Medicare Program Integrity: Contractors Reported Generating Savings, but CMS Could Improve Its Oversight
Released: 2013-11-25T00:00:00


Highlights: section_title: Why GAO Did This Study
paragraphs: GAO has designated Medicare as a high-risk program, in part because its size and complexity make it particularly vulnerable to fraud. To help detect and prevent potential Medicare fraud, CMS--the agency within the Department of Health and Human Services (HHS) that administers the Medicare program--contracts with ZPICs. These contractors are to identify potential fraud, investigate it thoroughly and in a timely manner, and take swift action, such as working to revoke suspect providers' Medicare billing privileges and referring potentially fraudulent providers to law enforcement.

GAO examined (1) ZPIC contract costs and how ZPICs use those funds, (2) the results of ZPICs' work, and (3) the results of CMS's evaluations of ZPICs' performance and aspects of CMS's evaluation practices. To do this, GAO examined ZPIC funding, contracts, and related documents; data on ZPICs' workloads, investigations, and results; and CMS evaluations of ZPICs as well as federal standards for performance measurement. GAO also interviewed CMS and ZPIC officials.

section_title: What GAO Found
paragraphs: The Centers for Medicare and Medicaid Services (CMS) paid its Zone Program Integrity Contractors (ZPIC) about $108 million in 2012. ZPICs reported spending most of this funding on fraud case development, primarily for investigative staff, who in 2012 reported conducting about 3,600 beneficiary interviews, almost 780 onsite inspections, and reviews of more than 200,000 Medicare claims.

ZPICs reported that their actions resulted in more than $250 million in savings to Medicare in calendar year 2012 from actions such as stopping payment on suspect claims. ZPICs also reported taking other actions to protect Medicare funds, including having more than 130 of their investigations accepted by law enforcement for potential prosecution, and working to stop more than 160 providers from receiving additional Medicare payments in 2012. However, CMS lacks information on the timeliness of ZPICs' actions--such as the time it takes between identifying a suspect provider and taking actions to stop that provider from receiving potentially fraudulent Medicare payments--and would benefit from knowing if ZPICs could save more money by acting more quickly.

ZPICs generally received good ratings in annual reviews, with five of six eligible for incentive awards. CMS follows some best practices for ZPICs' oversight, but the agency does not clearly link ZPIC performance to agency program integrity goals. The majority of the measures CMS uses to evaluate ZPICs relate to the quality of their work because, according to CMS officials, quality is the most important element. However, evaluation of such measures, while a best practice, does not connect ZPIC work to agency performance measures. For example, CMS aims to increase the percentage of actions taken against certain high risk Medicare providers--work central to ZPICs--but does not explicitly link ZPICs' work to the agency's progress toward that goal, another best practice that would allow the agency to better assess the ZPICs' support of CMS's fraud prevention efforts.

section_title: What GAO Recommends
paragraphs: GAO recommends that CMS collect and evaluate information on the timeliness of ZPICs' investigative and administrative actions, and develop ZPIC performance measures that explicitly link ZPICs' work to Medicare program integrity performance measures and goals. GAO requested comments from HHS on the draft report, but none were provided.

section_title: Letter
paragraphs: For more than 20 years, GAO has designated Medicare as a high-risk  program due to its size and complexity, as well as its susceptibility to  fraud. There are no reliable estimates of the extent of fraud in the  Medicare program, but recent convictions for multimillion dollar schemes  defrauding the program make clear that it continues to be vulnerable to  fraud. To help detect and prevent fraud in the Medicare program, the  Centers for Medicare & Medicaid Services (CMS)—the agency within the  Department of Health and Human Services (HHS) that administers the  Medicare program—contracts with Zone Program Integrity Contractors   These  (ZPIC) in seven specific geographic zones covering the nation.contractors are responsible for identifying potential fraud, investigating it  thoroughly and in a timely manner, and taking swift action—such as  working to revoke suspect providers’ Medicare billing privileges or  referring such providers to law enforcement.

CMS awarded the first ZPIC contracts in 2008, and ZPICs now operate in  six of the seven zones; however, weaknesses have been identified in  CMS’s oversight of ZPICs. Based on a review of the first two ZPICs in  operation, HHS’s Office of Inspector General (OIG) reported that CMS lacked complete and timely information on ZPICs’ activities and results,which raised concerns about what is known about ZPICs and their effect  on Medicare fraud.

You asked us to examine the activities and oversight of ZPICs. This  report examines (1) ZPIC contract costs and how ZPICs use those funds,  (2) the results of ZPICs’ work, and (3) the results of CMS’s evaluations of  ZPICs’ performance and aspects of CMS’s evaluation practices.

To determine ZPIC contract costs and how ZPICs use those funds, we  analyzed ZPICs’ financial data from CMS’s Analysis, Reporting, and  Tracking System (ARTS), an online system ZPICs use to submit invoices  and report workload statistics and that CMS uses to track and analyze  ZPIC workload, performance, and production; and interviewed ZPIC  officials on how they use their funds. To examine the six ZPICs’ results,  we analyzed calendar year 2012 data from CMS ARTS and the Fraud  Investigation Database (FID). These included data on the source of  investigations and the actions taken against suspect providers. We  interviewed officials from the operational ZPICs and CMS, as well as HHS  OIG. We reviewed CMS guidance to ZPICs on how they should prioritize  and conduct investigations. To examine the results of CMS’s evaluations  of ZPICs’ performance and aspects of CMS’s evaluation practices, we  reviewed ZPICs’ contracts and associated documents that set out  performance requirements, the most recently available ZPIC ratings from  the Contractor Performance Assessment Reporting System (CPARS),  and data from CMS on ZPICs’ most recent performance evaluations and  incentive award results. We reviewed internal CMS guidance on how to  evaluate ZPIC performance and interviewed CMS and ZPIC officials  about that evaluation process. We also reviewed federal standards and  best practices for measuring performance. A more detailed discussion of  our scope and methodology is included in appendix I.

We conducted this performance audit from October 2012 to September  2013 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
subsections: section_title: Background
paragraphs: To address Medicare’s vulnerability to fraud, the Health Insurance  Portability and Accountability Act of 1996 (HIPAA) established the  Medicare Integrity Program (MIP). In particular, HIPAA required the  Secretary of HHS to enter into contracts to promote the integrity of the  Medicare program. In exercising its authority to identify and combat  improper payments, CMS created 18 Program Safeguard Contractors  (PSC) to identify and investigate potential fraud in specific parts of  Medicare, such as Part A, in particular states or regions.

In 2008, as part of the implementation of broader agency contracting  reform, CMS began replacing PSCs with ZPICs, reducing the total  number of contractors and giving additional responsibilities to ZPICs to  investigate potential fraud across the Medicare fee-for-service program.  In September 2008, CMS awarded the first two ZPIC contracts for   Zones 4 and 7. As of September 2013, all but one of the ZPICs—  Zone 6—was in operation. PSCs continue to operate in Zone 6 because  of protest-related delays with respect to the Zone 6 ZPIC contract. The  term of each ZPIC contract is generally for a 1-year base period followed  by 4 option years, enabling CMS to extend each contract through 5 years  of performance. (See table 1 for contract performance timelines and   fig. 1 for a map of the seven ZPIC zones.)

In 2010, CMS established the Center for Program Integrity (CPI), which  oversees the agency’s program integrity efforts, including ZPICs. CPI’s  stated mission is to ensure that correct payments are made to legitimate  providers for covered, appropriate, and reasonable services for eligible  beneficiaries. CPI has undertaken an effort to try to move beyond the  “pay and chase” approach—which focused on the recovery of funds lost  due to payments of fraudulent claims—to focusing on fraud prevention.  To enhance these efforts, the Small Business Jobs Act of 2010  appropriated funds for and required CMS to implement predictive  analytics technologies, which are automated systems and tools that can  help identify patterns of potentially fraudulent claims before they are  paid. In turn, CMS developed the Fraud Prevention System (FPS), an  electronic system in which Medicare claims data are compared against  models of potentially fraudulent behavior to identify and prioritize for  investigation providers with aberrant billing patterns. As part of  implementing FPS, CPI modified ZPICs’ work. They are to continue to  investigate and quickly initiate actions to protect Medicare, but are also  charged with investigating certain referrals from FPS.
subsections: section_title: Investigating and Acting on Potential Fraud
paragraphs: To detect and investigate potential fraud within each zone, ZPICs develop  leads, investigate them, and initiate appropriate actions against suspect  providers, suppliers, and others. ZPICs do this with teams of  investigators, data analysts, and medical reviewers. Investigators perform  a range of actions to examine potential fraud, including conducting  provider audits, making site visits to suspect providers’ offices, and  interviewing Medicare beneficiaries. Data analysts, including statisticians,  examine Medicare claims and other data to support investigations and  search for potential fraud and new schemes. Medical reviewers, primarily  nurses, provide clinical knowledge to support the work of investigators  and data analysts.

ZPICs identify potential targets for fraud investigations using three  categories of sources:  1.  Reactive sources. Reactive sources are notifications of potential fraud  submitted to ZPICs, which may result in a ZPIC conducting an  investigation. A number of entities refer potential fraud to ZPICs for  investigation. These entities include Medicare Administrative  Contractors (MAC), which examine their contacts with beneficiaries  for indications of potential fraud and may forward the contacts to  ZPICs for additional scrutiny. In addition, HHS OIG operates a fraud  hotline and may refer calls from it to the MACs for initial screening and  then to the ZPICs for further investigation. Other sources include  investigations ZPICs receive directly from CMS.  2.  Proactive sources. ZPICs are required to maintain at least 3 years of  Medicare claims data for analysts to examine for potential fraud using  a variety of analytic tools and methods. For example, analysts  examining these data may identify providers that, compared with their  peers, have aberrant billing patterns, which can indicate potentially  fraudulent behavior. If analysts identify such patterns, those findings  may result in a ZPIC investigation.  3.  FPS. FPS identifies providers for ZPICs to investigate, with the goal of  identifying aberrant billing patterns early so that ZPICs can investigate  suspect providers before they generate large amounts of potentially  fraudulent claims.

ZPICs prioritize their investigations according to CMS guidance, which  states that ZPICs should give priority to investigations with the greatest  program impact and/or urgency. CMS’s Program Integrity Manual defines  such investigations as those involving patient abuse or harm, multistate  fraud, high dollar amounts of potential overpayments, likely increase in  the amount of fraud or enlarged pattern of fraud, and complaints made by  Medicare supplemental insurers. In addition, with the implementation of  FPS in July 2011, CMS directed the ZPICs to investigate certain high-risk  leads from that system.

As part of their investigations, ZPICs initiate administrative actions  against Medicare providers or suppliers, coordinating with CMS and  MACs to carry out those actions, which may result in Medicare savings.  (See table 2 for the administrative actions ZPICs may initiate as part of  their investigations.) For example, ZPICs may initiate payment  suspensions that allow CMS to stop payment on suspect claims and  prevent the payment of future claims until an investigation is resolved. In  addition, a ZPIC may recommend to CMS that the agency revoke a  provider’s Medicare billing privileges and will coordinate with a MAC to  implement that action following CMS approval. In addition to  administrative actions, ZPICs may forward vulnerabilities identified  during an investigation to CMS for consideration as possible local or  national prepayment edits.

In addition to administrative actions, if a ZPIC investigation uncovers  suspected instances of fraud, the ZPIC must refer the investigation to  HHS OIG for further examination and, if HHS OIG declines to investigate,  the ZPIC may refer the issue to the FBI or any other interested law  enforcement entity, such as a U.S. Attorney’s Office. A ZPIC investigation  that is referred to and accepted by law enforcement for further exploration  and potential prosecution is then called a case. As long as law  enforcement entities have not closed a case, it is considered open by  both law enforcement and ZPICs.

CMS also requires ZPICs to support HHS OIG, the Department of Justice  (DOJ), and other law enforcement entities with their Medicare fraud  investigations. This support can be for these entities’ own, independently  initiated cases, or for those that ZPICs initiated and then referred to law  enforcement. ZPICs provide support on ZPIC-initiated and non-ZPIC- initiated cases by responding to law enforcement requests for information.  These requests may be for data analysis; provider enrollment records,  which ZPICs obtain from MACs; medical review; or other investigative  support.

section_title: ZPIC Contracts by Area of Work and Award Amount
paragraphs: ZPIC contracts cover three areas of work:  1.  Fee-for-service program integrity work. ZPICs are to identify and  investigate potential fraud in Medicare fee-for-service. The contracts  for this work outline four categories of investigations: Part A, Part B,  durable medical equipment (DME), and home health and hospice.  Although DME providers and home health and hospice suppliers  provide services covered under Medicare Parts A and B, the ZPIC  contracts identify them separately and ZPICs track their fee-for- service program integrity work based on these four categories.  2.  Medicare-Medicaid Data Match Program (Medi-Medi). Medi-Medi is a  joint effort between CMS and states to identify providers with aberrant  Medicare and Medicaid billing patterns through analyses of claims  for individuals with both Medicare and Medicaid coverage. States  participate voluntarily and ZPIC Medi-Medi work and funding is  dependent on the number of states, if any, actively participating in  each zone.  3.  Special projects. CMS may also fund ZPICs for special zone- or fraud- specific projects. Special projects can vary in duration and can be as  short as several months or run for multiple years.

The total award amount for the six operating ZPIC contracts through all  option years is more than $600 million. Of that amount, $411 million is for  fee-for-service program integrity work, $169 million is for Medi-Medi, and  $62 million is for special zone- and fraud-specific projects over the life of  the contracts. (See fig. 2.) The contract award amounts for the   six operating ZPIC contracts (inclusive of option years) range from   $67 million to $182 million, which reflects variations between the zones in  terms of their size, exposure to fraud risk, and receipt of special projects.  For example, Zone 7 covers a geographically small area comprising one  state and one territory, but is an area CMS considers to be at high risk for  fraud. In comparison, Zone 2 is a geographically large but predominantly  rural area comprising 14 states and including areas that may be at a  lower risk of fraud. In addition, although not all ZPICs currently receive  funding for a special project, all six operating ZPICs have at some time  received such funding. For example, one ZPIC was awarded almost $50  million for an ongoing state-specific fraud hotline and another received  almost $3 million for a completed project specifically examining potential  fraud among home health providers.

CMS primarily oversees ZPICs through the coordinated efforts of CPI and  the Office of Acquisition and Grants Management (OAGM). The ZPIC  Contracting Officer in OAGM is responsible for ensuring effective  contracting, and the Contracting Officer’s Representatives (COR) are in  CPI. Each ZPIC is assigned a different COR, who helps oversee ZPIC  contractor compliance through ongoing reviews. Among other things, the  CORs use CMS ARTS to review their ZPICs’ monthly invoices and  aggregate workload, such as the total number of new investigations,  administrative actions, and dollar amounts recouped in a month.

Each ZPIC contract includes award fee provisions, which give contractors  the opportunity to earn all or some of the award fee allowed under their  contracts, depending on their level of performance. CMS evaluates each  ZPIC’s performance annually and determines how much of its award fees  it will receive. CMS first evaluates whether a ZPIC is eligible for an award  fee. For these reviews, CMS instructs its CORs on how to assess  specific areas of their ZPICs’ performance by interviewing ZPIC and other  staff; reviewing a sample of open and closed investigations and cases, as  well as other documents; reviewing data in CMS ARTS, FID, and other  systems; and making observations during ZPIC site visits. If in this review  CMS finds that a ZPIC meets certain performance thresholds, the CORs  move to the second step: using their annual review findings to  recommend the amount of award fees a ZPIC should receive. The ZPICs’  contracts specify through Award Fee Plans the criteria against which  CMS will measure ZPICs’ performance to earn their fees. These criteria  fall into two overarching areas: (1) quality of service measures that apply  to all ZPICs, worth 60 percent of the award fee, and (2) ZPIC-specific  plans drafted in the prior year by each ZPIC and approved by CMS on  how the ZPIC will improve its administrative actions—Award Fee  Administrative Action Plans—worth 40 percent. ZPICs can receive all or  part of their proposed award fees based on how well they perform in each  of the elements within the two areas.

section_title: CMS Paid About $108 Million to ZPICs during Calendar Year 2012, Primarily for Fee-for-Service Work, which ZPICs Mostly Spent on Fraud Case Development
paragraphs: CMS paid the six operating ZPICs about $108 million in calendar year  2012, including about $1.3 million in award fees for each ZPIC’s most  recent contract year evaluation. CMS’s payments were primarily to  reimburse contractors for fee-for-service work, comprising $77 million of  the $108 million paid.

ZPICs reported spending most of their fee-for-service funding in 2012 on  fraud case development, primarily for investigative staff. (See fig. 3 for the  breakdown of ZPIC fee-for-service spending.) According to CMS officials,  fraud case development costs are those related to identifying and  investigating potential Medicare fraud. These costs include those  associated with developing proactive sources, and addressing potential  fraud identified by FPS. Personnel accounts for most of these costs, with  ZPICs reporting that half their fraud case development staff are  investigators and the other half are split between medical reviewers and  data analysts. ZPIC officials told us that identifying and investigating  potential Medicare fraud can be labor intensive, which is why the largest  direct cost was for personnel. In 2012, ZPICs reported that their  investigations included 3,600 beneficiary interviews, 777 onsite  inspections, prepayment reviews of 190,000 suspended claims and  postpayment reviews of 32,000 paid claims. Additionally, ZPICs added  more than 1,100 providers to prepayment review and almost 300  providers to postpayment review.

section_title: ZPICs Reported More than $250 Million in Savings and Other Actions, Primarily from Reactive Sources, but CMS Lacks Information on Whether More Could Be Saved
paragraphs: In calendar year 2012, ZPICs reported more than $250 million in savings  to Medicare by stopping payment on suspect claims and recouping  money from overpayments. However, it is unclear if ZPICs could save  more money by taking swifter actions since CMS lacks information on the  speed of those actions. ZPICs took these actions based primarily on  reactive sources, such as tips and complaints.
subsections: section_title: ZPICs Reported More than $250 Million in Savings through Administrative Actions, but CMS Lacks Information to Track the Timeliness of These Actions
paragraphs: Example of investigations resulting in a  revocation:  One ZPIC described that investigations  involving “false fronts”—meaning there is no  provider at the designated address—allow the  ZPIC to quickly initiate revocations of those  providers’ billing privileges.

ZPICs reported initiating administrative actions that led to more than   $250 million in savings or money recovered to Medicare in calendar year  2012 (see table 3). These savings represent nearly $100 million in claims  flagged for review and then denied before payment; almost $100 million  in auto-denial edits for suspect providers, suppliers, and beneficiaries;  and almost $60 million recouped by MACs at the request of ZPICs. In  addition, ZPICs placed more than $14 million in suspense accounts while  the claims for that money were reviewed. ZPICs also reported taking  actions that could result in savings that may not be easily quantifiable. For  example, in 2012 ZPICs reported implementing more than 160  revocations and deactivations. Although these actions represent no direct   CMS has reported that revocations are the most effective fraud  savings,prevention tool because they prevent providers from submitting additional  potentially fraudulent claims. (See app. II for more information on ZPICs’  actions, including by provider type.)

ZPICs coordinate with law enforcement entities on ZPIC-initiated and  other investigations, resulting in additional savings to Medicare and other  results. In 2012, ZPICs reported that law enforcement entities accepted  more than 130 new cases from them, with HHS OIG as the primary entity  accepting the cases, followed by the FBI. In addition, ZPICs reported  completing almost 1,800 requests for information for cases initiated by  law enforcement and almost 700 for cases that had been initiated by  ZPICs, primarily for data analysis. ZPICs also reported that, as a result of  their cases being accepted and prosecuted by law enforcement,  convicted providers were ordered to pay almost $80 million in court- determined fines, settlements, and/or restitutions. Cases can also result  in prison sentences and other actions, though CMS does not  consistently track those outcomes. ZPICs are to track information on the  results of their cases in FID, but the system contains few outcomes. CMS  officials said that they are aware of this issue and have taken steps to  both improve ZPICs’ use of FID and integrate the system with CMS ARTS  and other systems to improve the data in FID. As of August 2013, CMS  officials reported that the agency was testing the integration of the  systems and expected the integration to be completed by late 2013.

According to CMS, ZPICs are to take immediate action to protect  Medicare funds, but CMS may be missing opportunities for additional  savings to Medicare because the agency lacks information on the  timeliness of certain ZPIC actions. ZPIC officials reported taking actions  and preventing potentially fraudulent payments before they were made, in  line with CMS fraud strategies, and CMS ARTS data show ZPICs  implementing some aspects of these strategies. For example, ZPIC  officials reported focusing on prepayment reviews of claims—preventing  potentially fraudulent payments—and 2012 CMS ARTS data showed that,  of the providers whom ZPICs reviewed in 2012, almost five times as  many had their claims reviewed on a prepayment basis rather than a  postpayment basis. However, CMS does not track information on the  swiftness of these actions, such as the length of time between a ZPIC’s  receipt of a complaint about a suspect provider and the ZPIC’s visit to that  provider, or between identifying a potentially fraudulent provider and  initiating an administrative action. Federal internal control standards state  that agencies’ management should have information on performance  relative to established objectives so that actual performance can be  continually compared against goals and differences can be analyzed.  Because CMS does not have information on ZPICs’ timeliness for these  types of activities, the agency cannot benchmark any changes in  timeliness or measure the effectiveness of its strategies, such as whether  ZPICs are limiting unnecessary losses to Medicare from suspect  providers continuing to receive potentially fraudulent Medicare payments  while awaiting investigative or administrative actions.

section_title: ZPICs Identified Potential Fraud Primarily through Reactive Sources
paragraphs: Reactive sources—primarily complaints—were the major source of new  ZPIC investigations in 2012, accounting for almost 90 percent of the  almost 5,000 new investigations that year. (See fig. 4 for the sources of  ZPIC investigations.) In 2012, ZPICs received almost 5,000 complaints,  45 percent of which were from MACs and over 50 percent from other  sources, primarily the HHS OIG hotline, as reported by ZPIC officials.  Proactive projects and FPS each accounted for less than 10 percent of  investigations. Examples of proactive projects include analyzing data to  identify spikes—large, rapid increases—in providers’ billing patterns;  aberrant providers, such as those with unusual billing patterns; and  schemes related to stolen beneficiary identities. ZPIC officials reported  that their proactive data analysis projects are valuable because they find  zone-specific fraud or new fraud schemes that reactive sources or FPS  may not identify. For example, one ZPIC that covers multiple frontier  states conducted a proactive project related to critical access hospitals,  40 percent of which are in that ZPIC’s geographic zone. ZPIC officials  reported that as a result of this project, they identified overpayments to  several hospitals that had opened new psychiatric units, as well as  opportunities for education to improve patient care. (See app. II for more  information on the sources of ZPIC investigations.)

Although ZPIC officials previously reported issues with the quality of leads  from FPS, as well as a decline in the number of proactive projects as a  result of increased work to address FPS leads, officials have since  reported improvements in FPS and their ability to address leads from the  system. For example, officials from one ZPIC reported that the leads  from FPS have improved and that the zone developed a new process for  investigating those leads, thereby improving results. CPI officials reported  that they will continue to direct ZPICs to investigate leads from proactive  and reactive sources, as well as FPS, noting that the most successful  ZPICs are those that can effectively address leads from all three  categories.

section_title: CMS Generally Gave ZPICs Good Reviews, but Does Not Link ZPIC Performance to Agency Program Integrity Measures
paragraphs: Based on CMS’s annual reviews, five of the six operating ZPICs were  eligible for some portion of their contracts’ available award fees, and  ZPICs received almost 70 percent of all fees for their most recent periods  of performance.the annual reviews—elements that measure aspects of quality of service,  cost control, business relations, and timeliness of certain activities— ranged from satisfactory to exceptional, meeting the award fee eligibility  requirement of at least a satisfactory rating in all four of these elements.  CMS awarded the five eligible ZPICs about two-thirds of the available  award fees—$1.3 million out of $1.9 million—in the ZPICs’ most recent  contract years based on ZPIC performance both on quality-of-service  measures in the annual reviews and achievement of their Award Fee  Administrative Action Plan goals. CMS officials reported that they  assigned the majority of available award fee amounts—60 percent—to  the quality-of-service measures in the annual evaluations because quality  is the most important element of ZPICs’ work. CMS apportions the   60 percent of award fee amounts for quality of service across multiple   The five ZPICs’ ratings for the elements considered in  assessment criteria. Table 4 lists the quality-of-service measures for  which ZPICs could earn award fees. Among the highest-value elements  are how well ZPICs prioritize and document investigations, conduct  medical reviews, and analyze data. ZPICs’ Award Fee Administrative  Action Plan goals varied by ZPIC, and included goals such as developing  a project to identify and prevent phantom provider schemes and  improving the timeliness of initiating and implementing payment  suspensions. CMS officials said that this portion of the award fee is  intended to encourage ZPICs to develop more innovative ways to take  administrative actions.

CMS follows some best practices for its oversight of ZPICs, but does not  clearly link ZPIC performance to agency performance measures and  goals. The award fee evaluations allow CMS to assess key elements of  ZPICs’ work, which follows federal best practices. Federal standards state  that performance measures may address the type or level of program  activities conducted (process), the direct products and services delivered  by a program (outputs), or the results of those products and services  (outcomes). CMS’s measures evaluate ZPICs’ processes and outputs,  but not their outcomes. Moreover, these performance measures do not  connect ZPIC work to agency performance measures that are linked to its  goals, which is another best practice. One way that agencies examine the  effectiveness of their programs is by measuring performance as required  by the Government Performance and Results Act of 1993 (GPRA), as  amended by the GPRA Modernization Act of 2010. One of CMS’s  GPRA goals is to fight fraud and work to eliminate improper payments.  Within that goal are two Medicare fee-for-service performance measures  for determining progress toward that goal, and CMS officials reported that  ZPICs are the primary actors for one of the measures: increasing the  percentage of providers who are identified as high risk against whom  CMS takes administrative actions. CMS’s fiscal year 2014 target for this  performance measure is to increase the percentage of administrative  actions taken for these high-risk providers from 27 percent to 36 percent.  Federal standards state that entities should link performance  measurements to goals and objectives, and previous GAO work found  that leading organizations try to link the goals and performance measures  for each organizational level to successive levels and ultimately to the  organization’s strategic goals.none of the ZPICs’ performance measures link to the agency’s measures  of increasing the percentage of administrative actions taken against high- risk providers, or to the other Medicare fee-for-service program integrity  performance measure of reducing improper payments. Some ZPICs had  goals in their Award Fee Administrative Action Plans related to the  agency’s performance measures—for example, one ZPIC set a goal of  increasing the value of its referrals of overpayments, which could reduce  improper payments—but these were zone-specific and do not allow CMS  to evaluate the overall impact of ZPICs on agency measures and,  ultimately, goals. CMS officials told us in April 2013 that they are revising  the ZPIC Award Fee Plans, but based on a draft of the revisions and  discussions with CMS officials, the revised plans will continue to lack  measures related to outcomes and will not tie performance to agency  program integrity measures or goals. difficult and setting targets can be problematic, CMS could explicitly link  ZPICs’ work to the agency’s progress toward meeting its performance  measures and goals. Specifically, CMS officials reported that they are  using FPS to identify and track high-risk providers for the performance  measure of increasing the number of administrative actions taken against  those providers. Although ZPICs are the primary users of FPS and have  primary responsibility for initiating administrative actions, CMS does not  link ZPICs’ use of FPS to that measure, hindering the agency’s ability to  effectively oversee its progress toward meeting its goal of fighting fraud  and working to eliminate improper payments.

section_title: Conclusions
paragraphs: Given the vulnerability of the Medicare program to fraud and the lack of  reliable estimates of the extent of fraud in the program, determining how  well CMS is carrying out its fraud prevention strategy is a vital, if  challenging, task. ZPICs, which are central to that strategy, reported that  their efforts have yielded positive results, such as savings greater than  their contract costs and multiple other actions that helped protect  Medicare from potentially fraudulent providers, such as referring suspect  providers to law enforcement. Yet little is known about how expeditiously  ZPICs take action to save Medicare funds—an important consideration  given that the longer a fraud scheme operates, the greater the potential  financial losses. As a result, CMS would benefit from enhancing its  collection and evaluation of information on the timeliness of ZPICs’  actions, including information on whether new tools or strategies have  increased the speed with which ZPICs investigate potentially fraudulent  providers or initiate administrative actions. In addition, as CMS attempts  to achieve its agencywide program integrity goal of fighting fraud and  eliminating improper payments in the Medicare program, it would benefit  from knowing how ZPICs are contributing to efforts to achieve this goal.  By linking the evaluation of ZPICs’ work to the agency’s program integrity  performance measures—in particular the performance measure focused  on administrative actions, which are a significant portion of ZPICs’ work— CMS would have greater assurance that its ZPIC activities are  appropriately supporting CMS fraud prevention efforts.

section_title: Recommendations
paragraphs: To help ensure that CMS’s fraud prevention activities are effective and  that CMS is comprehensively assessing ZPIC performance, the  Administrator of CMS should take the following two actions:

Collect and evaluate information on the timeliness of ZPICs’  investigative and administrative actions, such as how soon  investigations are initiated after ZPICs identify potential fraud and how  swiftly ZPICs initiate administrative actions after identifying potentially  fraudulent providers.

Develop ZPIC performance measures that explicitly link their work to  the agency’s Medicare fee-for-service program integrity performance  measures and targets for its GPRA goal of fighting fraud and working  to eliminate improper payments.

section_title: Agency Comments
paragraphs: We requested comments from HHS, but none were provided.

As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Secretary of Health  and Human Services, the Acting Administrator of CMS, appropriate  congressional committees, and other interested parties. In addition, the  report will be available at no charge on the GAO website at  http://www.gao.gov.

If you or your staff have any questions about this report, please contact  me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices  of Congressional Relations and Public Affairs may be found on the last  page of this report. GAO staff who made key contributions to this report  are listed in appendix III.

section_title: Appendix I: Scope and Methodology
paragraphs: To determine Zone Program Integrity Contractors’ (ZPIC) contract costs  and how ZPICs use those funds, we examined data from CMS’s Analysis,  Reporting, and Tracking System (ARTS), an online system ZPICs use to  submit invoices and report workload statistics and which CMS uses to  track and analyze ZPIC workload, performance, and production.  Specifically, we examined aggregated ZPIC invoices and workload  statistics that specified how ZPICs allocate their funds, and interviewed  ZPIC officials to confirm these data. We also reviewed the task orders  outlining the scope of each zone’s work and obtained data from CMS on  ZPIC contract amounts.

To describe the results of ZPIC Medicare fee-for-service investigations,  we examined data from CMS ARTS and the Fraud Investigation  Database (FID), a secure system that contains details related to Medicare  fraud and abuse investigations. We analyzed calendar year 2012 data for  the six operating ZPICs on the sources of their investigations, the  numbers of administrative actions taken, and dollar values of relevant  actions. We reviewed CMS guidance on how ZPICs should prioritize their  work and how to conduct investigations. We interviewed officials from the  CMS Center for Program Integrity about how they review and track ZPIC  administrative actions and their process of approval for actions, such as  revocations. We interviewed officials from all six ZPICs to learn about  their internal guidance on prioritizing and conducting their work, how they  determine when to take administrative actions, and how they decide to  refer a case to law enforcement.

To examine the results of CMS’s evaluation of ZPICs’ performance and  aspects of CMS’s evaluation practices, we reviewed the following: each  ZPIC’s most recent Contractor Performance Assessment Report; each  ZPIC’s most recently completed Award Fee Administrative Action Plan,  which describes the ZPIC’s plans to improve administrative actions and  how it will earn its award fee; and data from CMS on the percentage and  amount of each zone’s award fee. We reviewed internal CMS guidance  on how to evaluate ZPICs’ performance, as well as federal standards and  best practices for measuring performance. We also interviewed CMS  contracting and other officials to learn about the review process and how  such guidance is applied, and to discuss changes to ZPIC evaluations  and performance measures. We also interviewed ZPIC officials to learn  more about how ZPICs determine their Award Fee Administrative Action  Plan goals and how they evaluate themselves on these goals and other  work.

We assessed the reliability of the data we obtained from CMS ARTS and  FID through interviews with agency officials and users, system  demonstrations, and, in the case of CMS ARTS, direct use of the system.  We shared with CMS and the relevant ZPIC any errors we identified  through reviews of the data and comparisons with other sources to obtain  corrected information. We found the data sufficiently reliable for the  purposes of this review.

We conducted this performance audit from October 2012 to September  2013 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.

section_title: Appendix II: ZPIC Activities and Results, 2012
paragraphs: The following table shows selected ZPIC activities and results reported by  ZPICs in CMS ARTS. Durable medical equipment (DME) is covered  under Medicare Part B, and home health and hospice under are covered  under Part A, but ZPICs report data in CMS ARTS as monthly aggregates  by Part A, Part B, DME, and home health and hospice. CMS ARTS data  do not allow us to identify particular provider types, such as whether a  Part B provider was a family physician or podiatrist.

section_title: Appendix III: GAO Contact and Staff Acknowledgements
subsections: section_title: GAO Contact

section_title: Staff Acknowledgements
paragraphs: In addition to the contact named above, Karen Doran, Assistant Director;  Matthew Gever; Elizabeth Morrison; Eden Savino; Kristin Van Wychen;  and Jennifer Whitworth made key contributions to this report.


Question-summary annotations: questions: question: How did ZPICs affect Medicare savings in 2012?
answer: ZPICs reported that their actions resulted in more than $250 million in savings to Medicare in calendar year 2012 from actions such as stopping payment on suspect claims. ZPICs also reported taking other actions to protect Medicare funds, including having more than 130 of their investigations accepted by law enforcement for potential prosecution, and working to stop more than 160 providers from receiving additional Medicare payments in 2012.
child_questions: question: How did ZPICs work with law enforcement?
answer: ZPICs also reported taking other actions to protect Medicare funds, including having more than 130 of their investigations accepted by law enforcement for potential prosecution, and working to stop more than 160 providers from receiving additional Medicare payments in 2012.

question: Why would CMS benefit from knowing the timeliness of ZPICs' actions?
answer: However, CMS lacks information on the timeliness of ZPICs' actions--such as the time it takes between identifying a suspect provider and taking actions to stop that provider from receiving potentially fraudulent Medicare payments--and would benefit from knowing if ZPICs could save more money by acting more quickly.

questions: question: What kind of ratings did ZPICs receive?
answer: ZPICs generally received good ratings in annual reviews, with five of six eligible for incentive awards.

question: What is the relationship between CMS and ZPIC?
answer: CMS follows some best practices for ZPICs' oversight, but the agency does not clearly link ZPIC performance to agency program integrity goals.
child_questions: question: Why do most measures used to evaluate ZPICs relate to quality of work?
answer: The majority of the measures CMS uses to evaluate ZPICs relate to the quality of their work because, according to CMS officials, quality is the most important element.
child_questions: question: Why is the evaluation of quality of work insufficient?
answer: However, evaluation of such measures, while a best practice, does not connect ZPIC work to agency performance measures. For example, CMS aims to increase the percentage of actions taken against certain high risk Medicare providers--work central to ZPICs--but does not explicitly link ZPICs' work to the agency's progress toward that goal, another best practice that would allow the agency to better assess the ZPICs' support of CMS's fraud prevention efforts.
child_questions: question: How could CMS improve their evaluation measures?
answer: For example, CMS aims to increase the percentage of actions taken against certain high risk Medicare providers--work central to ZPICs--but does not explicitly link ZPICs' work to the agency's progress toward that goal, another best practice that would allow the agency to better assess the ZPICs' support of CMS's fraud prevention efforts.

questions: question: Why has GAO designated Medicare as a high-risk program?
answer: GAO has designated Medicare as a high-risk program, in part because its size and complexity make it particularly vulnerable to fraud.
child_questions: question: How does CMS help detect and prevent Medicare fraud?
answer: To help detect and prevent potential Medicare fraud, CMS--the agency within the Department of Health and Human Services (HHS) that administers the Medicare program--contracts with ZPICs.
child_questions: question: How do ZPICs help CMS in avoiding Medicare fraud?
answer: These contractors are to identify potential fraud, investigate it thoroughly and in a timely manner, and take swift action, such as working to revoke suspect providers' Medicare billing privileges and referring potentially fraudulent providers to law enforcement.

questions: question: What did GAO examine for this report?
answer: GAO examined (1) ZPIC contract costs and how ZPICs use those funds, (2) the results of ZPICs' work, and (3) the results of CMS's evaluations of ZPICs' performance and aspects of CMS's evaluation practices.
child_questions: question: How did CAO carry out these examinations?
answer: To do this, GAO examined ZPIC funding, contracts, and related documents; data on ZPICs' workloads, investigations, and results; and CMS evaluations of ZPICs as well as federal standards for performance measurement. GAO also interviewed CMS and ZPIC officials.
child_questions: question: How did GAO utilize interviews in their investigation?
answer: GAO also interviewed CMS and ZPIC officials.