CMS has made progress strengthening provider enrollment procedures and prepayment controls in the Medicare program to help ensure that payments are made correctly the first time, but the agency could further improve upon its efforts by implementing additional enrollment procedures and prepayment strategies. Likewise, additional improvements to CMS's postpayment claims review activities could improve their efficiency and effectiveness. CMS has implemented certain provider enrollment screening procedures authorized by the Patient Protection and Affordable Care Act (PPACA) and put in place other measures intended to strengthen existing procedures. The changes to provider screening procedures are intended to address past weaknesses identified by GAO and the HHS's Office of Inspector General (OIG) that allowed entities intent on committing fraud to enroll in Medicare. Blocking the enrollment of such providers helps to prevent Medicare from making improper payments. Specifically, CMS added screenings of categories of provider enrollment applications by risk level and contracted with new national enrollment screening and site visit contractors. Screening Provider Enrollment Applications by Risk Level: CMS and the OIG issued a final rule in February 2011 to implement many of the new screening procedures required by PPACA. CMS designated three levels of risk--high, moderate, and limited--with different screening procedures for categories of Medicare providers at each level. Providers in the high-risk level are subject to the most rigorous screening. Based in part on our work and that of the OIG, CMS designated newly enrolling home health agencies and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) as high risk, and designated other providers as lower risk. Providers at all risk levels are screened to verify that they meet specific requirements established by Medicare, such as having current licenses or accreditation and valid Social Security numbers. High- and moderate-risk providers are also subject to unannounced site visits. Further, PPACA authorizes CMS to require fingerprint-based criminal background checks of providers and suppliers depending on the risks presented. In March 2014, CMS awarded a contract to a Federal Bureau of Investigation-approved contractor that will enable the agency to access criminal history information to help conduct those checks of high-risk providers and suppliers. CMS has indicated that the agency will continue to review the criteria for its screening levels and will publish changes if the agency decides to update the assignment of screening levels for categories of Medicare providers. Doing so could become important because the Department of Justice and HHS reported multiple convictions, judgments, settlements, or exclusions against types of providers not currently at the high-risk level, including community mental health centers and ambulance providers. National Enrollment Screening and Site Visit Contractors: CMS contracted with two new contractors at the end of 2011 to assume centralized responsibility for two functions that had been the responsibility of multiple contractors. One of the new contractors is conducting automated screenings to check that existing and newly enrolling providers and suppliers have valid licensure, accreditation, and a National Provider Identifier, and are not on the OIG list of providers and suppliers excluded from participating in federal health care programs. The second contractor conducts site visits of providers to determine whether sites are legitimate and the providers meet certain Medicare standards. A CMS official reported that, since the implementation of the PPACA screening requirements, the agency had revoked over 17,000 suspect providers' privileges to bill the Medicare program. Although CMS has taken actions to strengthen the provider enrollment process, we and the OIG have found that CMS has not taken other actions authorized by PPACA and that could improve screening and ultimately reduce improper payments. They include issuing a rule to require surety bonds for certain providers and suppliers as well as a rule on provider and supplier disclosure requirements. Surety Bonds: PPACA authorized CMS to require a surety bond for Surety bonds may certain types of at-risk providers and suppliers. serve as a source for recoupment of erroneous payments. DMEPOS suppliers are currently required to post a surety bond at the time of enrollment. CMS told us in April 2014 that the agency collected about $1.6 million in DMEPOS supplier overpayments between February 2012 and March 2013. However, also in April 2014, CMS reported that it had not scheduled for publication a proposed rule to impose a surety bond requirement as authorized by PPACA for other types of at-risk providers and suppliers--such as home health agencies and independent diagnostic testing facilities. Providers and Suppliers Disclosure: CMS has not yet scheduled the publication of a proposed rule for increased disclosures of prior actions taken against providers and suppliers enrolling or revalidating enrollment in Medicare, such as whether the provider or supplier has been subject to a payment suspension from a federal health care program. As we reported in April 2012, agency officials indicated that developing the additional disclosure requirements has been complicated by provider and supplier concerns about what types of information will be collected, what CMS will do with it, and how the privacy and security of this information will be maintained. We are currently examining the ability of CMS's provider enrollment system to prevent and detect the continued enrollment of ineligible or potentially fraudulent providers in Medicare. Specifically, we are assessing the process used to enroll and verify the eligibility of Medicare providers in Medicare's Provider Enrollment, Chain, and Ownership System (PECOS) and the extent to which CMS's controls are designed to prevent and detect the continued enrollment of ineligible or potentially fraudulent providers in PECOS. CMS has enhanced its efforts to reduce improper payments by improving prepayment controls, particularly prepayment edits to deny claims that should not be paid. CMS has stated that one of its key goals is to pay claims properly the first time--that is, to ensure that payments go to legitimate providers in the right amount for reasonable and necessary services covered by the program for eligible beneficiaries. To do so, among other things, CMS uses prepayment controls such as prepayment edits--instructions that CMS's contractors, including Medicare Administrative Contractors (MAC), program into claims processing systems that compare claim information to Medicare requirements in order to approve or deny claims or to flag them for additional review. For example, some prepayment edits are related to service coverage and payment, while others are implemented to verify that the claim is properly filled out, that providers are enrolled in Medicare, or that patients are eligible Medicare beneficiaries.and its contractors are automated and applied to all claims; if a claim does not meet the criteria of the edits, it is automatically denied. Other prepayment edits are manual; they flag a claim for individual review by trained staff to determine whether it should be paid. Most of the edits implemented by CMS We previously evaluated CMS's implementation of prepayment edits and found that while use of prepayment edits saved Medicare at least $1.76 billion in fiscal year 2010, the savings could have been greater had prepayment edits been used more widely. For example, based on our analysis of a limited number of national policies and local coverage determinations in 2012, we identified $14.7 million and $100 million in payments, respectively, that were inconsistent with policies and determinations and were therefore improper. Such inconsistencies could have been identified using automated edits. As we recommended, CMS has taken steps to improve the development of certain prepayment edits that are implemented nationwide. For example, the agency has centralized the development and implementation of automated edits based on a type of national policy called national coverage determinations. In addition, CMS has modified its processes for identifying provider billing of services that are medically unlikely, in order to prevent circumvention of automated edits designed to identify an unusually large quantity of services provided to the same patient. However, as of April 2014, CMS had not fully implemented several of the recommendations we made in 2013 that we believe would promote greater use of prepayment edits and better ensure proper payment. For example, the agency did not include, in its written guidance to agency staff on procedures for ensuring consideration of automated edits, time frames for making decisions on whether an edit would be developed nor did it include requirements for assessing the effects of corrective actions taken. In addition, although CMS has taken initial steps to improve the data it collects about local prepayment edits implemented by its contractors, it had not yet determined a final process for how it would obtain and disseminate information about these edits across contractors. Nor does CMS require contractors to share information with each other about the underlying policies and savings related to their most effective edits, as the agency currently lacks a database to collect such information. Having information about the most effective local edits would enable contractors to determine the most appropriate approach for implementing Medicare payment policy effectively, which could help reduce improper payments. To help prevent improper payments, CMS also implemented a specific type of national edit, called a Medical Unlikely Edit (MUE), which limits the amount of a service that is paid when billed by a provider for a beneficiary on the same day. The limits for certain services that have been fraudulently or abusively billed are unpublished to deter providers from billing up to the maximum allowable limit. In 2013, we reported that CMS may be missing opportunities to prevent improper payments because it has not systematically evaluated MUE limits to determine whether In national edits should be revised to reflect more restrictive local limits.addition, we found that CMS and its contractors did not have a system in place for examining claims to determine the extent to which providers may be exceeding unpublished MUE limits and whether payments for such services were proper. As a result, we recommended that CMS examine contractor edits to determine whether any national unpublished MUE limits should be revised, consider reviewing claims to identify providers that exceed the unpublished MUE limits, and determine whether the provider's billing was proper. HHS agreed with these recommendations, but as of April 2014, CMS had not implemented them. Medicare uses four types of contractors to conduct postpayment claims reviews to identify and recoup overpayments.the same Medicare coverage and payment guidelines. MACs, in addition to conducting prepayment claims reviews, conduct postpayment claims reviews to help ensure accurate payment and specifically to identify payment errors. This includes identifying ways to address future payment errors--for example, through automated controls that can be added on a prepayment basis and by educating providers with a history of a sustained or high level of billing errors to ensure that they comply with Medicare billing requirements. Zone Program Integrity Contractors (ZPIC), the CMS contractors responsible for detecting and investigating fraud, perform postpayment claims reviews as a part of their investigations. Therefore, ZPIC reviews generally focus on providers whose billing patterns are unusual or aberrant in relation to those of similar providers in order to identify potential fraud. The Comprehensive Error Rate Testing (CERT) contractor estimates the Medicare FFS improper payment rate by using the results of postpayment claims reviews conducted on a sample of claims processed by the MACs. CERT reviews may also help identify program vulnerabilities by measuring the payment accuracy of each MAC, and the Medicare FFS improper payment rate by type of claim and service. Recovery audit contractors (RAC) conduct postpayment claims reviews to identify improper payments. Use of RACs was designed to be in addition to MACs' existing claims review processes, since the number of postpayment reviews conducted by MACs and other contractors was small relative to the number of claims paid and the amount of improper payments. Whereas RACs are paid on a contingency fee basis based on the amount of improper payments they recoup, the other three contractors are paid under the terms of their contract using appropriated funds. In February 2014, CMS announced a "pause" in the RAC program as the agency makes changes to the program and starts a new procurement process for the next round of recovery audit contracts. CMS said it anticipates awarding all five of these new Medicare FFS recovery audit contracts by the end of summer 2014. All four types of contractors conduct complex reviews of claims. Complex reviews involve manual examinations of each claim and any related documentation requested and received from the provider, including paper files, to determine whether the service was billed properly, and was covered, reasonable, and necessary. Licensed clinical professionals, such as licensed practical nurses, and certified coders typically perform the reviews. Contractors have physician medical directors on staff who provide guidance about making payment determinations on the basis of medical records and other documentation and who may discuss such determinations with providers. In addition to conducting complex reviews, RACs also conduct automated and semiautomated postpayment claims reviews. Automated reviews use computer programming logic to check claims for evidence of improper coding or other mistakes. Automated postpayment reviews analyze paid claims and identify those that can be determined to be improper without examining any additional documentation, such as when a durable medical equipment supplier bills for items that should have been included as part Semiautomated of a bundled payment for a skilled nursing facility stay.reviews use computer programming logic to check for possible improper payments, but allow providers to send in information to rebut the claim denial before it is implemented. If providers send in information, RAC staff review it before making a final determination. Our prior work has found that the overall number of postpayment claims reviews has been increasing in recent years, but remains a very small percentage of total Medicare claims submitted. year for which we have data, the four types of Medicare postpayment review contractors conducted about 2.3 million claims reviews, which is a 55 percent increase from 2011. RACs conducted about 2.1 million, or 90 percent, of these reviews in 2012. All four types of contractors listed except the CERT contractor increased the number of claims they reviewed in 2012, as shown in table 1. GAO, Medicare Program Integrity: Increasing Consistency of Contractor Requirements May Improve Administrative Efficiency. GAO-13-522 (Washington, D.C.: July 23, 2013). Reviews completed by MACs do not include the reviews performed by the three legacy contractors that were continuing to provide claims administration services as of June 2013. RAC data are reported for fiscal years 2011 and 2012, rather than calendar year. Automated reviews use computer programming logic to check claims for evidence of improper coding or other mistakes. Only the RACs conducted automated postpayment reviews. RAC complex reviews are based on the number of additional documentation requests received and also include semiautomated reviews. While the number of postpayment reviews has increased significantly, the percentage of Medicare claims reviewed after payment remains small. The 2.3 million reviews performed by these four types of contractors accounted for less than 1 percent of the more than 1 billion FFS claims paid annually. About 1.4 million of the reviews were complex reviews which required the submission of documentation for review. As a systematic matter, the increase in postpayment claims reviews is one factor causing backlogs and delays at the third level of the Medicare appeals process. Medicare providers and suppliers can appeal prepayment and postpayment claims determinations through the Medicare appeals process, which offers four levels of administrative review followed by judicial review. The first two levels of appeals for FFS claims are managed by two CMS contractors--the MAC that processed the original claim and a Qualified Independent Contractor, in that order. The third level of appeal is to an Administrative Law Judge (ALJ) at the Office of Medicare Hearings and Appeals (OMHA), a separate staff division within HHS. A Part A or Part B appeal filed with OMHA should generally be decided within 90 days of the appeal being filed. However, due to a backlog of cases, OMHA currently reports that the average time for appeals to be decided in fiscal year 2014 is 346 days. The number of appeals filed at the ALJ level increased from 59,601 in fiscal year 2011 to 384,651 in fiscal year 2013, according to OMHA. OMHA's website currently says that new appeals will take about 28 months before they are put on an ALJ's hearing docket. OMHA has reported that part of the reason for the backlog in Medicare appeals is the increase in postpayment contractor activities. We have been asked to examine the Medicare appeals process, including the reasons for the appeals backlog and what HHS is doing to address it. We have made recommendations to CMS in the past to improve the postpayment claims review process, and we continue to do work in this area. In October 2012, we reported on CMS's Fraud Prevention System (FPS), which uses predictive analytics to analyze Medicare FFS claims. FPS is intended to detect aberrant billing practices as quickly as possible so they can be investigated to determine whether the payments are proper. At the time, we recommended that CMS integrate FPS with Medicare's payment-processing system to allow for the prevention of payments until suspect claims could be investigated by ZPICs. Although CMS reported in April 2014 that it had integrated the systems, the system still does not have the ability to suspend payment until suspect claims can be investigated. CMS has begun to implement prepayment edits in FPS that automatically deny claims based on attributes of the FPS edit which reviews the claim against historical claims across all lines of business. In July 2013, we reported that the differences in CMS's postpayment claims review requirements for the four types of contractors may reduce the efficiency and effectiveness of claims reviews by complicating providers' compliance with the requirements. For instance, while RACs have to obtain approval from CMS for the billing issues they choose to review on a widespread basis and notify providers and suppliers of those issues on their websites, the other contractors do not. In addition, the minimum number of days that CMS requires a contractor to give a provider to submit additional documentation for a complex review before the claim can be found improper for lack of documentation varies among the contractors from 30 days for ZPICs to 75 days for the CERT contractor. Staffing requirements and quality assurance requirements also vary among the four types of contractors. We recommended that CMS examine all postpayment review requirements for contractors to determine whether they could be made more consistent without negative effects on program integrity. We also recommended that CMS reduce differences in those requirements where it can be done without impeding the efficiency of its efforts to reduce improper payments. In commenting on that report, CMS agreed with our recommendations and stated that the agency was beginning to review its requirements for postpayment claims reviews. We are following up on this work with a study reviewing, among other things, whether CMS has strategies for coordinating postpayment review contractors' claims review activities. In conclusion, given the amount of estimated improper payments in the Medicare program, the imperative for CMS to use all available authorities to prevent and recoup improper payments is clear. Although CMS has taken important steps to strengthen key strategies for identifying and preventing improper payments, the agency must continue to improve upon these efforts. Identifying the nature, extent, and underlying causes of improper payments and developing adequate corrective action processes to address vulnerabilities are essential prerequisites to reducing them. As CMS continues its implementation of PPACA, additional evaluation and oversight will help determine whether implementation of relevant provisions has been effective in reducing improper payments. We are continuing to conduct a body of work that assesses CMS's efforts to refine and improve its ability to prevent, identify, and recoup improper payments. Notably, we are currently assessing the extent to which CMS's information system can help prevent and detect the continued enrollment of ineligible or potentially fraudulent providers in Medicare. Additionally, we are examining CMS's oversight of some of the contractors that conduct postpayment reviews of claims including whether CMS has a strategy for coordinating these contractors' claims review activities. Separately, we have also been asked to examine the Medicare appeals process, including the reasons for the appeals backlog and how it is being addressed. Through this work, we hope to develop further recommendations for CMS to help the agency continue to refine its efforts to reduce improper Medicare payments. Chairman Lankford, Ranking Member Speier, and Members of the Subcommittee, this concludes my prepared remarks. I would be pleased to respond to any questions you may have at this time. For further information about this statement, please contact Kathleen M. King at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Lori Achman, Assistant Director; Rebecca Abela; Jennel Lockley; and Jennifer Whitworth were key contributors to this statement. Medicare Fraud: Progress Made, but More Action Needed to Address Medicare Fraud, Waste, and Abuse. GAO-14-560T. Washington, D.C.: April 30, 2014. Medicare Program Integrity: Contractors Reported Generating Savings, but CMS Could Improve Its Oversight. GAO-14-111. Washington, D.C.: October 25, 2013. Health Care Fraud and Abuse Control Program: Indicators Provide Information on Program Accomplishments, but Assessing Program Effectiveness Is Difficult. GAO-13-746. Washington, D.C.: September 30, 2013. Medicare Program Integrity: Increasing Consistency of Contractor Requirements May Improve Administrative Efficiency. GAO-13-522. Washington, D.C.: July 23, 2013. Medicare Program Integrity: Few Payments in 2011 Exceeded Limits under One Kind of Prepayment Control, but Reassessing Limits Could Be Helpful. GAO-13-430. Washington, D.C.: May 9, 2013. Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012. Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment. GAO-13-102. Washington, D.C.: November 13, 2012. Health Care Fraud: Types of Providers Involved in Medicare, Medicaid, and the Children's Health Insurance Program Cases. GAO-12-820. Washington, D.C.: September 7, 2012. Program Integrity: Further Action Needed to Address Vulnerabilities in Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.: June 7, 2012. Medicare: Important Steps Have Been Taken, but More Could Be Done to Deter Fraud. GAO-12-671T. Washington, D.C.: April 24, 2012. Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of Providers and Suppliers. GAO-12-351. Washington, D.C.: April 10, 2012. Improper Payments: Remaining Challenges and Strategies for Governmentwide Reduction Efforts. GAO-12-573T. Washington, D.C.: March 28, 2012. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Expand Efforts to Support Program Integrity Initiatives. GAO-12-292T. Washington, D.C.: December 7, 2011. Medicare Integrity Program: CMS Used Increased Funding for New Activities but Could Improve Measurement of Program Effectiveness. GAO-11-592. Washington, D.C.: July 29, 2011. Improper Payments: Reported Medicare Estimates and Key Remediation Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011. Fraud Detection Systems: Additional Actions Needed to Support Program Integrity Efforts at Centers for Medicare and Medicaid Services. GAO-11-822T. Washington, D.C.: July 12, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Improper Payments: Progress Made but Challenges Remain in Estimating and Reducing Improper Payments. GAO-09-628T. Washington, D.C.: April 22, 2009. Medicare: Thousands of Medicare Providers Abuse the Federal Tax System. GAO-08-618. Washington, D.C.: June 13, 2008. Improper Payments: Status of Agencies' Efforts to Address Improper Payment and Recovery Auditing Requirements. GAO-08-438T. Washington, D.C.: January 31, 2008. Improper Payments: Federal Executive Branch Agencies' Fiscal Year 2007 Improper Payment Estimate Reporting. GAO-08-377R. Washington, D.C.: January 23, 2008. Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies. GAO-07-59. Washington, D.C.: January 31, 2007. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary:
Due to its size, complexity, and susceptibility to mismanagement and improper payments, GAO has designated Medicare as a high-risk program. In 2013, Medicare financed health care services for approximately 51 million individuals at a cost of about $604 billion, and reported an estimated $50 billion in improper payments--payments that either were made in an incorrect amount or should not have been made at all. Most of these improper payments were made through the Medicare FFS program, which pays providers based on claims and uses contractors to pay the claims and ensure program integrity. This statement focuses on the progress made and steps still to be taken by CMS to improve improper payment prevention and recoupment efforts in the Medicare FFS program. This statement is based on relevant GAO products and recommendations issued from 2007 through 2014 using a variety of methodologies. GAO also updated information by examining public documents and, in April 2014, GAO received updated information from CMS on its actions related to laws and regulations discussed in this statement. The Centers for Medicare & Medicaid Services (CMS), the agency within the Department of Health and Human Services (HHS) that oversees Medicare, has made progress improving improper payment prevention and recoupment efforts in the Medicare fee-for-service (FFS) program, but further actions are needed. Provider enrollment . CMS has implemented certain provider enrollment screening procedures authorized by the Patient Protection and Affordable Care Act (PPACA) that address past weaknesses identified by GAO and others. The agency has also put in place other measures intended to strengthen existing procedures, but could do more to improve provider enrollment screening and ultimately reduce improper payments. For example, CMS has hired contractors to determine whether providers and suppliers have valid licenses, meet certain Medicare standards, and are at legitimate locations. CMS also recently contracted for fingerprint-based criminal history checks of providers and suppliers it has identified as high-risk. However, CMS has not implemented other screening actions authorized by PPACA that could further strengthen provider enrollment. Prepayment controls . In response to GAO's prior recommendations, CMS has taken steps to improve the development of certain prepayment edits--prepayment controls used to deny Medicare claims that should not be paid; however, important actions that could further prevent improper payments have not yet been implemented. For example, CMS has implemented an automated edit to identify services billed in medically unlikely amounts, but has not implemented a GAO recommendation to examine certain edits to determine whether they should be revised to reflect more restrictive payment limits. GAO has found that wider use of prepayment edits could help prevent improper payments and generate savings for Medicare. Postpayment claims reviews . Postpayment claims reviews help CMS identify and recoup improper payments. Medicare uses a variety of contractors to conduct such reviews, which generally involve reviewing a provider's documentation to ensure that the service was billed properly and was covered, reasonable, and necessary. GAO has found that differing requirements for the various contractors may reduce the efficiency and effectiveness of such reviews. To improve these reviews, GAO has previously recommended CMS examine ways to make the contractor requirements more consistent. CMS reported that it has begun to address these recommendations. Although the percentage of Medicare claims that undergo postpayment review remains very small, GAO has found that the overall number of postpayment claims reviews has been increasing in recent years. HHS has reported that the increase in claims reviews is one factor causing backlogs in the Medicare appeals process. GAO has ongoing work focused on how CMS could continue its efforts to reduce improper Medicare payments. For instance, GAO is examining the extent to which CMS's provider enrollment system can help prevent and detect the continued enrollment of ineligible providers in Medicare. GAO also has work underway to examine whether CMS has strategies for coordinating postpayment review contractors' claims review activities.