Medicare: More Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment Suppliers
Published: 2005-09-22T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: In fiscal year 2004, the Centers for Medicare & Medicaid Services (CMS) estimated that Medicare improperly paid $900 million for durable medical equipment, prosthetics, orthotics, and supplies--in part due to fraud by suppliers. To deter such fraud, CMS contracts with the National Supplier Clearinghouse (NSC) to verify that suppliers meet 21 standards before they can bill Medicare. NSC verifies adherence to the standards through on-site inspections and document reviews. Recent prosecutions of fraudulent suppliers suggest that there may be weaknesses in NSC's efforts to screen suppliers or in the standards. In this report, GAO evaluated: 1) NSC's efforts to verify suppliers' compliance with the 21 standards, 2) the adequacy of the standards to screen suppliers, and 3) CMS's oversight of NSC's efforts.
section_title: What GAO Found
paragraphs: NSC's efforts to verify compliance with the 21 standards are insufficient because of weaknesses in two key screening procedures--checking state licensure and conducting on-site inspections. NSC's licensure check is ineffective because it relies on self-reported information about the items suppliers intend to provide to beneficiaries and does not match this against actual billing later. We found a total of 22 suppliers in Florida, Louisiana, and Texas that had each been paid at least $1,000 by Medicare in 2004 for providing oxygen services, but did not have the required state license. Further, more than half of the almost $107 million paid by Medicare for custom-fabricated orthotics and prosthetics in Florida in 2004 went to suppliers that had not had their licenses checked. At least 46 of these suppliers were under investigation for fraud as of April 2005. NSC's on-site inspections also have weaknesses that limit their effectiveness. We estimate that NSC did not conduct required on-site inspections of 605 suppliers. Further, when conducting on-site inspections, NSC does not require its inspectors to examine beneficiary files to assess whether suppliers are meeting the standard to maintain proof of delivery or check whether suppliers have a real source of inventory, as required by Medicare. Medicare's 21 standards are currently too weak to be used effectively to screen medical equipment suppliers. Although Medicare paid suppliers about $8.8 billion in fiscal year 2004, the program's 21 standards do not include measures related to supplier integrity and capability analogous to those that federal agencies generally apply to prospective contractors or those used by at least two state Medicaid programs for their suppliers. For example, in sworn testimony before the Committee on Finance in April 2004, an individual who pleaded guilty to Medicare fraud described how she was able to open a sham business with $3,000--despite lacking the experience and the financial, technical, and managerial resources to operate a legitimate supply company. If an agency finds a company does not meet federal contracting standards for integrity and capability, the agency may decline to award it a contract. If a contractor performs inadequately, the agency can terminate the contract. Further, agencies may disqualify a contractor from competing for other federal contracts. In addition, a California supplier that is disenrolled from Medicaid for failing to meet state requirements cannot reenroll for 3 years. In contrast, if a Medicare supplier can later demonstrate compliance with the 21 standards, CMS readmits it into the program. CMS's oversight has not been sufficient to determine whether NSC is meeting its responsibilities in screening and enrolling DMEPOS suppliers. For example, CMS was unaware--until we informed the agency--that NSC had not conducted all required on-site inspections for suppliers. Moreover, while CMS has established performance goals for NSC related primarily to processing applications, it has not established a method to evaluate NSC's success in identifying noncompliant and fraudulent suppliers and recommending that they be removed from the program.

section_title: Letter
paragraphs: Medicare is the federal program that helps pay for a variety of health care  services and items on behalf of almost 42 million elderly and certain  disabled beneficiaries. One of the responsibilities of the Centers for  Medicare & Medicaid Services (CMS), the agency that administers  Medicare, is to minimize improper payments made on behalf of its  beneficiaries. Improper payments result from mistakes on the part of  those who bill Medicare; abusive activities; or fraud, which is intentional  misrepresentation. According to CMS estimates, in fiscal year 2004,  Medicare paid about $8.8 billion in claims for durable medical equipment,  prosthetics, orthotics, and supplies (DMEPOS), of which $900 million  were improper payments. As we previously reported in November 2004,  some improper payments were made to DMEPOS suppliers that were  committing fraud. For example, in one 2003 criminal case, 20 individuals  in Arizona pleaded guilty to charges of defrauding Medicare of more than  $25 million by creating about 30 sham companies that billed for DMEPOS  items that they did not deliver or that had not been ordered by the  beneficiaries’ physicians. Similarly, in 2004, the government won a civil  suit against 24 DMEPOS suppliers for $366 million as treble damages to  settle charges of falsely billing Medicare for items not needed or delivered  as claimed.
Because identifying and prosecuting suppliers engaged in fraudulent  activity is time consuming, resource intensive, and costly, CMS tries to  prevent potentially fraudulent entities from entering the Medicare  program. To do so, using its statutory authority, CMS developed  regulations that define the 21 standards that DMEPOS suppliers must meet  to be authorized to bill Medicare for items and services that they provide  to beneficiaries. The 21 standards are intended to help ensure that  suppliers are legitimate businesses as well as properly licensed by the  states in which they operate—and therefore qualified—to provide  DMEPOS items and services. CMS contracts with the National Supplier  Clearinghouse (NSC) to screen potential suppliers and enroll those that  comply with the 21 standards into the Medicare program. NSC verifies  DMEPOS suppliers’ compliance with most of the standards through on-site  inspections and conducts other verification procedures using information  from the applications or gathered during the on-site inspections. Enrolled  suppliers are authorized to bill Medicare, and to retain their billing  privileges must apply for reenrollment and be rescreened every 3 years.  NSC may also verify compliance with the standards at other times— usually when it receives information about possible noncompliance or  fraud.
Despite these safeguards, recent prosecutions of fraudulent suppliers that  successfully billed Medicare suggest that there may be weaknesses in  NSC’s efforts to verify compliance with the standards or in the standards  themselves. Due to concerns that such weaknesses may leave the  Medicare program vulnerable to improper billing practices or allow  unqualified suppliers to serve beneficiaries, you asked us to examine the  procedures used by NSC to ensure that DMEPOS suppliers are legitimate  businesses and are qualified to bill Medicare. In this report, we evaluated:  1) NSC’s efforts to verify suppliers’ compliance with the 21 standards,   2) the adequacy of the standards used to screen suppliers, and 3) CMS’s  oversight of NSC’s efforts.
To evaluate NSC’s efforts to verify suppliers’ compliance with the  standards, we examined NSC’s contract statement of work and its written  procedures. Through this analysis, we determined that checking DMEPOS  suppliers’ state licenses and conducting on-site inspections were two of  the most important verification procedures and we focused our review on  them. We analyzed Medicare DMEPOS claims data for 2003 and 2004 in  four states—Florida, Illinois, Louisiana, and Texas—and information from  NSC’s supplier database. This helped us determine whether suppliers had  the state licenses necessary for the items they billed and whether NSC had  conducted all required on-site inspections. We chose these states because  they have licensure requirements for certain DMEPOS items and have  suppliers with fraudulent Medicare DMEPOS billings. We assessed the  reliability of the 2003 and 2004 claims data from CMS and the NSC supplier  data files by performing electronic testing of required data elements,  reviewing existing information about the data and the systems that  produced them, and interviewing CMS and NSC officials knowledgeable  about the data. We determined that these data were sufficiently reliable to  address the issues in this report. We also accompanied NSC staff on  supplier on-site inspections and had our Forensic Audits and Special  Investigations staff investigate selected suppliers and companies  associated with them in Florida and Texas.
To determine the adequacy of the 21 standards to screen suppliers, we  compared them to certain standards applicable to government contracting  and for participating as Medicaid DMEPOS suppliers in California and  Florida. Further, we analyzed appeals from suppliers that had their  supplier numbers denied or revoked to better understand their infractions  and obtained documentation on criminal cases of suppliers that had  defrauded Medicare or were under active investigation. We interviewed  fraud inspectors at NSC and in the Department of Health and Human  Services Office of Inspector General (OIG), as well as DMEPOS suppliers  and their representatives. To assess CMS’s oversight of NSC, we reviewed  the agency’s written evaluation procedures, evaluation reports, and other  documents related to the agency’s oversight. In addition, we interviewed  NSC and CMS officials about NSC’s efforts to verify compliance, the  adequacy of the standards, and CMS’s oversight of NSC. Appendix I  includes a more detailed discussion of our scope and methodology. Our  work was conducted from June 2004 to September 2005 in accordance  with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: Most Medicare beneficiaries elect to enroll in Part B insurance, which  helps pay for certain physician, outpatient hospital, laboratory, and other  services; DME, such as oxygen, wheelchairs, hospital beds, and walkers;  prosthetics and orthotics; and certain supplies. Medicare, under Part B,  pays for most DMEPOS based on a series of state-specific or regional- specific fee schedules. Under the schedules, Medicare pays 80 percent,  and the beneficiary pays the balance, of either the actual charge submitted  by the supplier or the fee schedule amount, whichever is less. To review  and process DMEPOS claims, CMS contracts with four insurance  companies, known as DME regional carriers. The DME regional carriers  review and pay DMEPOS claims submitted by outpatient providers and  suppliers on behalf of beneficiaries residing in specific regions of the  country.
CMS contracts with Palmetto Government Benefits Administrators to  serve as the National Supplier Clearinghouse. In fiscal year 2004, NSC  received $11.4 million for these activities, and for fiscal year 2005, its  approved budget was $11.5 million. Palmetto also serves as the DME  regional carrier for Region C. In addition, Palmetto serves as the Statistical  Analysis Durable Medical Equipment Regional Carrier, which analyzes  claims and reports to the DME regional carriers and CMS on trends in  DMEPOS payment and areas of potential fraud.
subsections: section_title: Medicare’s Supplier Standards
paragraphs: Medicare’s 21 supplier standards were introduced primarily to deter  individuals intent on committing fraud from entering the program and to  safeguard Medicare beneficiaries by ensuring that suppliers were qualified.  The 21 standards apply to a variety of business practices and establish  certain requirements. (See app. II for a list of the 21 standards.) For  example, the standards require suppliers to have a physical facility on an  appropriate site that is accessible to beneficiaries and to CMS, with stated  business hours clearly posted. CMS established the requirement for having  an appropriate physical facility in December 2000 after investigators  discovered fraudulent suppliers without fixed locations claiming vans or  station wagons as their place of business or using mail drop boxes to  receive Medicare payments for items they billed but never delivered.  Among other things, the standards also require suppliers to:    comply with applicable federal and state regulatory requirements,  including state licensure, when providing DMEPOS items or services;    maintain inventory on site or off site, or available through valid contracts  with other companies not excluded from doing business with the federal  government or its health care programs; and    obtain comprehensive liability insurance.
The 21 supplier standards also prohibit certain practices. For example,  one standard generally prohibits suppliers from using telephone calls to  solicit new business, because the Social Security Act prohibits this type of  marketing to Medicare beneficiaries.
section_title: Verifying Compliance with Supplier Standards
paragraphs: NSC verifies compliance with the supplier standards primarily during  enrollment and reenrollment, through on-site inspections and desk  reviews conducted by NSC analysts. (App. II lists the standards and how  NSC verifies them during enrollment and reenrollment.) For example, the  on-site inspections are used to check the compliance with the standards  for whether the supplier:    has a physical facility on an appropriate site that is accessible to  beneficiaries and to CMS, with a clearly visible sign with hours posted;    has its own inventory in stock on site, off site at another location, or has a  contract with another company for the purchase of inventory;    maintains records that document delivery of items to beneficiaries and  information provided to beneficiaries on warranties, including how repairs  and exchanges will be handled, and how to contact the supplier in case of  questions or problems; and    has a written beneficiary complaint resolution policy and maintains  records on beneficiary complaints and their resolution.
NSC’s analysts are expected to follow procedures to review information  provided by the on-site inspection and take other steps to verify suppliers’  compliance with the standards. For example, when on site the inspectors  are expected to check that the supplier has all the valid occupation and  business licenses required by its state and has a comprehensive liability  insurance policy. The NSC analyst is expected to check that the supplier  has all the state licenses that it would need to provide the items it  disclosed in its application. The NSC analyst also is expected to contact  the insurance underwriter to ensure that the supplier’s policy is valid, and  the post office to make sure the supplier’s address is listed. NSC also has a  procedure to match data from its supplier database with computerized  lists maintained by the federal government to ensure that supply company  owners are not prohibited from participating in federal health care  programs or debarred from federal contracting.
NSC does not specifically verify adherence to 4 of the 21 standards at  enrollment and reenrollment, because violations would generally be  apparent through its verification of other standards. For example, the  standard that requires suppliers to furnish NSC with complete and  accurate information on the application and notify NSC of any changes  within 30 days is verified through checking the accuracy of the suppliers’  disclosures of information for other standards—such as ownership and  the appropriateness of the physical facility.
section_title: On-site Inspection Procedures
paragraphs: The majority of on-site inspections are conducted by more than 380 field  representatives of Overland Solutions, Inc. (OSI), a company that performs  this work as a subcontractor to NSC. In addition, NSC uses its own  personnel, who are located in six cities, to conduct on-site inspections.  NSC and OSI conducted over 20,000 on-site inspections in fiscal year 2004.
In performing their reviews, the site inspectors follow certain procedures.  NSC requires that site inspectors arrive unannounced for any inspection.  Before the inspection, NSC provides the inspectors with briefing  information on the supplier, including information on whether the supplier  is enrolling or reenrolling and the type of state licenses to verify. While on  site, inspectors are expected to take photographs of the supplier’s sign  with its business name, posted hours of operation, complete inventory in  stock, and facility. NSC also expects site inspectors to obtain copies of  relevant documents, such as state licenses, comprehensive liability  insurance, contracts with companies for inventory, and contracts for the  service and maintenance of DME.
section_title: Enrollment, Disenrollment, and Appeals
paragraphs: As long as suppliers can demonstrate that they comply with the standards  and have not been excluded from participating in any federal health care  program, NSC must enroll or reenroll them in Medicare. Enrolled  suppliers are issued a Medicare billing number. If NSC discovers that a  new applicant or enrolled supplier is not in compliance with any of the 21  supplier standards, NSC can deny the application or, with CMS’s approval,  revoke the supplier’s billing number.
Suppliers whose applications have been denied or whose numbers have  been revoked can submit a plan to NSC to correct the noncompliance or  appeal the denial or revocation by requesting a hearing or both. If a  supplier requests a hearing, the first level of appeal is conducted by a  carrier hearing officer who was not involved in the original determination.  The supplier can submit new information to address the compliance  problems identified by NSC. If dissatisfied with the carrier hearing  officer’s ruling, either NSC or the supplier can request a review by an  administrative law judge, which became the second level of appeal as of  December 8, 2004. Prior to that date, second level appeal hearings were  conducted by a CMS review official. At both levels of the hearing process,  if the supplier can demonstrate that it is currently in compliance with the  standards, the supplier will be given a billing number.
section_title: Other NSC Efforts to Verify Suppliers’ Compliance with Medicare’s Standards
paragraphs: NSC’s Supplier Audit and Compliance Unit (SACU) also has responsibility  to help verify suppliers’ compliance with the 21 standards and identify  fraudulent activity. The SACU supervises NSC’s site inspectors and  oversees the OSI on-site inspections. It also analyzes supplier billing and  enrollment patterns. Based on billing or other irregularities, the SACU can  help NSC identify suppliers for additional on-site inspections. For  example, the SACU might discover that several new suppliers are owned  by the same individuals as other companies that are under investigation  for fraudulent billing. Based on this information, the SACU could target  the new suppliers for additional on-site inspections or refer the suppliers  for investigation by federal law enforcement, such as the OIG and the  Federal Bureau of Investigation (FBI).
section_title: NSC’s Efforts Are Insufficient to Verify Suppliers’ Compliance with the 21 Standards
paragraphs: NSC’s verification procedures have weaknesses that leave the Medicare  program without assurance that suppliers billing the program are meeting  the 21 standards, and thus, are qualified and legitimate. NSC’s procedures  to verify state licenses have gaps that have allowed suppliers to be paid for  DMEPOS items they are not licensed to supply in their states. In part, this  is because CMS has not set requirements for a stronger licensure  verification effort. Further, although on-site inspections play a key role in  verifying suppliers’ compliance with the 21 standards, we estimate that  NSC did not conduct more than 600 required on-site inspections and its  inspection procedures have limitations.
subsections: section_title: NSC’s Procedures to Verify State Licenses Have Gaps
paragraphs: NSC does not have an effective means of identifying suppliers that violate  the standard to have appropriate state licensure for the items they provide  to beneficiaries. This is partly because CMS’s requirements are inadequate  to assure an effective process and partly because NSC does not have  effective procedures that are consistently followed. To determine whether  it needs to verify a supplier’s license, NSC relies on the information the  supplier provides—in enrollment or reenrollment applications—regarding  the items or services the supplier intends to provide to Medicare  beneficiaries. Suppliers are required to certify on their applications that  they will notify CMS of any changes to the information they provided on  the form. However, if the supplier fills out the application incorrectly or  dishonestly and does not provide a license during an on-site inspection,  NSC would not verify whether the supplier has all the licenses needed in  its state. We also found that NSC did not consistently resolve  discrepancies or omissions in the information provided by suppliers— such as not forwarding a copy of a needed state license–-before issuing  suppliers billing numbers. Further, even though suppliers may change the  items they supply, CMS’s contract requires NSC to verify licensure only  during enrollment and does not require verification at any later time, such  as during reenrollment. Thus, even if a supplier begins to bill for items that  require a state license and discloses this information during reenrollment,  CMS does not require NSC to check the supplier’s state licenses. Further,  CMS does not require NSC to recheck suppliers prior to reenrollment to  ensure that the supplier’s license has not lapsed. Finally, CMS has not  required NSC to verify licensure after enrollment by routinely comparing a  supplier’s actual billing history against the DMEPOS items and services  originally disclosed on the supplier’s application. Without such a check,  CMS lacks assurance that suppliers are billing only for items they  disclosed to NSC and for which NSC has verified a license.
As a result of these gaps, Medicare paid suppliers when NSC had not  verified their licenses, including some suppliers that lacked the  appropriate license. As table 1 shows, by analyzing 2004 DMEPOS claims  data, we found 121 suppliers in Florida, Louisiana, and Texas that were  each paid at least $1,000 by Medicare for oxygen services, even though  they should not have billed for them. These suppliers either had not  informed NSC that they would be billing for oxygen, did not provide NSC  with the appropriate state license to verify, or both. Therefore, these  suppliers were not in compliance with the 21 standards. In total, these  suppliers were paid almost $6 million by Medicare. When we checked with  the three states, we found that 22 of these suppliers did not have a license  to provide oxygen in their states in 2004. These unlicensed suppliers were  paid $231,730 in 2004 by Medicare for oxygen on behalf of beneficiaries. In  addition, we verified licensure with the respective states for a sample of  the suppliers that had disclosed to NSC their intention to bill for oxygen  and had been paid at least $1,000 by Medicare for this service. Through  this process, we identified 7 more suppliers that did not have the required  state license to provide oxygen services in 2004.
Similarly, in 2003 and 2004, Medicare paid prosthetics and custom- fabricated orthotics claims submitted by suppliers that did not both  disclose to NSC that they would supply these items and provide a copy of  their licenses. Thus, they should not have been allowed to bill Medicare  for these items. We found 28 suppliers in Illinois and Texas that were paid  a total of about $197,000 in 2004 for prosthetics and custom-fabricated  orthotics even though they should not have been billing for these items.
Routinely comparing suppliers’ billing to the information they report on  the enrollment or reenrollment application regarding the items and  services they intend to provide might have avoided some of the improper  prosthetics and orthotics payments that occurred in Florida. In this state,  Medicare payments for prosthetics and custom-fabricated orthotics  inexplicably tripled in 1 year—from about $32.5 million in 2003 to almost  $107.0 million in 2004. As figure 1 shows, most of the increase was in  payments to suppliers that did not disclose to NSC that they intended to  provide these items. In 2004, the 73 suppliers that did not disclose the  intention to provide prosthetics or orthotics were paid more than   $56.3 million. These 73 suppliers were paid more than the amount paid to  the 262 suppliers that had informed NSC that they would provide these  items. The DME regional carrier has established about $16.3 million as  overpaid to 70 of the 73 suppliers, but has collected less than $2.3 million  plus interest payments of $60,820, as of April 21, 2005. Investigative staff  at the Region C DME regional carrier informed us that at least 46 of the 73  suppliers are currently under active investigation for health care fraud.
When NSC reviewed each case we identified of suppliers that billed for  oxygen or prosthetics and custom-fabricated orthotics without disclosing  the intention to do so, its analysis revealed several types of problems with  its processing of suppliers’ applications. For example, in Florida, for one  case that we identified, the supplier had not correctly filled out the  application to disclose the intention of providing prosthetics and custom- fabricated orthotics but had given NSC a copy of its state license. In two  cases, the supplier disclosed the intention of providing prosthetics and  custom-fabricated orthotics, but did not give NSC a copy of its state  license to review. Despite the discrepancies in the information provided by  suppliers, NSC enrolled or reenrolled these suppliers. In three cases, the  supplier disclosed the intention to provide prosthetics and custom- fabricated orthotics and gave NSC a copy of its license, but NSC staff did  not update their information appropriately in the supplier database.
During this engagement, we discussed with CMS NSC’s weaknesses in  verifying suppliers’ licenses. CMS officials acknowledged that the law  requires CMS to restrict Medicare payment of prosthetics and certain  custom-fabricated orthotics to those supplied by a qualified practitioner  and fabricated by a qualified practitioner or supplier. The law defines  qualified practitioners as a physician; an orthotist or a prosthetist who is  licensed, certified, or has credentials and qualifications approved by the  Secretary of Health and Human Services; or a qualified physical therapist  or occupational therapist. The law defines qualified suppliers as entities  accredited by the American Board of Certification in Orthotics and  Prosthetics, Inc., the Board for Orthotist/Prosthetist Certification, or a  program approved by the Secretary of Health and Human Services. CMS is  in the process of developing proposed regulations that would further  define qualified practitioners and suppliers of prosthetics and certain  custom-fabricated orthotics on a national level. As an interim step, as of  October 3, 2005, CMS will be requiring its DME regional carriers to put  edits in their payment systems to deny claims for prosthetics and certain  custom-fabricated orthotics submitted by any suppliers that are not  qualified, or do not have qualified practitioners on staff, in the states that  currently require licensure or certification. CMS indicated that these two  actions should help address the problem of unlicensed suppliers billing for  prosthetics and custom-fabricated orthotics. However, if NSC does not  resolve discrepancies in the information provided by suppliers to have an  accurate supplier database, the DME regional carriers will not have  accurate information for approving or denying prosthetics and certain  custom-fabricated orthotics claims. Further, the agency has not restricted  payments for any other items that require state licensure—such as oxygen.  Nor has it taken action to prevent payments to suppliers that have violated  the standard for accurate disclosure of application information by billing  for items they have not disclosed to NSC—whether or not a license is  required in their states to provide these items.
CMS has recently added another requirement for verifying licensure and  other certifications. During this evaluation, we pointed out to CMS staff  that the agency’s contract with NSC was not specific about whether a  license close to its expiration date when submitted to NSC should be  rechecked to ensure the supplier had renewed it. CMS was developing a  new statement of work for NSC and as a result of our discussion, the new  statement of work requires NSC to follow up to ensure renewal of  licenses, insurance policies, and certifications submitted within 60 days of  expiration.
section_title: NSC Has Not Conducted All of the Routine On-site Inspections Required to Verify Standards
paragraphs: NSC has not conducted the routine on-site inspections to verify supplier  standards for all the DMEPOS suppliers that CMS requires it to inspect.  We estimate that 605 enrolled suppliers that NSC was required to inspect  never received an on-site inspection. We also estimate that NSC  conducted on-site inspections for another 3,079 suppliers, but did not  properly record the date of these inspections in its supplier database. As  a result, the database–-with inaccurate or missing information—is not a  reliable management tool for CMS to use in overseeing NSC’s activities.
NSC may not have conducted all of the required on-site inspections  because of its procedures for determining which suppliers to inspect.  According to NSC’s written procedures, NSC staff use discretion to decide  if an on-site inspection should be conducted prior to the enrollment or  reenrollment of a supplier. In contrast, while CMS’s contract with NSC  exempts certain types of suppliers from routine on-site inspection, it does  not state that NSC should use its discretion to choose whether to inspect  the nonexempt suppliers. CMS staff informed us that NSC is required to  inspect suppliers on initial enrollment and reenrollment, with some  exceptions, and they were unaware that NSC was not conducting all of the  required on-site inspections.
Furthermore, because CMS’s statements of work in its fiscal year 2004 and  2005 contracts with NSC were not clear about what constitutes a supplier  chain, NSC was not inspecting other suppliers that could be eligible for on- site inspections. NSC did not have to inspect supplier chains with 25 or  more locations. However, the contract did not clearly state whether all 25  locations in the chain have to have active billing numbers. As a result, NSC  was exempting some suppliers in chains that currently have fewer than 25  locations with active billing numbers. We found 484 active suppliers  included in chains with 24 or fewer locations with active billing numbers  as of May 31, 2004. Of these 484 active suppliers, 257 did not have any on- site inspections recorded. For example, NSC indicated to us that no on-site  inspection was needed for Responsive Home Health Care, because it was  included in a chain with 50 locations. However, it was part of a chain with  24 active locations, one location whose billing number had been revoked,  and 25 inactive locations. We recently informed CMS that its contract  language on chain suppliers was not clear, because CMS was developing a  new statement of work for the next NSC contract. As a result, CMS revised  its contract language for fiscal year 2006 to clarify that a chain consisted of  25 or more active supplier locations.
section_title: NSC’s Procedures for Conducting On-site Inspections May Limit Their Effectiveness in Verifying Compliance with Standards
paragraphs: Even if NSC had conducted all of its on-site inspections, the contractor’s  procedures for conducting them limit their effectiveness as a means of  verifying compliance with the supplier standards in several ways. Thus,  the procedures cannot assure suppliers’ legitimacy and qualifications to  serve beneficiaries. First, NSC does not explicitly require its site  inspectors to review a specific number of suppliers’ beneficiary files  during their inspections. NSC told us that inspectors reviewed beneficiary  files, but OSI told us that its inspectors were not required to review the  contents of any beneficiary files.
Without reviewing beneficiary files, it is unclear how inspectors can verify  suppliers’ compliance with the standard that requires suppliers to maintain  several forms of documentation—including proof of delivery and evidence  of their efforts to educate beneficiaries on how to use the equipment.  Further, reviewing beneficiary files is also helpful to provide support  beyond a written supplier policy that other standards are being met. For  example, a record of equipment maintenance is better proof that the  supplier repairs equipment than a written policy alone. Reviewing  beneficiary files can also enable an inspector to identify potentially  fraudulent patterns of behavior and fabrications designed to cover up lack  of compliance with the 21 standards. For example, NSC investigators told  us that when many beneficiaries using one supplier have the same  physician’s signature on certificates that are required by Medicare to  affirm the medical necessity of certain DMEPOS items, this can be a sign  of fraudulent certifications designed to falsify compliance with Medicare’s  rules. The Region C DME regional carrier is currently investigating a  group of suppliers using the same set of physicians on their certificates.
Second, NSC does not routinely provide its site inspectors with the dollar  amounts and specific DMEPOS items a supplier billed to Medicare.  Knowing a supplier’s billing history would enable inspectors to determine  whether the supplier’s submitted claims coincide with its inventory,  invoices, delivery tickets, and other documentation in beneficiary files.  When we accompanied NSC inspectors to the physical facilities of several  suppliers about which NSC had suspicions—based on the suppliers’ billing  patterns or their association with other companies under investigation— the site inspectors did not have data on the billing histories for the  suppliers being inspected. As a result, the inspectors did not know what  types and amounts of inventory, delivery tickets, or invoices they should  expect to find.
Third, neither CMS nor NSC explicitly requires the site inspectors to verify  a supplier’s inventory when it is stored at, or purchased from, another  location. The inventory standard does not preclude a supplier from storing  inventory off site or relying on another supplier—even a competitor—to  provide its inventory. However, when this occurs, without taking  additional verification steps, NSC would not know whether the off-site  inventory exists or whether the source of inventory is legitimate.  According to the inventory standard, suppliers cannot contract with  companies that are currently excluded from the Medicare program, any  state health programs, or from any other federal procurement or  nonprocurement programs. However, without investigating the companies  that are cited as sources of inventory, NSC would not know if this  standard was being met. NSC’s procedures suggest, but do not require, its  site inspectors to verify off-site inventory locations. Because CMS does not  require NSC to conduct verification of off-site inventory or an assessment  of the company cited as the source of inventory, the current procedures do  not fully verify the inventory standard.
Inspecting off-site inventory or assessing the validity of inventory  contracts can help pinpoint violations of the standard for inventory and  can also identify potentially fraudulent activities. For instance, when NSC  inspected an address of a company that a supplier gave as its source for  inventory, it discovered an auto body shop at that address. In another  instance, NSC found a vacant building at the address given as a supplier’s  inventory source. These suppliers violated the standards for disclosing  accurate information to NSC and for having inventory or a contract to  procure it. Further, citing a nonexistent source of inventory suggests the  possibility that these suppliers were engaging in fraud. Similarly, groups of  suppliers under investigation for fraud in Houston in 2003 and 2004 were  using the same company as their fictitious source of inventory. SACU  investigators were able to identify other suppliers participating in the same  fraud scheme because the suppliers claimed they were obtaining inventory  from a source that was under investigation.
Through examining sources of inventory, our investigators identified  companies with questionable financial transactions or owners involved  with suppliers engaged in potentially fraudulent billing. For example, we  identified and investigated one distribution company in Florida that six  suppliers had cited as one of their main sources of inventory. CMS had  denied or revoked the billing numbers for the six suppliers, in part  because they did not appear to have inventory, but five of them were able  to obtain or regain their billing numbers after providing contracts for  inventory from this distribution company. Our investigators found that the  distribution company’s bank had filed 27 separate reports identifying cash  withdrawals from company accounts in amounts ranging from $10,000 to  more than $98,000 over a period of 20 months—almost $1 million in total.  Such cash withdrawals are suspicious because they can indicate attempts  to disguise illicit funds and make them more difficult to track. Even more  suspicious, our investigators found that this distribution company did not  appear to be an active business. Through on-site inspections conducted in  March 2005, we found that two of the addresses given for it were vacant  office/storage units and one was a custom woodworking shop. In June  2005, we investigated a fourth possible address for the company. This  address had been leased by an individual who identified himself in leasing  paperwork as being associated with a “Medical Equipment” business and  was found to be a storage unit littered with debris and a pile of boxes,  many of which were crushed and broken. The investigators saw no posted  signs or activities that would indicate an active business. In addition, of  the five suppliers currently reenrolled in Medicare that cited this source of  inventory, three were under investigation in March 2005 by the Region C  DME regional carrier’s fraud control unit.
section_title: NSC Is Not Required by Contract to Conduct a Minimum Number of Out- of-cycle On-site Inspections
paragraphs: Out-of-cycle on-site inspections have been effective in identifying  suppliers that are not complying with Medicare’s standards. For example,  during the April 2004 hearing before the Senate Committee on Finance on  the Medicare power wheelchair benefit, the attendees watched a video of  law enforcement surveillance that showed individuals bringing office  equipment and DMEPOS items into an office suite in order to appear to  meet the standards for having an appropriate physical facility and  inventory to pass an on-site inspection. Because the timing of enrollment  and reenrollment inspections are predictable, a supplier intent on  committing fraud can anticipate an enrollment on-site inspection and  create the illusion of legitimacy, fully understanding that an inspector is  not likely to return for 3 years. Out-of-cycle on-site inspections can be so  valuable that we previously recommended that CMS direct NSC to  routinely conduct them for suppliers suspected of billing improperly.  CMS agreed with the recommendation and pointed out the number of out- of-cycle inspections that were being completed. In 2003, NSC conducted  over 600 out-of-cycle inspections and found 306 DMEPOS suppliers not  complying with Medicare’s standards. NSC continued this practice in fiscal  year 2004, conducting over 400 out-of-cycle on-site inspections targeted  specifically at high-volume suppliers that were not part of chains. CMS  has also requested NSC to conduct out-of-cycle on-site inspections in  fiscal year 2005. Nevertheless, NSC’s contract does not explicitly require it  to conduct out-of-cycle on-site inspections.
Although NSC has conducted out-of-cycle on-site inspections in the last  several years, without becoming an explicit part of its contract, this  activity could be curtailed at any time. We discussed our concerns about  this with CMS staff writing the revised statement of work for a new  contract that is scheduled to be awarded in December 2005. As a result,  CMS included language in the revised statement of work that will  explicitly require the contractor for NSC to conduct random, out-of-cycle  on-site inspections as resources permit. However, the change in the  statement of work does not require NSC to conduct a minimum number of  out-of-cycle on-site inspections as a routine part of its activities.
section_title: Medicare’s Standards Are Too Weak to be Used Effectively to Screen DMEPOS Suppliers
paragraphs: Medicare’s standards are currently too weak to be used effectively for  screening DMEPOS suppliers that want to enroll in the program. The 21  standards focus on certain operational characteristics. However, they do  not include standards related to supplier integrity and capability analogous  to those that federal agencies generally apply to prospective contractors or  those used by at least two state Medicaid programs for their suppliers. For  example, federal agencies do not have to contract with companies that  have demonstrated poor performance in the past. In contrast, CMS has  reenrolled suppliers whose billing numbers have been revoked, after they  have demonstrated compliance with the standards—no matter how many  standards they had previously violated. We found cases of suppliers that  had billed improperly and violated standards, reentered the program, and  then began to bill improperly for other items. CMS is currently developing  more specific guidance for applying some of its 21 standards. In addition,  to implement provisions in the Medicare Prescription Drug, Improvement,  and Modernization Act of 2003 (MMA), CMS is introducing a competitive  bidding process for DME, off-the-shelf orthotics, and supplies, and is  developing quality standards that would supplement the existing ones.  When implemented, these steps could help ensure that DMEPOS suppliers  are legitimate businesses and qualified to bill Medicare.
subsections: section_title: Medicare’s Standards Lack Assessment of Integrity and Capability Like Those for Federal Contractors and Some State Medicaid Suppliers
paragraphs: Although a federal agency primarily pays for items provided by DMEPOS  suppliers, these businesses are not held to standards analogous to those  that apply to companies that seek to contract with the federal government.  Under federal procurement regulations, agencies are generally required to  determine whether a potential contractor is “responsible”—that is,  whether it has a satisfactory record of performance, integrity, and  business ethics, as well as the financial, technical, and managerial ability  to provide the specified products and services. Federal agencies can  consider a contractor’s past performance as an indicator of future  performance and require a disclosure of financial and management  information to make their assessment. In addition, after a contract is  awarded, federal agencies can terminate the contract for default or  convenience. Further, for committing certain crimes or not meeting  certain federal requirements, a company may be debarred from receiving  federal contracts, generally for up to 3 years.
Some state governments have requirements to ensure that Medicaid  suppliers are responsible. For example, California’s Medicaid program  requires DME suppliers to have the administrative and fiscal foundation to  survive as a business, demonstrated by financial records, such as a  business plan, bank statements, and contractual agreements. California  state officials told us that a DME supplier in their state could not meet the  definition of being an established business for the Medicaid program if it  sold power wheelchairs out of a residence, as some Medicare DME  suppliers have done. Similarly, Florida’s Medicaid program requires  suppliers to provide evidence of being a viable, ongoing business. Florida  also requires anyone with 5 percent or greater ownership, and the  manager of the supplier, to be fingerprinted and undergo a criminal  background investigation, because the state will not enroll suppliers with  owners convicted of several types of crimes, such as health care fraud or  patient abuse.
In contrast, suppliers are not CMS contractors, and CMS’s standards do  not require suppliers to demonstrate that they are responsible based on  their financial, technical, and managerial ability, their integrity, and their  past performance. As a result, suppliers that are not legitimate DMEPOS  businesses have enrolled in Medicare and have been paid millions of  dollars in improper payments without having to demonstrate that they  have the ability and integrity to serve beneficiaries, as the following  examples show.
For example, in sworn testimony before the Senate Committee on Finance  in April 2004, a witness who pleaded guilty to fraud explained her part in a  $25 million fraud scheme that she and a group of 19 others committed  against the Medicare program. She explained how she was able to set up a  sham company—Mercury Medical Supplies—with $3,000 and obtain a  Medicare billing number, even though she had no prior experience,  expertise, or discernable resources for providing DMEPOS items or  services. From September 2000 to December 2001, when its billing number  was revoked, Medicare paid Mercury Medical Supplies $1,158,482 for  providing DMEPOS items that were falsely billed based on forged  physicians’ prescriptions and were generally not supplied to beneficiaries.  While the Medicare program paid Mercury Medical Supplies over   $1 million but did not inquire into its financial ability to supply DMEPOS  items, one federal agency refused to award a $230,000 contract to a  company with $32,500 in working capital, in part because the agency’s  contracting officer did not think that the company was financially strong  enough to fulfill the contractual obligations.
Like Mercury Medical Supplies, All-Divine Health Services in Lufkin, Texas  was not a legitimate DMEPOS business, but managed to enroll in Medicare  in December 2002. NSC’s inspector noted on an initial site inspection  report that the owner explained that she was awaiting inventory, which  was why she had none in her storage area prior to enrollment in the  Medicare program. Once enrolled, All-Divine Health Services began to bill  for power wheelchairs, an item for which Medicare pays over $5,000.  However, because of concerns about inappropriate power wheelchair  billing, NSC conducted out-of-cycle on-site inspections of All-Divine and  other power wheelchair suppliers in the area. The site inspector found  evidence of potential fraud, such as altered certificates from physicians  attesting to the beneficiaries’ medical need for the items to be supplied, as  well as violations of Medicare’s standards. Following the out-of-cycle  inspection, CMS found that All-Divine was in violation of four standards,  because it lacked comprehensive liability insurance, lacked a state license  to provide bedding, did not have adequate contracts for inventory, and did  not have adequate provision to repair and service DME. All-Divine’s billing  number was revoked effective August 6, 2003. After the owner pleaded  guilty to conspiracy to commit health care fraud on June 25, 2004, her  lawyer testified that All-Divine’s owner had not understood the intricacies  of proper Medicare billing and had no experience managing a DMEPOS  company. The owner told her lawyer that she did not think she was  committing a crime, although she admitted purchasing paperwork  certifying beneficiaries as needing power wheelchairs and then submitting  claims on their behalf. Her lawyer also testified that the owner stated that  her firm lacked the operational controls to ensure that beneficiaries  actually received the power wheelchairs for which the company billed and  was paid by Medicare. Before its billing number was revoked, All-Divine  was paid over $1.8 million by the program, predominantly for power  wheelchairs not provided as billed.
section_title: Medicare Suppliers Do Not Face the Same Penalties for Not Meeting Federal Requirements as Contractors and Medicaid Suppliers
paragraphs: While federal agencies, including CMS, may choose not to conduct  business with companies that lack integrity or perform poorly, and may  disqualify companies from competing for federal contracts, suppliers that  have failed to comply with Medicare’s standards have not lost their billing  privileges for any substantial length of time. Federal agencies can  terminate contracts at their convenience or for default—which is when a  contractor fails to perform the contract. For certain serious violations,  contractors can be debarred from receiving any federal contract, generally  for up to 3 years. Willful failure to perform the terms of a government  contract is a basis for debarment. In addition, apart from debarment,  agencies can refuse to offer new contracts to companies exhibiting  previous performance problems or a lack of integrity in the past. This  may occur after conviction for criminal charges, but sometimes the  refusals follow allegations of wrongdoing. For example, one agency  refused to offer a new contract to a company that had allegedly provided  false certifications in the past. Another agency used the results of  criminal investigative reports as a basis for refusing to offer contracts to  companies.
Compared with Medicare, the Medicaid programs of California and Florida  put more barriers to reenrollment of problematic suppliers into Medicaid.  For example, California provisionally enrolls new Medicaid providers for  12 to 18 months. During this period, if the provider fails to meet state  requirements, the state agency disenrolls the provider from Medicaid. In  addition, if a provider fails to accurately disclose information, such as the  ownership of the company, California can disenroll the provider from  Medicaid and keep it from reenrolling for 3 years. The California  Medicaid program denies applications from providers under investigation  for criminal offenses. Florida will not reenroll suppliers that have been  excluded from the program. When NSC identifies suppliers that violate  Medicare’s standards, CMS may revoke their billing privileges. However, in  contrast to California and Florida Medicaid, if a supplier can demonstrate  compliance with the 21 standards, CMS readmits it into Medicare unless it  has been otherwise excluded from participating in the program.
DMEPOS suppliers that have their billing privileges revoked and then later  reenter Medicare are not uncommon. We identified 1,038 DMEPOS  suppliers that lost their billing privileges in 2003, generally for violating  multiple standards. Of these suppliers, 192 were reenrolled in Medicare as  of May 31, 2004, with the average period of suspension lasting about 3  months. None of these suppliers encountered any barrier to enrollment for  violating the standards. Further, when some suppliers that had billed  improperly because they were unlicensed reentered the program, they  resumed improper billing for different types of items. See table 2 for two  examples.
section_title: CMS’s Efforts to Strengthen the Supplier Standards and Other Recent Steps May Partially Address Identified Weaknesses
paragraphs: According to NSC and CMS officials, strengthening the supplier standards  by increasing their specificity is an important step in preventing  enrollment of suppliers that are intent on committing fraud. NSC and CMS  officials agreed that the inventory and physical facility standards are not  specific enough. These standards do not specify the characteristics of an  inventory, or the amount, type, or source of inventory that should be  required for the items or services the supplier intends to provide to  Medicare beneficiaries. According to these officials, the lack of specificity  in the standards has allowed suppliers that were not legitimate companies  to acquire Medicare billing numbers and then defraud the program. NSC  and OIG officials investigating enrolled suppliers with potentially  fraudulent billing reported that many had physical facilities not conducive  to conducting a legitimate DMEPOS business. For example, these  investigators have found multiple suppliers located in close proximity in  small suites in the same building. In addition, they found suppliers in  buildings that were not located where beneficiaries were likely to come  and purchase DMEPOS items. The investigators also reported finding  DMEPOS suppliers operating out of their houses and garages. These  suppliers had few DMEPOS items in stock, but claimed that they had  contracts for acquiring inventory. These documents sometimes lacked the  usual elements of a contract, such as the clear signature of authorized  individuals from both companies and the time period for the contract.  Nevertheless, these suppliers met the current standards.
In early 2004, based on NSC proposals, CMS drafted new guidance on the  current supplier standards to make them more specific. For example, CMS  added more details to describe what constituted a reasonable amount of  inventory, the elements of an acceptable contract for inventory, and an  appropriate physical facility from which to provide items and services to  Medicare beneficiaries. As of June 2005, CMS had not issued the new  guidance. According to an agency official, some of the revisions have been  incorporated into a proposed regulation under review within the agency.  The official told us that CMS plans to issue other changes through  revisions of Medicare guidance manuals, once the proposed regulation had  been issued.
In addition to the new guidance, provisions of the MMA that require CMS  to develop quality standards for DMEPOS suppliers and competitive  bidding, when implemented, could enhance the agency’s ability to screen  suppliers. The MMA requires CMS to develop quality standards for all  DMEPOS suppliers and to select one or more independent accreditation  organizations that will apply these standards to determine if suppliers are  meeting them. CMS has not finished its development of the quality  standards, so it is not clear whether the standards will incorporate  requirements for suppliers to demonstrate that they have the integrity and  capability to perform their functions analogous to the standards for  federal contractors. In addition, the MMA requires CMS to establish  competitive bidding among suppliers for DME, supplies, off-the-shelf  orthotics, and enteral nutrients and related equipment and supplies in at  least 10 of the largest metropolitan areas by 2007 and in 80 of these areas  by 2009. The MMA will require suppliers chosen by competitive bidding to  comply with the quality standards that are being developed for all  DMEPOS suppliers as well as new financial standards to be specified by  the Secretary. However, competitive bidding will be limited to certain  DMEPOS items and localities, so not all Medicare DMEPOS suppliers will  be held to the new financial standards. CMS anticipates issuing a proposed  rule in the fall of 2005 on DME competitive bidding and on quality  standards and accreditation and a final rule in 2006.
section_title: CMS’s Oversight Is Insufficient to Determine Whether NSC Screens and Monitors Suppliers Effectively
paragraphs: CMS’s oversight has not been sufficient to determine whether NSC is  meeting its responsibilities in screening, enrolling, and monitoring  DMEPOS suppliers. CMS was unaware—until we informed the agency— that NSC had not conducted all required on-site inspections of suppliers.  Furthermore, CMS did not know that, in contrast to its requirements,  NSC’s procedures allow its staff to use discretion in selecting which  suppliers received on-site inspections. In addition, CMS did not recognize  gaps in NSC’s verification of suppliers’ state licenses and as a result,  Medicare paid suppliers whose licenses the contractor did not verify.
During our review, we found weaknesses in the methods CMS uses to  oversee its contractor that could lead to the agency not recognizing  problems in the verification process. CMS evaluates NSC’s performance  primarily through an annual inspection. During this inspection, CMS  analyzes a small random sample of supplier files to determine, for  instance, whether NSC is conducting on-site inspections, processing  enrollment applications, and handling appeals of denied or revoked billing  privileges in accordance with its requirements. The analysis of NSC’s  supplier files is CMS’s most direct means of assessing NSC’s efforts to  screen and enroll suppliers; however, we determined that CMS’s past  practice of basing NSC’s performance on a sample selected from a single  quarter of the year may not be adequate. NSC’s performance might differ  during the quarters in which it was not reviewed. CMS also recognized  problems with basing its review on a single quarter, and in October 2004  began to institute quarterly reviews of a sample of supplier files. However,  if any problems are uncovered, the sample sizes examined by CMS are too  small to be used as a means of oversight, relative to the number of  application files processed and other type of files reviewed. During fiscal  year 2004, NSC processed more than 58,000 supplier applications for  enrollment or reenrollment. To evaluate NSC’s efforts to enroll suppliers  during its fiscal year 2004 inspection, CMS examined a sample of 10  approved supplier applications, as well as 10 denied and 10 returned  applications. To evaluate NSC’s efforts to reenroll suppliers, CMS  examined a sample of 20 approved reenrollments. If CMS uncovered any  problems, it would need to select a much larger sample to determine if the  problems were systemic, a step that is not indicated in the evaluation  protocol.
CMS’s evaluation of NSC’s performance is focused primarily on whether  the suppliers’ applications are filled out and processed correctly—not  whether NSC has conducted the required verification tasks thoroughly.  For example, while NSC may have a supplier site inspection form with the  boxes checked to indicate that a supplier is complying with various  standards—such as the one to maintain documentation of delivery of  items to beneficiaries—CMS cannot know from reviewing the form if the  inspector checking that supplier actually examined any beneficiary files.
CMS also oversees NSC through reviewing monthly reports from NSC, but  this does not provide information on the thoroughness of NSC’s screening  and enrollment efforts. Instead, CMS reviews the monthly reports to  monitor NSC’s workload—including the number of enrollment and  reenrollment applications received, pending, approved, and returned; the  timeliness in processing applications; the number of denials and  revocations; and the timeliness with which NSC handles inquiries from  suppliers. This monitoring is important to ensure that NSC is managing its  workload, but does not inform CMS as to how well NSC performs these  activities.
Finally, while CMS has established performance goals in NSC’s contract  related primarily to processing supplier applications and managing other  aspects of NSC’s workload—such as handling inquiries—it has not  established performance goals connected to effectiveness of the screening  or fraud prevention efforts. CMS uses both the annual inspection and the  monthly reports to measure NSC’s performance against goals established  in its contract. These goals are linked to timeliness in processing suppliers’  applications, appeals, and inquiries. For example, according to its  contract, NSC must    process 90 percent of all applications and reenrollments accurately within  60 calendar days of receipt and 99 percent of applications within 120  calendar days of receipt,    process 90 percent of appeals accurately within 60 calendar days of    answer 85 percent of supplier telephone calls within the first 60 seconds.
These performance measures do not indicate the success of NSC or its  SACU in identifying noncompliant and fraudulent suppliers. Further,  CMS’s contract requires NSC to maintain a SACU, but the contract does  not establish outcomes expected from this unit. Similarly, in its annual  inspection, CMS does not evaluate the SACU’s efforts—whether, for  instance, the SACU has adequately educated suppliers, adequately  supervised the quality of on-site inspections, or analyzed supplier  enrollment and billing data so that NSC can identify suppliers for  additional inspections.
section_title: Conclusions
paragraphs: CMS is responsible for assuring that Medicare beneficiaries have access to  the equipment, supplies, and services they need, and at the same time, for  protecting the program from abusive billing and fraud. The supplier  standards and NSC’s gatekeeping activities were intended to provide  assurance that potential suppliers are qualified and would comply with  Medicare’s rules. However, there is overwhelming evidence—in the form  of criminal convictions, revocations, and recoveries—that the supplier  enrollment processes and the standards are not strong enough to  thoroughly protect the program from fraudulent entities.
We believe that CMS must focus on strengthening the standards and  overseeing the supplier enrollment process. It needs to better focus on  ways to scrutinize suppliers to ensure that they are responsible  businesses, analogous to federal standards for evaluating potential  contractors. CMS’s current effort to develop additional guidance on the  standards and the development of quality standards for DMEPOS suppliers  provide an opportunity for the agency to establish stronger requirements  for potential and enrolled suppliers. Developing more rigorous quality  standards that include an assessment of suppliers’ performance, integrity,  and financial, managerial, and technical ability would help ensure that  only qualified companies became suppliers. Suppliers whose previous  performance was poor or that demonstrated a lack of integrity should not  be allowed to quickly reenter the program. CMS also needs to provide  more specific requirements in NSC’s contract so that the program’s  policies will be consistently carried out. Finally, we believe that CMS has  not adequately evaluated NSC’s activities to ensure that it is meeting all of  its responsibilities and using all of the tools available to identify, and  address, problem suppliers.
section_title: Matter for Congressional Consideration
paragraphs: The Congress should consider whether suppliers that have violated  standards should have to wait a specified period of time from the date of  revocation to have a billing number reissued.
section_title: Recommendations
paragraphs: To improve the supplier enrollment process and oversight of NSC, we  recommend that the Administrator of CMS take eight actions—five related  to NSC’s efforts to verify DMEPOS suppliers’ compliance with the 21  standards, one related to the supplier standards, and two related to the  agency’s oversight of NSC. We recommend that CMS:    Starting in states where licensure is mandatory, require NSC to routinely  check suppliers’ billing for oxygen, prosthetics, orthotics, and any other  items requiring licensure, against the items the suppliers declared they are  providing on applications. Where suppliers are billing for services not  declared, take appropriate action to revoke the billing numbers of  suppliers not complying with program requirements.
Require NSC to provide information from suppliers’ billing histories to  inspectors before they conduct on-site inspections to help them collect  information to assess whether suppliers’ inventory or contracts to obtain  inventory are congruent with the suppliers’ Medicare payments.
When suppliers report having inventory that is primarily maintained off  site or supplied through another company, require NSC to evaluate the  legitimacy of the supply location or source and any related contracts.
As part of the on-site inspections, require inspectors to review, and  provide information to NSC analysts on the contents of, a minimum  number of patient files to determine supplier adherence to standards for  maintaining documentation of services and information provided to  beneficiaries.
Oversee NSC’s activities to ensure that it conducts on-site inspections of  suppliers as required by CMS and maintains accurate data on the on-site  inspections it conducts.
Establish a minimum number of out-of-cycle on-site inspections in its  contract that NSC must perform each year.
Develop standards that incorporate requirements for suppliers to  demonstrate that they have the integrity and capability to perform their  functions analogous to the standards for federal contractors.
Revise current evaluation procedures to fully assess the outcomes  expected from the SACU’s activities and NSC’s adherence to contract  requirements.
section_title: Agency Comments
paragraphs: In its written comments on a draft of this report, CMS generally concurred  with our eight recommendations and cited actions it is taking to  implement each recommendation. It also affirmed its commitment to  protect beneficiaries and Medicare from fraud, waste, and abuse by  ensuring that NSC only enrolled qualified suppliers and enforced the  supplier standards.
CMS agreed with our five recommendations related to improving NSC’s  efforts to verify DMEPOS suppliers’ compliance with the 21 standards. In  response to four of these recommendations, CMS stated that it has revised  the statement of work for fiscal year 2006 to require NSC to:    check suppliers’ licenses and liability insurance each year, rather than  every 3 years at reenrollment, and compare suppliers’ billing histories to  the licenses they provide at that time;    provide on-site inspectors with the billing histories of DMEPOS suppliers    conduct site inspections of suppliers’ off-site inventory storage locations  and of businesses that provide them with inventory through contracts; and    conduct out-of-cycle inspections, the number of which CMS will manage  based on NSC’s workload and budgetary constraints.
In addition to the completed revisions, to address the other  recommendation related to NSC’s efforts to verify suppliers’ compliance  with the 21 standards, CMS indicated that it intends to further revise the  statement of work to require site inspectors to review a minimum number  of beneficiary files maintained by suppliers.
CMS also agreed with our recommendation to develop standards for  suppliers to ensure they have the integrity and capability to perform their  functions analogous to the standards for federal contractors. In its  response to that recommendation, CMS indicated that the quality  standards the agency is developing for suppliers will improve its ability to  deter health care fraud and abuse. The agency stated that it will publish a  proposed rule to implement the standards in the fall of 2005 and expects to  issue a final rule in 2006.
Finally, to address the two recommendations on improving its oversight,  CMS stated that it intends to more closely review NSC’s activities to  ensure that the contractor conducts on-site inspections as required and  maintains accurate data on these inspections. CMS also noted that it had  expanded its oversight and evaluation procedures during fiscal year 2005  to include quarterly reviews of NSC and SACU enrollment functions.  CMS’s written comments on a draft of this report are included in appendix  III. CMS also provided technical comments, which we included as  appropriate.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  issue date. At that time, we will send copies of this report to the  Administrator of CMS, appropriate congressional committees, and other  interested parties. We will also make copies available to others upon  request. This report is also available at no charge on GAO’s Web site at  http://www.gao.gov.
If you or your staff have any questions about this report, please contact me  at (312) 220-7600 or aronovitzl@gao.gov. Contact points for our Offices of  Congressional Relations and Public Affairs may be found on the last page  of this report. GAO staff who made major contributions to this report are  listed in appendix IV.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: To evaluate the National Supplier Clearinghouse’s (NSC) efforts to verify  suppliers’ compliance with the 21 standards, we conducted interviews,  document reviews, field inspections, investigations, and data analysis. We  interviewed the Centers for Medicare & Medicaid Services (CMS) officials  that oversee NSC and NSC staff, assessed CMS’s contract statement of  work for enrollment screening, and reviewed NSC’s written procedures to  gain a better understanding of the procedures used. Through that  assessment, we determined that its procedures to check licensure and  conduct on-site inspections of suppliers were critical to verifying  compliance with the standards and we focused our evaluation on these  procedures. To better understand the on-site inspection process, we  accompanied NSC officials as they conducted on-site inspections of 12  suppliers in Maryland during August 9 and 10, 2004. In addition, to test the  effectiveness of the licensure verification, we analyzed Medicare durable  medical equipment, orthotics, prosthetics, and supplies (DMEPOS) claims  data for 2003 and 2004 from Florida, Illinois, Louisiana, and Texas  and  NSC’s active supplier data file to determine whether suppliers had the  licenses necessary for items billed. We also tested whether all required on- site inspections had been conducted through an analysis of NSC’s active  supplier data file and inspection procedures. To assess the reliability of  the 2003 and 2004 claims from CMS and NSC’s supplier data files, we  performed electronic testing of required data elements, reviewed existing  information about the data and the systems that produced them, and  interviewed CMS and NSC officials knowledgeable about the data. We  determined that these data were sufficiently reliable for the purposes of  this report. We also contacted Florida, Texas, and Louisiana to determine  which of the suppliers that had not disclosed to NSC that they would be  providing oxygen and were paid at least $1,000 for oxygen claims in 2004  actually had the needed state licenses. In addition, we also checked with  these states to determine whether a small sample of suppliers that had  disclosed the intention to bill for oxygen, and were paid at least $1,000 for  oxygen claims in 2004, had the needed state licenses. For custom- fabricated orthotics and prosthetics, we were not able to confirm whether  the suppliers that had not disclosed to NSC that they would be providing  these items and were paid at least $1,000 for such claims in 2004 in  Florida, Illinois, and Texas had the proper state licenses, because those  states license individuals to be allowed to supply these items, not  companies. To evaluate procedures for on-site inspections, we analyzed  on-site inspection instructions and the standards and interviewed on-site  inspectors and officials in NSC and Overland Solutions, Inc. We  investigated two companies cited as sources of inventory by two groups of  Florida and Texas suppliers that had their billing privileges denied or  revoked, in part because of inventory issues, and also investigated those  suppliers.
To evaluate the adequacy of the 21 supplier standards, we compared them  to the requirements for government contractors and those imposed by the  California and Florida Medicaid program on suppliers. In addition, we  analyzed cases of revocations that had been appealed to CMS in 2004 to  determine if weaknesses in the standards were leading to suppliers with  questionable billing practices being reinstated in the program. We also  obtained documentation on cases of suppliers that had defrauded  Medicare and interviewed fraud inspectors at NSC and in the Department  of Health and Human Services Office of Inspector General to develop  insight into the problems that they saw with the 21 standards. We also  interviewed NSC and CMS officials and individuals from the following  organizations: the American Association for Homecare, the American  Orthotic and Prosthetic Association, Hoveround, National Association for  Home Care and Hospice, Power Mobility Coalition, and a representative  from the National Supplier Clearinghouse’s Advisory Council.
To evaluate CMS’s oversight of NSC, we considered the information we  had gathered to answer the previous questions. We reviewed CMS’s  written procedures used to evaluate NSC and other documents related to  CMS’s oversight. We also discussed CMS’s oversight with CMS and NSC  officials.
Our work was conducted from June 2004 to September 2005 in accordance  with generally accepted government auditing standards.
section_title: Appendix II: Medicare’s 21 Standards for Suppliers and NSC’s Procedures to Verify Their Compliance
paragraphs: Suppliers of durable medical equipment (DME), prosthetics, orthotics, and  supplies must meet 21 standards in order to obtain and retain their  Medicare billing privileges. The NSC is responsible for screening suppliers  to ensure that they meet the standards. An abbreviated summary of the  most recent version of these standards, which became effective December  11, 2000, is presented in table 3. The Medicare Prescription Drug,  Improvement, and Modernization Act of 2003 requires CMS to develop  quality standards that must be at least as stringent as current standards for  all Medicare suppliers of DME, prosthetics, orthotics, and supplies.  Supplier compliance with the quality standards will be determined by one  or more designated independent accreditation organizations.
section_title: Appendix III: Agency Comments
section_title: Appendix IV: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Sheila K. Avruch, Assistant  Director; Kevin Dietz; Cynthia Forbes; Krister Friday; Christine  Hodakievic; Daniel Lee; Lisa Rogers; John Ryan; and Craig Winslow made  key contributions to this report.
section_title: Related GAO Products
paragraphs: Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending  for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004.
Medicare: Past Experience Can Guide Future Competitive Bidding for  Medical Equipment and Supplies. GAO-04-765. Washington, D.C.:  September 7, 2004.
Medicare: CMS Did Not Control Rising Power Wheelchair Spending.  GAO-04-716T. Washington, D.C.: April 28, 2004.
Medicare: HCFA to Strengthen Medicare Provider Enrollment  Significantly, but Implementation Behind Schedule. GAO-01-114R.  Washington, D.C.: November 2, 2000.