Health Care Fraud: Information on Most Common Schemes and the Likely Effect of Smart Cards
Released: 2016-02-22T00:00:00

Letter

Background

Health Care Fraud Statutes

There are multiple statutes that concern health care fraud, including the following:

The False Claims Act is often used by the federal government in health care fraud cases and prohibits certain actions, including the knowing presentation of a false claim for payment by the federal government.

Civil monetary penalty provisions of the Social Security Act apply to certain activities, such as knowingly presenting a claim for medical services that is known to be false and fraudulent. In addition, the Social Security Act also provides for criminal penalties for knowing and willful false statements in applications for payment.

The Anti-Kickback statute makes it a criminal offense for anyone to knowingly and willfully solicit, receive, offer, or pay any remuneration in return for or to induce referrals of items or services reimbursable under a federal health care program, subject to statutory exceptions and regulatory safe harbors.

The Stark law and its implementing regulations generally prohibit physicians from making “self-referrals”—certain referrals for “designated health services” paid for by Medicare to entities with which the physician (or an immediate family member) has a financial relationship—nor may the entities that perform the “designated health services” present claims to Medicare or bill for these services. These prohibitions also extend to payments for Medicaid-covered services to the same extent and under the same terms and conditions as if Medicare had covered them.

The Federal Food, Drug, and Cosmetic Act, as amended, makes it unlawful to, among other things, introduce an adulterated or misbranded pharmaceutical product or device into interstate commerce.

Types of Health Care Fraud and Provider and Beneficiary Involvement

Health care fraud takes many forms, and a single case can involve more than one fraud scheme. Schemes may include fraudulent billing for services not provided, services provided that were not medically necessary; and services intentionally billed at a higher level than appropriate for the services that were provided, called upcoding. Other fraud schemes include providing compensation—kickbacks—to beneficiaries or providers or others for participating in the fraud scheme and schemes involving prescription drugs (including prescription drugs that contain controlled substances), such as the submission of false claims for prescription drugs that have been improperly marketed for non- FDA-approved uses and the illicit diversion of prescription drugs for profit or abuse. Fraud cases may involve more than one scheme; for example, an infusion clinic may pay kickbacks to a beneficiary for receiving care at the clinic, and the care that was provided and billed for may not have been medically necessary.

Providers may be complicit in the schemes or unaware of the schemes. For example, providers who are complicit may willingly use their provider identification information to bill fraudulently, misrepresent services provided to receive higher payment, or receive kickbacks to provide their identification information for others to bill fraudulently. In other cases, providers may be unaware that their identification information has been stolen and used in various fraud schemes. Similarly, beneficiaries can be either complicit in or unaware of the fraud. Beneficiaries who are complicit may willingly provide their identification information to a provider for the purposes of committing fraud or receive kickbacks in exchange for providing their information to or receiving services from a provider. In contrast, they also may be unaware of fraud schemes in which the provider bills for services not medically necessary or uses beneficiaries’ identification information without their knowledge. Additionally, both beneficiaries and some providers may not be involved in the fraud scheme, in the sense that the fraud schemes involved circumstances other than a provider giving care to a beneficiary. For example, a pharmaceutical manufacturing company that marketed prescription drugs for non-FDA approved uses does not involve a provider giving care directly to a beneficiary. Individuals and entities that commit fraud do so in federal health care programs and private insurance programs, and may commit fraud in more than one program simultaneously.

Agencies That Investigate and Prosecute Health Care Fraud

Several agencies are involved in investigating and prosecuting health care fraud cases, including CMS; HHS OIG; DOJ’s U.S. Attorneys’ Offices, Civil and Criminal Divisions; and the FBI. HHS OIG and the FBI primarily conduct investigations of health care fraud, and DOJ’s divisions typically prosecute or litigate the cases. DOJ prosecutes fraud cases that affect both federal health programs and private health insurance.

Use of Smart Cards

Amid concerns about identify theft, proposals have been put forward to replace Medicare’s paper identification cards that contain the beneficiary’s Social Security numbers with electronically readable cards, such as smart cards. Some proposals have suggested that such cards should be issued to providers as well. Electronically readable cards include those that store information on magnetic stripes and bar codes and cards called smart cards that use microprocessor chips to store and process data. In March 2015, we identified three key uses for electronically readable cards: (1) authenticating beneficiary and provider presence at the point of care, (2) electronically exchanging beneficiary medical information, and (3) electronically conveying beneficiary identity and insurance information to providers. We also found that smart cards could provide more rigorous authentication of beneficiaries and providers at the point of care than cards with magnetic stripes and bar codes, though all three types of cards can electronically convey identity and insurance information. Proponents of smart cards have suggested that, among other benefits, using smart cards may reduce health care fraud in the Medicare program. For example, some proponents claim that the use of smart cards to identify the beneficiary and provider at the point of care could potentially curtail certain types of fraud such as schemes in which providers misuse another provider’s information to bill fraudulently.

However, our March 2015 report also found that there are several limitations associated with the use of smart cards. Specifically, it is possible that individuals may still be able to commit fraud by adapting and altering the schemes they use to account for the use of smart card technology. In addition, the use of smart card technology could introduce new types of fraud and ways for individuals to illegally access beneficiary information. For example, malicious software could be written onto a smart card and used to compromise provider IT systems. Further, various factors may limit the implementation of smart card technology in the Medicare program. As we found in our March 2015 report, while the use of smart cards to verify the beneficiary identity at the point of care could reduce certain types of fraud, it would have limited effect on Medicare fraud since CMS policy is to pay claims for Medicare beneficiaries even if they do not have a Medicare identification card at the time of care. CMS officials noted that it would not be feasible to require the use of smart cards because of concerns that this would limit beneficiaries’ access to care given that there may be legitimate reasons why a card might not be present at the point of care. For example, beneficiaries who experience a health care emergency may not have their Medicare cards with them at the time care is rendered. Additionally, we concluded that the use of smart cards to verify the beneficiary and provider presence at the point of care would require addressing costs and implementation challenges associated with card management and information technology system enhancements. These enhancements would be needed to update both CMS’s and providers’ claims processing and card management systems in order to achieve a high level of provider and beneficiary authentication as well as meet security requirements.

Fraudulent Billing Schemes Were Most Common Schemes in Cases Reviewed

The majority of the 739 cases resolved in 2010 that we reviewed had more than one fraud scheme. Fraudulent billing schemes, such as billing for services that were not provided and billing for services that were not medically necessary, were the most common fraud schemes. Over 20 percent of the cases included kickbacks to providers, beneficiaries, or other individuals. Providers were complicit in the fraud schemes in over half of the cases. In contrast with providers, only about 14 percent of the 739 cases we reviewed had beneficiaries who were complicit in the schemes.

Most Cases Had More than One Scheme, and Fraudulent Billing Schemes Were the Most Common

Using cases from 2010, we identified 1,679 fraud schemes in the 739 cases that we reviewed. The majority of the 739 cases (about 68 percent) included more than one scheme; 61 percent of the cases had 2 to 4 schemes, about 7 percent had 5 or more schemes. Thirty-two percent had only one scheme. The most common schemes used in the cases we reviewed were related to fraudulent billing, such as billing for services that were not provided (42.6 percent of cases), billing for services that were not medically necessary (24.5 percent), and upcoding, which is billing for a higher level of service than the service actually provided (17.5 percent). Additionally, schemes used to support other fraud were also common, such as falsifying a substantial portion of records to support the fraud scheme (25.2 percent) and paying kickbacks to participants in the scheme (20.6 percent). Schemes related to prescription drugs (including prescription drugs that contained controlled substances), such as fraudulently obtaining or distributing prescription drugs or marketing prescription drugs for non-FDA approved uses in order to commit fraud, were found in about 21 percent of the cases we reviewed. (See table 1 for the number and percentage of cases in which these schemes were used and app. II, table 6, for additional details on schemes we identified in cases.)

Many different combinations of schemes were present in the 68 percent of cases with more than one scheme. The most common schemes were also the ones that were most often used together: billing for services not provided along with billing for services that were not medically necessary, billing for services or supplies that were not prescribed by a physician and falsifying a substantial portion of records in order to support the fraud scheme. (See app. II, table 7, for additional analysis of the number of schemes per case.) For example, according to the indictment in a fraud case we reviewed, a DME supplier used two schemes to commit fraud: (1) billing Medicare for medical equipment, such as orthotic braces, that were not provided to Medicare beneficiaries and (2) billing for supplies that had not been prescribed by physicians for these beneficiaries.

Many different federal programs and private insurers were affected by fraud schemes in the cases we reviewed. In one-quarter of the cases, more than one program was affected. Medicare was affected in about 63 percent of the 739 cases reviewed, Medicaid and/or CHIP in about 32 percent, TRICARE in about 5 percent, and the Federal Employees Health Benefits Program (FEHBP) in 3 percent of the cases. In over 11 percent of the cases, private health insurers were affected. Other programs affected included Department of Veterans Affairs programs, Social Security programs, worker’s compensation programs, and other benefit plans.

Among the fraud cases we reviewed, one-third—262 cases—had information in the documents we reviewed about the amount of fraudulent payments made by the programs and insurers. For the 262 cases, the total paid was $801.5 million. The amounts of the fraudulent payments in these cases typically ranged from $10,000 to $1.5 million.

About 20 Percent of Cases Reviewed Included Kickbacks to Providers, Beneficiaries, or Other Individuals

In about 20 percent of the 739 cases we reviewed, kickbacks were paid to providers, beneficiaries, or other individuals. The most common schemes used in cases where providers were paid kickbacks were marketing prescription drugs for non-FDA-approved uses, billing for services that were not medically necessary, upcoding, and self-referring. Many different types of providers received or provided kickbacks in these cases; the most common provider types were DME suppliers, hospitals, and pharmaceutical manufacturers. The most common schemes used in cases where beneficiaries were paid kickbacks were billing for services that were not medically necessary and billing for services that were not provided. In addition, kickbacks were paid to both beneficiaries and providers for their involvement in a fraud case or to other individuals, such as “recruiters,” who connect providers and beneficiaries in exchange for a fee. For 23 of the cases we reviewed, there was information in the documents we reviewed about the amount of kickbacks paid to beneficiaries, providers, and other individuals, which totaled $69.7 million.

Providers Were Complicit in Fraud Schemes in More than Half of the Cases Reviewed

In about 62 percent of the 739 cases we reviewed, providers were complicit in the cases, either by submitting fraudulent claims or by supporting the fraud schemes. (See table 2 and app. II, table 8, for additional information on the role of the provider, by fraud scheme.) For example, a physician would be complicit when billing for higher level services than those actually provided in order to receive a higher payment rate (upcoding). A physician may also be complicit in a case by receiving kickbacks for referring beneficiaries to a particular clinic, even though the physician did not bill for the services provided by that clinic.

Example of health care fraud case in which providers were complicit According to an indictment in one of the cases we reviewed, a physician conspired with the owner of a medical testing company that performed diagnostic ultrasound tests to bill Medicare and private insurance companies for tests that were either never provided or were not medically necessary. The physician signed orders for these ultrasound tests for beneficiaries that he had not actually treated and received kickbacks from the medical testing company for the orders. well as hospitals, other clinics, home health agencies, and pharmacies were the most common types of providers that were complicit.

Providers were not complicit in about 10 percent of the cases we reviewed. In those cases, providers’ information had been stolen or used without their knowledge to carry out the fraud schemes. The most common schemes in these cases were falsifying records and billing for services or supplies that were not prescribed by the physicians. Additionally, in two cases, a fictitious provider was created to support the fraud schemes.

Example of health care fraud case in which provider was not complicit According to a complaint, a DME supplier billed Medicare for supplies prescribed by a physician. However, those supplies were not prescribed by the physician the DME supplier had listed on the claims. During an interview with investigators, the physician indicated his practice was not to prescribe DME supplies to his patients and instead to refer them to a specialist. When reviewing a list of 200 Medicare beneficiaries for whom the DME supplier had listed him as the prescribing physician on the claims, the physician identified that only 12 of those listed had ever been his patients. In this case, the DME supplier was using the physician’s information without his knowledge to bill for DME supplies that were not provided.

No provider was involved in another 10 percent of the cases that we reviewed. For example, no provider gave care directly or billed for services provided to a beneficiary in cases where a prescription drug manufacturer marketed prescription drugs for non-FDA-approved uses. In the remaining 18.5 percent of cases, we were unable to determine how the provider was involved as the court documents did not include this information.

Beneficiaries Were Complicit in about 14 Percent of Cases Reviewed

In contrast with providers, only about 14 percent of the 739 cases we reviewed had beneficiaries that were complicit in the schemes. For example, there were cases in which the beneficiary willingly provided identification information so a provider could fraudulently bill, or the beneficiary received kickbacks for receiving treatment at a specific clinic. Among the cases in which the beneficiary was complicit, the most common schemes were billing for services that were not medically necessary, billing for services that were not provided, and falsifying records to support the fraud schemes.

Example of health care fraud case in which beneficiary was complicit According to an information document filed by prosecutors in one case we reviewed, an employee of a medical clinic asked a beneficiary to visit the clinic complaining of ailments that the beneficiary did not have in order to receive prescriptions for drugs containing controlled substances. The beneficiary visited the clinic complaining of a toothache and obtained a prescription for a controlled substance. The employee then purchased that medication from the beneficiary.

In about 62 percent of the 739 cases we reviewed, beneficiaries were not complicit in the schemes. Among beneficiaries that were not complicit, most received services from the provider, but there was no evidence that the beneficiary was aware of the fraud (54.8 percent). For example, beneficiaries who were not complicit in the schemes received services from the provider but were unaware that the provider billed for upcoded services or that they received services that were not medically necessary. In 39 cases (5.3 percent), court documents we reviewed indicated that the beneficiaries’ information was stolen or sold without their knowledge. In an additional 12 cases (1.6 percent) we reviewed, the beneficiaries’ information was obtained through false pretenses, such as through a telemarketer. (See table 3 and app. II, table 9, for additional information on the role of the beneficiary, by fraud scheme.)

Additionally, the beneficiary was not involved in about 13 percent of the 739 cases we reviewed. The beneficiary may not have been involved in the fraud schemes because the schemes did not involve billing for care provided to a beneficiary. For instance, in one case, a pharmaceutical drug manufacturer marketed drugs for non-FDA-approved uses and paid kickbacks to providers for prescribing those drugs to beneficiaries. This scheme did not involve billing for care provided to the beneficiary. For the remaining 11 percent of cases we reviewed, we were unable to determine whether the beneficiary was complicit or not, and in 1 case, a fictitious beneficiary’s information was created to support the fraud scheme.

Smart Cards Likely Would Not Have Affected the Majority of Cases Reviewed

Among the 739 cases, we found 165 cases (22 percent) in which the entire case (2 percent) or part of the case (20 percent) could have been affected by the use of smart cards. The remaining 574 cases (78 percent) had schemes that would not have been affected by smart cards. (See fig. 1.)

Health Care Fraud Schemes That Could Have Been Affected by the Use of Smart Cards

Example of health care fraud case in which the provider was complicit but the beneficiary was not According to a complaint document in one case we reviewed, the provider submitted duplicate claims for the same service provided to a beneficiary. The beneficiary received the service from the provider the first time but was unaware that a second claim had been submitted as if the service had been provided a second time when it had not. Example of health care fraud case in which neither the beneficiary nor the provider was complicit According to a complaint document in one fraud case we reviewed, a DME supplier used the identification information for several beneficiaries to submit a bill for DME supplies. The DME supplier also used a physician’s identification information to allege that the supplies had been prescribed when that physician had not prescribed the DME supplies. In this case, neither the beneficiaries nor the provider were aware of the fraud schemes.

Among the 739 cases we reviewed, we found 165 cases in which the entire or part of the case could have been affected by the use of smart cards. These cases included at least one of six schemes smart cards could have affected as the schemes involved the lack of verification of the beneficiary or the provider at the point of care. These six schemes were (1) billing for services that were never actually provided and no legitimate services were provided; (2) misusing a provider’s identification information to bill fraudulently (such as using a retired provider’s identification information); (3) misusing a beneficiary’s identification information to bill fraudulently (such as using a deceased beneficiary’s identification information or stealing a beneficiary’s information); (4) billing more than once for the same service (known as duplicate billing) by altering a small portion of the claim, such as the date, and resubmitting it for payment; (5) providing services to ineligible individuals; and (6) falsifying a substantial part of the records to indicate that beneficiaries or providers were present at the point of care.

In 18 cases (2.4 percent of all cases resolved in 2010 that we reviewed), the entire case could have been affected because all of the schemes on those cases involved the lack of verification of the beneficiary or provider at the point of care. For these 18 cases, either the beneficiary or the provider was complicit in the scheme, while the other was not, or neither the beneficiary nor the provider was complicit in the scheme. The use of smart cards could have had an effect because the card would have been able to verify at least one identity.

Example of health care fraud case that may have been partially affected by the use of smart cards According to a complaint in one case we reviewed, a physical therapy provider was billing for services that were not medically necessary and was submitting duplicate bills for the same service. This case could have been partially affected by the use of smart cards, as the smart card would have verified that the beneficiary was present for only one service in which a duplicate bill was submitted but would not have affected the ability of the provider to bill for services that were not medically necessary.

Smart cards could have partially affected an additional 147 cases (19.9 percent) in which at least one of the six schemes was present. However, because other fraud schemes were used, the entire case would not have been affected. (See table 4.)

Health Care Fraud Schemes That Likely Would Not Have Been Affected by the Use of Smart Cards

Smart card technology would not have affected the majority of fraud schemes we identified, which represented 574 of the 739 cases that we reviewed (78 percent). In these instances, the schemes would not have been affected by the smart cards because although the beneficiary and provider were present at the point of care, the provider misrepresented the services rendered after the smart cards would have registered their identities. These schemes included the following: billing for services that were not provided along with services that billing for services that were not medically necessary, unbundling of services, billing for services that were not prescribed or not referred by a billing for services as if they were provided by a physician to receive a higher payment rate when they were actually provided by another provider in which the payment rate would have been lower.

In these schemes, smart cards would not be able to detect that the provider misrepresented the actual services provided even if the cards verified the beneficiary’s and provider’s presence. Similarly, schemes that involved a provider misrepresenting eligibility to provide services would not have been affected by smart cards, including schemes in which bills were submitted for services provided by an excluded provider or by an unlicensed, uncertified, or ineligible provider. Many of these schemes involved health care entities that billed for services provided by employees or contractors that were not licensed or were excluded from providing care.

In addition, smart card technology would not have affected schemes in which the beneficiary was not present or the verification of the beneficiary and provider was not relevant to the scheme. These fraud schemes involved improper marketing of prescription drugs, including drugs for non-FDA-approved uses; misbranding prescription drugs; inflating prescription drug prices; and physician self-referrals. In addition, smart cards would not have affected schemes related to improperly obtaining or distributing prescription drugs (including drugs that contained controlled substances), regardless of whether the beneficiary’s or provider’s identity was verified, such as cases in which individuals visited multiple providers complaining about pain to obtain prescriptions.

Further, smart cards would not have had an effect on cases in which the beneficiary and provider were complicit in the scheme, regardless of the schemes used on the case. For instance, smart cards would not have an effect on the billing for services never provided if both the beneficiary and provider were willing participants in the scheme. Similarly, smart cards would not have an effect on cases in which kickbacks were paid to a beneficiary or to a provider that allowed his or her smart card to be used for fraud.

Agency Comments

HHS and DOJ provided technical comments on a draft of this report, which we have incorporated as appropriate. In its comments, HHS reiterated that it would be difficult for CMS to implement smart cards in the Medicare program because implementation would require significant changes. For example, CMS stated that it would need to require that Medicare beneficiaries present smart cards at the point of care, which is contrary to current CMS policy and which CMS believes could create access to care issues. Additionally, CMS officials noted that implementing smart cards in Medicare would be a significant business process change, requiring substantial resources and time to implement. This report, as well as our past work on smart cards in Medicare, recognizes the concerns raised by CMS.

As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Attorney General, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix III.

Appendix I: Methodology for Describing the Types of Health Care Fraud and Their Prevalence

This appendix provides details on the methodology we used to describe the types of health care fraud and their prevalence among cases resolved in 2010 that we reviewed.

To describe types of health care fraud, we reviewed our prior reports, as well as reports from the Department of Health and Human Services (HHS) Office of Inspector General (OIG) and the Department of Justice (DOJ) to develop a list of schemes and definitions for these schemes, and then reviewed cases resolved in 2010 that we obtained through the course of work for our 2012 report. Specifically, we reviewed several government reports, such as reports produced by HHS and DOJ on the Health Care Fraud and Abuse Control Program, and DOJ and HHS OIG press releases to identify fraud schemes that were commonly included in the reports and to develop definitions for these schemes. See table 5 for the health care fraud schemes developed for our case review.

Using the list of fraud schemes identified, we reviewed court documents for the health care fraud cases resolved in 2010 to determine the prevalence of health care fraud schemes. The data we obtained for the 2012 report were for fraud cases, including investigations and prosecutions, from HHS OIG and DOJ’s U.S. Attorneys’ Offices and Civil Division and included a variety of information such as information on the subjects of the fraud case and outcomes of the case (such as prison or probation). We obtained data from both HHS OIG and DOJ, as HHS OIG conducts investigations but DOJ does not prosecute all of the cases that are investigated. Also, because HHS OIG often works jointly with DOJ on fraud cases, for our 2012 report, we reduced duplication of fraud cases from the data we received from HHS OIG and DOJ by comparing subjects of the fraud cases that were in more than one data set we received.

Although the cases we obtained for the 2012 report included investigations as well as prosecutions, judgments, and settlements, for this engagement, we included only cases that had been adjudicated favorably for the United States, meaning criminal cases in which the subjects were found guilty, pled guilty, or pled no contest to at least one of the charges, and civil cases that resulted in a judgment for the United States or a settlement. There were 834 cases that resulted in a favorable outcome for the United States, though we only reviewed 739 of these cases. We excluded 95 cases because they were duplicative of another case in our data set (18 cases), they were not health care fraud cases (21 cases), the data were insufficient to determine the fraud schemes used on the cases (15 cases), the cases were administrative actions rather than criminal or civil cases (9 cases), or we could not locate information on the cases, such as a court document or a press release, to determine the fraud schemes involved in the cases (32 cases).

To determine the health care fraud schemes used in the 739 cases included in our report, we reviewed court documents associated with the charging stage of the case (such as indictment, information, or complaint) unless the charging document for a case was not available. We used court documents that we had previously obtained through our work on the 2012 report. For that report, we obtained court documents from the Public Access to Court Electronic Records (PACER) database for the DOJ cases. However, we did not have a charging document for all of the DOJ cases and did not have a charging document for any of the HHS OIG cases. As a result, we searched in PACER for charging documents for any cases for which we were missing a charging document. If the charging document was not available, we reviewed case details as described in a DOJ or Federal Bureau of Investigation (FBI) press release. For several HHS OIG cases, we were unable to locate a charging document or a press release and obtained other court documents, such as settlement agreements and plea agreements, from HHS OIG.

When reviewing the court documents, we collected information on the health care fraud schemes that were used in the cases along with information about the beneficiary’s role, the provider’s role, whether a durable medical equipment supplier was involved, the programs that were affected by the fraud, and any monetary amounts associated with the fraud schemes (such as the amounts paid). For each case we reviewed, two reviewers independently categorized all information obtained for the case, including the relevant health care fraud schemes used on the case, and resolved any differences in the categorization. To assess the reliability of the data, we reviewed relevant documentation and examined the data for reasonableness and internal consistency. We found these data were sufficiently reliable for the purposes of our report.

Appendix II: Additional Details on Health Care Fraud Schemes in Cases GAO Reviewed

Tables 6 through 9 provide detailed information on health care fraud schemes for cases we reviewed, including whether the scheme was the only scheme in the case or used in combination with other schemes, the number of schemes used in cases, the role of the provider, and the role of the beneficiary.

Appendix III: GAO Contact and Staff Acknowledgments

GAO Contact

Staff Acknowledgments

In addition to the contact named above, Martin T. Gahart, Assistant Director; Christine Davis; Laura Elsberg; Christie Enders; Matt Gever; Jackie Hamilton; Dan Lee; Elizabeth T. Morrison; and Carmen Rivera- Lowitt made key contributions to this report.