Medicare Fraud: Further Actions Needed to Address Fraud, Waste, and Abuse
Released: 2014-06-25T00:00:00

Letter

Background

Since 1996, Congress has taken important steps to increase Medicare program integrity funding and oversight, including the establishment of the Medicare Integrity Program. Table 1 summarizes several key congressional actions.

CMS Has Strengthened Provider and Supplier Screening, but More Can Be Done to Improve Medicare Program Integrity

CMS has made progress in strengthening provider and supplier enrollment provisions, but needs to do more to identify and prevent potentially fraudulent providers and suppliers from participating in Medicare. Additional improvements to prepayment and postpayment claims review would help prevent and recover improper payments. Addressing payment vulnerabilities already identified could further help prevent or reduce fraud.

CMS Has Strengthened Certain Enrollment Screening Procedures since PPACA

PPACA authorized and CMS has implemented new provider and supplier enrollment procedures that address past weaknesses identified by GAO and HHS’s Office of Inspector General (OIG) that allowed entities intent on committing fraud to enroll in Medicare. CMS has also implemented other measures intended to improve existing procedures. Specifically, to strengthen the existing screening activities conducted by CMS contractors, the agency added screenings of categories of provider and supplier enrollment applications by risk level, contracted with new national enrollment screening and site visit contractors, began imposing moratoria on new enrollment of certain types of providers and suppliers, and issued regulations requiring certain prescribers to enroll in Medicare.

Screening Provider and Supplier Enrollment Applications by Risk Level

CMS and OIG issued a final rule in February 2011 to implement many of the new screening procedures required by PPACA. CMS designated three levels of risk—high, moderate, and limited—with different screening procedures for categories of Medicare providers and suppliers at each level. Providers and suppliers in the high-risk level are subject to the most rigorous screening. (See table 2.) Based in part on our work and that of OIG, CMS designated newly enrolling home health agencies and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) as high risk, and designated other providers and suppliers as lower risk levels. Providers and suppliers at all risk levels are screened to verify that they meet specific requirements established by Medicare, such as having current licenses or accreditation and valid Social Security numbers. High- and moderate-risk providers and suppliers are also subject to unannounced site visits. Further, depending on the risks presented, PPACA authorizes CMS to require fingerprint- based criminal history checks. In March 2014, CMS awarded a contract that is to enable the agency to access Federal Bureau of Investigation information to help conduct those checks of high-risk providers and suppliers. PPACA also authorizes the posting of surety bonds for certain providers and suppliers.

CMS has indicated that the agency will continue to review the criteria for its screening levels and will publish changes if the agency decides to update the assignment of screening levels for categories of Medicare providers and suppliers. Doing so could become important because the Department of Justice (DOJ) and HHS reported multiple convictions, judgments, settlements, or exclusions against types of providers and suppliers not currently at the high-risk level, including community mental health centers and ambulance suppliers. CMS’s implementation of accreditation for DMEPOS suppliers, and of a competitive bidding program, including in geographic areas thought to have high fraud rates, may be helping to reduce the risk of DMEPOS fraud. While continued vigilance of DMEPOS suppliers is warranted, other types of providers may become more problematic in the future. Specifically, in September 2012 we reported that a range of providers have been the subjects of fraud investigations. According to 2010 data from OIG and DOJ, over 10,000 providers and suppliers that serve Medicare, Medicaid, and Children’s Health Insurance Program beneficiaries were involved in fraud investigations, including not only home health agencies and DMEPOS In addition, suppliers but also physicians, hospitals, and pharmacies.the provider type constituting the largest percentage of subjects in criminal health care fraud investigations was medical facilities—including medical centers, clinics, or practices—which constituted almost a quarter of subjects in such investigations. DMEPOS suppliers made up a little over 16 percent of subjects.

We are currently examining the ability of CMS’s provider and supplier enrollment system to prevent and detect the continued enrollment of ineligible or potentially fraudulent providers and suppliers in Medicare. Specifically, we are assessing the process used to enroll and verify the eligibility of Medicare providers and suppliers in Medicare’s Provider Enrollment, Chain, and Ownership System (PECOS) and the extent to which CMS’s controls are designed to prevent and detect the continued enrollment of potentially ineligible or fraudulent providers and suppliers in PECOS. We plan to issue a report this winter.

Implementing National Enrollment Screening and Site Visit Contractors

CMS contracted with two new types of entities at the end of 2011 to assume centralized responsibility for two functions that had been the responsibility of multiple contractors. One of the new contractors is conducting automated screenings to check that existing and newly enrolling providers and suppliers have valid licensure, accreditation, and a National Provider Identifier (NPI), and are not on the OIG list of providers and suppliers excluded from participating in federal health care programs. The second contractor conducts site visits of providers and suppliers, except for DMEPOS suppliers, to determine whether sites are legitimate and the providers and suppliers meet certain Medicare standards. A CMS official reported that, since the implementation of the PPACA screening requirements, the agency had revoked over 17,000 suspect providers’ and suppliers’ ability to bill the Medicare program.

Establishing Moratoria on Enrollment of New Providers and Suppliers in Certain Areas

CMS has suspended enrollment of new home health providers and ground ambulance suppliers in certain fraud “hot spots” and other geographic areas. In July 2013, CMS first exercised its authority granted by PPACA to establish temporary moratoria on enrolling new home health agencies in Chicago and Miami, and new ambulance suppliers in Houston. In January 2014, CMS extended its first moratoria and added enrollment moratoria for new home health agency providers in Fort Lauderdale, Detroit, Dallas, and Houston, and new ambulance suppliers in Philadelphia. These moratoria are scheduled to be in effect until July 2014, unless CMS extends or lifts them. CMS officials cited areas of potential fraud risk, such as a disproportionate number of providers and suppliers relative to beneficiaries and extremely high utilization as rationales for suspending new enrollments of home health providers or ground ambulance suppliers in these areas.

Requiring Certain Prescribers to Enroll in Medicare

CMS recently issued a final rule requiring prescribers of drugs covered within Medicare’s prescription drug program, Part D, to enroll in Medicare by June 2015. As a result of this rule, CMS is to screen these prescribers to verify that they meet specific requirements, such as having current licenses or accreditation and valid Social Security numbers. OIG has identified concerns with CMS oversight of fraud, waste, and abuse in Part D, including the contractors tasked with this work. A June 2013 OIG report found that the Part D program inappropriately paid for drugs ordered by individuals who clearly did not have the authority to prescribe, such as massage therapists, athletic trainers, home contractors, and OIG recommended, among other things, that there should interpreters.be verification of prescribers’ authority to prescribe drugs, and that CMS should ensure that Medicare does not pay for prescriptions from individuals without such authority. CMS agreed with OIG’s recommendations and, in discussing the final rule, stated that this new enrollment requirement is to help ensure that Part D drugs are prescribed only by qualified physicians and eligible professionals. To continue to help address potential vulnerabilities in the Part D program, we are currently examining practices for promoting prescription drug program integrity and the extent to which CMS’s oversight of Medicare Part D reflects those practices. We plan to issue a report this fall.

Additional Enrollment Screening Could Help Ensure Potentially Fraudulent Providers and Suppliers Do Not Participate in Medicare

Although CMS has taken many needed actions, we and OIG have found that CMS has not fully implemented other enrollment screening actions authorized by PPACA. These actions could help further reduce the enrollment of providers and suppliers intent on defrauding the Medicare program, which is important because identifying and prosecuting providers and suppliers engaged in potentially fraudulent activity is time consuming, resource intensive, and costly. These actions include issuing a rule to implement surety bonds for certain providers and suppliers, issuing a rule on provider and supplier disclosure requirements, and establishing the core elements for provider and supplier compliance programs.

Surety Bonds

PPACA authorized CMS to require a surety bond for certain types of at- risk providers and suppliers. Surety bonds may serve as a source for recoupment of erroneous payments. DMEPOS suppliers are currently required to post a surety bond at the time of enrollment. CMS reported in April 2014 that it had not yet scheduled for publication a proposed rule to implement the PPACA surety bond requirement for other types of at- risk providers and suppliers—such as home health agencies and independent diagnostic testing facilities. In light of the moratoria that CMS has placed on enrollment of home health agencies in fraud “hot spots,” implementation of this rule could help the agency address potential concerns for these at-risk providers across the Medicare program.

Providers and Suppliers Disclosure

42 U.S.C. § 1395m(a)(16)(B). A DMEPOS surety bond is a bond issued by an entity guaranteeing that a DMEPOS supplier will fulfill its obligation to Medicare. If the obligation is not met, the surety bond is paid to Medicare. Medicare Program; Surety Bond Requirement for Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS), 74 Fed. Reg. 166 (Jan. 2, 2009). suspension from a federal health care program.indicated that developing the additional disclosure requirements has been complicated by provider and supplier concerns about what types of information will be collected, what CMS will do with it, and how the privacy and security of this information will be maintained.

Compliance Program

CMS has not established the core elements of compliance programs for providers and suppliers, as required by PPACA. We previously reported that agency officials indicated that they had sought public comments on the core elements, which they were considering, and were also studying criteria found in OIG model plans for possible inclusion.2014, CMS reported that it had not yet scheduled a proposed rule for publication.

Further Improvements to Prepayment and Postpayment Claims Review May Better Identify or Recover Improper Payments

Medicare uses prepayment review to deny claims that should not be paid and postpayment review to recover improperly paid claims. As claims go through Medicare’s electronic claims payment systems, they are subjected to prepayment controls called “edits,” most of which are fully automated; if a claim does not meet the criteria of the edit, it is automatically denied. Other prepayment edits are manual; they flag a claim for individual review by trained staff who determine whether it should be paid. Due to the volume of claims, CMS has reported that less than 1 percent of Medicare claims are subject to manual medical record review by trained personnel.

Increased use of prepayment edits could help prevent improper Medicare payments. Our prior work found that, while use of prepayment edits saved Medicare at least $1.76 billion in fiscal year 2010, the savings could have been greater had prepayment edits been used more widely. Based on an analysis of a limited number of national policies and local coverage determinations (LCD), we identified $14.7 million in payments in fiscal year 2010 that appeared to be inconsistent with four national policies and therefore improper. We also found more than $100 million in payments that were inconsistent with three selected LCDs that could have been identified using automated edits. Thus, we concluded that more widespread implementation of effective automated edits developed by individual MACs in other MAC jurisdictions could also result in savings to Medicare. CMS has taken steps to improve the development of other types of prepayment edits that are implemented nationwide, as we recommended. For example, the agency has centralized the development and implementation of automated edits based on a type of national policy CMS has also modified its called national coverage determinations.processes for identifying provider billing of services that are medically unlikely to prevent circumvention of automated edits designed to identify an unusually large quantity of services provided to the same patient.

We also evaluated the implementation of CMS’s Fraud Prevention System (FPS), which uses predictive analytic technologies as required by the Small Business Jobs Act of 2010 to analyze Medicare fee-for-service (FFS) claims on a prepayment basis. FPS identifies investigative leads for CMS’s Zone Program Integrity Contractors (ZPIC), the contractors responsible for detecting and investigating potential fraud. in July 2011, FPS is intended to help facilitate the agency’s shift from focusing on recovering potentially fraudulent payments after they have been made, to detecting aberrant billing patterns as quickly as possible, with the goal of preventing these payments from being made. However, in October 2012, we found that, while FPS generated leads for investigators, it was not integrated with Medicare’s payment-processing system to allow the prevention of payments until suspect claims can be determined to be valid. As of April 2014, CMS reported that while the FPS functionality to deny claims before payment had been integrated with the Medicare payment processing system in October 2013, the system did not have the ability to suspend payment until suspect claims could be investigated. In addition, while CMS directed the ZPICs to prioritize alerts generated by the system, in our work examining the sources of new ZPIC investigations in 2012, we found that FPS accounted for about 5 percent of ZPIC investigations in that year. A CMS official reported in March 2014 that ZPICs are now using FPS as a primary source of leads for fraud investigations, though the official did not provide details on how much of ZPICs’ work is initiated through the system.

GAO, Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness, GAO-13-104 (Washington, D.C.: Oct. 15, 2012).

Our prior work found that postpayment reviews are critical to identifying and recouping overpayments. The use of national recovery audit contractors (RAC) in the Medicare program is helping to identify underpayments and overpayments on a postpayment basis. CMS began the program in March 2009 for Medicare FFS. CMS reported that, as of the end of 2013, RACs collected $816 million for fiscal year 2014. PPACA required the expansion of Medicare RACs to Parts C and D. CMS has implemented a RAC for Part D, and CMS said it plans to award a contract for a Part C RAC by the end of 2014. Moreover, in February 2014, CMS announced a “pause” in the RAC program as the agency makes changes to the program and starts a new procurement process for the next round of recovery audit contracts for Medicare FFS claims. CMS stated it anticipates awarding all five of these new Medicare FFS recovery audit contracts by the end of summer 2014.

Other contractors help CMS investigate potentially fraudulent FFS payments, but CMS could improve its oversight of their work. CMS contracts with ZPICs in specific geographic zones covering the nation. In October 2013, we found that the ZPICs reported that their actions, such as stopping payments on suspect claims, resulted in more than $250 million in savings to Medicare in calendar year 2012. However, CMS lacks information on the timeliness of ZPICs’ actions—such as the time it takes between identifying a suspect provider and taking actions to stop that provider from receiving potentially fraudulent Medicare payments— and would benefit from knowing whether ZPICs could save more money by acting more quickly. Thus we recommended that CMS collect and evaluate information on the timeliness of ZPICs’ investigative and administrative actions. CMS did not provide comments on our recommendation. We are currently examining the activities of the CMS contractors, including ZPICs, that conduct postpayment claims reviews, and anticipate issuing a report later this summer. Our work is reviewing, among other things, whether CMS has a strategy for coordinating these contractors’ postpayment claims review activities.

CMS has taken steps to improve use of two CMS information technology systems that could help analysts identify fraud after claims have been paid, but further action is needed. In 2011, we found that the Integrated Data Repository (IDR)—a central data store of Medicare and other data needed to help CMS program integrity staff and contractors detect improper payments of claims—did not include all the data that were planned to be incorporated by fiscal year 2010, because of technical obstacles and delays in funding. As of March 2014, the agency had not addressed our recommendation, to develop reliable schedules to incorporate all types of IDR data, which could lead to additional delays in making available all of the data that are needed to support enhanced program integrity efforts and achieve the expected financial benefits. However, One Program Integrity (One PI)—a web-based portal intended to provide CMS staff and contractors with a single source of access to data contained in IDR, as well as tools for analyzing those data—is operational, and CMS has established plans and schedules for training all intended One PI users, as we also recommended in 2011. However, as of March 2014, CMS had not established deadlines for program integrity contractors to begin using One PI, as we recommended in 2011. Without these deadlines, program integrity contractors will not be required to use the system, and as a result, CMS may fall short in its efforts to ensure the widespread use and to measure the benefits of One PI for program integrity purposes.

Addressing Identified Vulnerabilities Could Help Reduce Fraud

Having mechanisms in place to resolve vulnerabilities that could lead to improper payments, some of which are potentially fraudulent, is critical to effective program management, but our work has shown weaknesses in CMS’s processes to address such vulnerabilities. Both we and OIG have made recommendations to CMS to improve the tracking of vulnerabilities. In our March 2010 report on the RAC demonstration program, we found that CMS had not established an adequate process during the demonstration or in planning for the national program to ensure prompt resolution of vulnerabilities that could lead to improper payments in Medicare; further, the majority of the most significant vulnerabilities identified during the demonstration were not addressed. In December 2011, OIG found that CMS had not resolved or taken significant action to resolve 48 of 62 vulnerabilities reported in 2009 by CMS contractors specifically charged with addressing fraud. We and OIG recommended that CMS have written procedures and time frames to ensure that vulnerabilities were resolved. CMS has indicated that it is now tracking vulnerabilities identified from several types of contractors through a single vulnerability tracking process, and the agency has developed some written guidance on the process. In 2012, we examined that process and found that, while CMS informs Medicare administrative contractors (MAC) about vulnerabilities that could be addressed through prepayment edits, the agency does not systematically compile and disseminate information about effective local edits to address such vulnerabilities. Specifically, we recommended that CMS require MACs to share information about the underlying policies and savings related to their most effective edits, and CMS generally agreed to do so. In addition, in 2011 CMS began requiring MACs to report on how they had addressed certain vulnerabilities to improper payment, some of which could be addressed through edits.

We also made recommendations to CMS to address the millions of Medicare cards that display beneficiaries’ Social Security numbers, which In August 2012, we increases beneficiaries’ vulnerability to identity theft.recommended that CMS (1) select an approach for removing Social Security numbers from Medicare cards that best protects beneficiaries from identity theft and minimizes burdens for providers, beneficiaries, and CMS; and (2) develop an accurate, well-documented cost estimate for such an option. In September 2013, we further recommended that CMS (1) initiate an information technology project for identifying, developing, and implementing changes for the removal of Social Security numbers; and (2) incorporate such a project into other information technology initiatives. HHS concurred with our recommendations and agreed that removing the numbers from Medicare cards is an appropriate step toward reducing the risk of identity theft. However, the department also stated that CMS could not proceed with changes without agreement from other agencies, such as the Social Security Administration, and that funding was also a consideration. Thus, CMS has not yet taken action to address these recommendations. We are currently examining other options for updating and securing Medicare cards, including the potential use of electronic-card technologies, and expect to issue a report early next year.

In conclusion, although CMS has taken some important steps to identify and prevent fraud through increased provider and supplier screening and other actions, the agency must continue to improve its efforts to reduce fraud, waste, and abuse in the Medicare program. Identifying the nature, extent, and underlying causes of improper payments, and developing adequate corrective action processes to address vulnerabilities, are essential prerequisites to reducing them. As CMS continues its implementation of PPACA and Small Business Jobs Act provisions, additional evaluation and oversight will help determine whether implementation of these provisions has been effective in reducing improper payments. We are investing resources in a body of work that assesses CMS’s efforts to refine and improve its fraud detection and prevention abilities. Notably, we are currently assessing potential use of electronic-card technologies, which can help reduce Medicare fraud. We are also examining the extent to which CMS’s information system can help prevent and detect the continued enrollment of ineligible or potentially fraudulent providers and suppliers in Medicare. Additionally, we have a study under way examining CMS’s oversight of fraud, waste, and abuse in Medicare Part D to determine whether the agency has adopted certain practices for ensuring the integrity of that program. We are also examining CMS’s oversight of some of the contractors that conduct reviews of claims after payment. These studies are focused on additional actions for CMS that could help the agency more systematically reduce potential fraud in the Medicare program.

Chairman Murphy, Ranking Member DeGette, and Members of the Subcommittee, this concludes my prepared remarks. I would be pleased to respond to any questions you may have at this time.

GAO Contact and Staff Acknowledgments

For further information about this statement, please contact Kathleen M. King at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Karen Doran, Assistant Director; Eden Savino; and Jennifer Whitworth were key contributors to this statement.

Appendix I: Abbreviations

Related GAO Products

Medicare: Further Action Could Improve Improper Payment Prevention and Recoupment Efforts. GAO-14-619T. Washington, D.C.: May 20, 2014.

Medicare Fraud: Progress Made, but More Action Needed to Address Medicare Fraud, Waste, and Abuse, GAO-14-560T. Washington, D.C.: April 30, 2014.

Medicare: Second Year Update for CMS’s Durable Medical Equipment Competitive Bidding Program Round 1 Rebid. GAO-14-156. Washington, D.C.: March 7, 2014.

Medicare Program Integrity: Contractors Reported Generating Savings, but CMS Could Improve Its Oversight. GAO-14-111. Washington, D.C.: October 25, 2013.

Health Care Fraud and Abuse Control Program: Indicators Provide Information on Program Accomplishments, but Assessing Program Effectiveness Is Difficult. GAO-13-746. Washington, D.C.: September 30, 2013.

Medicare Information Technology: Centers for Medicare and Medicaid Services Needs to Pursue a Solution for Removing Social Security Numbers from Cards. GAO-13-761. Washington, D.C.: September 10, 2013 Medicare Program Integrity: Few Payments in 2011 Exceeded Limits under One Kind of Prepayment Control, but Reassessing Limits Could Be Helpful. GAO-13-430. Washington, D.C.: May 9, 2013.

High-Risk Series: An Update. GAO-13-283. Washington, D.C.: February 14, 2013.

Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment. GAO-13-102. Washington, D.C.: November 13, 2012.

Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012.

Health Care Fraud: Types of Providers Involved in Medicare, Medicaid, and the Children’s Health Insurance Program Cases. GAO-12-820. Washington, D.C.: September 7, 2012.

Medicare: CMS Needs an Approach and a Reliable Cost Estimate for Removing Social Security Numbers from Medicare Cards. GAO-12-831. Washington, D.C.: August 1, 2012.

Program Integrity: Further Action Needed to Address Vulnerabilities in Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.: June 7, 2012.

Medicare: Review of the First Year of CMS’s Durable Medical Equipment Competitive Bidding Program’s Round 1 Rebid. GAO-12-693. Washington, D.C.: May 9, 2012.

Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of Providers and Suppliers. GAO-12-351. Washington, D.C.: April 10, 2012.

Medicare Part D: Instances of Questionable Access to Prescription Drugs. GAO-11-699. Washington, D.C.: September 6, 2011.

Medicare Integrity Program: CMS Used Increased Funding for New Activities but Could Improve Measurement of Program Effectiveness. GAO-11-592. Washington, D.C.: July 29, 2011.

Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011.

Medicare Fraud, Waste, and Abuse: Challenges and Strategies for Preventing Improper Payments. GAO-10-844T. Washington, D.C.: June 15, 2010.

Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010.

Medicare: Thousands of Medicare Providers Abuse the Federal Tax System. GAO-08-618. Washington, D.C.: June 13, 2008.

Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies. GAO-07-59. Washington, D.C.: January 31, 2007.

Medicare: More Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment Suppliers. GAO-05-656. Washington, D.C.: September 22, 2005.

Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004.

This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.