There are four major steps in the contract-level RADV audit process as reported by CMS: MA contract selection. CMS selects 30 MA organization contracts for contract-level RADV audits, which agency officials stated provides a sufficient representation of contracts (about 5 percent) without imposing unreasonable costs on the agency. An MA organization may have more than one contract selected for a contract-level RADV audit. CMS selects contracts based on diagnosis coding intensity, which the agency defines for each contract as the average change in the risk score component specifically associated with the reported diagnoses for the beneficiaries covered by the contract. That is, increases in coding intensity measure the extent to which the estimated medical needs of the beneficiaries in a contract increase from year to year; thus, contracts whose beneficiaries appear to be getting "sicker" at a relatively rapid rate, based on the information submitted to CMS, will have relatively high coding intensity scores. Contracts with the highest increases in coding intensity are those with beneficiaries whose reported diagnoses increased in severity at the fastest rates. CMS officials stated that the agency adopted this selection methodology to (1) focus the contract-level RADV audits on MA organization contracts that might be more likely to have submitted diagnoses that are not supported by the medical records and (2) provide additional oversight of contracts with the most aggressive coding. To be eligible for a contract-level audit, MA contracts must have had at least three pair-years of data that can be used to distinguish a change in disease risk scores from one year to the next; that is, the contract must have been in place for at least 4 years of continuous payment activity plus the audit year. For each pair year, CMS's coding intensity calculation excludes beneficiaries not enrolled in the same contract or not eligible for Medicare in consecutive years. CMS ranks contracts by coding intensity and divides them into three categories: high, medium, and low. CMS then randomly selects contracts for audit: 20 from the high category, 5 from the medium category, and 5 from the low category. According to CMS officials, this strategy ensures contracts with the highest coding intensity-- considered high risk for improper payments by CMS--have a higher probability for audit while keeping all contracts at risk for review. MA beneficiary sampling. After CMS selects 30 MA contracts to audit, the agency selects the beneficiaries whose medical records will be the focus of review. Up to 201 beneficiaries are chosen from each contract based on the individuals' risk scores using a stratified random sample: 67 beneficiaries from each of the three risk score groups (highest one-third of risk scores, the middle one-third, and the lowest third). Medical record collection and review. After selecting beneficiaries for review, CMS requests supporting medical record documentation for all diagnoses submitted to adjust risk in the payment year. The MA organization may submit up to five medical records per audited diagnosis. CMS contractors review the submitted medical records to determine if the records support the diagnoses submitted by the MA organizations. If the initial reviewer determines that a diagnosis is not supported, a second reviewer reviews the case. Payment error calculation and extrapolation. When medical record review is completed, CMS extrapolates a payment error rate to the entire contract beginning with contract-level audits of 2011 payments. Each beneficiary's payment error is multiplied by a sampling weight and the number of months the beneficiary was enrolled in the MA contract during the payment year. After these beneficiary-level payment errors are summed, the amount CMS will seek to recover will be reduced by (1) using the lower limit of a 99 percent confidence interval based on the sample and (2) reducing the recovery amount by a FFS adjuster amount that estimates payment errors that would have likely occurred in FFS claims data. Once the recovery amount is finalized, CMS releases contract-level RADV audit finding reports to each audited MA organization, which may dispute the results of medical record review or appeal the audit findings. Beginning with the contract-level RADV audits of 2011 payments, CMS will collect extrapolated overpayments from MA organizations once all appeals are final. Recovery auditors have been used in various industries, including health care, to identify and collect overpayments. The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 directed CMS to test the use of RACs to identify overpayments and underpayments through a postpayment review of FFS medical claims and recoup overpayments. The Tax Relief and Health Care Act of 2006 required CMS to implement a permanent national recovery audit contractor program by January 1, 2010 and to compensate RACs using a contingency fee structure under which the RACs are paid from recovered overpayments. The Patient Protection and Affordable Care Act expanded the recovery audit program initiated in Medicare FFS to MA plans under Part C, among other things. In future contract-level RADV audits, CMS also will review diagnoses submitted through MA encounter data. While CMS previously collected diagnoses from MA organizations, in 2012 the agency also began collecting encounter data from MA organizations similar to that submitted on FFS claims. CMS requires MA organizations to submit, via the Encounter Data System, encounter data weekly, biweekly, or monthly depending on their number of enrollees. Encounter data include diagnosis and treatment information recorded by providers for all medical services and may either originate from claims that providers submit to MA organizations for payment or from MA organizations' medical record review. CMS started including the diagnosis information from MA encounter data from 2014 dates of service when calculating 2015 enrollee risk scores. While coding intensity scores can be helpful in assessing the likelihood of improper payments for MA contracts, results from the CMS contract-level RADV audits of 2007 payments indicate that the coding intensity scores CMS calculated were not strongly correlated with the percentage of unsupported diagnoses within a contract. The fact that this correlation is not strong reduces the likelihood that contracts selected for audit would be those most likely to yield large amounts of improper payments and hampers CMS's goal of using the audits to recover improper payments. In addition, internal control standards for federal agencies state that agencies should use and communicate quality information in achieving program goals. Figure 1 shows, for example, that CMS reported that the percentage of unsupported diagnoses (36.0 percent) among the high coding intensity contracts it audited was nearly identical to the percentage of unsupported diagnoses (35.7 percent) among the medium coding intensity contracts audited. In addition, 7 contracts in the high coding intensity group had unsupported diagnosis rates below 30 percent, including the contract with the highest coding intensity score. Several shortcomings in CMS's methods for calculating coding intensity could have weakened the correlation between the degree of coding intensity and the percentage of improper payments. These shortcomings and their potential effects are as follows. CMS's coding intensity calculation may be based on noncomparable coding intensity scores across contracts because (1) the years of data used for each contract may not be the same and (2) coding intensity scores are not standardized to control for year-to-year differences. First, although CMS officials stated that the agency requires at least three pair- years of data for each contract, the agency includes data from all available years for each contract, which may vary between contracts. Because the growth in risk scores was lower in the MA program in earlier years among beneficiaries that continuously enrolled in the program, CMS's inconsistent standard of years measured for each contract would tend to calculate higher coding intensity scores for contracts that entered the MA market during periods of higher risk score growth. Among beneficiaries who enrolled in MA in consecutive years, the growth in average risk scores was 0.106 from 2004 through 2006, 0.119 from 2006 through 2010, and 0.132 from 2010 through 2013. Second, CMS officials stated that the agency does not standardize its coding intensity data relative to a measure of central tendency. Because CMS's coding intensity calculation does not account for the expected increase in risk scores during each period of growth, changes in risk scores may be more volatile from year to year than they would likely be if standardized or indexed to a measure of central tendency. CMS's coding intensity calculation does not distinguish between the diagnoses that were likely coded by providers and the diagnoses that were likely revised by MA organizations. MA organizations may receive diagnoses from providers that are related to services rendered to MA beneficiaries. Because these diagnoses are submitted by providers, the medical records they create may be more likely to support these diagnoses compared with diagnoses that are subsequently coded by the MA organization through medical record chart reviews. For future years, CMS has an available method to distinguish between diagnoses likely submitted by providers to MA organizations and diagnoses that were likely later added by MA organizations. CMS's Encounter Data System provides a way for MA organizations to designate supplemental diagnoses that the organization added or revised after conducting medical record review. CMS has not outlined plans for incorporating encounter data into its contract selection methodology, even though the encounter data could help target the submitted diagnoses that may be most likely related to improper payments in the future. CMS follows contracts that are renewed or consolidated under a different existing contract within the same MA organization; however, the agency's coding intensity calculation does not include the prior risk scores of the prior contract in the MA organization's renewed contract. This may result in overestimated improper payment risk if MA organizations move beneficiaries with higher risk scores--such as those with special needs-- into one consolidated contract. CMS's contract selection methodology did not (1) always target contracts with the highest coding intensity scores, (2) use results from prior contract-level RADV audits, (3) account for contract consolidation, and (4) account for contracts with high enrollment. These shortcomings are impediments to CMS's goal of recovering improper payments and are counter to federal internal control standards, which require that agencies use quality information to achieve their program goals. For the 2011 contract-level RADV audits, CMS used a contract selection methodology that did not focus on contracts with the highest coding intensity scores. While we found that coding intensity scores are not strongly correlated with diagnostic discrepancies, they are somewhat correlated. CMS failed to fully consider that correlation for the 2011 contract-level RADV audit. For that audit, CMS officials stated that 20 of the 30 contracts were chosen because they were among the top third of all contracts in coding intensity, but we found that many of the 20 contracts were not at the highest risk for improper payments according to CMS's estimate of coding intensity. Only 4 of the 20 contracts ranked among the highest 10 percent in coding intensity, while 8 of the 20 contracts ranked below the 75th percentile in the coding intensity distribution (see fig. 2). In addition, CMS chose 5 of the 30 contracts because they were among the bottom third of all contracts in coding intensity, even though CMS's contract-level RADV audits of 2007 payments found that all contracts in the lowest third of the agency's coding intensity calculation had a below-average percentage of unsupported diagnoses. CMS officials stated that the RADV contract selection methodology includes these contracts to show that all contracts are at risk of being audited. However, officials also stated that MA organizations are not informed of their contracts' coding intensity relative to all other MA contracts; thus, MA organizations cannot be certain their contracts will not be audited even if CMS announced it will no longer audit low coding intensity contracts. According to agency officials, CMS's 2011 contract-level RADV contract selection methodology also did not consider results from the agency's prior RADV audits, potentially overlooking information indicating contracts with known improper payment risk. Thus, contracts with the highest rates of unsupported diagnoses in the 2007 contract-level RADV audits were not among those selected for 2011 contract-level RADV audits. While CMS selected 6 contracts for 2011 that also underwent 2007 contract- level RADV audits, only 1 of these contracts was among the 10 with the highest rates of unsupported diagnoses in 2007. For the 2011 contract- level RADV audits, CMS officials stated that the agency selected 6 MA contracts because the HHS Office of Inspector General had conducted audits of 2007 payments on those contracts, but CMS did not know the rates of unsupported diagnoses for those contracts and did not determine which of them were at high risk of improper payments. By not considering results from prior contract-level RADV audits, CMS's contract selection methodology also did not account for contract consolidation. An MA organization may have more than one contract in a service area; further, it may no longer have a contract that underwent a prior RADV audit but continue to operate another contract within the same service area. For example, the contract with the highest rate of unsupported diagnoses in the 2007 contract-level RADV audit is no longer in place, but the MA organization continues to operate a different contract that includes the service area from its prior contract. Thus, without considering all of an MA organization's contracts in that service area, CMS cannot audit the beneficiaries affiliated with the highest percentage of unsupported diagnoses in 2007. Although the potential dollar amount of improper payments to MA organizations with high rates of unsupported diagnoses is likely greater when contract enrollment is large, CMS officials stated that the 2011 contract-level RADV contract selection methodology did not account for contracts with high enrollment. In 2011, the median enrollment among MA contracts was about 5,000, while enrollment at the 90th percentile was nearly 45,000. Some MA contracts with large enrollment had high rates of unsupported diagnoses under prior contract-level RADV audits. For example, 5 of the 10 MA contracts with the highest rates of unsupported diagnoses for the 2007 contract-level RADV audits had 2011 enrollment above the 90th percentile. CMS officials reported that current contract-level RADV audits have been ongoing for several years, including the appeals associated with the 2007 contract-level RADV audits. (See fig. 3.) For audits of 2007 payments, CMS notified MA organizations in November 2008 that their contracts would be audited but did not complete medical record review until approximately 4-1/2 years later in March 2013. Similarly, 2011 contract- level RADV audits had not been completed as of August 2015. CMS notified MA organizations of contract audit selection in November 2013 but did not begin medical record review for these contracts until May 2015. CMS officials said the agency will start collecting payments from the 2011 contract-level RADV audits in fiscal year 2016. As the agency is in the medical record review phase, appeals have not yet started. This slow progress in completing audits is contrary to CMS's goal to conduct contract-level RADV audits on an annual basis and slows its recovery of improper payments. In addition, CMS lacks a timetable that would help the agency to complete these contract-level audits on an annual cycle. In contrast, the national RADV audit that calculates the national improper payment estimate uses a timetable, but this is not applied to the contract-level audits. The national RADV audits that CMS annually conducts to estimate the national MA improper payment rate under IPIA provide the agency with a possible timetable for completing annual contract-level RADV audits. CMS has not followed established project management principles in this regard, which call for developing an overall plan to meet strategic goals and to complete projects in a timely manner. In addition to the lack of a timetable, other factors have lengthened the time frame of the contract-level audit process. First, CMS's sequential notification to MA organizations--first identifying which contracts had been selected for audit and then later identifying which beneficiaries under these contracts would be audited--hinders the agency's goal of conducting annual contract-level audits because it creates a time gap. For example, for the 2011 contract-level audits, CMS officials stated that the agency notified MA organizations about the beneficiaries whose diagnoses would be audited 3 months after notifying these same MA organizations about which contracts had been selected for audit. Both the selection of contracts and beneficiaries currently require risk score and beneficiary enrollment data. Second, ongoing performance issues with the web-based system CMS uses to receive medical records submitted by MA organizations for contract-level RADV audits caused CMS to substantially lengthen the time frame for MA organizations to submit these medical records for the 2011 contract-level RADV audits. According to CMS officials, for the 2007 contract-level RADV audits, MA organizations submitted medical records for 98 percent of all audited diagnoses within a 16-week time frame. However, system performance issues with the Central Data Abstraction Tool (CDAT)--CMS's web-based system for transferring and receiving contract-level RADV audit data--led CMS to more than triple the medical record submission time frame for the 2011 contract-level RADV audits to over 1 year. Officials from AHIP and the two MA organizations we interviewed indicated that CDAT often proved inoperable, with significant delays and errors in uploading files. CMS officials stated that the agency suspended the use of CDAT for 8 months and implemented steps to monitor and test CDAT's performance. CMS officials stated that they have implemented steps to continue monitoring and testing CDAT's performance. However, officials from MA organizations stated that CDAT continued to experience significant delays in uploading files after CMS reopened CDAT for use. Officials of one MA organization suspected that the system may have been overwhelmed because CMS increased the number of medical records allowed per audited diagnosis from one to five between the 2007 and 2011 contract-level audits. For future medical record submissions, CMS officials subsequently told us that they plan to use a 20-week submission period and did not indicate to us any plans for an additional medical record submission method if CDAT's problems persisted. CMS's Medicare FFS program has increasingly used the Electronic Submission of Medical Documentation System (ESMD) to transfer medical records reliably from providers to Medicare contractors since 2011. Both ESMD and CDAT allow for the electronic submission of medical records by securely uploading and submitting medical record documentation in a portable document format file. CMS officials stated that the agency did not use ESMD to transfer medical records primarily because it could not also be used for medical record review like CDAT. However, medical records could be reviewed without being transferred through CDAT. The transfer of medical records has been the main source of delay in completing CMS's contract-level audits of 2011 payments, and CMS has not assessed the feasibility of updating ESMD for transferring medical records in contract-level RADV audits. While ESMD was not available when CMS began its 2007 contract-level RADV audits, the system has demonstrated a greater capacity for transferring medical records than CDAT. In fiscal year 2014, providers used ESMD to transfer nearly 500,000 medical records--far beyond the capacity necessary for contract-level RADV audits. In interviews, officials of two FFS RACs stated that ESMD was very reliable and did not have technical issues that affected audits. In addition, CMS has not applied time limits to contract-level RADV reviewers for completing medical record reviews. These reviews took 3 years for the 2007 contract-level RADV audits. In contrast, CMS generally requires its Medicare Administrative Contractors (MAC)--a type of FFS contractor--to make postpayment audit determinations within 60 days of receiving medical record documentation. Because CMS has not required that contract-level RADV auditors complete medical record reviews within a specific time period, the agency is hindering its ability to reach its goal of conducting annual contract-level RADV audits. Disputes and appeals stemming from the 2007 contract-level RADV audit findings have been ongoing for years and the lack of time frames at the first level of the appeal process hinders CMS from achieving its goal of using contract-level audits to recoup improper payments. Nearly all MA organizations whose contracts were included in the 2007 contract-level RADV audit cycle disputed at least one diagnosis finding following medical record review, and five MA organizations disputed all the findings of unsupported diagnoses. CMS officials stated that MA organizations in total disputed 624 (4.3 percent) of the 14,388 audited diagnoses, and that the determinations on these disputes, which were submitted starting March 2013 through May 2013, were not complete until July 2014. If an MA organization disagrees with the medical record dispute determination, the MA organization may appeal to a hearing officer. This appeal level is called review by a CMS hearing officer. Because the medical record dispute process for the 2007 contract-level RADV audit cycle took nearly 1-1/2 years to complete, CMS officials stated that the agency did not receive all 2007 second-level appeal requests for hearing officer review until August 2014. CMS officials stated that the hearing officer adjudicated or received a withdrawal request from the MA organization for 377 of the 624 appeals (60 percent) from August 2014 through September 2015. Appeals for the 2011 contract-level RADV audit cycle have yet to begin, as CMS officials stated that the agency is currently in the process of reviewing medical records submitted by MA organizations for the 2011 contract-level RADV audits. CMS officials stated that the medical record dispute process for the 2011 contract-level RADV audit cycle will differ from the process used during the 2007 cycle in certain respects. In particular, for the 2011 RADV audit cycle, the medical record dispute process will be incorporated into the appeal process instead of being part of the audit process, as it was during the 2007 cycle. The new first-level appeal process, in which an MA organization can submit a written request for an independent reevaluation of the RADV audit decision, will be called the reconsideration stage. This change will allow MA organizations to request reconsideration of medical record review determinations simultaneously with the appeal of payment error calculations, rather than sequentially, as was the case during the 2007 contract-level RADV audit cycle. While such a change may be helpful, the new process does not establish time limits for when reconsideration decisions must be issued. In contrast, CMS generally imposes a 60-day time limit on MA organization decisions regarding beneficiary payment first-level appeals in MA. CMS measures the timeliness of decisions regarding MA beneficiary first-level appeals to assist the agency in assigning quality performance ratings and bonus payments to MA organizations. Similarly in Medicare FFS, officials generally must issue decisions within 60 days of receiving first-level appeal requests. CMS officials stated that due to the agency's limited experience with the contract-level RADV audit process, time limits were not imposed at the reconsideration appeal level and that this issue may be revisited once CMS completes a full contract-level RADV audit cycle. The lack of explicit time frames for appeal decisions at the reconsideration level hinders CMS's collection of improper payments as the agency cannot recover extrapolated overpayments until the MA organization exhausts all levels of appeal and is inconsistent with established project management principles. CMS has not expanded the RAC program to MA, as it was required to do by the end of 2010 by the Patient Protection and Affordable Care Act. CMS issued a request for industry comment regarding implementation of the MA RAC on December 27, 2010, seeking stakeholder input regarding potential ways improper payments could be identified in MA using RACs. CMS reported that it had received all stakeholder comments from this request by late February 2011. CMS issued a request for proposals for the MA RAC in July 2014. As defined by the Statement of Work in that request, the MA RAC would audit improper payments in the audit areas of Medicare secondary payer, end-stage renal disease, and hospice. In October 2014, CMS officials told us that the agency did not receive any proposals to conduct the work in those three audit areas and that CMS's goal was to reissue the MA RAC solicitation in 2015. In November 2015, CMS officials told us that the agency is no longer considering Medicare secondary payer, end-stage renal disease, and hospice services as audit areas for the MA RAC. Instead, the officials told us that CMS was exploring whether and how an MA RAC could assist CMS with contract-level RADV audits. In December 2015, CMS issued a request for information seeking industry comment regarding how an MA RAC could be incorporated into CMS's existing contract-level RADV audit framework. In the request document, CMS stated that it is seeking an MA RAC to help the agency expand the number of MA contracts subject to audit each year. In the request, CMS stated that its ultimate goal is to have all MA contracts subject to either a contract-level RADV audit or what it termed a condition-specific RADV audit for each payment year. Officials we interviewed from three of the current Medicare FFS RACs all acknowledged that their organizations had the capacity and willingness to conduct contract-level RADV audits. Despite its recent request for information, CMS does not have specific plans or a timetable for including RACs in the contract-level RADV audit process. Established project management principles call for developing an overall plan and monitoring framework to meet strategic goals. A plan and timetable would help guide CMS's efforts in incorporating a RAC in MA and help hold the agency accountable for implementing this requirement from the Patient Protection and Affordable Care Act. Once the requirement is implemented, CMS could leverage the MA RAC in order to increase the number of MA organization contracts audited. CMS's recovery of improper payments has been restricted because it has not established an MA RAC. For example, CMS currently plans to include 30 MA contracts in contract-level RADV audits for each payment year, about 5 percent of all contracts. Limitations in CMS's processes for selecting contracts for audit, in the timeliness of CMS's audit and appeal processes, and in the agency's plans for using MA RACs to assist in identifying improper payments hinder the accomplishment of its contract-level RADV audit goals: to conduct annual contract-level audits and recover improper payments. These limitations are also inconsistent with federal internal control standards and established project management principles. Our analyses of these processes and plans suggest that CMS will likely recover a small portion of the billions of dollars in MA improper payments that occur every year. Shortcomings in CMS's MA contract selection methodology may result in audits that are not focused on the contracts most likely to be disproportionately responsible for improper payments. Furthermore, CMS's RADV time frames are so long that they may hamper the agency's efforts to conduct audits annually, collect extrapolated payments efficiently, and use audit results to inform future RADV contract selection. By CMS's own estimates, conducting annual contract-level audits would potentially allow CMS to recover hundreds of millions of dollars more in improper payments each year. Agency officials have expressed concerns about the intensive agency resources required to conduct contract-level RADV audits. To address the resource requirements of conducting contract-level audits, CMS intends to leverage the MA RACs for this purpose; however, the agency has not outlined how it plans to incorporate RACs into the contract-level RADV audits and is in the early stages of soliciting industry comment regarding how to do so. As CMS continues to implement and refine the contract-level RADV audit process, we recommend that the Administrator of CMS take actions in the following five key areas to improve the efficiency and effectiveness of reducing and recovering improper payments. First, to improve the accuracy of CMS's calculation of coding intensity, the Administrator should modify that calculation by taking actions such as the following: including only the three most recent pair-years of risk score data for all contracts; standardizing the changes in disease risk scores to account for the expected increase in risk scores for all MA contracts; developing a method of accounting for diagnostic errors not coded by providers, such as requiring that diagnoses added by MA organizations be flagged as supplemental diagnoses in the agency's Encounter Data System to separately calculate coding intensity scores related only to diagnoses that were added through MA organizations' supplemental record review (that is, were not coded by providers); and including MA beneficiaries enrolled in contracts that were renewed from a different contract under the same MA organization during the pair-year period. Second, the Administrator should modify CMS's selection of contracts for contract-level RADV audits to focus on those contracts most likely to have high rates of improper payments by taking actions such as the following: excluding contracts with low coding intensity scores; selecting more contracts with the highest coding intensity scores; selecting contracts with high rates of unsupported diagnoses in prior contract-level RADV audits; if a contract with a high rate of unsupported diagnoses is no longer in operation, selecting a contract under the same MA organization that includes the service area of the prior contract; and selecting some contracts with high enrollment that also have either high rates of unsupported diagnoses in prior contract-level RADV audits or high coding intensity scores. Third, the Administrator should enhance the timeliness of CMS's contract- level RADV process by taking actions such as the following: closely aligning the time frames in CMS's contract-level RADV audits with those of the national RADV audits the agency uses to estimate the MA improper payment rate; reducing the time between notifying MA organizations of contract audit selection and notifying them about the beneficiaries and diagnoses that will be audited; improving the reliability and performance of the agency's process for transferring medical records from MA organizations, including assessing the feasibility of updating ESMD for use in transferring medical records in contract-level RADV audits; and requiring that CMS contract-level RADV auditors complete their medical record reviews within a specific number of days comparable to other medical record review time frames in the Medicare program. Fourth, the Administrator should improve the timeliness of CMS's contract-level RADV appeal process by requiring that reconsideration decisions be rendered within a specified number of days comparable to other medical record review and first-level appeal time frames in the Medicare program. Fifth, the Administrator should ensure that CMS develops specific plans and a timetable for incorporating a RAC in the MA program as mandated by the Patient Protection and Affordable Care Act. We provided a draft of this report to HHS for comment. HHS provided written comments, which are printed in appendix I. HHS concurred with our recommendations. In its comment letter, HHS also reaffirmed its commitment to identifying and correcting improper payments in the MA program. HHS also provided technical comments, which we incorporated as appropriate. Based on HHS's technical comments, we revised our suggested actions for how HHS could meet GAO's first recommendation. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees and the Secretary of Health and Human Services. In addition, this report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. James Cosgrove, (202) 512-7114 or cosgrovej@gao.gov. In addition to the contact named above, individuals making key contributions to this report include Martin T. Gahart, Assistant Director; Luis Serna III; and Marisa Beatley. Elizabeth T. Morrison and Jennifer Whitworth also provided valuable assistance.

Summary:
In 2014, Medicare paid about $160 billion to MA organizations to provide health care services for approximately 16 million beneficiaries. CMS, which administers Medicare, estimates that about 9.5 percent of its payments to MA organizations were improper, according to the most recent data--primarily stemming from unsupported diagnoses submitted by MA organizations. CMS currently uses RADV audits to recover improper payments in the MA program. GAO was asked to review the extent to which CMS is addressing improper payments in the MA program. This report examines the extent to which (1) CMS's contract selection methodology for RADV audits facilitates the recovery of improper payments, (2) CMS has completed RADV audits and appeals in a timely manner, and (3) CMS has made progress toward incorporating RACs into the MA program to identify and assist with improper payment recovery. In addition to reviewing research literature and agency documents, GAO analyzed data from ongoing RADV audits of 2007 and 2011 payments--CMS's two initial contract-level RADV audits. GAO also interviewed CMS officials. Medicare Advantage (MA) organizations contract with the Centers for Medicare & Medicaid Services (CMS) to offer beneficiaries a private plan alternative to the original program and are paid a predetermined monthly amount by Medicare for each enrolled beneficiary. These payments are risk adjusted to reflect each enrolled beneficiary's health status and projected spending for Medicare-covered services. CMS conducts risk adjustment data validation (RADV) audits of MA contracts which facilitate the recovery of improper payments from MA organizations that submitted beneficiary diagnoses for payment adjustment purposes that were unsupported by medical records. With a separate national audit, CMS estimated that it improperly paid $14.1 billion in 2013 to MA organizations, primarily because of these unsupported diagnoses. GAO found that CMS's methodology does not result in the selection of contracts for audit that have the greatest potential for recovery of improper payments. First, CMS's estimate of improper payment risk for each contract, which is based on the diagnoses reported for the beneficiaries in that contract, is not strongly correlated with unsupported diagnoses. Second, CMS does not use other available information to select the contracts at the highest risk of improper payments. As a result, 4 of the 30 contracts CMS selected for its RADV audit of 2011 payments were among the 10 percent of contracts estimated by CMS to be at the highest risk for improper payments. These limitations are impediments to CMS's goal of recovering improper payments and do not align with federal internal control standards, which require that agencies use quality information to achieve their program goals. CMS's goal of eventually conducting annual RADV audits is in jeopardy because its two RADV audits to date have experienced substantial delays in identifying and recovering improper payments. RADV audits of 2007 and 2011 payments have taken multiple years and are still ongoing for several reasons. First, CMS's RADV audits rely on a system for transferring medical records from MA organizations that has often been inoperable. Second, CMS audit procedures have lacked specified time requirements for completing medical record reviews and for other steps in the RADV audit process. In addition, CMS has not established timeframes for appeal decisions at the first-level of the MA appeal process, as it has done in other contexts. CMS has not expanded the recovery audit program to MA by the end of 2010, as it was required to do by the Patient Protection and Affordable Care Act. RACs have been used in other Medicare programs to recover improper payments for a contingency fee. In December 2015, CMS issued a request for information seeking industry comment on how an MA RAC could be incorporated into the RADV audit framework. CMS noted in its request that incorporating a RAC into the RADV framework would increase the number of MA contracts audited each year. CMS currently includes 30 MA contracts in each RADV audit, about 5 percent of all MA contracts. Despite the importance of increasing the number of contracts audited, CMS does not have specific plans or a timetable for incorporating RACs into the RADV audit framework, contrary to established project management principles, which stress the importance of developing an overall plan to meet strategic goals. GAO is making five recommendations to CMS to improve its processes for selecting contracts to include in the RADV audits, enhance the timeliness of the audits, and incorporate RACs into the RADV audits. HHS concurred with the recommendations.