Like financial institutions, credit card companies, telecommunications firms, and other private sector companies that take steps to protect customers’ accounts, CMS uses information technology to help predict or detect cases of improper claims and payments. For more than a decade, the agency and its contractors have used automated software tools to analyze data from various sources to detect patterns of unusual activities or financial transactions that indicate payments could be made for fraudulent charges or improper payments. For example, to identify unusual billing patterns and support investigations and referrals for prosecutions of cases, analysts and investigators access information about key actions taken to process claims as they are filed and the specific details about claims already paid. This would include accessing information on claims as they are billed, adjusted, and paid or denied; check numbers on payments of claims; and other specific information that could help establish provider intent. CMS uses many different means to store and manipulate data and, since the establishment of the agency’s program integrity initiatives in the 1990s, has built multiple disparate databases and analytical software tools to meet individual and unique needs of various programs within the agency. In addition, data on Medicaid claims are scattered among the states in multiple systems and data stores, and are not readily available to CMS. According to agency program documentation, these geographically distributed, regional approaches to storing and analyzing data result in duplicate data and limit the agency’s ability to conduct analyses of data on a nationwide basis. CMS has been working for most of the past decade to consolidate its disparate data and analytical tools. The agency’s efforts led to the IDR and One PI programs, which are intended to provide CMS and its program integrity contractors with a centralized source of Medicare and Medicaid data and a web-based portal and set of analytical tools by which these data can be accessed and analyzed to help detect cases of fraud, waste, and abuse. In 2006, CMS officials expanded the scope of a 3-year-old data modernization strategy to not only modernize data storage technology, but also to integrate Medicare and Medicaid data into a centralized repository so that CMS and its partners could access the data from a single source. They called the expanded program IDR. According to program officials, the agency’s vision was for IDR to become the single repository for CMS’s data and enable data analysis within and across programs. Specifically, this repository was to establish the infrastructure for storing data related to Medicaid and Medicare Parts A, B, and D claims processing, as well as a variety of other agency functions, such as program management, research, analytics, and business intelligence. CMS envisioned an incremental approach to incorporating data into IDR. Specifically, it intended to incorporate data related to paid claims for Medicare Part D by the end of fiscal year 2006, and for Medicare Parts A and B by the end of fiscal year 2007. The agency also planned to begin to incrementally add all Medicaid data for the 50 states in fiscal year 2009 and to complete this effort by the end of fiscal year 2012. Initial program plans and schedules also included the incorporation of additional data from legacy CMS claims-processing systems that store and process data related to the entry, correction, and adjustment of claims as they are being processed, along with detailed financial data related to paid claims. According to program officials, these data, called “shared systems” data, are needed to support the agency’s plans to incorporate tools to conduct predictive analysis of claims as they are being processed, helping to prevent improper payments. Shared systems data, such as check numbers and amounts related to claims that have been paid, are also needed by law enforcement agencies to help with fraud investigations. CMS initially planned to have all the shared systems data included in IDR by July 2008. Table 1, presented in our prior report, summarized CMS’s original planned dates and actual dates for incorporating the various types of data into IDR as of the end of fiscal year 2010. Also in 2006, CMS initiated the One PI program with the intention of developing and implementing a portal and software tools that would enable access to and analysis of claims, provider, and beneficiary data from a centralized source. The agency’s goal for One PI was to support the needs of a broad program integrity user community, including agency program integrity personnel and contractors who analyze Medicare claims data, along with state agencies that monitor Medicaid claims. To achieve its goal, CMS officials planned to implement a tool set that would provide a single source of information to enable consistent, reliable, and timely analyses and improve the agency’s ability to detect fraud, waste, and abuse. These tools were to be used to gather data from IDR about beneficiaries, providers, and procedures and, combined with other data, find billing aberrancies or outliers. For example, an analyst could use software tools to identify potentially fraudulent trends in ambulance services by gathering the data about claims for ambulance services and medical treatments, and then use other software to determine associations between the two types of services. If the analyst found claims for ambulance travel costs but no corresponding claims for medical treatment, it might indicate that further investigation could prove that the billings for those services were fraudulent. According to agency program planning documentation, the One PI system was also to be developed incrementally to provide access to IDR data, analytical tools, and portal functionality. CMS planned to implement the One PI portal and two analytical tools for use by program integrity analysts on a widespread basis by the end of fiscal year 2009. The agency engaged contractors to develop the system. IDR had been in use by CMS and its contractors who conduct Medicare program integrity analysis since September 2006 and incorporated data related to claims for reimbursement of services under Medicare Parts A, B, and D. According to program officials, the integration of these data into IDR established a centralized source of data previously accessed from multiple disparate system files. However, although the agency had been incorporating data from various data sources since 2006, our prior report noted that IDR did not include all the data that were planned to be incorporated by the end of 2010 and that are needed to support enhanced program integrity initiatives. For example, IDR did not include the Medicaid data that are critical to analysts’ ability to detect fraud, waste, and abuse in this program. While program officials initially planned to incorporate 20 states’ Medicaid data into IDR by the end of fiscal year 2010, the agency had not incorporated any of these data into the repository. Program officials told us that the original plans and schedules for obtaining Medicaid data did not account for the lack of funding for states to provide Medicaid data to CMS, or the variations in the types and formats of data stored in disparate state Medicaid systems. Consequently, the officials were not able to collect the data from the states as easily as they expected and did not complete this activity as originally planned. In December 2009, CMS initiated another agencywide program intended to, among other things, identify ways to collect Medicaid data from the many disparate state systems and incorporate the data into a single data store. As envisioned by CMS, this program, the Medicaid and Children’s Health Insurance Program Business Information and Solutions (MACBIS) program, was to include activities in addition to providing expedited access to current data from state Medicaid programs. According to agency planning documentation, as a result of efforts to be initiated under the MACBIS program, CMS would incorporate Medicaid data for all 50 states into IDR by the end of fiscal year 2014. However, program officials had not defined plans and reliable schedules for incorporating these data into IDR. Until the agency does so, it cannot ensure that current development, implementation, and deployment efforts will provide the data and technical capabilities needed to enhance efforts to detect potential cases of fraud, waste, and abuse. In addition to the Medicaid data, initial program integrity requirements included the incorporation of the shared systems data by July 2008; however, all of these data had not been added to IDR. According to IDR program officials, the shared systems data were not incorporated as planned because funding for the development of the software and acquisition of the hardware needed to meet this requirement was not approved until the summer of 2010. Subsequently, IDR program officials developed project plans and identified user requirements. In updating us on the status of this activity, the officials told us in November 2011 that they began incorporating shared systems data in September 2011 and plan to make them available to program integrity analysts in spring 2012. Beyond the IDR initiative, CMS program integrity officials had not taken appropriate actions to ensure the use of One PI on a widespread basis for program integrity purposes. According to program officials, the system was deployed to support Medicare program integrity goals in September 2009 as originally planned and consisted of a portal that provided web-based access to software tools used by CMS and contractor analysts to retrieve and analyze data stored in IDR. As implemented, the system provided access to two analytical tools—a commercial off-the-shelf decision support tool that is used to perform data analysis to, for example, detect patterns of activities that may identify or confirm suspected cases of fraud, waste, or abuse, and another tool that provides users extended capabilities to perform more complex analyses of data. For example, it allows the user to customize and create ad hoc queries of claims data across the three Medicare plans. However, while program officials deployed the One PI portal and two analytical tools, the system was not being used as widely as planned because CMS and contractor analysts had not received the necessary training. In this regard, program planning documentation from August 2009 indicated that One PI program officials had planned for 639 analysts to be trained and using the system by the end of fiscal year 2010, including 130 analysts who conduct reviews of Medicaid claims. However, CMS confirmed that by the end of October 2010, only 42 Medicare analysts who were intended to use One PI had been trained, with 41 actively using the portal and tools. These users represented fewer than 7 percent of the users originally intended for the program. Further, no Medicaid analysts had been trained to use the system. While the use of One PI cannot be fully optimized for Medicaid integrity purposes until the states’ Medicaid claims data are incorporated into IDR, the tools provided by the system could be used to supplement data currently available to Medicaid program integrity analysts and to enhance their ability to detect payments of fraudulent claims. For example, with training, Medicaid analysts may be able to compare data from their state systems to Medicare claims data in IDR to identify duplicate claims for the same service. Program officials responsible for implementing the system acknowledged that their initial training plans and efforts had been insufficient and that they had consequently initiated activities and redirected resources to redesign the One PI training plan in April 2010; they began to implement the new training program in July of that year. As we reported in June, One PI officials stated that 62 additional analysts had signed up to be trained in 2011, and that the number of training classes for One PI had been increased from two to four per month. Agency officials, in commenting on our report, stated that since January 2011, 58 new users had been trained; however, they did not identify an increase in the number of actual users of the system. Nonetheless, while these activities indicated some progress toward increasing the number of One PI users, the number of users reported to be trained and using the system represented a fraction of the population of 639 intended users. Moreover, One PI program officials had not yet made detailed plans and developed schedules for completing training of all the intended users. Agency officials concurred with our conclusion that CMS needed to take more aggressive steps to ensure that its broad community of analysts is trained, including those who conduct analyses of Medicaid claims data. Until it does so, the use of One PI may remain limited to a much smaller group of users than the agency intended and CMS will continue to face obstacles in its efforts to deploy One PI for widespread use throughout its community of program integrity analysts. Because IDR and One PI were not being used as planned, CMS officials were not in a position to determine the extent to which the systems were providing financial benefits or supporting the agency’s initiatives to meet program integrity goals and objectives. As we have reported, agencies should forecast expected benefits and then measure actual financial benefits accrued through the implementation of IT programs. Further, the Office of Management and Budget (OMB) requires agencies to report progress against performance measures and targets for meeting them that reflect the goals and objectives of the programs. To do this, performance measures should be outcome-based and developed with stakeholder input, and program performance must be monitored, measured, and compared to expected results so that agency officials are able to determine the extent to which goals and objectives are being met. In addition, industry experts describe the need for performance measures to be developed with stakeholders’ input early in a project’s planning process to provide a central management and planning tool and to monitor the performance of the project against plans and stakeholders’ needs. While CMS had shown some progress toward meeting the programs’ goals of providing a centralized data repository and enhanced analytical capabilities for detecting improper payments due to fraud, waste, and abuse, the implementation of IDR and One PI did not yet position the agency to identify, measure, and track financial benefits realized from reductions in improper payments as a result of the implementation of either system. For example, program officials stated that they had developed estimates of financial benefits expected to be realized through the use of IDR. Their projection of total financial benefits was reported to be $187 million, based on estimates of the amount of improper payments the agency expected to recover as a result of analyzing data provided by IDR. With estimated life cycle program costs of $90 million through fiscal year 2018, the resulting net benefit expected from implementing IDR was projected to be $97 million. However, as of March 2011, program officials had not identified actual financial benefits of implementing IDR. Further, program officials’ projection of financial benefits expected as a result of implementing One PI was reported to be approximately $21 billion. This estimate was increased from initial expectations based on assumptions that accelerated plans to integrate Medicare and Medicaid data into IDR would enable One PI users to identify increasing numbers of improper payments sooner than previously estimated, thus allowing the agency to recover more funds that have been lost due to payment errors. However, the implementation of One PI had not yet produced outcomes that positioned the agency to identify or measure financial benefits. CMS officials stated at the end of fiscal year 2010—more than a year after deploying One PI—that it was too early to determine whether the program had provided any financial benefits. They explained that, since the program had not met its goal for widespread use of One PI, there were not enough data available to quantify financial benefits attributable to the use of the system. These officials said that as the user community expanded, they expected to be able to begin to identify and measure financial and other benefits of using the system. In addition, program officials had not developed and tracked outcome- based performance measures to help ensure that efforts to implement One PI and IDR would meet the agency’s goals and objectives for improving the results of its program integrity initiatives. For example, outcome-based measures for the programs would indicate improvements to the agency’s ability to recover funds lost because of improper payments of fraudulent claims. However, while program officials defined and reported to OMB performance targets for IDR related to some of the program’s goals, they did not reflect the goal of the program to provide a single source of Medicare and Medicaid data that supports enhanced program integrity efforts. Additionally, CMS officials had not developed quantifiable measures for meeting the One PI program’s goals. For example, performance measures and targets for One PI included increases in the detection of improper payments for Medicare Parts A and B claims. However, the limited use of the system had not generated enough data to quantify the amount of funds recovered from improper payments. Moreover, measures of One PI’s program performance did not accurately reflect the existing state of the program. Specifically, indicators to be measured for the program included the number of states using One PI for Medicaid integrity purposes and decreases in the Medicaid payment error rate; however, One PI did not have access to those data because they were not yet incorporated into IDR. Because it lacked meaningful outcome-based performance measures and sufficient data for tracking progress toward meeting performance targets, CMS did not have the information needed to ensure that the systems were useful to the extent that benefits realized from their implementation could help the agency meet program integrity goals. Until the agency is better positioned to identify and measure financial benefits and establishes outcome-based performance measures to help gauge progress toward meeting program integrity goals, it cannot be assured that the systems will contribute to improvements in CMS’s ability to detect and prevent fraud, waste, and abuse, and improper payments of Medicare and Medicaid claims. Given the critical need for CMS to reduce improper payments within the Medicare and Medicaid programs, we included in our June 2011 report a number of recommended actions that we consider vital to helping the agency achieve more widespread use of IDR and One PI for program integrity purposes. Specifically, we recommended that the Administrator of CMS finalize plans and develop schedules for incorporating additional data into IDR that identify all resources and activities needed to complete tasks and that consider risks and obstacles to the IDR program; implement and manage plans for incorporating data in IDR to meet schedule milestones; establish plans and reliable schedules for training all program integrity analysts intended to use One PI; establish and communicate deadlines for program integrity contractors to complete training and use One PI in their work; conduct training in accordance with plans and established deadlines to ensure schedules are met and program integrity contractors are trained and able to meet requirements for using One PI; define any measurable financial benefits expected from the implementation of IDR and One PI; and with stakeholder input, establish measurable, outcome-based performance measures for IDR and One PI that gauge progress toward meeting program goals. In commenting on a draft of our report, CMS agreed with the recommendations and indicated that it planned to take steps to address the challenges and problems that we identified during our study. In conclusion, CMS’s success toward meeting goals to enhance program integrity efforts through the use of IDR and One PI depends upon the incorporation of all needed data into IDR, and effective use of the systems by the agency’s broad community of Medicare and Medicaid program integrity analysts. It is also essential that the agency identify measurable financial benefits and performance goals expected to be attained through improvements in its ability to prevent and detect fraudulent, wasteful, and abusive claims and resulting improper payments. In taking these steps, the agency will better position itself to determine whether these systems are useful for enhancing CMS’s ability to identify fraud, waste, and abuse and, consequently, reduce the loss of billions of dollars to improper payments of Medicare and Medicaid claims. Chairmen Platts and Gowdy, Ranking Members Towns and Davis, and Members of the Subcommittees, this concludes my prepared statement. I would be pleased to answer any questions that you may have. If you have questions concerning this statement, please contact Valerie C. Melvin, Director, Information Management and Technology Resources Issues, at (202) 512-6304 or melvinv@gao.gov. Other individuals who made key contributions include Teresa F. Tucker (Assistant Director), Amanda C. Gill, and Lee A. McCracken. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: The Centers for Medicare and Medicaid Services (CMS) is responsible for administering and safeguarding its programs from loss of funds. As GAO reported in June 2011, CMS utilizes automated systems and tools to help improve the detection of improper payments for fraudulent, wasteful, and abusive claims. To integrate claims information and improve its ability to detect fraud, waste, and abuse in these programs, CMS initiated two information technology system programs: the Integrated Data Repository (IDR) and One Program Integrity (One PI). GAO was asked to testify on its earlier report that examined CMS's efforts to protect the integrity of the Medicare and Medicaid programs through the use of information technology. In that prior study, GAO assessed the extent to which IDR and One PI have been developed and implemented, and CMS's progress toward achieving its goals and objectives for using these systems to detect fraud, waste, and abuse. GAO previously reported that CMS had developed and begun using both IDR and One PI, but had not incorporated into IDR all data as planned. IDR is intended to be the central repository of Medicare and Medicaid data needed to help CMS and states' program integrity staff and contractors prevent and detect improper payments. Program integrity analysts use these data to identify patterns of unusual activities or transactions that may indicate fraudulent charges or other types of improper payments. IDR has been operational and in use since September 2006 but did not include all the data that were planned to be incorporated by fiscal year 2010. For example, IDR included most types of Medicare claims data, but not the Medicaid data needed to help analysts detect improper payments of Medicaid claims. According to program officials, these data were not incorporated because of obstacles introduced by technical issues and delays in funding. Until the agency finalizes plans and develops reliable schedules for efforts to incorporate these data, CMS may face additional delays in making available all the data that are needed to support enhanced Medicare and Medicaid program integrity efforts. Additionally, CMS had not taken steps to ensure widespread use of One PI to enhance efforts to detect fraud, waste, and abuse. One PI is a web-based portal that is to provide CMS staff and contractors, and Medicaid analysts with a single source of access to data contained in IDR, as well as tools for analyzing those data. While One PI had been developed and deployed to users, no Medicaid analysts and only a few Medicare program integrity analysts were trained and using the system. Specifically, One PI program officials planned for 639 program integrity analysts, including 130 Medicaid analysts, to be using the system by the end of fiscal year 2010; however, as of October 2010, only 41--less than 7 percent--were actively using the portal and tools. According to program officials, the agency's initial training plans were insufficient and, as a result, they were not able to train the intended community of users. Until program officials finalize plans and develop reliable schedules for training users and expanding the use of One PI, the agency may continue to experience delays in reaching widespread use of the system. While CMS had made progress toward its goals to provide a single repository of data and enhanced analytical capabilities for program integrity efforts, the agency was not yet positioned to identify, measure, and track benefits realized from its efforts. As a result, it was unknown whether IDR and One PI as implemented had provided financial benefits. According to IDR officials, they did not measure benefits realized from increases in the detection rate for improper payments because they relied on business owners to do so; One PI officials stated that, because of the limited use of that system, there were not enough data to measure and gauge the program's success toward achieving the $21 billion in financial benefits that the agency projected. GAO is not making new recommendations at this time. GAO recommended in June 2011 that CMS take actions to finalize plans and schedules for achieving widespread use of IDR and One PI, and to define measurable benefits. CMS concurred with GAO's recommendations.