Medicare: Initial Results of Revised Process to Screen Providers and Suppliers, and Need for Objectives and Performance Measures
Released: 2016-12-15T00:00:00

Letter

Background

To become eligible to bill for services provided to Medicare beneficiaries, prospective Medicare providers and suppliers apply to the program by completing an online enrollment application in PECOS or by submitting a paper enrollment application that is manually entered into PECOS. Application information, such as name, address, specialty area, licensure, and accreditation, is used to create the provider’s or supplier’s enrollment record in PECOS. An individual provider or supplier may have more than one enrollment record; for example, a provider may have one enrollment record for a practice in one state and another enrollment record for a practice in another state.

CMS places all provider and supplier types into risk categories—limited, moderate, or high—based on CMS’s assessments of the potential risk of fraud, waste, and abuse each provider and supplier type poses to Medicare program integrity. CMS also designates specific screening activities for each risk category. See table 1 for the types of Medicare providers and suppliers assigned to each enrollment screening risk category.

Under contract to CMS, MACs screen providers and suppliers in all risk categories to verify that they meet Medicare eligibility requirements, such as having current federal or state licenses or accreditation. Medicare regulations require that site visits be conducted for all high- and moderate-risk providers and suppliers. Those conducting the site visits determine whether the reported practice locations are operational and meet requirements such as specified hours of operation. In addition to these site visits, high-risk providers and suppliers also are subject to a fingerprint-based criminal background check. In the course of this screening, MACs may request additional information from the prospective provider or supplier. Upon completion of screening, the MAC reaches a decision to approve eligible providers and suppliers, deny ineligible providers and suppliers, or reject incomplete applications. Figure 1 shows the enrollment process, including the screening conducted for each risk category.

Once enrolled, to remain eligible to bill Medicare providers and suppliers must continue to meet CMS’s enrollment requirements, and they must report to CMS any changes to their enrollment information, including final adverse actions taken against them, such as a suspension or licensure revocation by a state licensing authority. In addition, providers and suppliers periodically are required to resubmit enrollment information to the MAC to update their enrollment records. The MAC revalidates the provider’s or supplier’s enrollment record using the enrollment screening process, to determine whether the provider or supplier remains eligible to bill Medicare. Upon completing the revalidation process, the MAC reaches a decision to approve providers and suppliers that remain eligible; deactivate billing privileges for providers and suppliers that have not responded to a request to resubmit enrollment information or have not submitted all required information—privileges that may be reactivated upon submission of a new enrollment application or recertifying that current enrollment information is correct; or revoke billing privileges for providers and suppliers determined ineligible.

Providers and suppliers must submit updated information for their enrollment records for revalidation every 5 years, with the exception of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers, which must submit their information every 3 years. CMS initiated the first program-wide revalidation effort for all providers and suppliers enrolled in Medicare prior to March 25, 2011, by mailing notices to providers and suppliers in three phases, from September 2011 through March 2015, as shown in figure 2.

Each notice sent by the MAC asks the provider or supplier to submit a newly completed enrollment application for revalidation, which the MAC then screens using the enrollment screening process to verify the information provided and determine whether the provider or supplier remains eligible to bill Medicare. A provider or supplier must respond by the due date or may request an extension to submit an application. If the provider or supplier does not respond within the allowed time, the provider or supplier is to be placed on a payment hold and is not to receive Medicare payment for services billed until a complete enrollment application has been submitted and approved by the MAC. Figure 3 illustrates the process MACs use to revalidate existing providers and suppliers.

CMS Applied the Revised Enrollment Screening Process to over 2.4 Million New Applications and Existing Records, and Estimated Avoiding $2.4 Billion in Medicare Payments to Ineligible Providers and Suppliers

CMS Denied or Rejected over 23,000 New Applications and Deactivated or Revoked over 703,000 Existing Enrollment Records

According to our analysis of PECOS data, CMS applied its revised enrollment screening process to over 2.4 million unique new applications and existing enrollment records from March 25, 2011, through December 31, 2015. As a result, CMS took action to deny or reject new applications and to deactivate or revoke existing enrollment records that did not meet the revised screening requirements.

CMS’s screening of new enrollment applications resulted in actions against more than 23,000 new enrollment applications—CMS denied over 6,000 applications for ineligible providers and suppliers and rejected over 17,000 incomplete applications during the time period we reviewed. According to our analysis, the denials and rejections were disproportionately for providers and suppliers in the moderate- and high- risk categories. The most commonly recorded reason for a denial was because Medicare provider or supplier type requirements were not met (over 42 percent of total denials). Officials from a MAC said this may occur, for example, if a provider does not hold a certification required for that provider type. See table 2 for the most commonly recorded reasons in PECOS for denial by risk category.

The most commonly recorded reason in PECOS for a rejected enrollment application was a deleted enrollment application (about 25 percent of total rejections), which officials from a MAC said may occur when an enrollment application has been entered into PECOS in error, either by a provider or supplier, or by the MAC. See table 3 for the most commonly recorded reasons in PECOS for rejection by risk category.

Denied and rejected enrollment applications were relatively more common for moderate- and high-risk providers and suppliers and less common for limited-risk providers and suppliers. According to our analysis, while moderate- and high-risk providers and suppliers accounted for less than 10 percent of all new enrollment application decisions during the time period we reviewed, they accounted for over 30 percent of denials and over 22 percent of rejections. The disproportionate deactivations and rejections could be the result of the additional screening for moderate- and high-risk applicants or the underlying greater risk that these moderate- and high-risk providers and suppliers posed to Medicare.

CMS’s screening of existing enrollment records resulted in actions against more than 703,000 provider and supplier enrollment records— CMS deactivated over 660,000 and revoked over 43,000 throughout this period. Providers and suppliers lose their ability to bill Medicare when CMS either deactivates or revokes their enrollment record. Providers and suppliers in the limited-risk category accounted for about 90 percent of deactivations and 84 percent of revocations. Enrollment records of limited-risk providers and suppliers represented about 90 percent of the 1.9 million approved enrollment records as of December 31, 2015.

The reasons for deactivations and revocations varied, according to our analysis. Many were the result of enrollment screening conducted during CMS’s first revalidation cycle. For example, the most commonly recorded reason in PECOS for deactivations was not responding to a revalidation request (about 47 percent overall). See table 4 for the most commonly recorded reasons in PECOS for deactivation by risk category.

The most commonly recorded reason overall for revocations was not being professionally licensed (over 61 percent), but the most commonly recorded reasons differed between the limited-risk category and the moderate- and high-risk categories. See table 5 for the most commonly recorded reasons in PECOS for revocation by risk category.

According to our analysis of PECOS data, there were about 500,000 more approved enrollment records nearly 5 years after CMS began applying its revised enrollment screening process. When the revised enrollment screening process took effect on March 25, 2011, there were about 1.4 million approved enrollment records in PECOS, which increased by more than 30 percent to about 1.9 million approved enrollment records by December 31, 2015. During roughly the same time frame, the number of Medicare beneficiaries increased by more than 13 percent, from 48.7 million in 2011 to 55.3 million in 2015.

CMS Estimates It Avoided $2.4 Billion in Medicare Payments to Ineligible Providers and Suppliers from Enrollment Screening Process, Among Other Benefits

CMS estimates the revised enrollment screening process avoided $2.4 billion in Medicare payments to ineligible providers and suppliers from March 2011 to May 2015, and CMS and MAC officials report additional benefits. According to CMS officials, the estimate is based on Medicare payments providers and suppliers with revoked enrollment records would have received had they not been revoked. To make its estimate, CMS used the provider’s or supplier’s past billing history and a formula it has developed for estimating Medicare payments avoided from other Medicare program integrity efforts. In addition to Medicare payments avoided, CMS and MAC officials report other benefits from the revised enrollment screening process, including the following:

More accurate and complete data in PECOS. For example, the MACs deactivated providers and suppliers that were no longer billing Medicare, and created new PECOS enrollment records during the first program-wide revalidation effort for providers and suppliers that were in the Medicare claims system but not in PECOS.

Providers and suppliers more knowledgeable about their responsibilities to keep enrollment information up to date. MAC officials said providers and suppliers are now more frequently providing them with changes of information, which according to CMS and MAC officials may result in fewer deactivated enrollment records during the second program-wide revalidation effort that began in March 2016.

Identified provider and supplier enrollment records that needed increased scrutiny. CMS reported in September 2016 that it identified about 1,700 such cases and raised the provider’s or supplier’s risk category from limited or moderate risk to high risk.

While CMS and MAC officials reported benefits from the revised enrollment screening process, they also reported challenges. For example, MAC officials said that there were challenges revalidating enrollment information for providers and suppliers with multiple billing locations during the first program-wide revalidation effort, which led to deactivations of some otherwise eligible providers and suppliers. According to officials at one MAC we interviewed, this could have occurred, for example, if the provider’s or supplier’s address information in PECOS was not accurate and a revalidation letter was not sent to each billing location or if the revalidation notice did not reach the correct office personnel handling the requests for enrollment information for revalidation.

We and the HHS Office of the Inspector General have also found some issues with PECOS data since the revised process took effect. In June 2015, we reported that a review of PECOS data as of early 2013 found that an estimated 23,400 of 105,234 practice location addresses in PECOS were potentially ineligible, for example because they were vacant addresses. CMS concurred with our recommendations to incorporate flags into its software to help identify potentially questionable practice location addresses and to collect additional license information. In January 2016, CMS replaced the current PECOS address verification software used during the enrollment screening process for new applications with software that, according to CMS, will better detect potentially ineligible addresses. In April 2016, the HHS Office of the Inspector General reported that PECOS did not contain the reasons for enrollment application submissions—for example, whether a new enrollment application or an application submitted in response to a revalidation request—for 54,903 of 479,115 applications submitted from March 25, 2012, through March 24, 2013. The reason for submission determines the screening level for certain providers and suppliers—for example, newly enrolling home health agencies are screened in the high- risk category while home health agencies being revalidated are screened in the moderate-risk category—and therefore some providers and suppliers may not have received appropriate screening. CMS concurred with the HHS Office of the Inspector General’s recommendations.

CMS Modified Elements of the Revised Enrollment Screening Process and Plans to Implement Further Modifications in the Future

Since 2011, CMS has modified some of the methods it uses to screen providers and suppliers trying to enroll or maintain eligibility to bill Medicare. For example, CMS officials said that screening modifications include the addition of a licensure continuous monitoring report, beginning in November 2013, and a criminal continuous monitoring report, beginning July 2015. CMS officials stated that the MACs now use these reports to help ensure that providers and suppliers continue to meet CMS’s enrollment requirements after they have been enrolled. The MACs do so by identifying those providers and suppliers that no longer meet licensure requirements or that now have certain criminal convictions, and deactivating or revoking their enrollment records. Before implementing the reports, MACs did not receive routine reporting to use for checking licensure and criminal convictions of enrolled providers and suppliers, and CMS officials said they did not know whether the MACs were conducting such reviews regularly. CMS officials reported the agency made these screening modifications in part to meet PPACA requirements for provider and supplier enrollment. Table 6 includes examples of modifications CMS has made to methods used to screen providers and suppliers under the revised enrollment screening process put into effect in 2011.

CMS has also made a number of operational modifications to the enrollment screening process used to revalidate existing providers and suppliers since 2011. These modifications include some that CMS officials said are intended to encourage providers to be more responsive to revalidation requests, such as establishing revalidation due dates that are posted online 6 months in advance and eliminating automatic approvals of provider and supplier requests for deadline extensions. Others are modifications that help the MACs better manage and streamline their operations, CMS officials said, such as eliminating the requirement for MACs to send CMS bi-monthly revalidation data, as MAC officials told us that CMS can pull that data directly from PECOS. CMS also began giving the MACs the lists of providers to contact for revalidation further in advance of the required mailing date than CMS did during the first program-wide revalidation cycle. CMS officials said these changes resulted from work groups that included CMS and MAC officials that were set up to identify and plan operational modifications to improve and streamline revalidation. See appendix II for examples of operational modifications CMS has made to the enrollment screening process used to revalidate existing providers and suppliers.

CMS plans to implement additional modifications using a detailed work plan, but has not yet determined these modifications. In March 2016, CMS officials said they plan to continue to work with the MACs to generate modifications as in the past, allowing each of the four MAC work groups, which according to CMS officials include CMS points-of-contact, to keep track of its own notes and individually manage its activities as it works to generate ideas and proposals for modifications that each work group then submits to CMS for consideration. While CMS did not use a detailed work plan to make operational modifications to the enrollment screening process in preparation for the second program-wide revalidation effort, CMS officials said that the agency intends to develop a detailed work plan for the modifications they select for implementation, but have not yet set a time frame for developing such a plan. CMS officials stated that they have not yet determined future modifications and are waiting to see the results of the previous modifications before modifying the enrollment process further.

CMS Monitors Elements of Its Screening Process but Monitoring Is Limited by a Lack of Objectives and Performance Measures

CMS monitoring includes reviewing certain results of enrollment screening, examining the efficiency of the enrollment screening process, and evaluating the performance of contractors.

CMS officials said that the agency reviews, at least monthly, information such as the number of deactivations and revocations, including the reasons for deactivations and revocations, the number of deactivations and revocations that result from fingerprint checks and site visits, and the number of provider and supplier revocations that are overturned upon appeal.

CMS and MAC officials said they meet periodically to examine operational efficiency. For example, CMS officials met with the MACs to examine the efficiency of the first program-wide revalidation effort and reviewed operations to identify potential efficiency improvements. According to CMS and MAC officials, those meetings resulted in changes to operations, such as CMS giving MACs the lists of providers to contact for revalidation further in advance of the required mailing date. CMS and MAC officials said they convened work groups based on those meetings and are continuing to use those work groups to identify future operational modifications, as we noted earlier in this report.

We found that CMS also annually evaluates contractor performance by comparing performance against specific measures for the MACs and other contractors that assist with enrollment screening, such as the site visit contractor. For example, CMS developed the Performance Assessment Program for the MACs, which includes three evaluative reviews—the Quality Control Plan review, the Quality Assurance Surveillance Plan review, and the Award Fee Plan review. The Quality Assurance Surveillance Plan review includes, and the Award Fee Plan review may include, contractor performance measures for provider enrollment. The contractor performance measures relate to MAC processing of provider enrollment applications and are designed to assess elements such as timeliness and accuracy.

Despite these efforts, we found that CMS’s monitoring of enrollment screening, including screening conducted as part of revalidation, lacks objectives and performance measures for assessing progress toward achieving its goals. In November 2015, CMS officials stated that the goals for the enrollment screening process are to (1) place providers and suppliers into proper risk categories and (2) effectively screen the providers in each category. According to CMS officials, the agency also set goals for its revalidation effort to (1) implement provisions of PPACA, (2) keep provider and supplier information up to date, (3) reduce improper payments, and (4) ensure program integrity. However, CMS officials said they have not established objectives and performance measures to use in monitoring progress toward achieving these goals. Federal internal control standards specify that management should define objectives in specific and measurable terms, establish appropriate performance measures for the defined objectives, and conduct ongoing monitoring so that progress toward achieving desired goals can be assessed. In addition, leading practices call for performance measures to monitor and gauge results.

In March 2016, CMS officials said that the agency does not plan to develop any objectives or performance measures for enrollment screening, including screening conducted as part of revalidation, which is contrary to federal internal control standards and leading practices for managing programs. Performance measures focus on whether a program has achieved measurable standards. They allow agencies to monitor and report program accomplishments on an ongoing basis. CMS officials stated that while they want to assess the screening process, they are uncertain of what performance measures to establish in part because they are concerned that some measures would be inappropriate. For example, CMS officials stated that while they review the number of deactivations and revocations, it would not be appropriate to have targets for deactivating or revoking a predetermined number of providers or suppliers. This is consistent with our previous work in which CMS officials stated that setting such targets could create incentives that could potentially jeopardize the quality of contractors’ work. We also previously reported that it is important that agencies avoid the appearance of striving to achieve certain numerical quotas regardless of quality.

However, without developing objectives and performance measures to use in ongoing monitoring, the agency will be unable to measure the progress it has made toward achieving its goals for the screening process and for revalidating provider and supplier enrollment information. We have previously reported that performance measurement gives managers crucial information to identify gaps in program performance and plan any needed improvements. While there may be challenges in developing such objectives and performance measures, there are opportunities to do so that would allow CMS to better monitor the enrollment screening process without setting specific targets for the number of deactivations or revocations. For example, CMS could focus on developing objectives and performance measures related to its goals for enrollment screening, such as keeping enrollment information up to date. CMS officials have said that since the revised screening process took effect, providers and suppliers are more aware of their responsibilities to keep information up to date, and MAC officials have stated that providers and suppliers are more frequently providing MACs with changes of information. According to CMS officials, this may result in fewer deactivated enrollment records during the second program-wide revalidation effort. CMS officials said they regularly review the number of deactivated enrollment records, and the agency has information on the reasons for deactivation. Some of those reasons may be associated with failing to keep information up to date, such as nonresponse to requests for updated enrollment information. However, CMS has no objectives and performance measures for the reasons for deactivation to use in measuring progress toward its goal of keeping enrollment information up to date.

Conclusions

Effective provider and supplier enrollment screening is critical to ensuring program integrity and preventing improper payments. With its revised enrollment screening process, CMS has implemented a preventive risk- based strategy for achieving program integrity where increased scrutiny and greater resources are dedicated to providers and suppliers that present a higher potential risk of fraud, waste, and abuse. CMS has subsequently modified some elements and conducted monitoring of the process. However, CMS has not taken certain important steps that could help ensure the effectiveness of these actions. As CMS considers future modifications to the enrollment screening process and undertakes its second program-wide revalidation effort, opportunities exist to address limitations in its current monitoring of the process. By establishing specific objectives and performance measures for the enrollment screening process and periodically assessing the progress, the agency could better ensure the effectiveness of the screening process as a means of maintaining program integrity and limiting improper payments in Medicare.

Recommendation for Executive Action

To improve the efficiency and effectiveness of the agency’s enrollment screening process, we recommend that the Administrator of CMS establish objectives and performance measures for assessing progress toward achieving its goals.

Agency Comments

We provided a draft of this report to HHS for comment, and its comments are reprinted in appendix III. HHS also provided technical comments, which we incorporated as appropriate.

In commenting on this report, HHS agreed with our recommendation. HHS stated that it will review the goals of the enrollment screening process and determine if there are appropriate objectives and performance measures for the program that the agency can establish.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of the Centers for Medicare & Medicaid Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix IV.

Appendix I: Scope and Methodology for the Provider Enrollment, Chain and Ownership System Data Analysis

To examine the results of the revised enrollment screening process put into place in 2011, we analyzed data from provider and supplier enrollment records in the Provider Enrollment, Chain and Ownership System (PECOS), the Centers for Medicare & Medicaid Services’ (CMS) centralized database for Medicare enrollment information. We analyzed PECOS data from March 25, 2011 (the date the new screening process went into effect) through December 31, 2015 (the most current data available at the time of our analysis) to determine (1) the number enrollment records and enrollment applications to which CMS applied the revised screening process, (2) the number of approved, denied, and rejected new enrollment applications, (3) the number of deactivated or revoked existing enrollment records, and (4) the number of enrollment records associated with providers and suppliers eligible to bill Medicare. We did not independently verify the accuracy of the PECOS data; however, we checked the PECOS data for obvious errors and omissions, compared analysis results to CMS publicly reported information on screening process outcomes, and interviewed CMS officials to resolve any identified discrepancies. On the basis of this review, we determined that the PECOS data were sufficiently reliable for the purposes of this report, and we accounted for any limitation in these data during our analyses, such as removing certain outcomes from our analysis of initial enrollment applications and removing enrollment records that did not have a risk category assigned in PECOS from our analysis of the percentages of deactivated and revoked enrollment records in each risk category.

To determine the number of enrollment records and enrollment applications to which CMS applied the revised enrollment screening process during the time period we reviewed, we analyzed PECOS data to identify which one of three distinct groups each enrollment record belonged. Specifically, we identified (1) the number of new enrollment application decisions made, (2) the number of enrollment records with a change in enrollment status, for example, from approved to deactivated, and (3) the number of approved enrollment records as of March 25, 2011, that did not have an enrollment status change during the time period. Each enrollment record could only fall in to a single group and we excluded from our analysis deactivated or revoked enrollment records that did not have an enrollment status change during the time period since CMS would not have applied the enrollment screening process to these enrollment records.

To determine the number of approved, denied, and rejected new enrollment applications during the time period we reviewed, we analyzed PECOS data to calculate the number of enrollment applications by outcome. For the denied and rejected new enrollment applications, we analyzed the PECOS recorded reasons for the denial or rejection and calculated the number of denials and rejections by recorded reason and by provider and supplier risk category during that time period. CMS officials reported that there could be multiple reasons for a denial or rejection, but due to PECOS system limitations, the Medicare Administrative Contractors (MAC) responsible for enrolling providers and suppliers can only record one reason. In addition, the reason codes that can be recorded in PECOS changed during the time frame covered by our analysis.

To determine the number of existing enrollment records deactivated or revoked during the time period we reviewed, we analyzed PECOS data to identify enrollment record statuses that changed to deactivated or revoked during the time period. We identified both the total number of status changes, as well as the number of unique enrollment records deactivated or revoked. The total number of deactivations or revocations is greater than the number of unique enrollment records deactivated or revoked because a provider’s or supplier’s enrollment record could have been deactivated or revoked more than once during that time. For enrollment records with deactivated or revoked statuses, we analyzed the PECOS recorded reason for the deactivation or revocation and calculated the number of deactivations and revocations by recorded reason and by provider and supplier risk category during that time period. As with new enrollment application decisions, the reason codes that can be recorded in PECOS for existing enrollment records changed during the time period of our analysis.

To determine the number of enrollment records associated with providers and suppliers eligible to bill Medicare during the time period we reviewed, we analyzed PECOS data to calculate the total number of approved enrollment records on March 25, 2011, and on December 31, 2015.

Appendix II: Examples of Operational Modifications to Revalidation

The Centers for Medicare & Medicaid Services (CMS) has made operational modifications to revalidation since 2011. For example, in September 2014, CMS modified its guidelines so that the Medicare Administrative Contractors (MAC) need not obtain data missing from a provider’s or supplier’s application elsewhere if the information is disclosed in another place on the application or in the supporting documentation in the enrollment application submitted for revalidation. In addition, CMS made several modifications in preparation for the second program-wide enrollment record revalidation effort which began March 2016. Table 7 provides examples of these operational modifications, as described in CMS instructions to the MACs.

Appendix III: Comments from the Department of Health and Human Services

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Kathleen M. King, (202) 512-7114 or kingk@gao.gov.

Staff Acknowledgments

In addition to the contact named above, Karen Doran (Assistant Director), Peter Mangano (Analyst-in-Charge), Cathy Hamann, Colbie Holderness, Sylvia Diaz Jones, and Daniel Ries made key contributions to this report. Also contributing were Muriel Brown, Christine Davis, and Jennifer Whitworth.