal process hinders CMS from achieving its goal of  using contract-level audits to recoup improper payments. Nearly all MA  organizations whose contracts were included in the 2007 contract-level  RADV audit cycle disputed at least one diagnosis finding following  medical record review, and five MA organizations disputed all the findings  of unsupported diagnoses. CMS officials stated that MA organizations in  total disputed 624 (4.3 percent) of the 14,388 audited diagnoses, and that  the determinations on these disputes, which were submitted starting  March 2013 through May 2013, were not complete until July 2014.
If an MA organization disagrees with the medical record dispute  determination, the MA organization may appeal to a hearing officer. This  appeal level is called review by a CMS hearing officer. Because the  medical record dispute process for the 2007 contract-level RADV audit  cycle took nearly 1-1/2 years to complete, CMS officials stated that the  agency did not receive all 2007 second-level appeal requests for hearing  officer review until August 2014. CMS officials stated that the hearing  officer adjudicated or received a withdrawal request from the MA  organization for 377 of the 624 appeals (60 percent) from August 2014  through September 2015.
Appeals for the 2011 contract-level RADV audit cycle have yet to begin,  as CMS officials stated that the agency is currently in the process of  reviewing medical records submitted by MA organizations for the 2011  contract-level RADV audits. CMS officials stated that the medical record  dispute process for the 2011 contract-level RADV audit cycle will differ  from the process used during the 2007 cycle in certain respects. In  particular, for the 2011 RADV audit cycle, the medical record dispute  process will be incorporated into the appeal process instead of being part  of the audit process, as it was during the 2007 cycle. The new first-level  appeal process, in which an MA organization can submit a written request  for an independent reevaluation of the RADV audit decision, will be called  the reconsideration stage. This change will allow MA organizations to  request reconsideration of medical record review determinations  simultaneously with the appeal of payment error calculations, rather than  sequentially, as was the case during the 2007 contract-level RADV audit  cycle.
While such a change may be helpful, the new process does not establish  time limits for when reconsideration decisions must be issued. In contrast,  CMS generally imposes a 60-day time limit on MA organization decisions  regarding beneficiary payment first-level appeals in MA. CMS measures  the timeliness of decisions regarding MA beneficiary first-level appeals to  assist the agency in assigning quality performance ratings and bonus  payments to MA organizations. Similarly in Medicare FFS, officials  generally must issue decisions within 60 days of receiving first-level  appeal requests. CMS officials stated that due to the agency’s limited  experience with the contract-level RADV audit process, time limits were  not imposed at the reconsideration appeal level and that this issue may  be revisited once CMS completes a full contract-level RADV audit cycle.  The lack of explicit time frames for appeal decisions at the  reconsideration level hinders CMS’s collection of improper payments as  the agency cannot recover extrapolated overpayments until the MA  organization exhausts all levels of appeal and is inconsistent with  established project management principles.
section_title: CMS Has Made Little Progress toward Incorporating a Recovery Audit Contractor in MA
paragraphs: CMS has not expanded the RAC program to MA, as it was required to do  by the end of 2010 by the Patient Protection and Affordable Care Act.  CMS issued a request for industry comment regarding implementation of  the MA RAC on December 27, 2010, seeking stakeholder input regarding  potential ways improper payments could be identified in MA using RACs.  CMS reported that it had received all stakeholder comments from this  request by late February 2011. CMS issued a request for proposals for  the MA RAC in July 2014. As defined by the Statement of Work in that  request, the MA RAC would audit improper payments in the audit areas of  Medicare secondary payer, end-stage renal disease, and hospice. In  October 2014, CMS officials told us that the agency did not receive any  proposals to conduct the work in those three audit areas and that CMS’s  goal was to reissue the MA RAC solicitation in 2015.
In November 2015, CMS officials told us that the agency is no longer  considering Medicare secondary payer, end-stage renal disease, and  hospice services as audit areas for the MA RAC. Instead, the officials told  us that CMS was exploring whether and how an MA RAC could assist  CMS with contract-level RADV audits. In December 2015, CMS issued a  request for information seeking industry comment regarding how an MA  RAC could be incorporated into CMS’s existing contract-level RADV audit  framework. In the request document, CMS stated that it is seeking an  MA RAC to help the agency expand the number of MA contracts subject  to audit each year. In the request, CMS stated that its ultimate goal is to  have all MA contracts subject to either a contract-level RADV audit or  what it termed a condition-specific RADV audit for each payment year.  Officials we interviewed from three of the current Medicare FFS RACs all  acknowledged that their organizations had the capacity and willingness to  conduct contract-level RADV audits.
Despite its recent request for information, CMS does not have specific  plans or a timetable for including RACs in the contract-level RADV audit  process. Established project management principles call for developing  an overall plan and monitoring framework to meet strategic goals. A  plan and timetable would help guide CMS’s efforts in incorporating a RAC  in MA and help hold the agency accountable for implementing this  requirement from the Patient Protection and Affordable Care Act. Once  the requirement is implemented, CMS could leverage the MA RAC in  order to increase the number of MA organization contracts audited.  CMS’s recovery of improper payments has been restricted because it has  not established an MA RAC. For example, CMS currently plans to include  30 MA contracts in contract-level RADV audits for each payment year,  about 5 percent of all contracts.
section_title: Conclusions
paragraphs: Limitations in CMS’s processes for selecting contracts for audit, in the  timeliness of CMS’s audit and appeal processes, and in the agency’s  plans for using MA RACs to assist in identifying improper payments  hinder the accomplishment of its contract-level RADV audit goals: to  conduct annual contract-level audits and recover improper payments.  These limitations are also inconsistent with federal internal control  standards and established project management principles. Our analyses  of these processes and plans suggest that CMS will likely recover a small  portion of the billions of dollars in MA improper payments that occur every  year. Shortcomings in CMS’s MA contract selection methodology may  result in audits that are not focused on the contracts most likely to be  disproportionately responsible for improper payments. Furthermore,  CMS’s RADV time frames are so long that they may hamper the agency’s  efforts to conduct audits annually, collect extrapolated payments  efficiently, and use audit results to inform future RADV contract selection.  By CMS’s own estimates, conducting annual contract-level audits would  potentially allow CMS to recover hundreds of millions of dollars more in  improper payments each year. Agency officials have expressed concerns  about the intensive agency resources required to conduct contract-level  RADV audits. To address the resource requirements of conducting  contract-level audits, CMS intends to leverage the MA RACs for this  purpose; however, the agency has not outlined how it plans to incorporate  RACs into the contract-level RADV audits and is in the early stages of  soliciting industry comment regarding how to do so.
section_title: Recommendations for Executive Action
paragraphs: As CMS continues to implement and refine the contract-level RADV audit  process, we recommend that the Administrator of CMS take actions in the  following five key areas to improve the efficiency and effectiveness of  reducing and recovering improper payments.
First, to improve the accuracy of CMS’s calculation of coding intensity, the  Administrator should modify that calculation by taking actions such as the  following:  including only the three most recent pair-years of risk score data for  all contracts;  standardizing the changes in disease risk scores to account for the  expected increase in risk scores for all MA contracts; developing a method of accounting for diagnostic errors not coded by  providers, such as requiring that diagnoses added by MA  organizations be flagged as supplemental diagnoses in the agency’s  Encounter Data System to separately calculate coding intensity  scores related only to diagnoses that were added through MA  organizations’ supplemental record review (that is, were not coded by  providers); and  including MA beneficiaries enrolled in contracts that were renewed  from a different contract under the same MA organization during the  pair-year period.
Second, the Administrator should modify CMS’s selection of contracts for  contract-level RADV audits to focus on those contracts most likely to have  high rates of improper payments by taking actions such as the following: excluding contracts with low coding intensity scores; selecting more contracts with the highest coding intensity scores;  selecting contracts with high rates of unsupported diagnoses in prior  contract-level RADV audits;  if a contract with a high rate of unsupported diagnoses is no longer in  operation, selecting a contract under the same MA organization that  includes the service area of the prior contract; and  selecting some contracts with high enrollment that also have either  high rates of unsupported diagnoses in prior contract-level RADV  audits or high coding intensity scores.
Third, the Administrator should enhance the timeliness of CMS’s contract- level RADV process by taking actions such as the following:  closely aligning the time frames in CMS’s contract-level RADV audits  with those of the national RADV audits the agency uses to estimate  the MA improper payment rate;  reducing the time between notifying MA organizations of contract  audit selection and notifying them about the beneficiaries and  diagnoses that will be audited;  improving the reliability and performance of the agency’s process for  transferring medical records from MA organizations, including  assessing the feasibility of updating ESMD for use in transferring  medical records in contract-level RADV audits; and  requiring that CMS contract-level RADV auditors complete their  medical record reviews within a specific number of days comparable  to other medical record review time frames in the Medicare program.
Fourth, the Administrator should improve the timeliness of CMS’s  contract-level RADV appeal process by requiring that reconsideration  decisions be rendered within a specified number of days comparable to  other medical record review and first-level appeal time frames in the  Medicare program.
Fifth, the Administrator should ensure that CMS develops specific plans  and a timetable for incorporating a RAC in the MA program as mandated  by the Patient Protection and Affordable Care Act.
section_title: Agency Comments
paragraphs: We provided a draft of this report to HHS for comment. HHS provided  written comments, which are printed in appendix I. HHS concurred with  our recommendations. In its comment letter, HHS also reaffirmed its  commitment to identifying and correcting improper payments in the MA  program. HHS also provided technical comments, which we incorporated  as appropriate. Based on HHS’s technical comments, we revised our  suggested actions for how HHS could meet GAO’s first recommendation.
As agreed with your office, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to the  appropriate congressional committees and the Secretary of Health and  Human Services. In addition, this report will be available at no charge on  the GAO website at http://www.gao.gov.
If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix II.
section_title: Appendix I: Comments from the Department of Health and Human Services
section_title: Appendix II: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
paragraphs: James Cosgrove, (202) 512-7114 or cosgrovej@gao.gov.
section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, individuals making key  contributions to this report include Martin T. Gahart, Assistant Director;  Luis Serna III; and Marisa Beatley. Elizabeth T. Morrison and Jennifer  Whitworth also provided valuable assistance.