In 2017, nearly one in three Medicare Part D beneficiaries received an opioid prescription, and Medicare spending for prescription opioids was almost $3.4 billion. Medicare data for 2017 showed that the beneficiaries potentially at risk for opioid misuse and abuse were more likely to be under 65 years of age, female, and dually eligible for Medicare and Medicaid. For years, to limit Medicaid at-risk beneficiaries’ access to controlled substances, state Medicaid programs have used lock-in programs, which restrict certain beneficiaries’ access to a single prescriber (such as a physician or other health-care provider), a single pharmacy, or both. States have broad discretion in how and whether to implement lock-ins, including how to identify at-risk beneficiaries. Medicaid lock-in programs have been associated with advantages including declines in inappropriate prescribing, decreases in abuse of controlled substances, and increased treatment options for beneficiaries. Research has identified an unintended consequence of the Medicaid lock-in programs; some individuals increased the amount of out-of-pocket payments they made for controlled substances, thus avoiding lock-in programs as data on these purchases are not collected by Medicaid. State Prescription Drug Monitoring Programs (PDMP) are state-run electronic databases that track the prescribing, dispensing, and purchasing of controlled substances by individuals, whether purchased out-of-pocket, through private insurance, or under insurance programs such as Medicare and Medicaid. Data are available to individuals or organizations as authorized under state law. For example, health-care prescribers can check PDMPs for a specific individual prior to prescribing controlled substances. State PDMPs have documentation of controlled substances obtained by individuals. As of February 2018, all 50 states, the District of Columbia, Guam, and Puerto Rico had operational PDMPs within their borders. Medicare DMPs perform case management to identify at-risk beneficiaries and attempt to mitigate risk by increasing communication and coordination across plan sponsors, health-care prescribers, pharmacists, and at-risk beneficiaries. CMS established a framework for plan sponsors that volunteer to establish Medicare DMPs. CMS’s framework includes two steps for identifying at-risk beneficiaries: 1) CMS identifies potentially at-risk beneficiaries based on key clinical factors and 2) plan sponsors use case management to identify the subset of potentially at-risk beneficiaries who are actually at risk. Step One: Identifying potentially at-risk beneficiaries. CMS identifies potentially at-risk beneficiaries based on the minimum Overutilization Monitoring System’s criteria and develops a quarterly list of these beneficiaries, which it sends to plan sponsors. The Overutilization Monitoring System was originally designed and implemented by CMS in July 2013 to oversee plan sponsors’ compliance with CMS’s opioid overutilization policy and is based on beneficiary claims data. It was enhanced in 2019 to support the implementation of DMPs. The system encompasses a medication safety approach with the goal of reducing beneficiary overutilization of opioids while maintaining beneficiary access to needed medication. The Overutilization Monitoring System creates and sends a list of beneficiaries meeting minimum criteria quarterly to plan sponsors with DMPs. These patients are considered potentially at- risk beneficiaries. Additional supplemental criteria can also be used by plan sponsors to identify other potential at-risk beneficiaries, such as those who use seven or more pharmacies for opioid prescriptions. Use of higher numbers of prescribers and pharmacies may put the beneficiary at more risk. (See table 1.) Step Two: Using case management to identify actually at-risk beneficiaries and mitigate risk of misuse or abuse. After identification of potentially at-risk beneficiaries by CMS, the second step in the framework is for plan sponsors to coordinate the provision of care, referred to as case management. Plan sponsors use case management to determine which potentially at-risk beneficiaries are deemed to be actually at risk. Plan sponsors’ clinicians must begin case management for each potentially at-risk beneficiary with the beneficiary’s prescribers of frequently abused drugs, with the purpose of determining if current treatment is appropriate, examining specifically if the beneficiary is being appropriately treated with frequently abused drugs. This step allows for health-care providers to bring the beneficiary’s clinical information into the discussion. Two groups of beneficiaries identified as potentially at risk are excluded from Medicare DMPs during the case management process: First, CMS will automatically exempt from Medicare DMP consideration any beneficiary who (a) has elected to receive hospice, palliative, or end-of- life care; (b) is a resident of a long-term-care facility or of another facility for which frequently abused drugs are dispensed for residents through a contract with a single pharmacy; or (c) has active cancer-related pain. Second, through a discussion of beneficiary-level clinical information as part of case management, beneficiaries found to be receiving appropriate treatment, or who have had cases resolved with adjustments to their treatment will also be excluded from Medicare DMP consideration. CMS officials told us that the beneficiaries’ health-care providers often adjust their prescribing after talking with the health plans’ clinicians and learning information about other health-care providers also treating the beneficiary. After eliminating the excluded beneficiaries, the plan sponsor sends an initial notification letter to the remaining beneficiaries who continue to be identified as potentially at risk, and thus, may require limiting the coverage of a prescription drug in some manner (coverage limitation). The notification letter notifies each beneficiary that he or she has been identified as potentially at risk; details which coverage limitations the sponsor intends to implement and for how long; explains how the beneficiary can submit preferences for the selected frequently abused drugs prescriber(s) and the selected dispensing pharmacy or pharmacies for frequently abused drugs in case a lock-in tool is used; provides information about resources and plan benefits that address prescription abuse; explains how additional information can be provided to the plan sponsor; and informs the beneficiary of the right to appeal, among other things. Medicare plan sponsors have three coverage limitation tools that can be used either concurrently or sequentially: Frequently abused drugs prescriber lock-in. The at-risk beneficiary will receive prescriptions from only one or more selected prescriber. Prescribers in a group practice will count as a single prescriber. Frequently abused drugs-dispensing pharmacy lock-in. The at- risk beneficiary will receive all prescriptions from one or more selected dispensing pharmacy. The pharmacy must be in their plan sponsor’s network. When a pharmacy has different locations that share real-time electronic data, such as chain pharmacies, all locations of the pharmacy will be treated as one pharmacy. Beneficiary specific point-of-sale claim edit. The at-risk beneficiary will be restricted to certain frequently abused drugs and amounts through the point-of-sale claim edit. This means that a plan sponsor must not cover a prescription for the frequently abused drug for an at- risk beneficiary that is in excess of the limit in the edit. Pharmacists will receive a message when a beneficiary attempts to fill a prescription if the prescription exceeds the limit in place for that beneficiary. After a 30-day period from the date of the initial notification letter, there are two possible outcomes: either the plan sponsor will determine that the beneficiary is at risk for misuse or abuse of frequently abused drugs and will proceed with the coverage limitation under its DMP, or the sponsor will determine that the beneficiary is not at risk. If the potentially at-risk beneficiary is found to be at risk, a second notification letter is sent to the beneficiary as soon as possible after the 30-day period but no later than 60 days from the date of the initial notification letter. The second letter includes the beneficiary’s identification as at risk for misuse or abuse of frequently abused drugs, the right to appeal the decision, coverage limitations to be employed, and the expiration date of the coverage limitations, among other things. The second notification letter also explains how the beneficiary can submit preferences for the selected frequently abused drugs prescriber(s) and the selected dispensing pharmacy or pharmacies for frequently abused drugs in case a lock-in tool is used. The selected frequently abused drugs prescriber(s) must agree to serve as the beneficiary’s only frequently abused drugs prescriber(s) and must be determined by the plan sponsor as not contributing to the beneficiary’s opioid misuse. The at-risk beneficiary generally has 60 days from the date of the second notification letter to request an appeal of an at-risk determination. A new at-risk determination is made by the plan sponsor as a result of continued case management (that is, continued coordination of care and clinical discussions) within a standard time frame of 7 days for redetermination, or an expedited time frame of 72 hours for redetermination. Alternatively, if it is determined that the potentially at-risk beneficiary is being treated appropriately for their medical condition and is therefore not at risk, an alternate second notification letter is sent to the beneficiary stating that the beneficiary was deemed not to be at risk and that access to frequently abused drugs will not be limited under a DMP. This alternate second notification letter must be sent no later than 60 days after the date on the initial notification letter. If a beneficiary switches to a different plan sponsor after being identified as potentially at risk or actually at risk, the determination does not automatically transfer to the new plan sponsor. The new plan sponsor will be able to see the previous plan sponsor’s determination, but the new plan sponsor may have to make its own determination through case management unless the prior plan’s case management information is up to date. According to CMS’s framework, the termination date of an at-risk determination is the earlier of two possible dates: 12 months from the effective date of the coverage limitation, unless the limitation is extended, or when the beneficiary demonstrates that he or she is no longer likely to be at risk before the end of the 12 months. At the end of the 12-month period, a clinical assessment of the at-risk beneficiary will determine if the DMP should continue for another year or be ended. The maximum coverage limitation period in a DMP is 24 months. After 24 months, the coverage limitation is halted, but according to the framework, CMS continues to monitor the beneficiary quarterly through the Overutilization Monitoring System and can re-identify the beneficiary as potentially at risk again if he or she meets the minimum Overutilization Monitoring System criteria. Reporting requirements for Medicare DMPs. Although the Medicare DMPs are currently voluntary, the framework places reporting requirements on plan sponsors that choose to establish DMPs. Medicare DMPs are integrated with the Opioid Drug Utilization Review Policy and Overutilization Monitoring System to improve medication safety. Plan sponsors must report to CMS, through the Overutilization Monitoring System, the results of case management for each potential at-risk beneficiary identified. For each beneficiary deemed to be at risk, the coverage limitation tools – frequently abused drugs prescriber lock-in, frequently abused drugs-dispensing pharmacy lock-in, and beneficiary specific point-of-sale claims edit – that will be used to limit the beneficiary’s access to frequently abused drugs must also be reported. Other required information to be reported to CMS includes dates of the initial and second notification letters, and the date that the plan sponsor decides to terminate a potential at-risk or at-risk status. This data allows CMS to track beneficiary-level data for those beneficiaries placed in DMPs. Input about Medicare DMP framework from plan sponsors and experts. Although the at-risk determination is the responsibility of the plan sponsor, four of the five plan sponsors we interviewed stated they would rely on results from case management, including the beneficiary’s primary health-care provider’s input, to make the determination. One plan sponsor told us it has a panel of physicians and pharmacists that makes the at-risk determination for beneficiaries. The panel takes into consideration the input of the beneficiary’s prescribers of frequently abused drugs, but the panel makes the final decision. None of the five plan sponsors we interviewed expressed concerns about beneficiaries not receiving clinically appropriate doses of opioids under the Medicare DMPs, given that the case management process includes clinician input, including the beneficiary’s primary health-care provider and plan sponsors’ clinicians. According to one medical expert, case management is beneficial because it allows for input from the beneficiary’s prescriber rather than relying solely on the Overutilization Monitoring System metric criteria to determine who is at risk. Three of the five plan sponsors we interviewed expressed prior positive experiences with lock-ins. All plan sponsors had experience with the lock- in tools from their experience participating in Medicaid programs or offering private insurance plans. Three of the five plan sponsors reported better coordinated oversight and management of patients and their conditions in those experiences. One sponsor stated that lock-in programs are perceived as an additional safety mechanism for at-risk beneficiaries by helping with the coordination of the beneficiaries’ care because the plan sponsor’s clinicians, prescribers, and pharmacies are aware of the lock-in programs. Officials with five plan sponsors and six stakeholder organizations representing physicians, pharmacy benefit managers, and patients we interviewed told us that several factors beyond the clinical input incorporated in the case management process could contribute to the success of DMPs. These factors include communication, collaboration, and flexibility for plan sponsors to manage and incorporate best practices. Communication among plan sponsors, opioid prescribers, and pharmacies dispensing opioids could reduce any potential resistance to DMPs by stakeholders, and contribute to DMP success, officials told us. Specifically, several officials with plan sponsors and stakeholders noted that sponsors should communicate with, and educate stakeholders to ensure that DMPs, especially their coverage limitation tools, are not viewed as punitive tools by beneficiaries, but rather as tools for keeping them safe. Some of these officials stated that through education and other means, plan sponsors should also encourage health-care providers and their enrollees to view opioid addiction by at-risk beneficiaries as a disease rather than a choice. Effective collaboration among prescribers and patients in making individualized treatment decisions for pain management is another key to successful DMPs, according to some stakeholders we interviewed. Specifically, some plan sponsors and a stakeholder noted that during and after case management plan sponsors should support collaboration between prescribers and patients to ensure access to the clinically appropriate level of opioids for each beneficiary. Flexibility to incorporate best practices from DMPs and flexibility in varying coverage limitation features to fit regional differences are other keys to success, some plan sponsors and a stakeholder told us, due to regional and other differences in population groups. Data from CDC show that there is some variation in death rates from opioids in the overall population by state, and a CDC study also shows that opioid prescribing patterns also vary by location—the average per capita prescribed amounts varied widely by county, and demographic and other factors are sometimes associated with higher prescribing patterns. In addition, some officials with plan sponsors and stakeholders stated that the criteria for DMPs such as how at-risk beneficiaries are identified, and other parameters of the DMP (such as which drugs are designated as frequently abused drugs) should be periodically reassessed by CMS with feedback by plan sponsors and adjusted, where appropriate, to incorporate evidence from the outcomes of the DMP. Officials with plan sponsors and stakeholders we interviewed also discussed several factors that could limit the success of the DMPs: An official with a plan sponsor and a stakeholder told us that purchases of opioids made by beneficiaries using cash are not captured in the available prescription drug claims data maintained by plan sponsors. These officials suggested therefore that sponsors should encourage the selected prescribers to review this information by using state PDMPs, which track controlled substance prescriptions in a state and include cash sales of opioids. One plan sponsor commented that coverage limitations could have a negative effect on beneficiary health satisfaction survey scores and therefore could affect how a physician prescribes opioids. Beneficiaries who are placed in a DMP or subject to one of the DMP tools may report decreased satisfaction in the “Consumer Assessment of Healthcare Providers and Systems” surveys. Under Medicare Advantage, patient experience about the ease of receiving care is one measure of quality and is a factor in plan sponsor reimbursement. Finally, some officials with plan sponsors and stakeholders told us that in localities where prescribers feel a stigma associated with dispensing opioids, the coverage limitation feature could have the unintended consequence of creating a disincentive for prescribers to take care of patients who require opioid treatment. According to an official, to combat the opioid crisis, some states send letters to the top opioid prescribers in their state as a way to create awareness about trends in opioid prescribing. Officials with a plan sponsor and a stakeholder said that providers who want to avoid being on the list of top prescribers refer patients to pain specialists for management of pain. Officials told us that the demand for these pain specialists is increasing and there are long waiting lists to access care by these pain specialists. CMS is taking several steps to assess the DMPs and gather information to make periodic changes to the program. For example, CMS officials told us they plan to monitor and analyze beneficiary complaints, appeals, prescription drug event data, and other data submitted by plan sponsors related to DMPs. According to CMS officials, the agency also will obtain feedback from plan sponsors about how the DMPs are working, and this feedback will be the basis for making periodic changes to the DMPs. CMS is also updating its Medicare Part C and D audit protocol so it can audit DMP related beneficiary notices. Finally, CMS tracks the utilization of opioids by Medicare Part D enrollees using Part D data and the Overutilization Monitoring System. For example in the 2020 Medicare Advantage and Part D draft call letter, CMS reported that between 2012 and 2017, there was a 33 percent decrease in the number of Part D enrollees meeting or exceeding 90 MME for at least one day, with the largest decrease (14 percent) in 2017. We provided a draft of this report to HHS for review. HHS provided technical comments, which we incorporated as appropriate. We are sending copies of this report to the appropriate congressional committees, the Secretary of Health and Human Services, the Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on GAO’s website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at CosgroveJ@gao.gov. Contact points for our Office of Congressional Relations and Office of Public Affairs can be found on the last page of this report. Other major contributors to this report are listed in appendix I. In addition to the contact named above, Martin T. Gahart (Assistant Director), N. Rotimi Adebonojo (Analyst in Charge), Jennie Apter, Deborah J. Miller, Emily Wilson, Rick Lipinski, Todd Anderson, and Vikki Porter made key contributions to this report.

Summary: Misuse and abuse of prescription opioids can lead to overdose and death. According to the Centers for Disease Control and Prevention (CDC), 47,600 overdose deaths in the United States in 2017 involved an opioid. GAO and other federal entities have raised concerns about opioid misuse and abuse in Medicare. The Comprehensive Addiction and Recovery Act of 2016 (CARA) authorized CMS and Medicare plan sponsors to establish voluntary DMPs that may limit access to frequently abused prescription drugs, such as opioids, for Medicare beneficiaries who are identified as being at risk for prescription drug abuse. DMPs will become mandatory in Medicare starting in January 2022. CARA included a provision for GAO to review DMPs under Medicare. This report: 1) describes how Medicare identifies beneficiaries at risk of opioid misuse and abuse and how it attempts to mitigate that risk; and 2) identifies the factors likely to affect the success of Medicare DMPs. GAO reviewed CDC's Guideline for Prescribing Opioids for Chronic Pain , CMS regulations, and other relevant CMS guidance. GAO also interviewed officials from CMS, the five largest Medicare Part D prescription drug plan sponsors, and officials from six other stakeholder organizations representing Medicare plan sponsors, physicians (including pain specialists), pharmacy benefit managers, state Medicaid programs, and patients. Medicare's drug management programs (DMP) identify beneficiaries at risk of opioid misuse or abuse, and attempt to mitigate that risk through the use of case management and coverage limitations. DMPs are overseen by the Centers for Medicare & Medicaid Services (CMS) and voluntarily implemented by Medicare Part D prescription drug plan sponsors (private health plans). CMS established a two-step framework for identifying at-risk beneficiaries under DMPs. First, CMS identifies potentially at-risk beneficiaries based on key factors, such as beneficiaries' daily dosage of opioids and the number of prescribers and pharmacies from which they receive opioids, with higher numbers possibly putting the beneficiary at more risk. Second, Medicare Part D prescription drug plan sponsors' clinicians coordinate the provision of care among prescribers and pharmacists (referred to as case management) to determine if those potentially at-risk beneficiaries are actually at risk. If a patient is deemed to be at risk, coverage limitation tools—such as limiting a beneficiary to a selected prescriber or pharmacy, and implementing point-of-sale restrictions on certain drugs or amounts—can be used to limit the at-risk beneficiary's access to opioids. Beneficiaries have an opportunity to appeal an at-risk designation. None of the five plan sponsors GAO interviewed expressed concerns about beneficiaries not receiving clinically appropriate doses of opioids under the Medicare DMPs. Medicare Part D prescription drug plan sponsors and other stakeholders GAO interviewed reported several factors beyond the case management process that could contribute to the success of DMPs. These factors included communication among sponsors, opioid prescribers, and pharmacies dispensing opioids to reduce potential resistance to participating in DMPs by opioid prescribers or beneficiaries. According to plan sponsors and stakeholders, plan sponsors could communicate with stakeholders to ensure that DMPs are not viewed as a punitive tool by beneficiaries, but rather as tools for keeping them safe. Plan sponsors and stakeholders noted that it is important for plan sponsors to have flexibility in varying coverage limitation features to fit regional and other differences in population groups. They noted that CMS should periodically reassess and adjust the elements of the DMP program where appropriate, to incorporate evidence from the outcomes of the DMP—such as how at-risk beneficiaries are identified, or which drugs are selected as frequently abused drugs. Finally, CMS officials told GAO that they are taking steps to assess the DMPs and gather the information required to make periodic changes to the DMP program. For example, CMS officials plan to analyze data for at-risk beneficiaries that DMPs are required to report to CMS, update their Medicare Part D audit protocol, and obtain feedback from plan sponsors about how the DMPs are working. The Department of Health and Human Services provided technical comments on a draft of this report, which GAO incorporated as appropriate.