Medicare and Medicaid FFS are federal health care programs, though there are certain distinctions between the programs’ coverage and financing. Medicare coverage policies are generally established at the national level, and the program directly pays providers for services rendered. Medicaid is a federal-state program, and states are provided flexibility to design their coverage policies. State Medicaid agencies pay providers for services rendered, and the federal government and states share in the financing of the program, with the federal government matching most state expenditures. The Improper Payments Information Act of 2002 (IPIA), as amended, requires federal executive branch agencies to report a statistically valid estimate of the annual amount of improper payments for programs identified as susceptible to significant improper payments. To accomplish this, agencies follow guidance for estimating improper payments issued by OMB. According to the HHS-OIG, which conducts annual compliance reviews and regularly reviews the estimation methodology for both the Medicare FFS and Medicaid improper payment measurement programs, the methodology for both programs’ estimates comply with federal improper payment requirements. To estimate improper payments in Medicare and Medicaid FFS, respectively, CMS’s CERT and PERM contractors randomly sample and manually review medical record documentation associated with FFS claims for payment from providers, also known as medical reviews. The CERT and PERM programs project the improper payments identified in the sample to all FFS claims to estimate improper payment amounts and rates for the programs nationally for a given fiscal year. For Medicare, the CERT contractor conducted medical reviews on about 50,000 Medicare claims in fiscal year 2017. For Medicaid, the PERM contractor conducted medical reviews on nearly 31,000 Medicaid claims across fiscal years 2015, 2016, and 2017 to estimate fiscal year 2017 improper payments. Although IPIA, as amended, only requires agencies to develop one improper payment estimate for each identified program, both the CERT and PERM programs also estimate national service-specific improper payment amounts and rates to identify services at high risk for improper payment. Additionally, the PERM program estimates state-level improper payment rates based on the amounts of improper payments identified through medical reviews in each state. The CERT and PERM contractors conduct medical reviews to determine whether claims were paid or denied properly in accordance with program coverage policies—including coverage policies based on statutes, regulations, other CMS coverage rules, and each state’s coverage policies in the case of Medicaid. To perform medical reviews, trained clinicians review documentation—such as progress notes, plans of care, certificates of medical necessity, and physician orders for services—to ensure that claims meet program coverage policies. In general, Medicare and Medicaid documentation requirements define the documentation needed to ensure that services are medically necessary and demonstrate compliance with program coverage policies. For example, Medicare home health services must be supported by documentation demonstrating compliance with the coverage policy that beneficiaries be homebound, among other requirements. Certain coverage policies and documentation requirements were implemented to help reduce the potential for fraud, waste, and abuse. For example, Medicare implemented a requirement that DME providers maintain documentation demonstrating proof of item delivery, to better ensure program integrity. (Figure 1 presents an example of a progress note to support the medical necessity of Medicare home health services. See App. III for additional examples of provider documentation). The CERT and PERM contractors classify improper payments identified through medical review by the type of payment error. Two types of errors are related to documentation—no documentation and insufficient documentation. No documentation: Improper payments in which providers fail to submit requested documentation or respond that they do not have the requested documentation. Insufficient documentation: Improper payments in which providers submit documentation that is insufficient to determine whether a claim was proper, such as when there is insufficient documentation to determine if services were medically necessary, or when a specific, required documentation element, such as a signature, is missing. In fiscal year 2017, insufficient documentation comprised the majority of estimated FFS improper payments in both Medicare and Medicaid, with 64 percent of Medicare and 57 percent of Medicaid medical review improper payments. Improper payments stemming from insufficient documentation in Medicare FFS increased substantially starting in 2009, while insufficient documentation in Medicaid has remained relatively stable since 2011 (see Fig. 2). CMS has attributed the increase in Medicare insufficient documentation since 2009 in part to changes made in CERT review criteria. Prior to 2009, CERT medical reviewers used “clinical inference” to determine that claims were proper even when specific documentation was missing if, based on other documentation and beneficiary claim histories, the reviewers could reasonably infer that the services were provided and medically necessary. Beginning with CMS’s fiscal year 2009 CERT report, in response to 2008 HHS-OIG recommendations, CMS revised the criteria for CERT medical reviews to no longer allow clinical inference and the use of claim histories as a source of review information. More recent policy changes that added to Medicare documentation requirements may have also contributed to the increase in insufficient documentation in Medicare FFS. Medicare’s CERT and Medicaid’s PERM contractors make multiple attempts to contact providers to request medical record documentation for medical reviews, and review all documentation until they must finalize the FFS improper payment estimate. The CERT and PERM contractors allow providers 75 days to submit documentation, though providers can generally submit late documentation up to the date each program must finalize its improper payment estimate, known as the cut-off date (See Fig. 3.). Both programs also contact providers to subsequently request additional documentation if the initial documentation submitted by the providers does not meet program requirements. Initial documentation request: The CERT and PERM contractors make initial requests for documentation by sending a letter and calling the provider. After the initial provider request, if there is no response, the contractors contact the provider at least three additional times to remind them to submit the required documentation. If there is no response, the claim is determined to be improper due to no documentation. Claims are also classified as improper due to no documentation when the provider responds but cannot produce the documentation, such as providers that do not have the beneficiary’s documentation or records for the date of service, among other reasons (see Table 1). For referred services, such as home health, DME, and laboratory services, the CERT contractor also conducts outreach to referring physicians to request documentation. For example, for a laboratory claim, the CERT contractor may contact the physician who ordered the laboratory test to request associated documentation, such as progress notes. Conversely, the PERM contractor told us they generally do not contact referring physicians to request documentation. Subsequent documentation request: If a provider initially submits documentation that is insufficient to support a claim, then the CERT and PERM contractors subsequently request additional documentation. In fiscal year 2017, of the 50,000 claims in the CERT sample, the contractor requested additional documentation from 22,815 providers. Providers did not submit additional documentation to sufficiently support 56 percent of the associated claims. For the 3 years that comprise the 2017 Medicaid improper payment rate, of the nearly 31,000 claims in the PERM sample, the contractor requested additional documentation for 5,448, and providers did not submit additional documentation to sufficiently support about 8 percent of the 5,448 claims. In addition to having similar outreach to providers for obtaining documentation, the CERT and PERM contractors also have processes to refer suspected fraud to the appropriate program integrity entity, to ensure the accuracy of medical reviews, and to allow providers to dispute improper payment determinations. Suspected fraud: When CERT and PERM contractors identify claims with evidence of suspected fraud, they are required to refer the claims to other program integrity entities that are responsible for investigating suspected fraud. CERT and PERM contractor officials said that in 2017, the CERT contractor referred 35 claims, and the PERM contractor did not make any referrals. Interrater reliability (IRR) reviews: As a part of their medical review processes, both the CERT and PERM contractors conduct IRR reviews, where two reviewers conduct medical reviews on the same claim and compare their medical review determinations. These IRR reviews ensure the consistency of medical review determinations and processes for resolving differences identified through the IRR reviews. CMS staff said that they also review a sample of the CERT and PERM contractors’ payment determinations to ensure their accuracy. CERT: The contractor performs IRR reviews for at least 300 claims each month, including claims with and without improper payment determinations. PERM: The contractor conducts IRR reviews of all improper payment determinations, except improper payments due to no documentation, and 10 percent of all correctly paid claims in the sample, which combined was about 3,600 claims for the fiscal year 2017 national improper payment rate. Disputing improper payment determinations: Both CERT and PERM contractors have processes in place for disputing the CERT or PERM contractor’s improper payment determinations. These processes involve reviewing the claim, including any newly submitted documentation, and may result in upholding or overturning the initial improper payment determination. Improper payment determinations that are overturned prior to the CERT and PERM contractors’ cut-off dates are no longer considered improper, and estimated improper payment amounts and rates are adjusted appropriately. CERT: Medicare Administrative Contractors, which process and pay claims, may dispute the CERT contractor’s improper payment determinations first with the CERT contractors and then, if desired, with CMS. Additionally, Medicare providers can appeal the CERT contractor’s improper payment determinations through the Medicare appeals process. PERM: State Medicaid officials may dispute the PERM contractor’s improper payment determinations first with the PERM contractor and then, if desired, with CMS. Providers are not directly involved in this process; instead, providers can contact the state to appeal the improper payment determination. We found that Medicare, relative to Medicaid, had a higher estimated FFS improper payment rate primarily due to insufficient documentation in fiscal year 2017. According to CMS data, across all services in fiscal year 2017, the rate of insufficient documentation was 6.1 percent for Medicare and 1.3 percent in Medicaid, substantially greater than the difference in rates for all other types of errors, which were 3.4 and 1.0 percent, respectively. For home health, DME, and laboratory services, the insufficient documentation rate was at least 27 percentage points greater for Medicare than for Medicaid, and for hospice services, the rate was 9 percentage points greater (see Fig. 4). Differences between Medicare and Medicaid coverage policies and documentation requirements likely contributed to the substantial variation in the programs’ insufficient documentation rates for the services we examined. Among the services we examined, there are four notable differences in coverage policy and documentation requirements that likely affected how the programs conducted medical reviews: face-to-face examinations; prior authorization; signature requirements; and documentation from referring physicians for referred services, as discussed below. Face-to-face examinations. In part to better ensure program integrity, the Patient Protection and Affordable Care Act established a requirement for referring physicians to conduct a face-to-face examination of beneficiaries as a condition of payment for certain Medicare and Medicaid services. States were still in the process of implementing the policies for Medicaid in fiscal year 2017. include narrative information that sufficiently supported that the beneficiary had a life expectancy of less than 6 months. include the certification date span. documentation supporting that the referring physician conducted an examination when certifying the medical necessity of the service. Hospice providers must submit documentation of a face-to-face examination when recertifying the medical necessity of hospice services for beneficiaries who receive care beyond 6 months after their date of admission. (See sidebar for examples of insufficient documentation in Medicare hospice services.) CMS officials told us that documentation requirements for the face-to-face examination policy for home health services in particular led to an increase in insufficient documentation. When initially implemented in April 2011, home health providers had to submit separate documentation from the referring physician detailing the examination and the need for home health services. Beginning January 2015, CMS changed the requirement to allow home health providers to instead use documentation from the referring physician, such as progress notes, to support the examinations. CMS and several stakeholders attributed recent decreases in the home health improper payment rate to the amended documentation requirement (see Fig. 5). agency did not apply to the sampled day of care associated with the claim. health and DME services in Medicaid in 2016; however, the requirement likely did not apply to many claims subject to fiscal year 2017 PERM medical reviews. Medicaid does not have a face-to-face policy for hospice services, and most states we interviewed did not have such policies. (See sidebar for examples of insufficient documentation in Medicaid.) Prior authorization. Medicare does not have the same broad authority as state Medicaid agencies to implement prior authorization, which can be used to review documentation and verify the need for coverage prior to services being rendered. State Medicaid agencies we spoke with credit prior authorization with preventing improper payments from being paid in the first place. CMS has used prior authorization in Medicare for certain services through temporary demonstration projects and models, as well as one permanent program. In April 2018, we found that savings from a series of Medicare temporary demonstrations and models that began in 2012 could be as high as about $1.1 to $1.9 billion as of March 2017. We recommended that CMS take steps, based on its evaluations of the demonstrations, to continue prior authorization. All six of our selected states use prior authorization in Medicaid for at least one of the four services we examined. In particular, all six selected states require prior authorization for DME, and five require prior authorization for home health. Officials from several states noted that they often apply prior authorization to services at high risk for improper payments, and most told us that prior authorization screens potential improper payments before services are rendered. We did not evaluate the effectiveness of states’ use of prior authorization, or review the documentation required by states for prior authorization. (See Fig 6 for an example state Medicaid prior authorization form.) Physician signatures: While both Medicare and state Medicaid agencies require signatures on provider documents to ensure their validity, Medicare has detailed standards for what constitutes a valid signature. physician did not support the medical necessity for the specific type of catheter ordered. variety of situations. For example, illegible signatures and initials on their own are generally invalid, though they are valid when over a printed name. Examples of insufficient documentation in Medicare laboratory Documentation from the referring physician did not support the order or an intent to order the billed laboratory tests. In Medicaid, PERM contractor staff told us that state agencies generally have not set detailed standards for valid signatures, and that reviewers generally rely on their judgment to assess signature validity. Documentation from the referring physician did not support that the beneficiary’s currently has diabetes for a billed laboratory test for the management and control of diabetes. Documentation for referred services. Medicare requires documentation from referring physicians to support the medical necessity of the referred services that we examined—home health, DME, and laboratory services—but Medicaid generally does not require such documentation. Medicare generally requires documentation from the referring physician, such as progress notes, to support the medical necessity of referred services. CMS officials told us that Medicare requires such documentation from referring physicians to ensure that medical necessity determinations are independent of the financial incentive to provide the referred service, particularly as certain referred services are high risk for fraud, waste, and abuse. (See sidebar for examples of insufficient documentation in Medicare home health, DME, and laboratory services.) In Medicaid, documentation requirements to support the medical necessity of referred services are primarily established by states, and states generally do not require documentation, such as progress notes from referring physicians, to support medical necessity. Further, PERM contractor staff told us that they generally do not review such documentation when conducting medical reviews of claims for referred services. Officials from CMS, the CERT contractor, and provider associations told us that Medicare’s documentation requirements for referred services present challenges for providers of referred services to submit sufficient documentation since they are dependent on referring physician documentation to support medical necessity. Some officials further stated that referring physicians may lack incentive to ensure the sufficiency of such documentation, as they do not experience financial repercussions when payments for referred services are determined to be improper. Officials told us that: It is generally not standard administrative practice for laboratories or DME providers to obtain referring physician documentation, and referring physicians may not submit them when the referred services are subject to medical review. For example, laboratories generally render services based solely on physician orders for specific tests, and generally do not obtain associated physician medical records. Referring physicians may not document their medical records in a way that meets Medicare documentation requirements to support the medical necessity of referred services. Officials from a physician organization told us that physicians refer beneficiaries for a broad array of services, and face challenges documenting their medical records to comply with Medicare documentation requirements for various referred services. We previously reported on CMS provider education efforts and recommended that CMS take steps to focus education on services at high risk for improper payments and to better educate referring physicians on documentation requirements for DME and home health services. CMS agreed with and has fully addressed our recommendation. Medicare and Medicaid pay for many of the same services, to some of the same providers, and likely face many of the same underlying program risks. However, because of differences in documentation requirements between the two programs, the same documentation for the same service can be sufficient in one program but not the other. The substantial variation in the programs’ improper payment rates raise questions about how well their documentation requirements help in determining whether services comply with program coverage policies, and accordingly help identify causes of program risks. This is inconsistent with federal internal control standards, which require agencies to identify, analyze, and respond to program risks. CMS officials attributed any differences in the two programs’ documentation requirements to the role played by the states in establishing such requirements under Medicaid, and told us that they have not assessed the implications of how differing requirements between the programs may lead to differing assessments of the programs’ risks. CMS relies on improper payment estimates to help develop strategies to reduce improper payments, such as informing Medicare’s use of routine medical reviews, educational outreach to providers, and efforts to address fraud. Without a better understanding of how documentation requirements affect estimates of improper payments, CMS may not have the information it needs to effectively identify and analyze program risks, and develop strategies to protect the integrity of the Medicare and Medicaid programs. CMS’s Patients over Paperwork initiative is an ongoing effort to simplify provider processes for complying with Medicare FFS requirements, including documentation requirements. Although CMS officials said this initiative is intended to help providers meet documentation requirements in both Medicare and Medicaid, current efforts only address Medicare documentation requirements. As part of the initiative, CMS solicited comments from stakeholders through proposed rulemaking on documentation requirements that often lead to insufficient documentation, and CMS officials stated that they have met with provider associations to obtain feedback. The initiative is generally focused on reviewing documentation requirements the agency has the authority to easily update, namely requirements that are based on CMS coverage rules, as opposed to requirements based on statute. Through this initiative, CMS has clarified and amended several Medicare documentation requirements. For example, CMS clarified Medicare documentation requirements for DME providers to support proof of item delivery. As part of another initiative to examine insufficient documentation in Medicare, CMS found that 3 percent of improper payments due to insufficient documentation were clerical in nature in fiscal year 2018. For the CERT’s fiscal year 2018 medical reviews, the CERT contractor classified whether improper payments due to insufficient documentation were clerical in nature—meaning the documentation supported that the service was covered and necessary, had been rendered, and was paid correctly, but did not comply with all Medicare documentation requirements. Such errors would not result in an improper payment determination if the documentation had been corrected. For example, such clerical errors may involve missing documentation elements that may be found elsewhere within the medical records. According to CMS officials, the information gathered on clerical errors may inform efforts to simplify documentation requirements. Specifically, CMS plans to use this information to help identify requirements that may not be needed to demonstrate medical necessity or compliance with coverage policies. CMS said that it does not plan to engage in similar efforts to examine insufficient documentation errors in Medicaid because of challenges associated with variations in state Medicaid documentation requirements and the additional burden it would place on states. On a national basis, CMS’s PERM program generates statistically valid improper payment estimates for the Medicaid FFS program. At the state level, however, CMS officials told us that the PERM contractor’s medical reviews do not generate statistically generalizable information about improper payments by service type and, as a result, they do not provide robust state-specific information on the corrective actions needed to address the underlying causes of improper payments. According to CMS, the number of improper payments identified through medical reviews is too small to generate robust state-specific results. In fiscal year 2017, the PERM contractor identified 918 improper payments nationwide out of nearly 31,000 claims subjected to medical reviews. More than half of all states had 10 or fewer improper payments identified through medical reviews in fiscal year 2017, and these made up about 7 percent of total sample improper payments identified through medical reviews (see Table 2). According to CMS officials, estimating improper payments for specific service types within each state with the same precision as the national estimate would involve substantially expanding the number of medical reviews conducted and commensurately increasing PERM program costs. CMS officials also estimated federal spending on PERM Medicaid FFS medical reviews at about $8 million each year, which does not include state costs, the federal share of the state costs, or providers’ costs. Of our six selected states, officials from one state said that data on service-specific improper payment rates at the state level would be useful, though officials had reservations about increasing sample sizes because of the resources involved in doing so. CMS requires state Medicaid agencies to develop corrective actions to rectify each improper payment identified. However, since the Medicaid review sample in a state typically is not large enough to be statistically generalizable by service type, the identified improper payments may not be representative of the prevalence of improper payments associated with different services within the state. Accordingly, corrective actions designed to rectify specific individual improper payments may not address the most prevalent underlying causes of improper payments. For example, state Medicaid officials in four of our six states said that most improper payments identified through PERM medical reviews are unique one-time events. Federal internal control standards require agencies to identify and analyze program risks so they can effectively respond to such risks, and OMB expects agencies to implement corrective actions that address underlying causes of improper payments. Without estimates that provide information on the most prevalent underlying causes of improper payments within a state, particularly by service type, a state Medicaid agency may not be able to develop appropriate corrective actions or prioritize activities to effectively address program risks. Corrective actions that do not address the underlying causes of improper payments are unlikely to be an effective use of state resources. Increasing sample sizes of the PERM is one approach that could improve the usefulness of the medical reviews for states—but other options also exist. For example, PERM findings could be augmented with data from other sources—such as findings from other CMS program integrity efforts, state auditors, and HHS-OIG reports. States conduct their own program integrity efforts, including medical reviews, to identify improper payments and state Medicaid officials we spoke with in four of our six selected states said that they largely rely on such efforts to identify program risks. One state’s Medicaid officials said that state-led audits allow them to more effectively identify—and subsequently monitor—services that are at risk for improper payments in the state. CMS also could use data from other sources on state-specific program risks to help design states’ PERM samples. These options could help CMS and the states better identify the most prevalent causes of improper payments and more effectively focus corrective actions and program integrity strategies to address program risks. State Medicaid agencies may, but are not required to, determine whether providers included in the PERM sample are under fraud investigation and notify the PERM contractor. Under CMS policy, when a state notifies the PERM contractor of a provider under investigation, the contractor will end all contact with the provider to avoid compromising the fraud investigation, and the claim will be determined to be improper, due to no documentation. In fiscal year 2017, of the 328 Medicaid improper payments due to no documentation, 27 (8 percent) from five states, according to CMS, were because the provider was under fraud investigation. If a state Medicaid agency does not notify the PERM contractor about providers under fraud investigation, the PERM contractor will conduct its medical review, which involves contacting the provider to obtain documentation as a part of its normal process, and communicate about improper payment determinations. Contacting providers that are under fraud investigation as part of PERM reviews could interfere with an ongoing investigation, such as in the following ways we identified based on information from the Association of Certified Fraud Examiners and others. The contact by the PERM contractor to request documentation, although unrelated to the fraud investigation, may give the impression that the provider is under heightened scrutiny. This could prompt the provider to change its behavior, or to destroy, falsify, or create evidence. These actions could in turn disrupt or complicate law enforcement efforts to build a criminal or civil case. The PERM contractor’s communication about improper payment determinations may prompt states to conduct educational outreach to the provider about proper billing procedures. This may inadvertently change the billing practices of a fraudulent provider for whom law enforcement is trying to establish a pattern of behavior. We found that states may not have processes to determine whether providers included in the PERM sample are under fraud investigation. Of the six states we spoke with, officials from two states said they did not have a mechanism in place to identify providers under fraud investigation. However, it is a best practice for investigative and review entities to communicate and coordinate with one another to determine if multiple entities are reviewing the same provider and for investigators to work discreetly without disrupting the normal course of business, based on our analysis of information from the Association of Certified Fraud Examiners and others. Accordingly, investigators should be aware of other government entities that are in contact with providers under investigation, such as the PERM contractor, who may contact providers multiple times to request documentation, and refer identified improper payments for recovery. If multiple entities are reviewing the same provider, one entity may be directed to pause or cease its activities, such as a PERM medical review, to reduce the risk of compromising an active fraud investigation. CMS has stated that it is not the agency’s intention to negatively impact states’ provider fraud investigations and, therefore, it has provided states the option to notify the PERM contractor of any providers under investigation to avoid compromising investigations. However, CMS does not require states to determine whether providers under PERM medical reviews are also under fraud investigation, which creates the potential that PERM reviews could interfere with ongoing investigations. State Medicaid agencies may not have incentives to notify the PERM contractor of providers under fraud investigation, as doing so will automatically result in a no documentation error, which increases states’ improper payment rates. Medicaid officials from one state we spoke with said that while they check whether providers subject to PERM reviews are under investigation for fraud, they do not report these instances to the PERM contractor because the PERM contractor would find a no documentation error and the claim would be cited as improper, increasing the state’s improper payment rate. Officials from another state said this policy penalizes states, in the form of higher state-level improper payment rates that may reflect poorly on states. Additionally, officials from this state were reluctant to develop corrective actions for improper payments stemming from such no documentation errors. CMS and states need information about the underlying causes of improper payments to develop corrective actions that will effectively prevent or reduce future improper payments in Medicare and Medicaid FFS. The substantial variation in Medicare and Medicaid estimated improper payment rates for the services we examined raise questions about how well the programs’ documentation requirements ensure that services were rendered in accordance with program coverage policies. While our study focused on certain services with high rates of insufficient documentation, differences in documentation requirements between the programs may apply to other services as well. Without examining how the programs’ differing documentation requirements affect their improper payment rates, CMS’s ability to better identify and address FFS program risks and design strategies to assist providers with meeting requirements may be hindered. At the state level, PERM medical reviews do not provide robust information to individual states. CMS’s requirements to address individual improper payments may lead states to take corrective actions that may not fully address underlying causes of improper payments identified through medical review, and may misdirect state efforts to reduce improper payments. Absent a more comprehensive review of existing sources of information on the underlying causes of Medicaid improper payments, CMS and states are missing an opportunity to improve their ability to address program risks. In addition, the lack of a requirement for state Medicaid agencies to determine whether providers whose claims are selected for PERM medical reviews are also under fraud investigation risks compromising ongoing investigations. Further, citing such claims as improper payments in states’ estimated improper payment rates may discourage state Medicaid agencies from notifying the PERM contractor that a provider is under investigation. We are making the following four recommendations to CMS: The Administrator of CMS should institute a process to routinely assess, and take steps to ensure, as appropriate, that Medicare and Medicaid documentation requirements are necessary and effective at demonstrating compliance with coverage policies while appropriately addressing program risks. (Recommendation 1) The Administrator of CMS should take steps to ensure that Medicaid medical reviews provide robust information about and result in corrective actions that effectively address the underlying causes of improper payments. Such steps could include adjusting the sampling approach to reflect state-specific program risks, and working with state Medicaid agencies to leverage other sources of information, such as state auditor and HHS-OIG findings. (Recommendation 2) The Administrator of CMS should take steps to minimize the potential for PERM medical reviews to compromise fraud investigations, such as by directing states to determine whether providers selected for PERM medical reviews are also under fraud investigation and to assess whether such reviews could compromise investigations. (Recommendation 3) The Administrator of CMS should address disincentives for state Medicaid agencies to notify the PERM contractor of providers under fraud investigation. This could include educating state officials about the benefits of reporting providers under fraud investigation, and taking actions such as revising how claims from providers under fraud investigation are accounted for in state-specific FFS improper payment rates, or the need for corrective actions in such cases. (Recommendation 4) We provided a draft of this report to HHS for comment, and its comments are reprinted in appendix I. HHS also provided us with technical comments, which we incorporated in the report as appropriate. HHS concurred with our first recommendation that CMS institute a process to routinely assess and ensure that Medicare and Medicaid documentation requirements are necessary and effective. HHS stated that CMS’s Patients over Paperwork initiative is focused on simplifying Medicare documentation requirements and noted that for the Medicaid program, CMS will identify and share documentation best practices with state Medicaid agencies. CMS’s Patients over Paperwork initiative may help CMS streamline Medicare documentation requirements. However, we believe CMS should take steps to assess documentation requirements in both programs to better understand the variation in the programs’ requirements and their effect on estimated improper payment rates. Without an assessment of how the programs’ documentation requirements affect estimates of improper payments, CMS may not have the information it needs to ensure that Medicare and Medicaid documentation requirements are effective at demonstrating compliance and appropriately address program risks. HHS did not concur with our second recommendation that CMS ensure that Medicaid medical reviews provide robust information about and result in corrective actions that effectively address the underlying causes of improper payments. HHS noted that increasing the PERM sample size would involve increasing costs and state Medicaid agencies’ burden, and that incorporating other sources of information into the PERM sample design could jeopardize the sample’s statistical validity. HHS also commented that it already uses a variety of sources to identify and take corrective actions to address underlying causes of improper Medicaid payments. We acknowledge that increasing the sample size would increase the costs of the PERM medical review program, though the level of improper payments warrants continued action. Further, under the current approach, we found that CMS and state Medicaid agencies are expending time and resources developing and implementing corrective actions that may not be representative of the underlying causes of improper payments in their states. It is important that corrective actions effectively and efficiently address the most prevalent causes of improper payments, and our report presents options that could improve the usefulness of the PERM’s medical reviews—such as augmenting medical reviews with other sources of information during the development of corrective actions. We continue to believe that corrective actions based on more robust information would help CMS and state Medicaid agencies more effectively address Medicaid program risks. HHS concurred with our third and fourth recommendations that CMS minimize the potential for PERM medical reviews to compromise fraud investigations and address disincentives for state Medicaid agencies to notify the PERM contractor of providers under fraud investigation. In its comments HHS described the actions it has taken and is considering taking to implement these recommendations. We are sending copies of this report to appropriate congressional committees, to the Secretary of Health and Human Services, the Administrator of CMS, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114, or cosgrovej@gao.gov or yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV. During the period of our review, fiscal year 2017 data represented the most recent, complete data for both Medicare and Medicaid fee-for- service (FFS) estimated improper payment amounts and rates. As of March 2019, the Centers for Medicare & Medicaid Services published the fiscal year 2018 Medicare FFS Supplemental Improper Payment Data report, but had not published the 2018 Medicaid FFS Supplemental Improper Payment Data report. The Centers for Medicare & Medicaid Services estimated Medicare FFS spending of $389 billion, and $32 billion in improper payments. Table 3 below presents updated fiscal year 2018 data for the Medicare improper payment data by the services examined in our report. Medicare and state Medicaid agencies have released template medical record documentation, such as certificates of medical necessity and plans of care that providers may use to document information necessary to ensure compliance with coverage policies. This appendix presents examples of such templates. Figure 7 presents a Medicare template that referring physicians can use to certify beneficiary need for home health services. Figure 8 presents a Medicare template that referring physicians can use to certify beneficiary need for home oxygen supplies. Figure 9 presents a template from the Indiana Medicaid program that hospices may use to document beneficiary plans of care. In addition to the contact named above, Leslie V. Gordon (Assistant Director), Michael Erhardt (Analyst-in-Charge), Arushi Kumar, and Dawn Nelson made key contributions to this report. Also contributing were Sam Amrhein, Vikki Porter, and Jennifer Rudisill.

Summary: In fiscal year 2017, Medicare FFS had an estimated $23.2 billion in improper payments due to insufficient documentation, while Medicaid FFS had $4.3 billion—accounting for most of the programs' estimated FFS medical review improper payments. Medicare FFS coverage policies are generally national, and the program directly pays providers, while Medicaid provides states flexibility to design coverage policies, and the federal government and states share in program financing. Among other things, GAO examined: (1) Medicare and Medicaid documentation requirements and factors that contribute to improper payments due to insufficient documentation; and (2) the extent to which Medicaid reviews provide states with actionable information. GAO reviewed Medicare and Medicaid documentation requirements and improper payment data for fiscal years 2005 through 2017, and interviewed officials from CMS, CMS contractors, and six state Medicaid programs. GAO selected the states based on, among other criteria, variation in estimated state improper payment rates, and FFS spending and enrollment. The Centers for Medicare & Medicaid Services (CMS) uses estimates of improper payments to help identify the causes and extent of Medicare and Medicaid program risks and develop strategies to protect the integrity of the programs. CMS estimates Medicare and Medicaid fee-for-service (FFS) improper payments, in part, by conducting medical reviews—reviews of provider-submitted medical record documentation to determine whether the services were medically necessary and complied with coverage policies. Payments for services not sufficiently documented are considered improper payments. In recent years, CMS estimated substantially more improper payments in Medicare, relative to Medicaid, primarily due to insufficient documentation (see figure). For certain services, Medicare generally has more extensive documentation requirements than Medicaid. For example, Medicare requires additional documentation for services that involve physician referrals, while Medicaid requirements vary by state and may rely on other mechanisms—such as requiring approval before services are provided—to ensure compliance with coverage policies. Although Medicare and Medicaid pay for similar services, the same documentation for the same service can be sufficient in one program but not the other. The substantial variation in the programs' improper payments raises questions about how well the programs' documentation requirements help identify causes of program risks. As a result, CMS may not have the information it needs to effectively address program risks and direct program integrity efforts. CMS's Medicaid medical reviews may not provide the robust state-specific information needed to identify causes of improper payments and address program risks. In fiscal year 2017, CMS medical reviews identified fewer than 10 improper payments in more than half of all states. CMS directs states to develop corrective actions specific to each identified improper payment. However, because individual improper payments may not be representative of the causes of improper payments in a state, the resulting corrective actions may not effectively address program risks and may misdirect state program integrity efforts. Augmenting medical reviews with other sources of information, such as state auditor findings, is one option to better ensure that corrective actions address program risks. GAO is making four recommendations to CMS, including that CMS assess and ensure the effectiveness of Medicare and Medicaid documentation requirements, and that CMS take steps to ensure Medicaid's medical reviews effectively address causes of improper payments and result in appropriate corrective actions. CMS concurred with three recommendations, but did not concur with the recommendation on Medicaid medical reviews. GAO maintains that this recommendation is valid as discussed in this report.