Medicare Advantage: Actions Needed to Enhance CMS Oversight of Provider Network Adequacy
Released: 2015-09-28T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: MAOs contract with a network of providers to manage health care delivery to their enrollees. MAOs can initiate or terminate contracts with providers at any time for any reason. Recently, some MAOs have been narrowing their provider networks, prompting concerns about ensuring enrollee access to care and CMS's oversight of MAO compliance with network adequacy criteria.

GAO was asked to review how CMS ensures adequate access to care for MA enrollees. This report examines (1) how CMS defines network adequacy and how its criteria compares with other programs, (2) how and when CMS applies its criteria, (3) the extent to which CMS conducts ongoing monitoring of MAO networks, and (4) how CMS ensures that MAOs inform beneficiaries about terminations. GAO reviewed CMS and other guidance on network adequacy, federal regulations, and standards for internal control. GAO also interviewed CMS officials and representatives of medical associations and beneficiary advocacy groups, and analyzed CMS data on oversight of MAO provider networks for contract years 2013 through 2015.

section_title: What GAO Found
paragraphs: The Centers for Medicare & Medicaid Services (CMS) is the agency within the Department of Health and Human Services (HHS) responsible for overseeing the Medicare Advantage (MA) program—Medicare's private plan alternative. Since 2011, CMS has defined an adequate MA provider network as meeting two criteria: a minimum number of providers and maximum travel time and distance to those providers. To reflect local conditions, the requirements are specific to different county types and a range of provider types. However, the MA criteria do not reflect aspects of provider availability, such as how often a provider practices at a given location. In contrast, other network-based health programs use provider availability measures to assess network adequacy. For example, federal Medicaid managed care rules address providers' ability to accept new patients and TRICARE criteria address appointment wait times for active duty servicemembers. Without taking availability into account, as is done in some other programs, MA provider networks may appear to CMS and beneficiaries as more robust than they actually are.

CMS applies its network adequacy criteria narrowly. Rather than assessing all county-based provider networks against its criteria, CMS limits its annual application of the criteria to provider networks in counties that MA organizations (MAO)—private organizations that offer one or more health benefit plans—propose to enter in the upcoming year. From 2013 through 2015, CMS's reviews accounted for less than 1 percent of all networks. To facilitate its review of these networks, CMS has established standardized data collection via an automated system. However, CMS does little to assess the accuracy of the network data in applications MAOs submit, even though the submissions contain the same data elements as in provider directories, which have been shown to be inaccurate in a number of government and private studies. Until CMS takes steps to verify MAO provider information, as outlined in federal internal control standards, the agency cannot be confident that MAOs meet network adequacy criteria.

For established provider networks, CMS does not require MAOs to routinely submit updated network information for review, but may learn of any adequacy issues through its broader oversight of MAOs. CMS recently required that MAOs disclose efforts to significantly narrow provider networks, allowing MAOs to determine when such disclosure is necessary. CMS also relies on complaints it receives to identify any problems related to network changes that are not otherwise identified. However, contrary to internal control standards, CMS does not measure ongoing MAO networks against its current MA criteria. Because a plan's providers may change at any time, CMS cannot be assured that networks continue to be adequate and provide sufficient access for enrollees until the agency collects evidence of compliance on a regular basis.

While CMS requires that MAOs give enrollees advance notice when a provider contract is terminated, the agency has not established information requirements for those notices and does not review sample notices sent to enrollees. This lack of scrutiny appears inconsistent with the agency's oversight of other Medicare beneficiary communications and with internal controls. Without a minimum set of required information elements and a check on adherence to them, the agency cannot ensure that MAO communications are clear, accurate, and consistent.

section_title: What GAO Recommends
paragraphs: The Administrator of CMS should augment oversight of MA networks to address provider availability, verify provider information submitted by MAOs, conduct more periodic reviews of MAO network information, and set minimum information requirements for MAO enrollee notification letters. HHS concurred with the recommendations.

section_title: Letter
paragraphs: Depending on where they live, Medicare beneficiaries may enroll in fee- for-service (FFS) Medicare or Medicare Advantage (MA)—under which  private MA organizations (MAO) offer one or more health benefit plans.  In making this decision, beneficiaries typically face a trade-off between  affordability and provider choice. In FFS Medicare, beneficiaries pay a  premium, deductible, and any applicable cost sharing, and may elect to  receive covered benefits from any Medicare participating provider. In  contrast, beneficiaries who enroll in an MA plan receive Medicare covered  services, sometimes with extra benefits, and often pay lower out-of- pocket costs. MA enrollees’ choice of providers is generally limited to  physicians, hospitals, and other providers that contract with their MAO.  Enrollees that use the MAO’s network of providers typically incur lower  overall copayments or coinsurance than those enrolled in FFS Medicare.  In maintaining their networks, MAOs may take action to exclude providers  from a network at any time throughout the year.

Competition for enrollees provides MAOs with incentives to reduce  expenses and control costs. Some MAOs have begun trimming existing  networks or offering health plans with narrower networks, in which  beneficiaries are limited to a smaller group of physicians and hospitals.  According to the trade association that represents MAOs, this may be  done in order to shape a network of high-quality, low-cost care providers  and to keep costs low for beneficiaries. MAOs may control costs by  excluding providers who charge higher fees or by negotiating with a  smaller set of providers for lower payment rates. According to industry  representatives, narrower networks also allow MAOs to better monitor  provider performance and impose guidelines more effectively.

However, some professional medical associations and beneficiary  advocates have expressed concern about the narrowing of provider  networks and how disruptive changes to networks can be for MA  enrollees. Medical associations have questioned the way that MAOs  identify less efficient providers and their lack of transparency in decisions  to drop certain providers. Advocates note that beneficiaries are often  unaware of how broad or narrow their MA plans’ provider networks are  and experience confusion over which providers are participating in which  plans. Because MA plans may not cover as much of the cost of services  obtained from providers out of their networks, enrollees who obtain  services from non-network providers could face higher out-of-pocket  costs. Beneficiaries notified that their providers will be terminated from  their MA plans’ networks may decide to disenroll from MA or switch to  another MA plan during a designated period each year. However, even if  their providers leave or are dropped from their MA plans’ networks  outside of that period, beneficiaries typically have a limited ability to  change their plan selections throughout the year.

The Centers for Medicare & Medicaid Services (CMS)—the agency within  the Department of Health and Human Services (HHS) that administers  the Medicare program—contracts with MAOs to manage the care of MA  enrollees. CMS established requirements for MA provider networks to  ensure adequate access for enrollees to Medicare-covered services.  CMS has also developed requirements and policies regarding which  provider types must be included in plan networks, and when and how  MAOs should notify the agency, providers, and enrollees if certain  network reductions are imminent. In light of media reports about  reductions in provider networks and the effect those reductions might  have on access to care for MA enrollees, questions have been raised  about CMS oversight of MA plans’ network adequacy. GAO was asked to  report on how CMS ensures adequate access to care for MA enrollees. In  this report, we examine  1.  how CMS defines network adequacy and how its criteria compare with  those of other programs that have guidelines for managed care plans,  2.  how and when CMS applies its network adequacy criteria to MAOs,  3.  the extent to which CMS conducts ongoing monitoring of MAO  4.  how CMS ensures that MAOs inform beneficiaries about network  provider terminations and options for care.

To examine MA network adequacy criteria, we reviewed CMS guidance  and interviewed officials from CMS. We also interviewed representatives  from an agency contractor—The Lewin Group (Lewin)—that developed  and re-assesses the MA criteria. We reviewed the strengths and  limitations of MA network adequacy criteria and compared them against  other programs’ standards for network-based plans. To compare CMS’s  MA criteria with other managed care guidelines, we compiled information  on the quantitative, subjective, and other standards applicable to three  federal health care programs and developed by one entity for state use  (hereafter “programs”):  the network adequacy model for states designed by the National  Association of Insurance Commissioners (NAIC),  the federal network adequacy requirements applicable to qualified  health plans (QHP) offered in the marketplaces established under the  Patient Protection and Affordable Care Act (PPACA),  the federal network adequacy requirements applicable to Medicaid  managed care organizations, and  the federal network adequacy requirements applicable to TRICARE’s  managed care health plan option.

To examine CMS’s process for applying network adequacy criteria and  also to determine the extent to which CMS conducts ongoing monitoring  of MAOs’ network adequacy, we reviewed relevant CMS policy and  procedure guidance for its staff. We also examined analyses conducted  by Lewin with regards to CMS’s network adequacy oversight. In addition,  we interviewed CMS officials responsible for MAO oversight and network  adequacy policy, including officials at five regional offices directly  responsible for conducting reviews of the MAO submissions. We also  interviewed representatives from several primary and specialty care  medical associations that have recently commented on MA network  adequacy requirements, as well as beneficiary advocacy groups, and the  trade association that represents MAOs to obtain their perspectives on  CMS oversight. We reviewed the Standards for Internal Control in the  Federal Government and identified explicit criteria against which to  assess CMS policies. We also examined CMS data on MAO provider  network adequacy determinations for contract years 2013 through 2015.  We assessed the reliability of CMS network adequacy data by  interviewing agency officials knowledgeable about the data, reviewing  related documentation, and performing electronic data testing for obvious  errors and accuracy and completeness, where applicable. We determined  that the data were sufficiently reliable for the purposes of this report.

To examine how CMS ensures that MA enrollees are notified of provider  terminations and options for care, we reviewed CMS policies and  guidance for MAOs on network notification requirements and provider  directories. We spoke with CMS central office and regional office officials  to ascertain how CMS puts these policies into practice. We also  interviewed medical associations and beneficiary advocacy groups to  obtain their perspectives on plan communication about network changes.  Finally, we reviewed federal regulations for MAOs and identified explicit  criteria with regard to marketing activities—along with internal controls— against which to assess CMS policies.

We conducted this performance audit from August 2014 to August 2015  in accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.
subsections: section_title: Background
subsections: section_title: MA Enrollment Opportunities and Trends
paragraphs: For the approximately 10,000 individuals who age into Medicare every  day, the first opportunity to sign up for an MA plan may occur during their  initial Medicare election period. After that, beneficiaries in FFS Medicare  may enroll in MA—and MA beneficiaries may change their plan  selection—during the annual election period from October 15 to  December 7. Beneficiaries’ plan selections, effective January 1, are then  “locked in” for that calendar year, with some exceptions. CMS grants  certain special election periods (SEP) outside of the annual election  period when beneficiaries may join MA or change their MA plan selection.  For example, MA enrollees who move to states not served by their MA  plans are entitled to an SEP to select new coverage.

By offering comprehensive coverage and limiting out-of-pocket costs, MA  has attracted a substantial number of Medicare beneficiaries. As of May  2015, nearly 16 million beneficiaries, or 30 percent of the Medicare  population, were enrolled in approximately 3,800 plan options offered by  about 500 MAOs. The Congressional Budget Office has projected that,  as the Medicare-eligible population increases, MA enrollment will grow to  30 million beneficiaries, representing about 40 percent of Medicare, by  2025.

section_title: Provider Network Formation and Directories
paragraphs: A fundamental characteristic of MA is that most plans direct enrollees to a  limited network of health care providers. The size of a provider network  may range from very narrow to fairly broad, depending on the type of  plan, the area of the country, and local market characteristics. For  example, in urban areas, competition may allow MAOs to recruit  providers who are willing to offer discounts on their usual fees in order to  be included in the network, providing easy access to an MAO’s many  enrollees. However, in rural areas, MAOs may have difficulty organizing  an adequate network due to the more limited supply of providers in those  areas. To provide beneficiaries with wide access to MA plans, CMS  network adequacy requirements take into account differences in  utilization, patterns of care, and supply of providers in urban and rural  areas.

In building their networks, MAOs contract directly with providers. To  establish or renew a contract, MAOs negotiate with providers to find  agreed-upon payment rates, terms, and duration. MAOs can initiate  contracts with providers at any point during the year and can also  terminate contracts with network providers at any point. These  terminations can be made “for cause,” for such things as a loss of license  or breach in contract, or “without cause”—requiring no explanation for the  termination. Under Medicare rules, MAOs must give providers written  notice at least 60 days in advance of terminating them without cause and  must offer providers a process for appealing contract terminations. CMS  does not take part in those appeals.

To determine whether their current provider, or a provider they wish to  use, participates in their MA plan network, beneficiaries commonly rely on  provider directories. CMS has published a model directory template,  which, though not mandatory, provides MAOs that use it with an  expedited agency review. MAOs are required to provide enrollees with  paper directories and maintain current directories on their websites at all  times. However, research has shown that provider directories issued by  insurers often contain inaccurate information and, as a consequence,  may mislead beneficiaries about their provider options. The following are  examples:

The HHS Office of Inspector General reported that 35 percent of  1,800 primary care and specialty providers could not be found at the  location listed by the selected Medicaid managed care  organizations.

The California Department of Managed Health Care called physician  offices listed in the provider directories for two large plans in the  state’s PPACA marketplace. For Anthem Blue Cross, it found that  12.5 percent of the listings had inaccurate locations and about   13 percent of physicians did not take Anthem Blue Cross patients.   For Blue Shield of California, it found that about 18 percent of the  listings had inaccurate locations and about 9 percent of physicians   did not take Blue Shield of California patients.

A study of 4,754 MA dermatology providers listed in directories of  large MAOs in 12 metropolitan areas found that about 46 percent of  the listings were duplicates and 8.5 percent of the unique providers  had died, retired, or moved out of the area.

Posing as patients, researchers phoned 360 in-network psychiatrists  listed on a major insurer’s website and attempted to make  appointments. Sixteen percent of the telephone numbers were wrong  and 15 percent of practices were not accepting new patients.

section_title: Regulation of MA Network Adequacy
paragraphs: Through the annual MAO contracting process, MAOs must attest to the  regulatory requirement that they “maintain and monitor a network of  appropriate providers that is supported by written agreements and is  sufficient to provide adequate access to covered services to meet the  needs of the population served.” These networks must also conform to  the local pattern of health care delivery. MAOs that do not comply with  CMS requirements for network adequacy or do not maintain complete  and accurate provider directories may be subject to enforcement actions,  including civil monetary penalties or enrollment sanctions.

Beginning with contract year 2011, CMS adopted network adequacy  criteria designed to be more objective and defensible, as well as updated  procedures for reviewing the criteria. Lewin analyzed utilization patterns  and standards used by other entities, among other things, to develop the  current criteria that CMS regional offices use in conducting their reviews  of the MAO submissions. Lewin also revisits network adequacy criteria  and CMS oversight processes annually, and provides recommendations  for improvement, as needed. To update requirements for MAOs and its  oversight of network adequacy, CMS sets forth new policies in its  Medicare Managed Care Manual and Marketing Guidelines as well as in  its annual Final Call Letter. For example, the 2015 Final Call Letter put  forth several changes in network adequacy-related guidance, including a  policy that allows an SEP when beneficiaries are affected by significant  midyear provider network terminations initiated by MAOs without cause.

section_title: For MA Network Adequacy, CMS Uses Robust Travel Time and Distance Criteria; Other Programs Include Provider Availability Standards
paragraphs: Through its network adequacy criteria, CMS requires that MAOs have  enough providers in their networks to ensure that enrollees can access  care within specific travel time and distance maximums. The agency’s  quantitative criteria take into account differences in utilization across  provider types and patterns of care in urban and rural areas. However,  contracting with a certain number and type of providers may not be the  same as true provider availability—measured by appointment wait times,  providers accepting new patients, or how often a provider practices at a  particular location. To varying degrees, provider availability standards  have been incorporated broadly into other programs and used in some  states to more completely assess the adequacy of provider networks.
subsections: section_title: CMS Established County- Based Time and Distance Criteria for Determining Minimum Number of Providers Constituting an Adequate MA Network
paragraphs: Since 2011, CMS has defined an adequate MAO network as meeting two  criteria: a minimum number of providers and maximum travel time and  distance to those providers. These criteria are sensitive to local conditions  in that they vary by type of provider and type of county.

A minimum number of providers. To determine the minimum number  of providers required, CMS considers such county-specific factors as  the total number of Medicare beneficiaries and historical data on MA  market share in similar counties. CMS sets minimum provider ratios  per 1,000 beneficiaries by provider type in each county, for both  primary care (including geriatrics and internal medicine) and specialty  care (such as cardiology, gastroenterology, and oncology). These  ratios differ by the county’s geographic designation as large metro,  metro, micro, rural, or counties with extreme access considerations.

Maximum travel time and distance. CMS’s time and distance   criteria also vary substantially by provider type and county   geographic designation. CMS developed these measures—such   as 10 minutes/5 miles for primary care providers in large metro  counties or 40 minutes/30 miles for primary care providers in rural  counties—by juxtaposing beneficiary addresses with provider  locations. At least 90 percent of beneficiaries in a county must have  access to the appropriate number of providers within the required time  and distance maximums. To count toward the threshold, network  providers do not have to be located in the same county as  beneficiaries as long as they are within the required proximity.

Each year, CMS updates its network adequacy criteria for each county  and provider type for the subsequent contract year. In advance   of contract year 2016, CMS required that MAO networks comprise   55 provider types, including 6 specific primary care provider types,   26 specialty care types, and 23 facility types. For the minimum number   of providers criterion, CMS counts each specialty care type separately,  but counts all primary care provider types together as one group for  mapping purposes. For example, in a metro county with nearly 32,000  total Medicare beneficiaries, each MAO—regardless of the number of  plan enrollees—must include in its network at least 7 primary care  providers, 2 cardiologists, 2 general surgeons, and 1 of each of the  remaining specialty care types. Each MAO in this metro county must also  include 47 acute inpatient beds per 1,000 beneficiaries, and one of each  of the facility and transplant program types. (For more information on  CMS’s network adequacy criteria for contract year 2016, see app. I.)

Health care researchers have noted that network adequacy criteria  measured by provider type and geographic designation serve to protect  beneficiary access while preserving MAO flexibility in provider network  design. Furthermore, some researchers have pointed out that  quantitative standards derived from sound research provide clarity and  certainty, and level the playing field among insurers. In addition, the CMS  regional office officials we spoke with expressed a preference for the  current criteria. Before 2011, the criteria CMS used were more  ambiguous and did not allow for the more objective and consistent  application they do now. One beneficiary advocacy group we interviewed  described the MA network adequacy criteria as acceptable and  appropriate parameters for the program.

However, some medical associations we spoke with and recent research  by the HHS Office of Inspector General have noted shortcomings in  CMS’s reliance on geography-based provider ratios. Medical associations  stated that CMS does not obtain information on whether providers in  MAO networks are accepting new patients or if the appointment wait  times reasonably ensure that patients can see a provider in a timely  manner. In commenting on CMS’s draft Call Letter for contract year  2016, a number of medical associations collectively stated that a  provider’s full-time equivalent status at a given location should be taken  into account to ensure access to care without unreasonable delay. As the  HHS Office of Inspector General recent study of Medicaid managed care  standards found, when provider availability is not factored into network  adequacy criteria, insurers may be able to meet network adequacy  criteria even if their network providers are not readily available to all their  enrollees.

As noted by a Lewin representative, CMS’s priority in updating MA criteria  has focused on the number and geographic distribution of providers over  other measures of access. She noted, for example, the challenge in  identifying network physicians who do not take new MA patients due to  practice capacity constraints. Although physicians may choose to  participate in multiple health plans or serve FFS patients, MAOs do not  require that they report on their practice capacity—that is, the extent to  which they contract with other MAOs or the size of their patient panel.  Without such data it is difficult to determine the number of potential  beneficiaries providers could reasonably serve.

Additionally, medical associations told us that CMS’s provider type  classifications in the MA criteria mask distinctions within specialties that  could have consequences for how MAOs design their networks. The  American Academy of Ophthalmology noted that MAOs do not make  distinctions for retina or glaucoma specialties. Similarly, the American  Society of Retina Specialists reported that it can be challenging for MA  enrollees with certain eye conditions to receive treatment when MAOs are  not required to include retina specialists in their networks. The American  Academy of Dermatology said that dermatologists in plan networks may  include subspecialists whose practices focus on certain populations, such  as pediatric dermatology. Therefore, counting all specialists regardless of  practice focus, as CMS’s criteria do, may overstate the actual number of  specialists available to serve MA enrollees. Lewin acknowledged the  difficulty in recognizing variation with medical subspecialties as the  provider identification data used to establish ratios does not account for  these type of breakdowns. For example, because retina specialists are  not identified separately from other ophthalmologists in CMS data, there  was no way for Lewin to develop subspecialty requirements.

section_title: Unlike MA, Some Other Programs Consider Provider Availability as a Component of Network Adequacy
paragraphs: Network adequacy standards in other managed care programs we  examined cover a variety of approaches to setting network adequacy  criteria and differ, to some extent, from MA criteria. To measure the  adequacy of provider networks, these standards generally include  aspects of provider availability, along with time and distance maximums  and provider-to-enrollee ratios. Most of the programs—NAIC’s model act,  PPACA marketplaces, and Medicaid managed care—establish minimum  network requirements, with states having flexibility to impose additional  standards.

Since 1996, NAIC has made available to states a model act for network  adequacy. To update the model act, NAIC convened a group of state  insurance regulators and other interested parties and expects to issue a  new model act in 2015. The draft NAIC revised model suggests that  states incorporate aspects of provider availability, such as wait times for  visits with network providers. NAIC uses a subjective “reasonable access”  standard instead of distinct time and distance maximums, which  accommodates state differences in geographic accessibility and  population dispersion. NAIC’s model act also suggests that states  consider provider-to-enrollee ratios for primary and specialty care. While  some groups, such as consumer advocates, called on NAIC to establish  more quantitative requirements, it has chosen not to be as prescriptive as  these groups recommend.

QHPs offered in the PPACA marketplaces (whether state-based or  federally facilitated) are subject to federal network adequacy standards,  which CMS updates in annual rulemaking. CMS used the 1996 NAIC  model act for network adequacy as the basis for the PPACA marketplace  standards and intends to use the revised model to update requirements  applicable to QHPs. States may also impose additional network adequacy  requirements on QHPs. Federal rules for PPACA marketplaces do not  address network provider availability. Federal regulations do specify that  services be accessible without unreasonable delay, but do not include  any maximum time or distance requirements. Also, federal regulations do  not set any provider-to-enrollee ratios, although QHPs are generally  required to contract with a sufficient number of essential community  providers, such as federally qualified health centers and other providers  that serve predominately low-income, underserved populations. A 2015  Commonwealth Fund study of plans in PPACA marketplaces found that  23 states have quantitative time or distance criteria, while fewer states  have quantitative criteria for appointment wait times (11 states) and  provider-to-enrollee ratios (10 states).

Medicaid managed care organizations are subject to broad federal  network adequacy requirements, and states may impose additional or  more specific standards. Federal law generally requires a Medicaid  managed care organization to provide adequate assurances it has  sufficient capacity to serve expected enrollment in its service area.  Federal Medicaid regulations contain standards covering different aspects  of network adequacy, but do not include any quantitative measures. To  address provider availability, regulations require that states consider the  numbers of network providers who are not accepting new Medicaid  patients. While the rules do not set specific time and distance maximums,  regulations point to other access considerations—means of transportation  and physical access to care for individuals with disabilities. Additionally,  the law does not set specific provider-to-enrollee ratios, but requires that  states consider other aspects that would factor into a ratio, including  anticipated enrollment, expected utilization, and number and types of  providers required to furnish services. In a review of 33 states with  Medicaid managed care programs, the HHS Office of Inspector General  reported that states typically set standards for appointment wait time,  travel time and distance, as well as provider-to-enrollee ratios. These  requirements varied widely among the states reviewed, with some  differentiation by provider type (primary or specialty care) and location  (urban or rural). For example, the states ranged from a maximum  appointment wait time for a routine primary care visit of 10 business days  in California and Pennsylvania to 45 calendar days in Massachusetts and  Minnesota. CMS recently issued a proposed rule that would amend  current Medicaid managed care standards to reduce variation in how  states evaluate and define network adequacy, and would impose  minimum time and distance standards for certain types of providers.

TRICARE’s managed care access standards generally have a more  quantitative approach. To address provider availability, TRICARE sets  appointment wait time limits for routine visits, well-patient visits or  specialty care referrals, and urgent care. TRICARE standards set  maximum travel times at 30 minutes for primary care and 1 hour for  specialty care under normal circumstances. The only aspect of network  adequacy standards that TRICARE does not set specific requirements for  are provider-to-enrollee ratios, where TRICARE generally requires a  sufficient number and mix of specialists to reasonably meet the  anticipated needs of enrollees.

The inclusion of provider availability in other programs’ network adequacy  requirements suggests CMS may be missing a key element for  measuring access. In addition, recent health care research we examined  and representatives of medical associations we spoke with have  suggested that provider availability is a key element for measuring access  to care, which most network-based programs have broadly incorporated  into federal standards, state standards, or both. While the federal or  nationwide requirements are largely broad and subjective, some states  have set more quantitative criteria. MA criteria are more robust than those  of other programs in terms of distinct travel time and distance for a  defined set of providers, but CMS does not assess whether those  providers are truly available to enrollees. CMS’s goal has been to set  objective measures of network adequacy. Certain programs or states  have demonstrated that quantifiable criteria can also extend to measures  of provider availability, such as appointment wait time limits.

section_title: CMS Applies Its Network Adequacy Criteria to Very Few MAO Provider Networks Each Year and Grants Permanent Exceptions to Its Criteria
paragraphs: One of CMS’s key MA oversight responsibilities is to ensure that MAOs  maintain a network of providers sufficient to meet the needs of all their  enrollees. However, CMS limits its annual application of its network  adequacy criteria to only those provider networks in counties that MAOs  propose to enter in the upcoming year—less than 1 percent of all  networks. To facilitate its review of these networks, CMS has established  standardized data collection via an automated system. However, the  agency performs minimal validation of network data. MAO applicants  cannot serve counties without meeting all network criteria, but they may  seek—and often receive—exceptions from CMS.
subsections: section_title: CMS’s Reviews of MAO Network Adequacy Reach Less than 1 Percent of County-Based Provider Networks Each Year
paragraphs: While CMS has established criteria defining network adequacy, the  agency does not ensure that every network is meeting its current  requirements. Instead, it has chosen to collect data for only a minimal  subset of MAO networks during the annual application process. Rather  than assessing all MAO county-based provider networks against its  network criteria, CMS limits its use of the criteria by focusing exclusively  on networks in counties that MAOs propose to enter in the upcoming  year. During the annual MA application process, CMS’s criteria are only  applied against proposed networks, not networks in counties that MAOs  already serve. For contract years 2013 through 2015, the agency  reviewed over 9,000 proposed networks. CMS approved about half of  these networks, while the rest were either withdrawn by MAOs or denied  by CMS. (See table 1.) The approval rate varied greatly across the   10 CMS regional offices, ranging from 68 percent at the Atlanta regional  office to 22 percent at the San Francisco regional office.

The proposed county-based provider networks that CMS approves  constitute a fraction of MAO networks and account for a small percentage  of enrollees. For contract years 2013 through 2015, new provider  networks comprised 0.38 percent of all networks and served 1.99 percent  of all MA enrollees during their initial year of operation (see table 2). The  small scope of CMS’s network adequacy reviews raise questions as to  the agency’s internal controls. For an agency to achieve its objectives,  federal internal control standards provide that management must obtain  relevant data in a timely manner based on identified information  requirements. However, CMS only collects network information for  proposed MAO networks during the annual application process.

section_title: For Networks Subject to Adequacy Assessments, CMS Uses an Automated Review Process but Performs Minimal Data Validation
paragraphs: CMS has established a standardized process for collecting data on  proposed county-based MAO provider networks. Each January, CMS  posts on its website Health Services Delivery (HSD) reference tables that  contain network adequacy criteria thresholds for each county. CMS  requires MAO applicants to report network data using the HSD table  format and transmit the data through the Health Plan Management  System (HPMS)—the primary communication tool between CMS and  MAOs. The HSD table template has fields to record each network   provider’s name, address, provider type, medical affiliation, and  employment status. Before submitting their applications to CMS in  February, MAOs are able to determine the adequacy of their provider  networks by comparing their HSD table data against the thresholds in the  HSD reference tables. For example, MAOs planning to enter Cook   County, Illinois, for contract year 2016 know from the HSD reference  tables that they need at least 92 primary care providers within 10 minutes  or 5 miles from at least 90 percent of beneficiaries’ homes in that county,  and also know the thresholds for all other required provider types. If  MAOs do not meet all the thresholds in Cook County, they may choose,  among other options, to contract with more providers to build an adequate  network or to not enter that county.

After MAOs submit their applications, CMS evaluates their provider  networks using an automated system. Through HPMS, CMS performs  automated checks, which rely on the HSD reference tables, to determine  whether provider networks meet each threshold and then generates two  reports on the data errors detected. One report lists problematic  address information, such as blank fields, duplicative records, and street  addresses and zip codes that are not recognized by the system. The  other HPMS report lists all providers shown as supporting the threshold  for more than one type of specialty care within a given network. CMS  regional office officials praised the automated checks for being far more  thorough than the manual review process used before contract year 2011  and for requiring significantly less of their time. Beyond these system- generated reports, CMS does little else to assess the accuracy of the  HSD data that MAOs submit.

While the HPMS reports identify certain data errors and anomalies,  challenges remain with verifying MAO provider network data submissions.  In its review of provider submissions, Lewin raised concerns about the  validity of addresses in the HSD tables and the overstatement of  beneficiary access. In addition, CMS and MAOs both told Lewin they  had difficulty verifying provider data. They noted that commonly used  verification resources, such as public Medicare websites for comparing  physicians or hospitals against quality and cost ratings, often contain  incorrect data due to lags in updates and poor provider self-reporting. To  address these concerns, Lewin recommended that CMS develop data  verification tools to facilitate the accuracy and consistency of application  data submissions and HSD table reviews and include more information  on the strengths and limitations of commonly used verification resources  in its standard operating procedures. While CMS officials said they  developed a tool during the contract year 2015 application cycle to  facilitate the consistency of submissions, they told us they have no plans  to develop additional tools to determine the accuracy of submissions or  add information to the standard operating procedures.

Federal internal controls call for management to obtain relevant data that  have a logical connection with, or bearing upon, identified information  requirements; be reasonably free from error and bias; and faithfully  represent what they purport to represent. For effective monitoring,  management must also evaluate the reliability of data sources.  However, CMS does not check the HSD data against other data sources  to identify inconsistencies and other indications of error. Officials from one  CMS regional office questioned the purpose of cross-checking the HSD  data, but officials from another regional office noted that they occasionally  call providers and perform Internet searches to verify the data. The lack of  data validation is notable because provider directories, which contain the  same elements as the HSD data, have been proven to be inaccurate, as  previously discussed. Because the HSD data and provider directories are  populated from the same source, according to the trade organization that  represents MAOs, the HSD data likely contain the same inaccuracies.

Inaccuracies in provider directories—and, as an extension, HSD tables— may be attributable to both MAOs and providers. According to the trade  organization that represents MAOs, it is a challenge for health plans to  ensure that provider directories are up-to-date and accurate because  providers often do not notify the plans of changes, such as retirements  and office relocations, in a timely manner. The American Academy of  Dermatology representatives explained that MAOs are responsible for  updating provider directories, in part because MAOs use networks to  attract consumers and sell their insurance policies. Representatives from  two medical associations reported that they were not aware of any MAO  contract requirements regarding updates to directory information. The  American Academy of Ophthalmology representatives told us that most  providers inform MAOs of address changes, for example, but such  notices are not always acted upon by the MAOs. To eliminate the hassle  of notifying multiple MAOs of changes in office hours or locations, the  representatives proposed the construction of an electronic portal  accessible by all health plans to allow providers to update their  information in one place. Medical association representatives also  contended that MAOs are in a better position to detect when directories  need to change, because the absence of claims for a specific period,  such as 30 days, would indicate whether a provider has, for example,  moved or died. In CMS’s 2016 Final Call Letter, the agency reported  plans to conduct direct monitoring of online provider directories to verify  the information MAOs include about network providers. The agency also  indicated it will consider requiring MAOs to provide, and regularly update,  network information in a standardized, electronic format for eventual  inclusion in a nationwide provider database readily available to  beneficiaries and others.

section_title: CMS Commonly Grants Permanent Exceptions from Its Network Adequacy Criteria When MAOs Offer Alternatives Consistent with Local Patterns of Care
paragraphs: March  MAOs whose provider networks do not meet  CMS’s network adequacy criteria are able to  request exceptions from the criteria.

CMS allows MAOs whose proposed networks fail to meet the adequacy  criteria for a particular provider type in a county to request an exception  from the criteria. After completing the automated checks, CMS provides  an opportunity in March to MAOs whose provider networks did not pass  the checks to request exceptions from its network criteria along with a  justification. If MAOs’ provider networks do not initially pass the  automated checks, CMS notifies them and requests updated data, if  applicable. HPMS then generates a report that MAOs can use to prepare  exception requests for each provider type deemed insufficient. According   to CMS, exceptions are intended to be granted under limited  circumstances, primarily when its network criteria are not in line with local  patterns of care. CMS’s standard operating procedure for reviewing  exceptions states that they may be allowed when an insufficient number  of providers are located in or near the county, the pattern of care in the  county does not support the need to have the required number of  providers, or the services of the provider type can be rendered by another  provider type.

For each exception request, CMS requires MAOs to submit a detailed  plan for ensuring access to the services of the provider type for which the  exception is being made. MAOs must identify non-contracted providers in  or near the county, explain why they have not contracted with those  providers, specify the local patterns of care issues they identified,  propose another provider type to offer services, and describe each data  source used. Along with this information, MAOs must upload in HPMS  lists of the network providers that can provide the services of the provider  type and the closest network providers of the provider type. CMS’s policy  is that an MAO’s refusal to contract with a provider or a provider’s refusal  to contract with an MAO is not a valid reason for an exception.

April  CMS manually reviews the exception requests  from MAOs.

In April, regional offices—which CMS officials said best understand their  markets—review and grant exception requests on a case-by-case basis.  Regional office reviewers manually scrutinize each request for the  counties in their region. While the Atlanta, Boston, Kansas City, and  Philadelphia regional offices approved all the exception requests they  reviewed during contract years 2013 through 2015, the San Francisco  and Seattle regional offices each approved approximately 80 percent.  According to the reviewers we interviewed, it can take 5 minutes to up to  a day to review each one, depending on the experience and workload of  the reviewer, the complexity and thoroughness of the exception request,  and the availability of providers in a county. The reviewers may use  Internet search engines and mapping tools to confirm whether providers  are at the listed location and may call providers to determine the local  pattern of care in a county. Some reviewers told us they also examine  state and local medical board information, while others said they perform  only spot checks for well-written exception requests. Asked if they  considered analyzing Medicare FFS claims data for patterns of care,  reviewers from one regional office said such analyses would not be  helpful in determining where a county’s beneficiaries customarily obtain  health services. They explained that determining the local pattern of care  can be subjective and an understanding of the geographic area where  exceptions are requested is all that is needed.

CMS has approved most exception requests of those it has reviewed over  the past 3 years. For contract years 2013 through 2015, CMS reviewed  approximately 2,300 exception requests and approved 91.8 percent. For  contract year 2015, CMS approved all but 1 of the 641 exception requests  it reviewed. (See table 3.)

While exceptions may be warranted under certain conditions, CMS never  revisits its approved exceptions to see if they continue to be justified.  Although provider networks and provider markets are constantly  changing, exceptions that are based on a point in time hold indefinitely.  Moreover, CMS officials noted that regional office account managers are  often not aware of past exceptions that have been granted to existing  MAOs.

The number of exception requests CMS has reviewed has varied greatly  across different types of counties. For contract years 2013 through 2015,  less densely populated counties accounted for most exception requests.  Approximately 23 percent of the requests were for provider types in  counties with extreme access considerations, 24 percent in rural counties,  18 percent in micro counties, 27 percent in metro counties, and 8 percent  in large metro counties. Although the time and distance requirements are  more generous in less populated areas, the pattern of care may be  unusual. Some provider types do not exist in certain rural areas,  according to CMS officials, and it may not be unusual for beneficiaries to  travel far distances to receive specialty care.

In addition, since contract year 2013, the number of exception requests  and the CMS approval rate have varied widely across provider types. Of  the 2,304 exception requests CMS reviewed over the past 3 years,  specialists accounted for 78 percent, facilities for 20 percent, and primary  care providers for 2 percent. While the CMS approval rate for exception  requests was 78 percent for facilities, it was 95 percent and 96 percent for  specialists and primary care providers, respectively. The 4 types of  providers with the greatest number of exception requests were  gastroenterology (154), dermatology (151), outpatient dialysis facilities  (132), and pulmonology (102). The CMS approval rate ranged from   12 percent for chiropractors to 100 percent for infectious diseases,  physiatry and rehabilitative medicine, neurosurgery, and 12 other provider  types. In addition to chiropractors, the approval rate was notably low   for outpatient dialysis facilities (40 percent) and skilled nursing facilities  (67 percent).

April-May  CMS approves or denies MAOs’ applications  depending on the adequacy of their provider  networks.

After the manual review of exception requests ends in late April, CMS  either approves the requests or issues a notice of intent to deny the  requests. MAOs whose exception requests are not approved have the  opportunity to submit revised requests in May, and then CMS makes its  final decisions. The regional office reviewers we interviewed noted that  they commonly deny requests from MAOs that do not follow the  instructions, provide poorly written responses, or do not provide enough  information on the local pattern of care. The reviewers explained that  many denials are the result of MAOs trying to expand too quickly or being  pressured by deadlines. MAOs may choose to withdraw their application  for a particular county so that CMS does not deny their entire  application.

section_title: CMS Does Not Routinely Examine Current Network Information, but Relies on MAO Self- Disclosure and Enrollee or Provider Complaints to Identify Network Issues
paragraphs: CMS’s regional account managers hold regular discussions with MAOs  during which network adequacy issues are sometimes raised, but CMS  does not routinely examine MAO information on provider networks to  assess ongoing compliance with criteria. CMS recently added a  requirement that MAOs disclose their plans to significantly narrow their  networks, but the agency has not defined what it means to have a  significant change, allowing each MAO to determine the need for  disclosure. CMS further expects that evidence of problems related to any  undisclosed network narrowing to appear as complaints to the agency,  even though some complaints may not be accounted for.
subsections: section_title: While CMS Checks in Regularly with MAOs, the Agency Does Not Require MAOs to Routinely Submit Updated Information on Network Composition
paragraphs: As part of its broader MAO oversight activities, CMS regularly holds  teleconferences with MAOs, where network issues may or may not be  discussed. The agency’s regional account managers monitor compliance  with various aspects of MA contracts—such as issues with provider  payments—but network adequacy is not always an item for discussion. At  the regional offices we interviewed, CMS account managers met with  MAOs in varying frequencies, with some meeting weekly and others  meeting monthly. Officials from three of the five regional offices told us  that account managers regularly prompt MAOs to discuss network issues,  such as pending provider contract negotiations; officials at the remaining  two told us that network adequacy discussions occur only on an as- needed basis.

Moreover, CMS does not routinely collect or review provider network  information from MAOs not subject to the application process, leaving  nearly all—over 99 percent—of ongoing county-based provider networks  unexamined against the current MA criteria. Internal control standards  stipulate that agencies should establish and operate ongoing monitoring  activities to assess quality performance over time; the standards also  note that operating information is needed to determine whether agencies  are achieving compliance with requirements under various laws and  regulations. Because a plan’s network providers and enrollees change  from year to year, the lack of regular review means CMS cannot be  assured that MAO networks continue to be adequate, providing sufficient  access for enrollees. CMS also never examined the networks that existed  before 2011 against the current network adequacy criteria, and as a  result, lacks the requisite information needed for proper oversight of  network adequacy in the MA program. Lewin analyzed samples of these  pre-existing networks and found that most, but not all, of the provider  network specialties met current adequacy requirements. Lewin further  concluded that more regular assessments of provider networks against  the current network adequacy criteria could help ensure that MA plans  continue to meet network adequacy criteria and would not be overly  burdensome for MAOs. Lewin recommended to CMS that the agency  develop a rigorous network monitoring program to ensure that all MAO  networks—not just those entering a county for the first time—continue to  meet network adequacy criteria. For example, Lewin suggested that   CMS consider evaluating each MA plan on a cyclical basis, such as every  3 years. Additionally, officials from two regional offices noted that more  regular assessments of adequacy based on HSD data submissions would  be an effective monitoring tool. CMS told us that it does not have plans  underway to review all networks for adequacy on a cyclical basis, but the  agency has announced plans to include network adequacy as a part of its  audit process on a pilot basis beginning in late 2015.

section_title: CMS Allows MAOs Discretion in Disclosing Adequacy Issues Stemming from Narrowing Provider Networks
paragraphs: Under the monitoring processes that CMS has put in place, MAOs must  disclose efforts to significantly narrow provider networks, but the agency  allows MAOs discretion in determining whether this disclosure is  necessary. As of contract year 2015, MAOs must notify CMS at least   90 days prior to significant changes involving provider contract  terminations. In deciding whether a network reduction is significant,  CMS has not provided any explicit criteria but directed MAOs to take a  conservative approach. According to CMS, leaving the definition of  significant to each MAO stems from the lack of consensus among  stakeholders—including beneficiary advocates and professional  associations—about how to define a significant network change.

In the event of a self-disclosed significant change, CMS requires MAOs to  provide information demonstrating their continued compliance with  network adequacy criteria, such as through the submission of updated  HSD tables or automated reports. In addition, it requires MAOs to develop  and submit a plan for ensuring continuity of care for affected enrollees. If  CMS determines that access for a large number of enrollees has been  impaired as a result of a significant network reduction, the agency may  approve an SEP. This would allow those enrollees to switch MAOs or  enroll in FFS Medicare outside the annual open election period. To make  this determination, CMS takes into account the number of enrollees  affected, the size of the area served, the timing of the termination, and  information related to the enrollee notification, but also requires that  enrollees demonstrate that they were affected by the loss of their network  provider. Some CMS officials we spoke with asserted that MAOs have an  incentive to self-disclose major provider network reductions because they  are subject to more severe compliance actions if they are not forthcoming  about changes impacting access to care. However, from 2011 to early  2015, CMS had taken only one compliance action—issuance of a warning  letter—against an MAO for a network adequacy issue.

Other MAOs, including Humana and Blue Cross Blue Shield affiliates, have conducted  similar provider network narrowing efforts. UHC is presented here because it was the  largest MAO in 2014, accounting for 20 percent of total MA enrollment.

section_title: CMS Relies on Complaints Reported to the Agency to Identify Network Adequacy Issues Not Disclosed by MAOs
paragraphs: CMS relies on complaints it receives to identify any problems related to  network changes that are not identified through MAO self-disclosure, but  does not routinely review complaints made to MAOs directly or data on  out-of-network service utilization. CMS tracks complaints from  beneficiaries and providers made to its Medicare call center (1-800- MEDICARE), State Health Insurance Assistance Programs,  congressional offices, or directly to its regional offices. Complaint  information is compiled in CMS’s Complaints Tracking Module (CTM) and  categorized by topic before being assigned to a regional office  caseworker. Agency officials told us that any network adequacy issues  not already disclosed by MAOs would be reflected as a spike in  complaints reported by MA enrollees or providers. As a part of the  agency’s ongoing monitoring responsibilities, CMS account managers are  directed to analyze trends in the CTM data and investigate those trends  that they believe need to be addressed, particularly as they relate to  beneficiary access issues. Until recently, network adequacy was not a  separate category in the CTM but may have been included under other  categories, such as one for problems with plan enrollment. In 2014, CMS  created a distinct category—”provider or network issues”—to better  monitor trends in network-related complaints, but agency officials  acknowledge that such complaints may still appear in several other  categories.

Furthermore, CMS does not routinely ask MAOs about the complaints  they receive through their customer service lines or information about out- of-network utilization. In the event an MAO discloses significant network  changes, CMS may follow up about the types of complaints the MAO  subsequently receives, but the agency does not regularly do so. In  addition, CMS does not collect data from MAOs on how frequently  enrollees claim care from out-of-network providers, which would provide  account managers an additional tool to evaluate access in provider  networks.

section_title: CMS Has Not Set Information Requirements for Notices MAOs Send to Enrollees Regarding Provider Terminations and Options for Care
paragraphs: CMS requires that MAOs make a good faith effort to give enrollees  advance written notice when a provider contract is terminated, but has not  established information requirements for those notices. MAOs are  expected to send a letter to affected enrollees at least 30 calendar days  before the effective date of termination, and CMS suggests a longer  notification period in the event of a significant change to a provider  network. CMS issued guidance in its 2015 Final Call Letter that suggests  that, as a best practice, MAOs include information on in-network  providers to replace terminated providers in their notification letters to  enrollees. CMS also recommended that notices indicate how enrollees  can request continuation of ongoing medical care—such as  chemotherapy or post-operative rehabilitation—from the enrollee’s current  provider at in-network rates for a limited period of time.

Unlike some other beneficiary communications, CMS has not developed  a model template or list of required content for these notices. The agency  maintains standards for other MAO material distributed to beneficiaries to  ensure clarity and completeness. For example, CMS developed models  for MAO marketing materials, including provider directories. MAOs may  use a directory format different from the model directory, but it must  contain, at a minimum, all the same information elements required in the  model directory. Similarly, MA plans offering prescription drug coverage  must mail standardized annual notices of change to enrollees that contain  CMS-required elements about formularies and pharmacies. Yet, CMS  does not require that enrollee notifications of provider terminations  include all pertinent information in an understandable format.

Furthermore, CMS does not regularly review sample notices of  terminated providers sent to enrollees. For instance, officials at one  regional office told us that MAO account managers would review enrollee  notification letters only in the event of significant terminations. Officials at  four other regional offices did not identify this as a triggering event for  review. CMS officials explained that these notifications are considered ad  hoc communications and are classified as materials that are not subject  to marketing review.

CMS regulations prohibit MAOs from engaging in marketing activities,  including communications about provider networks, that could mislead or  confuse Medicare beneficiaries. In addition, internal control standards  state that management should ensure there are adequate means of  communicating with, and obtaining information from, external  stakeholders that may have a significant impact on the agency achieving  its goals. Because CMS neither requires specific information elements  nor reviews notifications, enrollees may receive inconsistent and  potentially confusing or inaccurate information when their providers are  terminated from MAO networks. For example, communication we  examined indicated that enrollees had been told by their MAO to select a  new provider long before the effective termination date for their current  provider. An MAO wrote to a primary care physician on May 21, 2014,  stating that his contract with the MAO would end May 11, 2015, the  anniversary date of the agreement. Then the MAO sent a letter to that  physician’s patient, dated June 3, 2014, stating that he must select a new  primary care provider by July 8, 2014, or one would be chosen for him.  Thus, although the enrollee could have continued receiving care from his  network physician for another 10 months, the MAO shifted the physician’s  patients to other providers.

section_title: Conclusions
paragraphs: CMS is responsible for ensuring that Medicare beneficiaries can access  timely care. To do this effectively, the agency must set appropriate MA  network adequacy criteria, oversee MAOs’ adherence to its requirements,  and ensure that enrollees are properly notified about MAO network  changes. Yet, the rules and processes the agency has put in place— which lack certain elements used in other managed care programs and  outlined in federal internal controls—cannot reasonably ensure that MAO  networks continue to meet the needs of MA enrollees.

CMS has established network adequacy criteria that put a premium on  the number of providers in a network within county-based time and  distance standards. The advantage of such quantitative criteria is that  they can be operationalized through automated processes. However,  unlike those of some other managed care programs, the CMS criteria  ignore measures of provider availability. CMS does not consider whether  an MAO’s contracted providers are part-time, work at their listed  locations, or are taking new patients. As a result, provider networks may  appear to regulators and beneficiaries as more robust than they actually  are if not all providers are open for business.

Under current CMS policy, the agency cannot be sure that all MAO  networks either fully meet its current criteria or qualify for an exception.  Although Medicare contracts with MAOs every year, CMS does not  require that MAOs demonstrate compliance with network adequacy  criteria every year. Instead, CMS performs systematic reviews of network  adequacy for only a small fraction of MA networks, relying on information  that is supplied by MAOs but is not fully checked for accuracy. For the  vast majority of plans, MAOs annually attest that they have an adequate  network, and CMS accepts that statement without verification. The  agency’s approach to monitoring existing networks is largely reactive,  relying on MAO disclosure of adequacy issues and beneficiary and  provider complaints. Unless CMS verifies provider information submitted  by MAOs and periodically requires evidence of compliance, for example  every 3 years, the agency cannot be confident that MAOs are meeting  network adequacy criteria.

Furthermore, while CMS requires that MAOs make a good faith effort to  notify enrollees in advance of a provider termination, the agency has no  standards for those notices. Also, unlike some beneficiary communication  and plan marketing materials, MAO notification letters are not subject to  any minimum information requirements. Without greater standardization,  the agency cannot ensure that MAO communications are clear, accurate,  and complete, and MA enrollees remain at risk of receiving potentially  confusing information.

section_title: Recommendations for Executive Action
paragraphs: To improve its oversight of network adequacy in MA, we recommend that  the Administrator of CMS augment MA network adequacy criteria to address provider  verify provider information submitted by MAOs to ensure validity of the  Health Services Delivery data; expand network adequacy reviews by requiring that all MAOs  periodically submit their networks for assessment against current  Medicare requirements; and  set minimum requirements for MAO letters notifying enrollees of  provider terminations and require MAOs to submit sample letters to  CMS for review.

section_title: Agency Comments and Our Evaluation
paragraphs: We provided a draft of this report to HHS for comment. The agency  provided written comments, which are printed in appendix II. In addition,  CMS provided technical comments, which we incorporated as  appropriate.

HHS concurred with our recommendations. In its comment letter, the  agency outlined several actions it plans to take, or is considering, to  strengthen its oversight of MAO network adequacy. Because these efforts  have yet to be implemented, it is too early to determine whether they will  fully address the issues we identified.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution of it until 30 days from its  date. At that time, we will send copies to the appropriate congressional  committees, the Secretary of Health and Human Services, and the CMS  Administrator. In addition, the report will be available at no charge on the  GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact  me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made key contributions to this  report are listed in appendix III.

section_title: Appendix I: Medicare Advantage Network Adequacy Criteria
paragraphs: The Centers for Medicare & Medicaid Services (CMS) uses two criteria  for determining network adequacy in Medicare Advantage (MA): minimum  number of providers and maximum travel time and distance. There are  several key elements CMS uses each year to update its requirements.  One key element is the provider types that MA organizations (MAO) must  include in their networks. Lewin—the agency contractor that developed  the criteria—explained that CMS had an original list of provider types that  it reviewed to see if the categorizations were appropriate. They found that  CMS’s list was mostly aligned with frequently used facility types. The 55  provider types required in contract year 2016 are listed in table 4.

For the minimum number of providers, CMS requires that MAOs  demonstrate that their networks have a sufficient number of providers  based on county characteristics. The five county classifications are  based on population and density estimates from U.S. Census Bureau and  Office of Management and Budget data. A county must meet both the  population and density indicators to be included as that county type. CMS  then multiplies three variables to determine the minimum number of  providers. The first variable is the 95th percentile of MA market  penetration rates for each county type. CMS chose the 95th percentile to  estimate market share through work conducted by Lewin, which  examined the market penetration in managed care and network-based  private fee-for-service (FFS) plans. The percentiles are updated each  year based on current enrollment. County type classifications and each  county’s respective percentile for contract year 2016 are listed in table 5.

The second variable in the formula is the number of Medicare  beneficiaries—those in MA and FFS—in a specific county. Each year,  CMS updates the total number of beneficiaries in each county. This  variable is multiplied with that year’s 95th percentile of MA market  penetration in the respective county type to determine the number of  beneficiaries an MAO could reasonably serve in its initial year in the  proposed county. For example, the 95th percentile for metro counties in  contract year 2016 was 12.1 percent. For an MAO seeking to enter that  county, the 95th percentile (0.121) would be multiplied by the total  number of Medicare beneficiaries in the county the MAO proposes to  enter to develop the number of beneficiaries the MAO must cover.

The third and final variable in the calculation is the established ratios of  provider types required per 1,000 beneficiaries for each county type. CMS  bases the established ratios on primary and secondary research of  utilization patterns and clinical needs of beneficiaries. To calculate the  minimum number of each provider type in each county, CMS multiplies  the ratio for each provider type by the number of beneficiaries an MAO  must cover and then rounds up to the nearest whole number. Table 6  illustrates the calculation for a minimum number of providers for primary  care in Muscogee, Georgia, which is a metro county.

For maximum travel time and distance, CMS requires that MAOs ensure  that their networks meet specific geographic metrics. CMS uses geo- mapping software to determine the distance between the locations of  beneficiaries’ addresses and network provider practices. For each county  MAOs propose to enter, they must show that at least 90 percent of  beneficiaries in that county will have access to at least one provider of  each type within CMS’s time and distance criterion for the applicable  county type.

section_title: Appendix II: Comments from the Department of Health and Human Services

section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact

section_title: Staff Acknowledgments
paragraphs: In addition to the contact named above, Rosamond Katz, Assistant  Director; Sandra George; David Grossman; Kate Nast Jones; and   E. Jane Whipple made key contributions to this report.


Question-summary annotations: questions: question: What is CMS?
answer: The Centers for Medicare & Medicaid Services (CMS) is the agency within the Department of Health and Human Services (HHS) responsible for overseeing the Medicare Advantage (MA) program—Medicare's private plan alternative.

question: What are the requirements for MA provider networks?
answer: Since 2011, CMS has defined an adequate MA provider network as meeting two criteria: a minimum number of providers and maximum travel time and distance to those providers.
child_questions: question: What do the MA criteria not reflect?
answer: However, the MA criteria do not reflect aspects of provider availability, such as how often a provider practices at a given location.
child_questions: question: How is this criteria different than other network-based health programs?
answer: In contrast, other network-based health programs use provider availability measures to assess network adequacy.

question: Why may the requirements differ across the board?
answer: To reflect local conditions, the requirements are specific to different county types and a range of provider types.

question: What do federal Medicaid managed care rules address?
answer: For example, federal Medicaid managed care rules address providers' ability to accept new patients and TRICARE criteria address appointment wait times for active duty servicemembers.

question: What may happen as long as MA provider networks do not take availability into account?
answer: Without taking availability into account, as is done in some other programs, MA provider networks may appear to CMS and beneficiaries as more robust than they actually are.

questions: question: How does CMS apply network adequacy criteria?
answer: Rather than assessing all county-based provider networks against its criteria, CMS limits its annual application of the criteria to provider networks in counties that MA organizations (MAO)—private organizations that offer one or more health benefit plans—propose to enter in the upcoming year.

question: What did CMS reviews account for from 2013 through 2015?
answer: From 2013 through 2015, CMS's reviews accounted for less than 1 percent of all networks.

question: How does CMS review all of its networks?
answer: To facilitate its review of these networks, CMS has established standardized data collection via an automated system.
child_questions: question: What does CMS not yet do regarding assessing accuracy of networks?
answer: However, CMS does little to assess the accuracy of the network data in applications MAOs submit, even though the submissions contain the same data elements as in provider directories, which have been shown to be inaccurate in a number of government and private studies.

question: What does CMS need to do?
answer: Until CMS takes steps to verify MAO provider information, as outlined in federal internal control standards, the agency cannot be confident that MAOs meet network adequacy criteria.

questions: question: What does CMS not require from MAOs?
answer: For established provider networks, CMS does not require MAOs to routinely submit updated network information for review, but may learn of any adequacy issues through its broader oversight of MAOs.
child_questions: question: What did CMS recently require of MAOs?
answer: CMS recently required that MAOs disclose efforts to significantly narrow provider networks, allowing MAOs to determine when such disclosure is necessary.

question: How does CMS identify problems?
answer: CMS also relies on complaints it receives to identify any problems related to network changes that are not otherwise identified.

question: Why can CMS not be assured that networks continue to be adequate and provide sufficient access for enrollees?
answer: Because a plan's providers may change at any time, CMS cannot be assured that networks continue to be adequate and provide sufficient access for enrollees until the agency collects evidence of compliance on a regular basis.

questions: question: What has CMS not yet done?
answer: While CMS requires that MAOs give enrollees advance notice when a provider contract is terminated, the agency has not established information requirements for those notices and does not review sample notices sent to enrollees.
child_questions: question: Why is this lack of action inconsistent?
answer: This lack of scrutiny appears inconsistent with the agency's oversight of other Medicare beneficiary communications and with internal controls.

question: What is the problem with CMS not having a minimum set of required information elements?
answer: Without a minimum set of required information elements and a check on adherence to them, the agency cannot ensure that MAO communications are clear, accurate, and consistent.

questions: question: What was GAO asked to do?
answer: GAO was asked to review how CMS ensures adequate access to care for MA enrollees.

question: What does this report examine?
answer: This report examines (1) how CMS defines network adequacy and how its criteria compares with other programs, (2) how and when CMS applies its criteria, (3) the extent to which CMS conducts ongoing monitoring of MAO networks, and (4) how CMS ensures that MAOs inform beneficiaries about terminations.
child_questions: question: How did GAO get information for this report?
answer: GAO reviewed CMS and other guidance on network adequacy, federal regulations, and standards for internal control.

question: What interactions did GAO have with CMS to get information?
answer: GAO also interviewed CMS officials and representatives of medical associations and beneficiary advocacy groups, and analyzed CMS data on oversight of MAO provider networks for contract years 2013 through 2015.