Medicare: More Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment Suppliers
Released: 2005-10-12T00:00:00

Letter

Background

Most Medicare beneficiaries elect to enroll in Part B insurance, which helps pay for certain physician, outpatient hospital, laboratory, and other services; DME, such as oxygen, wheelchairs, hospital beds, and walkers; prosthetics and orthotics; and certain supplies. Medicare, under Part B, pays for most DMEPOS based on a series of state-specific or regional- specific fee schedules. Under the schedules, Medicare pays 80 percent, and the beneficiary pays the balance, of either the actual charge submitted by the supplier or the fee schedule amount, whichever is less. To review and process DMEPOS claims, CMS contracts with four insurance companies, known as DME regional carriers. The DME regional carriers review and pay DMEPOS claims submitted by outpatient providers and suppliers on behalf of beneficiaries residing in specific regions of the country.

CMS contracts with Palmetto Government Benefits Administrators to serve as the National Supplier Clearinghouse. In fiscal year 2004, NSC received $11.4 million for these activities, and for fiscal year 2005, its approved budget was $11.5 million. Palmetto also serves as the DME regional carrier for Region C. In addition, Palmetto serves as the Statistical Analysis Durable Medical Equipment Regional Carrier, which analyzes claims and reports to the DME regional carriers and CMS on trends in DMEPOS payment and areas of potential fraud.

Medicare’s Supplier Standards

Medicare’s 21 supplier standards were introduced primarily to deter individuals intent on committing fraud from entering the program and to safeguard Medicare beneficiaries by ensuring that suppliers were qualified. The 21 standards apply to a variety of business practices and establish certain requirements. (See app. II for a list of the 21 standards.) For example, the standards require suppliers to have a physical facility on an appropriate site that is accessible to beneficiaries and to CMS, with stated business hours clearly posted. CMS established the requirement for having an appropriate physical facility in December 2000 after investigators discovered fraudulent suppliers without fixed locations claiming vans or station wagons as their place of business or using mail drop boxes to receive Medicare payments for items they billed but never delivered. Among other things, the standards also require suppliers to: comply with applicable federal and state regulatory requirements, including state licensure, when providing DMEPOS items or services; maintain inventory on site or off site, or available through valid contracts with other companies not excluded from doing business with the federal government or its health care programs; and obtain comprehensive liability insurance.

The 21 supplier standards also prohibit certain practices. For example, one standard generally prohibits suppliers from using telephone calls to solicit new business, because the Social Security Act prohibits this type of marketing to Medicare beneficiaries.

Verifying Compliance with Supplier Standards

NSC verifies compliance with the supplier standards primarily during enrollment and reenrollment, through on-site inspections and desk reviews conducted by NSC analysts. (App. II lists the standards and how NSC verifies them during enrollment and reenrollment.) For example, the on-site inspections are used to check the compliance with the standards for whether the supplier: has a physical facility on an appropriate site that is accessible to beneficiaries and to CMS, with a clearly visible sign with hours posted; has its own inventory in stock on site, off site at another location, or has a contract with another company for the purchase of inventory; maintains records that document delivery of items to beneficiaries and information provided to beneficiaries on warranties, including how repairs and exchanges will be handled, and how to contact the supplier in case of questions or problems; and has a written beneficiary complaint resolution policy and maintains records on beneficiary complaints and their resolution.

NSC’s analysts are expected to follow procedures to review information provided by the on-site inspection and take other steps to verify suppliers’ compliance with the standards. For example, when on site the inspectors are expected to check that the supplier has all the valid occupation and business licenses required by its state and has a comprehensive liability insurance policy. The NSC analyst is expected to check that the supplier has all the state licenses that it would need to provide the items it disclosed in its application. The NSC analyst also is expected to contact the insurance underwriter to ensure that the supplier’s policy is valid, and the post office to make sure the supplier’s address is listed. NSC also has a procedure to match data from its supplier database with computerized lists maintained by the federal government to ensure that supply company owners are not prohibited from participating in federal health care programs or debarred from federal contracting.

NSC does not specifically verify adherence to 4 of the 21 standards at enrollment and reenrollment, because violations would generally be apparent through its verification of other standards. For example, the standard that requires suppliers to furnish NSC with complete and accurate information on the application and notify NSC of any changes within 30 days is verified through checking the accuracy of the suppliers’ disclosures of information for other standards—such as ownership and the appropriateness of the physical facility.

On-site Inspection Procedures

The majority of on-site inspections are conducted by more than 380 field representatives of Overland Solutions, Inc. (OSI), a company that performs this work as a subcontractor to NSC. In addition, NSC uses its own personnel, who are located in six cities, to conduct on-site inspections. NSC and OSI conducted over 20,000 on-site inspections in fiscal year 2004.

In performing their reviews, the site inspectors follow certain procedures. NSC requires that site inspectors arrive unannounced for any inspection. Before the inspection, NSC provides the inspectors with briefing information on the supplier, including information on whether the supplier is enrolling or reenrolling and the type of state licenses to verify. While on site, inspectors are expected to take photographs of the supplier’s sign with its business name, posted hours of operation, complete inventory in stock, and facility. NSC also expects site inspectors to obtain copies of relevant documents, such as state licenses, comprehensive liability insurance, contracts with companies for inventory, and contracts for the service and maintenance of DME.

Enrollment, Disenrollment, and Appeals

As long as suppliers can demonstrate that they comply with the standards and have not been excluded from participating in any federal health care program, NSC must enroll or reenroll them in Medicare. Enrolled suppliers are issued a Medicare billing number. If NSC discovers that a new applicant or enrolled supplier is not in compliance with any of the 21 supplier standards, NSC can deny the application or, with CMS’s approval, revoke the supplier’s billing number.

Suppliers whose applications have been denied or whose numbers have been revoked can submit a plan to NSC to correct the noncompliance or appeal the denial or revocation by requesting a hearing or both. If a supplier requests a hearing, the first level of appeal is conducted by a carrier hearing officer who was not involved in the original determination. The supplier can submit new information to address the compliance problems identified by NSC. If dissatisfied with the carrier hearing officer’s ruling, either NSC or the supplier can request a review by an administrative law judge, which became the second level of appeal as of December 8, 2004. Prior to that date, second level appeal hearings were conducted by a CMS review official. At both levels of the hearing process, if the supplier can demonstrate that it is currently in compliance with the standards, the supplier will be given a billing number.

Other NSC Efforts to Verify Suppliers’ Compliance with Medicare’s Standards

NSC’s Supplier Audit and Compliance Unit (SACU) also has responsibility to help verify suppliers’ compliance with the 21 standards and identify fraudulent activity. The SACU supervises NSC’s site inspectors and oversees the OSI on-site inspections. It also analyzes supplier billing and enrollment patterns. Based on billing or other irregularities, the SACU can help NSC identify suppliers for additional on-site inspections. For example, the SACU might discover that several new suppliers are owned by the same individuals as other companies that are under investigation for fraudulent billing. Based on this information, the SACU could target the new suppliers for additional on-site inspections or refer the suppliers for investigation by federal law enforcement, such as the OIG and the Federal Bureau of Investigation (FBI).

NSC’s Efforts Are Insufficient to Verify Suppliers’ Compliance with the 21 Standards

NSC’s verification procedures have weaknesses that leave the Medicare program without assurance that suppliers billing the program are meeting the 21 standards, and thus, are qualified and legitimate. NSC’s procedures to verify state licenses have gaps that have allowed suppliers to be paid for DMEPOS items they are not licensed to supply in their states. In part, this is because CMS has not set requirements for a stronger licensure verification effort. Further, although on-site inspections play a key role in verifying suppliers’ compliance with the 21 standards, we estimate that NSC did not conduct more than 600 required on-site inspections and its inspection procedures have limitations.

NSC’s Procedures to Verify State Licenses Have Gaps

NSC does not have an effective means of identifying suppliers that violate the standard to have appropriate state licensure for the items they provide to beneficiaries. This is partly because CMS’s requirements are inadequate to assure an effective process and partly because NSC does not have effective procedures that are consistently followed. To determine whether it needs to verify a supplier’s license, NSC relies on the information the supplier provides—in enrollment or reenrollment applications—regarding the items or services the supplier intends to provide to Medicare beneficiaries. Suppliers are required to certify on their applications that they will notify CMS of any changes to the information they provided on the form. However, if the supplier fills out the application incorrectly or dishonestly and does not provide a license during an on-site inspection, NSC would not verify whether the supplier has all the licenses needed in its state. We also found that NSC did not consistently resolve discrepancies or omissions in the information provided by suppliers— such as not forwarding a copy of a needed state license–-before issuing suppliers billing numbers. Further, even though suppliers may change the items they supply, CMS’s contract requires NSC to verify licensure only during enrollment and does not require verification at any later time, such as during reenrollment. Thus, even if a supplier begins to bill for items that require a state license and discloses this information during reenrollment, CMS does not require NSC to check the supplier’s state licenses. Further, CMS does not require NSC to recheck suppliers prior to reenrollment to ensure that the supplier’s license has not lapsed. Finally, CMS has not required NSC to verify licensure after enrollment by routinely comparing a supplier’s actual billing history against the DMEPOS items and services originally disclosed on the supplier’s application. Without such a check, CMS lacks assurance that suppliers are billing only for items they disclosed to NSC and for which NSC has verified a license.

As a result of these gaps, Medicare paid suppliers when NSC had not verified their licenses, including some suppliers that lacked the appropriate license. As table 1 shows, by analyzing 2004 DMEPOS claims data, we found 121 suppliers in Florida, Louisiana, and Texas that were each paid at least $1,000 by Medicare for oxygen services, even though they should not have billed for them. These suppliers either had not informed NSC that they would be billing for oxygen, did not provide NSC with the appropriate state license to verify, or both. Therefore, these suppliers were not in compliance with the 21 standards. In total, these suppliers were paid almost $6 million by Medicare. When we checked with the three states, we found that 22 of these suppliers did not have a license to provide oxygen in their states in 2004. These unlicensed suppliers were paid $231,730 in 2004 by Medicare for oxygen on behalf of beneficiaries. In addition, we verified licensure with the respective states for a sample of the suppliers that had disclosed to NSC their intention to bill for oxygen and had been paid at least $1,000 by Medicare for this service. Through this process, we identified 7 more suppliers that did not have the required state license to provide oxygen services in 2004.

Similarly, in 2003 and 2004, Medicare paid prosthetics and custom- fabricated orthotics claims submitted by suppliers that did not both disclose to NSC that they would supply these items and provide a copy of their licenses. Thus, they should not have been allowed to bill Medicare for these items. We found 28 suppliers in Illinois and Texas that were paid a total of about $197,000 in 2004 for prosthetics and custom-fabricated orthotics even though they should not have been billing for these items.

Routinely comparing suppliers’ billing to the information they report on the enrollment or reenrollment application regarding the items and services they intend to provide might have avoided some of the improper prosthetics and orthotics payments that occurred in Florida. In this state, Medicare payments for prosthetics and custom-fabricated orthotics inexplicably tripled in 1 year—from about $32.5 million in 2003 to almost $107.0 million in 2004. As figure 1 shows, most of the increase was in payments to suppliers that did not disclose to NSC that they intended to provide these items. In 2004, the 73 suppliers that did not disclose the intention to provide prosthetics or orthotics were paid more than $56.3 million. These 73 suppliers were paid more than the amount paid to the 262 suppliers that had informed NSC that they would provide these items. The DME regional carrier has established about $16.3 million as overpaid to 70 of the 73 suppliers, but has collected less than $2.3 million plus interest payments of $60,820, as of April 21, 2005. Investigative staff at the Region C DME regional carrier informed us that at least 46 of the 73 suppliers are currently under active investigation for health care fraud.

When NSC reviewed each case we identified of suppliers that billed for oxygen or prosthetics and custom-fabricated orthotics without disclosing the intention to do so, its analysis revealed several types of problems with its processing of suppliers’ applications. For example, in Florida, for one case that we identified, the supplier had not correctly filled out the application to disclose the intention of providing prosthetics and custom- fabricated orthotics but had given NSC a copy of its state license. In two cases, the supplier disclosed the intention of providing prosthetics and custom-fabricated orthotics, but did not give NSC a copy of its state license to review. Despite the discrepancies in the information provided by suppliers, NSC enrolled or reenrolled these suppliers. In three cases, the supplier disclosed the intention to provide prosthetics and custom- fabricated orthotics and gave NSC a copy of its license, but NSC staff did not update their information appropriately in the supplier database.

During this engagement, we discussed with CMS NSC’s weaknesses in verifying suppliers’ licenses. CMS officials acknowledged that the law requires CMS to restrict Medicare payment of prosthetics and certain custom-fabricated orthotics to those supplied by a qualified practitioner and fabricated by a qualified practitioner or supplier. The law defines qualified practitioners as a physician; an orthotist or a prosthetist who is licensed, certified, or has credentials and qualifications approved by the Secretary of Health and Human Services; or a qualified physical therapist or occupational therapist. The law defines qualified suppliers as entities accredited by the American Board of Certification in Orthotics and Prosthetics, Inc., the Board for Orthotist/Prosthetist Certification, or a program approved by the Secretary of Health and Human Services. CMS is in the process of developing proposed regulations that would further define qualified practitioners and suppliers of prosthetics and certain custom-fabricated orthotics on a national level. As an interim step, as of October 3, 2005, CMS will be requiring its DME regional carriers to put edits in their payment systems to deny claims for prosthetics and certain custom-fabricated orthotics submitted by any suppliers that are not qualified, or do not have qualified practitioners on staff, in the states that currently require licensure or certification. CMS indicated that these two actions should help address the problem of unlicensed suppliers billing for prosthetics and custom-fabricated orthotics. However, if NSC does not resolve discrepancies in the information provided by suppliers to have an accurate supplier database, the DME regional carriers will not have accurate information for approving or denying prosthetics and certain custom-fabricated orthotics claims. Further, the agency has not restricted payments for any other items that require state licensure—such as oxygen. Nor has it taken action to prevent payments to suppliers that have violated the standard for accurate disclosure of application information by billing for items they have not disclosed to NSC—whether or not a license is required in their states to provide these items.

CMS has recently added another requirement for verifying licensure and other certifications. During this evaluation, we pointed out to CMS staff that the agency’s contract with NSC was not specific about whether a license close to its expiration date when submitted to NSC should be rechecked to ensure the supplier had renewed it. CMS was developing a new statement of work for NSC and as a result of our discussion, the new statement of work requires NSC to follow up to ensure renewal of licenses, insurance policies, and certifications submitted within 60 days of expiration.

NSC Has Not Conducted All of the Routine On-site Inspections Required to Verify Standards

NSC has not conducted the routine on-site inspections to verify supplier standards for all the DMEPOS suppliers that CMS requires it to inspect. We estimate that 605 enrolled suppliers that NSC was required to inspect never received an on-site inspection. We also estimate that NSC conducted on-site inspections for another 3,079 suppliers, but did not properly record the date of these inspections in its supplier database. As a result, the database–-with inaccurate or missing information—is not a reliable management tool for CMS to use in overseeing NSC’s activities.

NSC may not have conducted all of the required on-site inspections because of its procedures for determining which suppliers to inspect. According to NSC’s written procedures, NSC staff use discretion to decide if an on-site inspection should be conducted prior to the enrollment or reenrollment of a supplier. In contrast, while CMS’s contract with NSC exempts certain types of suppliers from routine on-site inspection, it does not state that NSC should use its discretion to choose whether to inspect the nonexempt suppliers. CMS staff informed us that NSC is required to inspect suppliers on initial enrollment and reenrollment, with some exceptions, and they were unaware that NSC was not conducting all of the required on-site inspections.

Furthermore, because CMS’s statements of work in its fiscal year 2004 and 2005 contracts with NSC were not clear about what constitutes a supplier chain, NSC was not inspecting other suppliers that could be eligible for on- site inspections. NSC did not have to inspect supplier chains with 25 or more locations. However, the contract did not clearly state whether all 25 locations in the chain have to have active billing numbers. As a result, NSC was exempting some suppliers in chains that currently have fewer than 25 locations with active billing numbers. We found 484 active suppliers included in chains with 24 or fewer locations with active billing numbers as of May 31, 2004. Of these 484 active suppliers, 257 did not have any on- site inspections recorded. For example, NSC indicated to us that no on-site inspection was needed for Responsive Home Health Care, because it was included in a chain with 50 locations. However, it was part of a chain with 24 active locations, one location whose billing number had been revoked, and 25 inactive locations. We recently informed CMS that its contract language on chain suppliers was not clear, because CMS was developing a new statement of work for the next NSC contract. As a result, CMS revised its contract language for fiscal year 2006 to clarify that a chain consisted of 25 or more active supplier locations.

NSC’s Procedures for Conducting On-site Inspections May Limit Their Effectiveness in Verifying Compliance with Standards

Even if NSC had conducted all of its on-site inspections, the contractor’s procedures for conducting them limit their effectiveness as a means of verifying compliance with the supplier standards in several ways. Thus, the procedures cannot assure suppliers’ legitimacy and qualifications to serve beneficiaries. First, NSC does not explicitly require its site inspectors to review a specific number of suppliers’ beneficiary files during their inspections. NSC told us that inspectors reviewed beneficiary files, but OSI told us that its inspectors were not required to review the contents of any beneficiary files.

Without reviewing beneficiary files, it is unclear how inspectors can verify suppliers’ compliance with the standard that requires suppliers to maintain several forms of documentation—including proof of delivery and evidence of their efforts to educate beneficiaries on how to use the equipment. Further, reviewing beneficiary files is also helpful to provide support beyond a written supplier policy that other standards are being met. For example, a record of equipment maintenance is better proof that the supplier repairs equipment than a written policy alone. Reviewing beneficiary files can also enable an inspector to identify potentially fraudulent patterns of behavior and fabrications designed to cover up lack of compliance with the 21 standards. For example, NSC investigators told us that when many beneficiaries using one supplier have the same physician’s signature on certificates that are required by Medicare to affirm the medical necessity of certain DMEPOS items, this can be a sign of fraudulent certifications designed to falsify compliance with Medicare’s rules. The Region C DME regional carrier is currently investigating a group of suppliers using the same set of physicians on their certificates.

Second, NSC does not routinely provide its site inspectors with the dollar amounts and specific DMEPOS items a supplier billed to Medicare. Knowing a supplier’s billing history would enable inspectors to determine whether the supplier’s submitted claims coincide with its inventory, invoices, delivery tickets, and other documentation in beneficiary files. When we accompanied NSC inspectors to the physical facilities of several suppliers about which NSC had suspicions—based on the suppliers’ billing patterns or their association with other companies under investigation— the site inspectors did not have data on the billing histories for the suppliers being inspected. As a result, the inspectors did not know what types and amounts of inventory, delivery tickets, or invoices they should expect to find.

Third, neither CMS nor NSC explicitly requires the site inspectors to verify a supplier’s inventory when it is stored at, or purchased from, another location. The inventory standard does not preclude a supplier from storing inventory off site or relying on another supplier—even a competitor—to provide its inventory. However, when this occurs, without taking additional verification steps, NSC would not know whether the off-site inventory exists or whether the source of inventory is legitimate. According to the inventory standard, suppliers cannot contract with companies that are currently excluded from the Medicare program, any state health programs, or from any other federal procurement or nonprocurement programs. However, without investigating the companies that are cited as sources of inventory, NSC would not know if this standard was being met. NSC’s procedures suggest, but do not require, its site inspectors to verify off-site inventory locations. Because CMS does not require NSC to conduct verification of off-site inventory or an assessment of the company cited as the source of inventory, the current procedures do not fully verify the inventory standard.

Inspecting off-site inventory or assessing the validity of inventory contracts can help pinpoint violations of the standard for inventory and can also identify potentially fraudulent activities. For instance, when NSC inspected an address of a company that a supplier gave as its source for inventory, it discovered an auto body shop at that address. In another instance, NSC found a vacant building at the address given as a supplier’s inventory source. These suppliers violated the standards for disclosing accurate information to NSC and for having inventory or a contract to procure it. Further, citing a nonexistent source of inventory suggests the possibility that these suppliers were engaging in fraud. Similarly, groups of suppliers under investigation for fraud in Houston in 2003 and 2004 were using the same company as their fictitious source of inventory. SACU investigators were able to identify other suppliers participating in the same fraud scheme because the suppliers claimed they were obtaining inventory from a source that was under investigation.

Through examining sources of inventory, our investigators identified companies with questionable financial transactions or owners involved with suppliers engaged in potentially fraudulent billing. For example, we identified and investigated one distribution company in Florida that six suppliers had cited as one of their main sources of inventory. CMS had denied or revoked the billing numbers for the six suppliers, in part because they did not appear to have inventory, but five of them were able to obtain or regain their billing numbers after providing contracts for inventory from this distribution company. Our investigators found that the distribution company’s bank had filed 27 separate reports identifying cash withdrawals from company accounts in amounts ranging from $10,000 to more than $98,000 over a period of 20 months—almost $1 million in total. Such cash withdrawals are suspicious because they can indicate attempts to disguise illicit funds and make them more difficult to track. Even more suspicious, our investigators found that this distribution company did not appear to be an active business. Through on-site inspections conducted in March 2005, we found that two of the addresses given for it were vacant office/storage units and one was a custom woodworking shop. In June 2005, we investigated a fourth possible address for the company. This address had been leased by an individual who identified himself in leasing paperwork as being associated with a “Medical Equipment” business and was found to be a storage unit littered with debris and a pile of boxes, many of which were crushed and broken. The investigators saw no posted signs or activities that would indicate an active business. In addition, of the five suppliers currently reenrolled in Medicare that cited this source of inventory, three were under investigation in March 2005 by the Region C DME regional carrier’s fraud control unit.

NSC Is Not Required by Contract to Conduct a Minimum Number of Out- of-cycle On-site Inspections

Out-of-cycle on-site inspections have been effective in identifying suppliers that are not complying with Medicare’s standards. For example, during the April 2004 hearing before the Senate Committee on Finance on the Medicare power wheelchair benefit, the attendees watched a video of law enforcement surveillance that showed individuals bringing office equipment and DMEPOS items into an office suite in order to appear to meet the standards for having an appropriate physical facility and inventory to pass an on-site inspection. Because the timing of enrollment and reenrollment inspections are predictable, a supplier intent on committing fraud can anticipate an enrollment on-site inspection and create the illusion of legitimacy, fully understanding that an inspector is not likely to return for 3 years. Out-of-cycle on-site inspections can be so valuable that we previously recommended that CMS direct NSC to routinely conduct them for suppliers suspected of billing improperly. CMS agreed with the recommendation and pointed out the number of out- of-cycle inspections that were being completed. In 2003, NSC conducted over 600 out-of-cycle inspections and found 306 DMEPOS suppliers not complying with Medicare’s standards. NSC continued this practice in fiscal year 2004, conducting over 400 out-of-cycle on-site inspections targeted specifically at high-volume suppliers that were not part of chains. CMS has also requested NSC to conduct out-of-cycle on-site inspections in fiscal year 2005. Nevertheless, NSC’s contract does not explicitly require it to conduct out-of-cycle on-site inspections.

Although NSC has conducted out-of-cycle on-site inspections in the last several years, without becoming an explicit part of its contract, this activity could be curtailed at any time. We discussed our concerns about this with CMS staff writing the revised statement of work for a new contract that is scheduled to be awarded in December 2005. As a result, CMS included language in the revised statement of work that will explicitly require the contractor for NSC to conduct random, out-of-cycle on-site inspections as resources permit. However, the change in the statement of work does not require NSC to conduct a minimum number of out-of-cycle on-site inspections as a routine part of its activities.

Medicare’s Standards Are Too Weak to be Used Effectively to Screen DMEPOS Suppliers

Medicare’s standards are currently too weak to be used effectively for screening DMEPOS suppliers that want to enroll in the program. The 21 standards focus on certain operational characteristics. However, they do not include standards related to supplier integrity and capability analogous to those that federal agencies generally apply to prospective contractors or those used by at least two state Medicaid programs for their suppliers. For example, federal agencies do not have to contract with companies that have demonstrated poor performance in the past. In contrast, CMS has reenrolled suppliers whose billing numbers have been revoked, after they have demonstrated compliance with the standards—no matter how many standards they had previously violated. We found cases of suppliers that had billed improperly and violated standards, reentered the program, and then began to bill improperly for other items. CMS is currently developing more specific guidance for applying some of its 21 standards. In addition, to implement provisions in the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA), CMS is introducing a competitive bidding process for DME, off-the-shelf orthotics, and supplies, and is developing quality standards that would supplement the existing ones. When implemented, these steps could help ensure that DMEPOS suppliers are legitimate businesses and qualified to bill Medicare.

Medicare’s Standards Lack Assessment of Integrity and Capability Like Those for Federal Contractors and Some State Medicaid Suppliers

Although a federal agency primarily pays for items provided by DMEPOS suppliers, these businesses are not held to standards analogous to those that apply to companies that seek to contract with the federal government. Under federal procurement regulations, agencies are generally required to determine whether a potential contractor is “responsible”—that is, whether it has a satisfactory record of performance, integrity, and business ethics, as well as the financial, technical, and managerial ability to provide the specified products and services. Federal agencies can consider a contractor’s past performance as an indicator of future performance and require a disclosure of financial and management information to make their assessment. In addition, after a contract is awarded, federal agencies can terminate the contract for default or convenience. Further, for committing certain crimes or not meeting certain federal requirements, a company may be debarred from receiving federal contracts, generally for up to 3 years.

Some state governments have requirements to ensure that Medicaid suppliers are responsible. For example, California’s Medicaid program requires DME suppliers to have the administrative and fiscal foundation to survive as a business, demonstrated by financial records, such as a business plan, bank statements, and contractual agreements. California state officials told us that a DME supplier in their state could not meet the definition of being an established business for the Medicaid program if it sold power wheelchairs out of a residence, as some Medicare DME suppliers have done. Similarly, Florida’s Medicaid program requires suppliers to provide evidence of being a viable, ongoing business. Florida also requires anyone with 5 percent or greater ownership, and the manager of the supplier, to be fingerprinted and undergo a criminal background investigation, because the state will not enroll suppliers with owners convicted of several types of crimes, such as health care fraud or patient abuse.

In contrast, suppliers are not CMS contractors, and CMS’s standards do not require suppliers to demonstrate that they are responsible based on their financial, technical, and managerial ability, their integrity, and their past performance. As a result, suppliers that are not legitimate DMEPOS businesses have enrolled in Medicare and have been paid millions of dollars in improper payments without having to demonstrate that they have the ability and integrity to serve beneficiaries, as the following examples show.

For example, in sworn testimony before the Senate Committee on Finance in April 2004, a witness who pleaded guilty to fraud explained her part in a $25 million fraud scheme that she and a group of 19 others committed against the Medicare program. She explained how she was able to set up a sham company—Mercury Medical Supplies—with $3,000 and obtain a Medicare billing number, even though she had no prior experience, expertise, or discernable resources for providing DMEPOS items or services. From September 2000 to December 2001, when its billing number was revoked, Medicare paid Mercury Medical Supplies $1,158,482 for providing DMEPOS items that were falsely billed based on forged physicians’ prescriptions and were generally not supplied to beneficiaries. While the Medicare program paid Mercury Medical Supplies over $1 million but did not inquire into its financial ability to supply DMEPOS items, one federal agency refused to award a $230,000 contract to a company with $32,500 in working capital, in part because the agency’s contracting officer did not think that the company was financially strong enough to fulfill the contractual obligations.

Like Mercury Medical Supplies, All-Divine Health Services in Lufkin, Texas was not a legitimate DMEPOS business, but managed to enroll in Medicare in December 2002. NSC’s inspector noted on an initial site inspection report that the owner explained that she was awaiting inventory, which was why she had none in her storage area prior to enrollment in the Medicare program. Once enrolled, All-Divine Health Services began to bill for power wheelchairs, an item for which Medicare pays over $5,000. However, because of concerns about inappropriate power wheelchair billing, NSC conducted out-of-cycle on-site inspections of All-Divine and other power wheelchair suppliers in the area. The site inspector found evidence of potential fraud, such as altered certificates from physicians attesting to the beneficiaries’ medical need for the items to be supplied, as well as violations of Medicare’s standards. Following the out-of-cycle inspection, CMS found that All-Divine was in violation of four standards, because it lacked comprehensive liability insurance, lacked a state license to provide bedding, did not have adequate contracts for inventory, and did not have adequate provision to repair and service DME. All-Divine’s billing number was revoked effective August 6, 2003. After the owner pleaded guilty to conspiracy to commit health care fraud on June 25, 2004, her lawyer testified that All-Divine’s owner had not understood the intricacies of proper Medicare billing and had no experience managing a DMEPOS company. The owner told her lawyer that she did not think she was committing a crime, although she admitted purchasing paperwork certifying beneficiaries as needing power wheelchairs and then submitting claims on their behalf. Her lawyer also testified that the owner stated that her firm lacked the operational controls to ensure that beneficiaries actually received the power wheelchairs for which the company billed and was paid by Medicare. Before its billing number was revoked, All-Divine was paid over $1.8 million by the program, predominantly for power wheelchairs not provided as billed.

Medicare Suppliers Do Not Face the Same Penalties for Not Meeting Federal Requirements as Contractors and Medicaid Suppliers

While federal agencies, including CMS, may choose not to conduct business with companies that lack integrity or perform poorly, and may disqualify companies from competing for federal contracts, suppliers that have failed to comply with Medicare’s standards have not lost their billing privileges for any substantial length of time. Federal agencies can terminate contracts at their convenience or for default—which is when a contractor fails to perform the contract. For certain serious violations, contractors can be debarred from receiving any federal contract, generally for up to 3 years. Willful failure to perform the terms of a government contract is a basis for debarment. In addition, apart from debarment, agencies can refuse to offer new contracts to companies exhibiting previous performance problems or a lack of integrity in the past. This may occur after conviction for criminal charges, but sometimes the refusals follow allegations of wrongdoing. For example, one agency refused to offer a new contract to a company that had allegedly provided false certifications in the past. Another agency used the results of criminal investigative reports as a basis for refusing to offer contracts to companies.

Compared with Medicare, the Medicaid programs of California and Florida put more barriers to reenrollment of problematic suppliers into Medicaid. For example, California provisionally enrolls new Medicaid providers for 12 to 18 months. During this period, if the provider fails to meet state requirements, the state agency disenrolls the provider from Medicaid. In addition, if a provider fails to accurately disclose information, such as the ownership of the company, California can disenroll the provider from Medicaid and keep it from reenrolling for 3 years. The California Medicaid program denies applications from providers under investigation for criminal offenses. Florida will not reenroll suppliers that have been excluded from the program. When NSC identifies suppliers that violate Medicare’s standards, CMS may revoke their billing privileges. However, in contrast to California and Florida Medicaid, if a supplier can demonstrate compliance with the 21 standards, CMS readmits it into Medicare unless it has been otherwise excluded from participating in the program.

DMEPOS suppliers that have their billing privileges revoked and then later reenter Medicare are not uncommon. We identified 1,038 DMEPOS suppliers that lost their billing privileges in 2003, generally for violating multiple standards. Of these suppliers, 192 were reenrolled in Medicare as of May 31, 2004, with the average period of suspension lasting about 3 months. None of these suppliers encountered any barrier to enrollment for violating the standards. Further, when some suppliers that had billed improperly because they were unlicensed reentered the program, they resumed improper billing for different types of items. See table 2 for two examples.

CMS’s Efforts to Strengthen the Supplier Standards and Other Recent Steps May Partially Address Identified Weaknesses

According to NSC and CMS officials, strengthening the supplier standards by increasing their specificity is an important step in preventing enrollment of suppliers that are intent on committing fraud. NSC and CMS officials agreed that the inventory and physical facility standards are not specific enough. These standards do not specify the characteristics of an inventory, or the amount, type, or source of inventory that should be required for the items or services the supplier intends to provide to Medicare beneficiaries. According to these officials, the lack of specificity in the standards has allowed suppliers that were not legitimate companies to acquire Medicare billing numbers and then defraud the program. NSC and OIG officials investigating enrolled suppliers with potentially fraudulent billing reported that many had physical facilities not conducive to conducting a legitimate DMEPOS business. For example, these investigators have found multiple suppliers located in close proximity in small suites in the same building. In addition, they found suppliers in buildings that were not located where beneficiaries were likely to come and purchase DMEPOS items. The investigators also reported finding DMEPOS suppliers operating out of their houses and garages. These suppliers had few DMEPOS items in stock, but claimed that they had contracts for acquiring inventory. These documents sometimes lacked the usual elements of a contract, such as the clear signature of authorized individuals from both companies and the time period for the contract. Nevertheless, these suppliers met the current standards.

In early 2004, based on NSC proposals, CMS drafted new guidance on the current supplier standards to make them more specific. For example, CMS added more details to describe what constituted a reasonable amount of inventory, the elements of an acceptable contract for inventory, and an appropriate physical facility from which to provide items and services to Medicare beneficiaries. As of June 2005, CMS had not issued the new guidance. According to an agency official, some of the revisions have been incorporated into a proposed regulation under review within the agency. The official told us that CMS plans to issue other changes through revisions of Medicare guidance manuals, once the proposed regulation had been issued.

In addition to the new guidance, provisions of the MMA that require CMS to develop quality standards for DMEPOS suppliers and competitive bidding, when implemented, could enhance the agency’s ability to screen suppliers. The MMA requires CMS to develop quality standards for all DMEPOS suppliers and to select one or more independent accreditation organizations that will apply these standards to determine if suppliers are meeting them. CMS has not finished its development of the quality standards, so it is not clear whether the standards will incorporate requirements for suppliers to demonstrate that they have the integrity and capability to perform their functions analogous to the standards for federal contractors. In addition, the MMA requires CMS to establish competitive bidding among suppliers for DME, supplies, off-the-shelf orthotics, and enteral nutrients and related equipment and supplies in at least 10 of the largest metropolitan areas by 2007 and in 80 of these areas by 2009. The MMA will require suppliers chosen by competitive bidding to comply with the quality standards that are being developed for all DMEPOS suppliers as well as new financial standards to be specified by the Secretary. However, competitive bidding will be limited to certain DMEPOS items and localities, so not all Medicare DMEPOS suppliers will be held to the new financial standards. CMS anticipates issuing a proposed rule in the fall of 2005 on DME competitive bidding and on quality standards and accreditation and a final rule in 2006.

CMS’s Oversight Is Insufficient to Determine Whether NSC Screens and Monitors Suppliers Effectively

CMS’s oversight has not been sufficient to determine whether NSC is meeting its responsibilities in screening, enrolling, and monitoring DMEPOS suppliers. CMS was unaware—until we informed the agency— that NSC had not conducted all required on-site inspections of suppliers. Furthermore, CMS did not know that, in contrast to its requirements, NSC’s procedures allow its staff to use discretion in selecting which suppliers received on-site inspections. In addition, CMS did not recognize gaps in NSC’s verification of suppliers’ state licenses and as a result, Medicare paid suppliers whose licenses the contractor did not verify.

During our review, we found weaknesses in the methods CMS uses to oversee its contractor that could lead to the agency not recognizing problems in the verification process. CMS evaluates NSC’s performance primarily through an annual inspection. During this inspection, CMS analyzes a small random sample of supplier files to determine, for instance, whether NSC is conducting on-site inspections, processing enrollment applications, and handling appeals of denied or revoked billing privileges in accordance with its requirements. The analysis of NSC’s supplier files is CMS’s most direct means of assessing NSC’s efforts to screen and enroll suppliers; however, we determined that CMS’s past practice of basing NSC’s performance on a sample selected from a single quarter of the year may not be adequate. NSC’s performance might differ during the quarters in which it was not reviewed. CMS also recognized problems with basing its review on a single quarter, and in October 2004 began to institute quarterly reviews of a sample of supplier files. However, if any problems are uncovered, the sample sizes examined by CMS are too small to be used as a means of oversight, relative to the number of application files processed and other type of files reviewed. During fiscal year 2004, NSC processed more than 58,000 supplier applications for enrollment or reenrollment. To evaluate NSC’s efforts to enroll suppliers during its fiscal year 2004 inspection, CMS examined a sample of 10 approved supplier applications, as well as 10 denied and 10 returned applications. To evaluate NSC’s efforts to reenroll suppliers, CMS examined a sample of 20 approved reenrollments. If CMS uncovered any problems, it would need to select a much larger sample to determine if the problems were systemic, a step that is not indicated in the evaluation protocol.

CMS’s evaluation of NSC’s performance is focused primarily on whether the suppliers’ applications are filled out and processed correctly—not whether NSC has conducted the required verification tasks thoroughly. For example, while NSC may have a supplier site inspection form with the boxes checked to indicate that a supplier is complying with various standards—such as the one to maintain documentation of delivery of items to beneficiaries—CMS cannot know from reviewing the form if the inspector checking that supplier actually examined any beneficiary files.

CMS also oversees NSC through reviewing monthly reports from NSC, but this does not provide information on the thoroughness of NSC’s screening and enrollment efforts. Instead, CMS reviews the monthly reports to monitor NSC’s workload—including the number of enrollment and reenrollment applications received, pending, approved, and returned; the timeliness in processing applications; the number of denials and revocations; and the timeliness with which NSC handles inquiries from suppliers. This monitoring is important to ensure that NSC is managing its workload, but does not inform CMS as to how well NSC performs these activities.

Finally, while CMS has established performance goals in NSC’s contract related primarily to processing supplier applications and managing other aspects of NSC’s workload—such as handling inquiries—it has not established performance goals connected to effectiveness of the screening or fraud prevention efforts. CMS uses both the annual inspection and the monthly reports to measure NSC’s performance against goals established in its contract. These goals are linked to timeliness in processing suppliers’ applications, appeals, and inquiries. For example, according to its contract, NSC must process 90 percent of all applications and reenrollments accurately within 60 calendar days of receipt and 99 percent of applications within 120 calendar days of receipt, process 90 percent of appeals accurately within 60 calendar days of answer 85 percent of supplier telephone calls within the first 60 seconds.

These performance measures do not indicate the success of NSC or its SACU in identifying noncompliant and fraudulent suppliers. Further, CMS’s contract requires NSC to maintain a SACU, but the contract does not establish outcomes expected from this unit. Similarly, in its annual inspection, CMS does not evaluate the SACU’s efforts—whether, for instance, the SACU has adequately educated suppliers, adequately supervised the quality of on-site inspections, or analyzed supplier enrollment and billing data so that NSC can identify suppliers for additional inspections.

Conclusions

CMS is responsible for assuring that Medicare beneficiaries have access to the equipment, supplies, and services they need, and at the same time, for protecting the program from abusive billing and fraud. The supplier standards and NSC’s gatekeeping activities were intended to provide assurance that potential suppliers are qualified and would comply with Medicare’s rules. However, there is overwhelming evidence—in the form of criminal convictions, revocations, and recoveries—that the supplier enrollment processes and the standards are not strong enough to thoroughly protect the program from fraudulent entities.

We believe that CMS must focus on strengthening the standards and overseeing the supplier enrollment process. It needs to better focus on ways to scrutinize suppliers to ensure that they are responsible businesses, analogous to federal standards for evaluating potential contractors. CMS’s current effort to develop additional guidance on the standards and the development of quality standards for DMEPOS suppliers provide an opportunity for the agency to establish stronger requirements for potential and enrolled suppliers. Developing more rigorous quality standards that include an assessment of suppliers’ performance, integrity, and financial, managerial, and technical ability would help ensure that only qualified companies became suppliers. Suppliers whose previous performance was poor or that demonstrated a lack of integrity should not be allowed to quickly reenter the program. CMS also needs to provide more specific requirements in NSC’s contract so that the program’s policies will be consistently carried out. Finally, we believe that CMS has not adequately evaluated NSC’s activities to ensure that it is meeting all of its responsibilities and using all of the tools available to identify, and address, problem suppliers.

Matter for Congressional Consideration

The Congress should consider whether suppliers that have violated standards should have to wait a specified period of time from the date of revocation to have a billing number reissued.

Recommendations

To improve the supplier enrollment process and oversight of NSC, we recommend that the Administrator of CMS take eight actions—five related to NSC’s efforts to verify DMEPOS suppliers’ compliance with the 21 standards, one related to the supplier standards, and two related to the agency’s oversight of NSC. We recommend that CMS: Starting in states where licensure is mandatory, require NSC to routinely check suppliers’ billing for oxygen, prosthetics, orthotics, and any other items requiring licensure, against the items the suppliers declared they are providing on applications. Where suppliers are billing for services not declared, take appropriate action to revoke the billing numbers of suppliers not complying with program requirements.

Require NSC to provide information from suppliers’ billing histories to inspectors before they conduct on-site inspections to help them collect information to assess whether suppliers’ inventory or contracts to obtain inventory are congruent with the suppliers’ Medicare payments.

When suppliers report having inventory that is primarily maintained off site or supplied through another company, require NSC to evaluate the legitimacy of the supply location or source and any related contracts.

As part of the on-site inspections, require inspectors to review, and provide information to NSC analysts on the contents of, a minimum number of patient files to determine supplier adherence to standards for maintaining documentation of services and information provided to beneficiaries.

Oversee NSC’s activities to ensure that it conducts on-site inspections of suppliers as required by CMS and maintains accurate data on the on-site inspections it conducts.

Establish a minimum number of out-of-cycle on-site inspections in its contract that NSC must perform each year.

Develop standards that incorporate requirements for suppliers to demonstrate that they have the integrity and capability to perform their functions analogous to the standards for federal contractors.

Revise current evaluation procedures to fully assess the outcomes expected from the SACU’s activities and NSC’s adherence to contract requirements.

Agency Comments

In its written comments on a draft of this report, CMS generally concurred with our eight recommendations and cited actions it is taking to implement each recommendation. It also affirmed its commitment to protect beneficiaries and Medicare from fraud, waste, and abuse by ensuring that NSC only enrolled qualified suppliers and enforced the supplier standards.

CMS agreed with our five recommendations related to improving NSC’s efforts to verify DMEPOS suppliers’ compliance with the 21 standards. In response to four of these recommendations, CMS stated that it has revised the statement of work for fiscal year 2006 to require NSC to: check suppliers’ licenses and liability insurance each year, rather than every 3 years at reenrollment, and compare suppliers’ billing histories to the licenses they provide at that time; provide on-site inspectors with the billing histories of DMEPOS suppliers conduct site inspections of suppliers’ off-site inventory storage locations and of businesses that provide them with inventory through contracts; and conduct out-of-cycle inspections, the number of which CMS will manage based on NSC’s workload and budgetary constraints.

In addition to the completed revisions, to address the other recommendation related to NSC’s efforts to verify suppliers’ compliance with the 21 standards, CMS indicated that it intends to further revise the statement of work to require site inspectors to review a minimum number of beneficiary files maintained by suppliers.

CMS also agreed with our recommendation to develop standards for suppliers to ensure they have the integrity and capability to perform their functions analogous to the standards for federal contractors. In its response to that recommendation, CMS indicated that the quality standards the agency is developing for suppliers will improve its ability to deter health care fraud and abuse. The agency stated that it will publish a proposed rule to implement the standards in the fall of 2005 and expects to issue a final rule in 2006.

Finally, to address the two recommendations on improving its oversight, CMS stated that it intends to more closely review NSC’s activities to ensure that the contractor conducts on-site inspections as required and maintains accurate data on these inspections. CMS also noted that it had expanded its oversight and evaluation procedures during fiscal year 2005 to include quarterly reviews of NSC and SACU enrollment functions. CMS’s written comments on a draft of this report are included in appendix III. CMS also provided technical comments, which we included as appropriate.

As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its issue date. At that time, we will send copies of this report to the Administrator of CMS, appropriate congressional committees, and other interested parties. We will also make copies available to others upon request. This report is also available at no charge on GAO’s Web site at http://www.gao.gov.

If you or your staff have any questions about this report, please contact me at (312) 220-7600 or aronovitzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV.

Appendix I: Objectives, Scope, and Methodology

To evaluate the National Supplier Clearinghouse’s (NSC) efforts to verify suppliers’ compliance with the 21 standards, we conducted interviews, document reviews, field inspections, investigations, and data analysis. We interviewed the Centers for Medicare & Medicaid Services (CMS) officials that oversee NSC and NSC staff, assessed CMS’s contract statement of work for enrollment screening, and reviewed NSC’s written procedures to gain a better understanding of the procedures used. Through that assessment, we determined that its procedures to check licensure and conduct on-site inspections of suppliers were critical to verifying compliance with the standards and we focused our evaluation on these procedures. To better understand the on-site inspection process, we accompanied NSC officials as they conducted on-site inspections of 12 suppliers in Maryland during August 9 and 10, 2004. In addition, to test the effectiveness of the licensure verification, we analyzed Medicare durable medical equipment, orthotics, prosthetics, and supplies (DMEPOS) claims data for 2003 and 2004 from Florida, Illinois, Louisiana, and Texas and NSC’s active supplier data file to determine whether suppliers had the licenses necessary for items billed. We also tested whether all required on- site inspections had been conducted through an analysis of NSC’s active supplier data file and inspection procedures. To assess the reliability of the 2003 and 2004 claims from CMS and NSC’s supplier data files, we performed electronic testing of required data elements, reviewed existing information about the data and the systems that produced them, and interviewed CMS and NSC officials knowledgeable about the data. We determined that these data were sufficiently reliable for the purposes of this report. We also contacted Florida, Texas, and Louisiana to determine which of the suppliers that had not disclosed to NSC that they would be providing oxygen and were paid at least $1,000 for oxygen claims in 2004 actually had the needed state licenses. In addition, we also checked with these states to determine whether a small sample of suppliers that had disclosed the intention to bill for oxygen, and were paid at least $1,000 for oxygen claims in 2004, had the needed state licenses. For custom- fabricated orthotics and prosthetics, we were not able to confirm whether the suppliers that had not disclosed to NSC that they would be providing these items and were paid at least $1,000 for such claims in 2004 in Florida, Illinois, and Texas had the proper state licenses, because those states license individuals to be allowed to supply these items, not companies. To evaluate procedures for on-site inspections, we analyzed on-site inspection instructions and the standards and interviewed on-site inspectors and officials in NSC and Overland Solutions, Inc. We investigated two companies cited as sources of inventory by two groups of Florida and Texas suppliers that had their billing privileges denied or revoked, in part because of inventory issues, and also investigated those suppliers.

To evaluate the adequacy of the 21 supplier standards, we compared them to the requirements for government contractors and those imposed by the California and Florida Medicaid program on suppliers. In addition, we analyzed cases of revocations that had been appealed to CMS in 2004 to determine if weaknesses in the standards were leading to suppliers with questionable billing practices being reinstated in the program. We also obtained documentation on cases of suppliers that had defrauded Medicare and interviewed fraud inspectors at NSC and in the Department of Health and Human Services Office of Inspector General to develop insight into the problems that they saw with the 21 standards. We also interviewed NSC and CMS officials and individuals from the following organizations: the American Association for Homecare, the American Orthotic and Prosthetic Association, Hoveround, National Association for Home Care and Hospice, Power Mobility Coalition, and a representative from the National Supplier Clearinghouse’s Advisory Council.

To evaluate CMS’s oversight of NSC, we considered the information we had gathered to answer the previous questions. We reviewed CMS’s written procedures used to evaluate NSC and other documents related to CMS’s oversight. We also discussed CMS’s oversight with CMS and NSC officials.

Our work was conducted from June 2004 to September 2005 in accordance with generally accepted government auditing standards.

Appendix II: Medicare’s 21 Standards for Suppliers and NSC’s Procedures to Verify Their Compliance

Suppliers of durable medical equipment (DME), prosthetics, orthotics, and supplies must meet 21 standards in order to obtain and retain their Medicare billing privileges. The NSC is responsible for screening suppliers to ensure that they meet the standards. An abbreviated summary of the most recent version of these standards, which became effective December 11, 2000, is presented in table 3. The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 requires CMS to develop quality standards that must be at least as stringent as current standards for all Medicare suppliers of DME, prosthetics, orthotics, and supplies. Supplier compliance with the quality standards will be determined by one or more designated independent accreditation organizations.

Appendix III: Agency Comments

Appendix IV: GAO Contact and Staff Acknowledgments

GAO Contact

Acknowledgments

In addition to the contact named above, Sheila K. Avruch, Assistant Director; Kevin Dietz; Cynthia Forbes; Krister Friday; Christine Hodakievic; Daniel Lee; Lisa Rogers; John Ryan; and Craig Winslow made key contributions to this report.

Related GAO Products

Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004.

Medicare: Past Experience Can Guide Future Competitive Bidding for Medical Equipment and Supplies. GAO-04-765. Washington, D.C.: September 7, 2004.

Medicare: CMS Did Not Control Rising Power Wheelchair Spending. GAO-04-716T. Washington, D.C.: April 28, 2004.

Medicare: HCFA to Strengthen Medicare Provider Enrollment Significantly, but Implementation Behind Schedule. GAO-01-114R. Washington, D.C.: November 2, 2000.