Title XIX of the Social Security Act establishes Medicaid as a joint federal- state program to finance health care for certain low-income, aged, or disabled individuals. Medicaid is an entitlement program, under which the federal government is obligated to pay its share of expenditures for covered services provided to eligible individuals under each state’s federally approved Medicaid plan. States operate their Medicaid programs by paying qualified health care providers for a range of covered services provided to eligible beneficiaries and then seeking reimbursement for the federal share of those payments. Although the federal government establishes broad federal requirements for the Medicaid program, states can elect to cover a range of optional populations and benefits. CMS, within HHS, is responsible for administering legislation and regulations affecting the Medicaid program, including disbursement of federal matching funds. CMS also provides guidelines, technical assistance, and periodic assessments of state Medicaid programs. Title XIX of the Social Security Act allows flexibility in the states’ Medicaid plans. Guidelines established by federal statutes, regulations, and policies allow each state some flexibility to (1) broaden its eligibility standards; (2) determine the type, amount, duration, and scope of services; (3) set the rate of payment for services; and (4) administer its own program, including enrollment of providers and beneficiaries, processing and monitoring of medical claims, payment of claims, and maintenance of fraud prevention programs. Controlled Substances Act The Controlled Substances Act of 1970 (CSA) established a classification structure for certain drugs and chemicals used in drug manufacturing. Controlled substances are classified into five schedules on the basis of their currently accepted medical use and potential for abuse and dependence. Schedule I drugs—including heroin, marijuana, and hallucinogens such as LSD—have a high potential for abuse, no currently accepted medical uses in treatment in the United States, and a lack of accepted safety for use under medical supervision. Schedule II drugs— including methylphenidate (Ritalin) and opiates such as morphine and oxycodone—have high potential for abuse and abuse may lead to severe psychological or physical dependence, but have currently accepted medical uses. Drugs on Schedules III through V have medical uses and successively lower potentials for abuse and dependence. Schedule III drugs include anabolic steroids, codeine, hydrocodone in combination with aspirin or acetaminophen, and some barbiturates. Schedule IV contains such drugs as the anti-anxiety medications diazepam (Valium) and alprazolam (Xanax). Schedule V includes preparations such as cough syrups with codeine. All drugs but those in Schedule I are legally available to the public with a prescription. CSA mandates that DEA establish a closed system of control for manufacturing, distributing, and dispensing controlled substances. Any person who manufactures, dispenses, imports, exports, or conducts research with controlled substances must register with DEA (unless exempt), keep track of all stocks of controlled substances, and maintain records to account for all controlled substances received, distributed, or otherwise disposed of. Although all registrants, including pharmacies, are required to maintain records of controlled substance transactions, only manufacturers and distributors are required to report their Schedule I and II drugs and Schedule III narcotics drug transactions, including sales to the retail level, to DEA. The data provided to DEA are available for use in investigations of illegal diversions. The act does not require pharmacies to report dispensing information at the patient level to DEA. We found tens of thousands of Medicaid beneficiaries and providers involved in potential fraudulent, wasteful, and abusive purchases of controlled substances through the Medicaid program in the selected states during fiscal years 2006 and 2007. The fraud, waste, and abuse activities that we examined in our analysis include the following: beneficiaries acquiring addictive medication from multiple medical practitioners, known as doctor shopping, to feed their habits, sell on the street, or both; medical practitioners and pharmacies barred from receiving federal funds nevertheless writing and filling Medicaid prescriptions; and prescriptions being paid for with Medicaid funds for dead beneficiaries and for prescriptions attributed to dead doctors by pharmacies. Approximately 65,000 Medicaid beneficiaries in the five states investigated visited six or more doctors to acquire prescriptions for the same type of controlled substances in the selected states during fiscal years 2006 and 2007. These individuals incurred approximately $63 million in Medicaid costs for these drugs, which were painkillers, sedatives, and stimulants. In some cases, beneficiaries may have justifiable reasons for receiving prescriptions from multiple medical practitioners, such as visiting specialists or several doctors in the same medical group. However, our analysis of Medicaid claims found that at least 400 of them visited 21 to 112 medical practitioners and up to 46 different pharmacies for the same controlled substances. In these situations, Medicaid beneficiaries were likely seeing several medical practitioners to support and disguise their addiction or to obtain drugs to fraudulently sell. Our analysis understates the number of instances and dollar amounts involved in the potential abuse related to multiple medical practitioners. First, the total we found does not include related costs associated with obtaining prescriptions, such as visits to the doctor’s office and emergency room. Second, the selected states did not identify the prescriber for many Medicaid claims submitted to CMS. Without such identification, we could not always identify and thus include the number of unique doctors for each beneficiary who received a prescription. Third, our analysis did not focus on all controlled substances, but instead targeted 10 types of the most frequently abused controlled substances, as shown in table 1. Table 2 shows how many beneficiaries received controlled substances and the number of medical practitioners who prescribed them the same type of drug. We found that 65 medical practitioners and pharmacies in the selected states had been barred from federal health care programs, excluded from these programs, or both, including Medicaid, when they wrote or filled Medicaid prescriptions for controlled substances during fiscal years 2006 and 2007. Nevertheless, Medicaid approved the claims at a cost of approximately $2.3 million. The offenses that led to their banishment from federal health programs included Medicaid fraud and illegal diversion of controlled substances. Our analysis understates the total number of excluded providers because the selected states either did not identify the prescribing medical practitioner for many Medicaid claims (i.e., the field was blank) or did not provide the taxpayer identification number for the practitioner, which was necessary to determine if a provider was banned. The banned providers we identified had been placed on one or both of the following exclusion lists, which Medicaid officials must check before paying for a prescription claim: the List of Excluded Individuals/Entities (LEIE), managed by HHS, and the Excluded Parties List System (EPLS), managed by GSA. The LEIE provides information on health care providers that are excluded from participation in Medicare, Medicaid, and other federal health care programs because of criminal convictions related to Medicare or state health programs or other major problems related to health care (e.g., patient abuse or neglect). The EPLS provides information on individuals or entities that are debarred, suspended, or otherwise excluded from participating in any other federal procurement or nonprocurement activity. Federal agencies can place individuals or entities on the GSA debarment list for a variety of reasons, including fraud, theft, bribery, and tax evasion. Our analysis of matching Medicaid claims in the selected states with SSA’s Death Master File (DMF) found that controlled substance prescription claims to over 1,800 beneficiaries were filled after they died. Even though the selected state programs assured us that beneficiaries were promptly removed from Medicaid following their deaths based on either SSA DMF matches or third-party information, these same state programs paid over $200,000 for controlled substances during fiscal years 2006 and 2007 for postdeath controlled substance prescription claims. In addition, our analysis also found that Medicaid paid about $500,000 in Medicaid claims based on controlled substance prescriptions “written” by over 1,200 doctors after they died. The extent to which these claims were paid because of fraud is not known. For example, in the course of our work, we found that certain nursing homes use long-term care pharmacies to fill prescriptions for drugs. One long-term care pharmacy dispensed controlled substances to over 50 beneficiaries after the dates of their deaths because the nursing homes did not notify the pharmacy of their deaths before delivery of the drugs. The nursing homes that received the controlled substances, which included morphine, Demerol, and Fentanyl, were not allowed to return them because, according to DEA officials, CSA does not permit such action. Officials at two selected states said that unused controlled substances at nursing homes represent a waste of Medicaid funds and also pose risk of diversion by nursing home staff. In fact, officials from one state said that the certain nursing homes dispose of these controlled substances by flushing them “down the toilet,” which also poses environmental risks to our water supply. In addition to performing the aggregate-level analysis discussed above, we also performed in-depth investigations for 25 cases of fraudulent, improper, and abusive actions related to the prescribing and dispensing of controlled substances through the Medicaid program in the selected states. Table 3 shows a breakdown of the types of cases that we identified from our analysis and confirmed through our investigations. In the course of our investigation, as we pursued leads produced from our data mining, we also found two other types of fraudulent, improper, and abusive actions, as shown in table 4. As noted in table 4, we are highlighting six examples where a doctor’s DEA registration did not authorize the doctor to prescribe a particular schedule of controlled substance. Under CSA, controlled substances are classified into five schedules based on the extent to which the drugs have an accepted medical use and their potential for abuse and degree of psychological or physical dependence. Schedule II includes what are considered by DEA to be the most addictive and abused drugs that legally can be prescribed. Schedule V, meanwhile, covers those that are least likely to cause such problems. Each provider must obtain a valid registration from DEA that reflects the schedule(s) of controlled substances the provider is authorized to store, dispense, administer, or prescribe. For example, if a physician wants the authority to prescribe Schedule II drugs, the physician must register and be granted authority by DEA to do so. As noted in table 4, we also found two cases where the physician prescribed controlled substances in excess of medical need. In one of these cases, our investigators found that the physician prescribed a controlled substance in a manner intended to circumvent Medicaid’s dosage limitations. In the other, the beneficiary sold excess controlled substances (in this case, painkillers). Table 5 summarizes 15 of the 25 cases we developed of fraudulent, improper, and abusive controlled substance activities in the Medicaid program. Appendix I provides details on the other 10 cases we examined. We have referred certain cases to DEA and the selected states for further criminal investigation. The following provides illustrative detailed information on four cases we investigated. Case 2: The beneficiary used the identity of an individual who was killed in 1980 to receive Medicaid benefits. According to a state Medicaid official, he originally applied for Medicaid assistance at a California county in January 2004. During the application process, the man provided a Social Security card to a county official. When the county verified the SSN with SSA, SSA responded that the SSN was not valid. The county enrolled the beneficiary into Medicaid provisionally for 90 days under the condition that the beneficiary resolve the SSN discrepancy with SSA within that time frame. Although the beneficiary never resolved the issue, he remained in the Medicaid program until April 2007. From 2004 through 2007, the Medicaid program paid for over $200,000 in medical services. This included at least $2,870 for controlled substances that he received from the pharmacies. We attempted to locate the beneficiary but could not locate him. Case 8: The physician prescribed controlled substances to the beneficiary after she died in February 2006. The physician stated that the beneficiary had been dying of a terminal disease and became unable to come into the office to be examined. The physician stated that in instances where a patient is compliant and needs pain medication, physicians will sometimes prescribe it without requiring an examination. A pharmacy eventually informed the physician that the patient had died and the patient’s spouse had continued to pick up her prescriptions for Methadone, Klonopin, and Xanax after her death. According to the pharmacy staff, the only reason they became aware of the situation was when an acquaintance of the spouse noticed him picking up prescriptions for a wife who had died months ago. The acquaintance informed the pharmacy staff of the situation. They subsequently contacted the prescribing physician. Since this incident, the pharmacy informed us that it has not filled another prescription for the deceased beneficiary. Case 9: A mother with a criminal history and Ritalin addiction used her child as a means to doctor shop for Ritalin and other similar controlled stimulants used to treat ADHD. Although the child received overlapping prescriptions of methylphenidate and amphetamine medications during a 2-year period and was banned (along with his mother) from at least three medical practices, the Illinois Medicaid Program never placed the beneficiary on a restricted recipient program. Such a move would have restricted the child to a single primary care, pharmacy, or both thus preventing him (and his mother) from doctor shopping. Over the course of 21 months, the Illinois Medicaid Program paid for 83 prescriptions of ADHD controlled stimulants for the beneficiary, which totaled approximately 90,000 mg and cost $6,600. Case 11: Claims indicated that a deceased physician “wrote” controlled substance prescriptions for several patients in the Houston area. Upon further analysis, we discovered that the actual prescriptions were signed by a physician assistant who once worked under the supervision of the deceased physician. The pharmacy neglected to update its records and continued filling prescriptions under the name of the deceased prescriber. The physician assistant has never been a DEA registrant. The physician assistant told us that the supervising physicians always signed prescriptions for controlled substances. After informing her that we had copies of several Medicaid prescriptions that she had signed for Vicodin and lorazepam, the physician assistant ended the interview. Although states are primarily responsible for the fight against Medicaid fraud and abuse, CMS is responsible for overseeing state fraud and abuse control activities. CMS has provided limited guidance to the states on how to improve their control measures to prevent fraud and abuse of controlled substances in the Medicaid program. Thus, for the five state programs we reviewed, we found different levels of fraud prevention controls. For example, the Omnibus Budget Reconciliation Act of 1990 encourages states to establish a Drug Utilization Review (DUR) Program. The main emphasis of the program is to promote patient safety through an increased review and awareness of prescribed drugs. States receive increased federal funding if they design and install a point-of-sale electronic prescription claims management system to interact with their Medicaid Management Information Systems (MMIS), each state’s Medicaid computer system. Each state was given considerable flexibility in how to identify prescription problems, such as therapeutic duplication and overprescribing by providers, and how to use MMIS to prevent such problems. The level of screening, if any, states perform varies because CMS does not set minimum requirements for the types of reviews or edits that are to be conducted on controlled substances. Thus, one state requires prior approval when ADHD treatments like Ritalin and Adderall are prescribed outside age limitations, while another state had no such controlled substance requirement at the time of our review. Recently, under the Deficit Reduction Act of 2005 (DRA), CMS is required to initiate the Medicaid Integrity Program (MIP) to combat Medicaid fraud, waste, and abuse. DRA requires CMS to enter intocontracts with Medicaid integrity contractors (MIC) to review provideractions, audit provider claims and identify overpayments, and cond uct provider education. To date, CMS has awarded umbrella contracts to several contractors to perform the functions outlined above. According to CMS, these contractors cover 40 states, 5 territories, and the Distri Columbia. CMS officials stated that CMS will award task orders to cover the rest of the country by the end of fiscal year 2009. CMS officials stated that MIC audits are currently under way in 19 states. CMS officials stated that most of the MIP reviews will focus on Medicaid providers and that the state Medicaid programs will handle beneficiary fraud. Because the Medicaid program covers a full range of health care services and the prescription costs associated with controlled substances is relatively small, the extent to which MICs focus on controlled substances is likely to be relatively minimal. In addition, CMS is required to provide effective support and assistance to states in their efforts to combat Medicaid provider fraud and abuse. investigations and prosecutions to design more effective preventive controls. Preventive controls: Fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse. Thus, controls that prevent fraudulent health care providers and individuals from entering the Medicaid program or submitting claims are the most important element in an effective fraud prevention program. Effective fraud prevention controls require that where appropriate, organizations enter into data-sharing arrangements with organizations to perform validation. System edit checks (i.e., built-in electronic controls) are also crucial in identifying and rejecting fraudulent enrollment applications, fraudulent claims, or both before payments are disbursed. Some of the preventive controls and their limitations that we observed at the selected states include the following. Federal debarment and exclusion: Federal regulation requires states to ensure that no payments are made for any items or services furnished, ordered, or prescribed by an individual or entity that has been debarred from federal contracts, excluded from Medicare and Medicaid programs, or both. Officials from all five selected states said that they do not screen prescribing providers or pharmacies against the federal debarment list, also known as the EPLS. Further, officials from four states said that when a pharmacy claim is received, they do not check to see if the prescribing provider was excluded by HHS OIG from participating in the Medicaid program. DEA registration: DEA, on behalf of the Attorney General of the United States, is the agency primarily responsible for enforcing CSA. Federal regulations require physicians and pharmacies to be registered with DEA for the controlled substance schedule(s) that they are authorized to prescribe or dispense. According to DEA officials, DEA can take administrative action against a provider who violates CSA or its implementing regulations, such as revoking DEA registration. Legal action against the provider is also a possibility. Although DEA’s registrant database is available for purchase by the public through the Department of Commerce’s National Technical Information Service, none of the five state Medicaid offices obtained the database at the time of our study to determine if physicians are authorized to prescribe particular controlled substances. Thus, the selected state Medicaid programs do not screen prescription claims for controlled substances to ensure that a health care provider is authorized to prescribe the particular drug(s). Further, DEA officials stated that pharmacies have corresponding responsibility to determine if a prescription is legitimate, which includes determining whether a health care provider is authorized to prescribe the particular schedule of controlled substance before filling a prescription. However, none of the pharmacy boards of the selected states said that this is a requirement they monitor. In fact, four pharmacy boards stated that the states only require that their pharmacists check to see if the DEA number on the prescription appears to be a valid DEA number, without verifying it with the DEA registration database. Duplicate enrollment: Medicaid officials in two states said that they did not have pre-enrollment checks in place to provide assurance that duplicate applications are not approved. One state does not even require the beneficiary to furnish an SSN when applying for the Medicaid program, thus making this fraud difficult to identify. In fact, during the period covered by our work, this state had 4,296 Medicaid beneficiaries who were enrolled without SSNs. These beneficiaries were approved for about 8,300 controlled substances claims, totaling $193,500. We did not investigate these beneficiaries for fraud or abuse. DUR: As mentioned earlier, states perform DURs and other controls during the prescription claims process to promote patient safety, reduce costs, and prevent fraud and abuse. The DURs include prospective screening and edits for potential inappropriate drug therapies, such as overutilization, drug-drug interaction, or therapeutic duplication. In addition, selected states also require health care providers to submit prior authorization forms for certain prescriptions of drugs because those medications have public health concerns, are considered high risk for fraud and abuse, or both. Each state has developed its DUR differently, and some of the differences that we saw from the selected states include the following: Officials from certain states said that they use the results of prospective screening (e.g., findings of overutilization, overlapping controlled substance prescriptions, etc.) as an automatic denial of the prescription. Officials from the other states generally use the prospective screening as more of an advisory tool for pharmacies, which pharmacies can override by entering a reason code. As such, the effectiveness of the tool for preventing fraud and abuse in these states is more limited. The types of drugs that require prior authorization vary greatly between the selected states. In states where it is used, health care providers may be required to obtain prior authorization if a specific brand name is prescribed (e.g., OxyContin) or if a dosage exceeds a predetermined amount for a therapeutic class of controlled substances (e.g., hypnotics, narcotics). Detection and monitoring: Even with effective preventive controls, there is risk that fraud and abuse will occur in Medicaid regarding controlled substances. States must continue their efforts to monitor the execution of the prescription program, including periodically matching their beneficiary files to third-party databases to determine continued eligibility, monitor controlled substance prescriptions to identify abuse, and make necessary corrective actions. Such actions include the following. Checking death files: After enrolling beneficiaries, Medicaid offices in the selected states generally did not periodically compare their information against death records. Specifically, two of the five selected states said that they did not obtain death records from SSA or the state vital statistics office to determine if a Medicaid beneficiary was still alive. Officials from two states said that Medicaid offices primarily rely on obituaries, providers, family members, or others to report the status change of the beneficiary. Increasing the use of the restricted recipient program: In the course of DURs or audits, the state Medicaid offices may identify beneficiaries who have abused, the Medicaid prescription drug program, defrauded the program, or both. In those cases, the selected states may place the beneficiaries into a restricted recipient program. Under this program, the state Medicaid office restricts the beneficiaries to one health care provider, one pharmacy, or both for receiving prescriptions. This program only applies to those beneficiaries in a fee-for-service arrangement since managed care organizations are responsible for determining the quality of care treatments for their enrollees. Thus, a significant portion of the Medicaid recipients for some of the selected states are not subject to this program. Fully utilizing the prescription drug monitoring program: Beginning in fiscal year 2002, Congress appropriated funding to the Department of Justice to support prescription drug monitoring programs (PDMP). These programs help prevent and detect the diversion and abuse of pharmaceutical controlled substances, particularly at the retail level where no other automated information collection system exists. States that have implemented PDMPs have the capability to collect and analyze data on filled and paid prescriptions more efficiently than those without such programs, where the collection of prescription information can require a time- consuming manual review of pharmacy files. If used properly, PDMPs are an effective way to identify and prevent diversion of the drugs by health care providers, pharmacies, and patients. The PDMPs at the selected states have the following limitations: For PDMPs to be useful, health care providers and pharmacies must use the data. Officials from the five selected states said that physician participation in the PDMP is not widespread and not required. In fact, one state did not have a Web-based PDMP; a health care provider has to put in a manual request to the agency to have a controlled substance report generated. Program officials at the selected states said that their systems were primarily used to respond to requests for controlled substance information on specific patients from medical practitioners. None of the selected states compared all the prescribers of controlled substances to the DEA authorization list to identify medical practitioners who are illegally prescribing drugs that they are not authorized to prescribe. Although the PDMPs generally capture the name and address of the patient, the controlled substance prescribed, the date of the prescription, and the identity of the prescriber, they generally do not capture the method of payment that the patient used. Thus, the system will not differentiate between prescriptions paid in cash and those paid using health insurance. One state restricts law enforcement access to the PDMP to only the state bureau of investigation. As such, local police and sheriff’s departments cannot access the data, which impedes their ability to conduct prescription drug diversion investigations. According to state officials, the limitation was enacted because of privacy concerns. No nationwide PDMP exists, and only 33 states had operational PDMPs as of June 2009. According to an official in one of the selected states, people would sometimes cross state borders to obtain prescription drugs in a state without a program. Investigations and prosecutions: Another element of a fraud prevention program is the aggressive investigation and prosecution of individuals who defraud the federal government. Prosecuting perpetrators serves as a preventive measure; it sends the message that the government will not tolerate individuals stealing money. Schemes identified through investigations and prosecution also can be used to improve the fraud prevention program. The MFCU serves as the single identifiable entity within a state government that investigates and prosecutes health care providers who defraud the Medicaid program. In the course of our investigation, however, we found several factors that may limit its effectiveness. Federal regulations generally limit MFCUs from pursuing beneficiary fraud. According to MFCU officials at one selected state, this limitation impedes investigations because agents cannot use the threat of prosecution as leverage to persuade beneficiaries to cooperate in criminal probes of Medicaid providers. In addition, the MFCU officials in this selected state said that this limitation restricts the agency’s ability to investigate organized crime related to controlled substances when the fraud is perpetrated by the beneficiaries. Federal regulations do not permit federal funding for MFCUs to engage in routine computer screening activities that are the usual monitoring function of the Medicaid agency. According to MFCU officials in one selected state, this issue has caused a strained working relationship with the state’s Medicaid OIG, on whom the MFCU relies for claims information. The MFCU official stated that based on fraud trends in other states, the state MFCU wanted the Medicaid OIG to provide claims information on providers who had similar trends in that state. The Medicaid OIG cited this prohibition on routine computer screening activities when refusing to provide these data. In addition, this MFCU official also stated that the state Medicaid office and its OIG did not promptly incorporate improvements that the MFCU suggested regarding preventing the abuse of controlled substances. DEA officials stated that although DEA monitors purchases of certain Schedule II and III controlled substances by pharmacies, it does not routinely receive information regarding written or dispensed controlled substance prescriptions. In states with PDMPs, a state agency collects and maintains data relating to dispensed controlled substance prescriptions. In the course of an investigation regarding the diversion or abuse of controlled substances, DEA may request information from a PDMP. In those states without PDMPs, DEA may obtain controlled substance prescription information from an individual pharmacy’s records during the course of an inspection or investigation. Fraud and abuse related to controlled substances paid for by Medicaid exist in the five selected states. Given that states are responsible for administering Medicaid and investigating and prosecuting any fraudulent activities, each state must set its own course to ensure the integrity of its Medicaid program, including its monitoring of the dispensing and use of controlled substances. CMS is also responsible for actively partnering with and providing guidance to the states to ensure that they succeed in minimizing fraud and abuse in the Medicaid program. To establish an effective fraud prevention system for the Medicaid program, we recommend that the Administrator of CMS evaluate our findings and consider issuing guidance to the state programs to provide assurance that claims processing systems prevent the processing of claims from providers and pharmacies debarred from federal contracts (i.e., on the EPLS), excluded from the Medicare and Medicaid programs (i.e., on the LEIE), or both; DUR and restricted recipient program requirements adequately identify and prevent doctor shopping and other abuses of controlled substances; effective claims processing system are in place to periodically identify both duplicate enrollments and deaths of Medicaid beneficiaries and to prevent the approval of claims when appropriate; and effective claims processing systems are in place to periodically identify deaths of Medicaid providers and prevent the approval of claims when appropriate. We provided a draft of this report to DEA and CMS for comment. DEA provided us technical comments by e-mail. CMS comments are reprinted in appendix II. CMS stated that it generally agrees with the four recommendations. CMS stated that it will continue to evaluate its programs and will work to develop methods to address the identified issues found in this report. CMS provided us two comments regarding our recommendations. First, CMS stated that we should be more specific as to the databases that the states should access in screening for debarred providers. Second, CMS also stated that we recommend that DEA make its registrant database available to the states without a fee. Third, CMS stated that information on deceased providers and beneficiaries could be provided by a feed from SSA. CMS also provided us two technical comments to the report. In response to CMS comment on the specificity of databases, we revised the recommendation to specify the two databases that should be used in screening claims: (1) the EPLS on federal debarments and (2) Medicare and Medicaid exclusions (i.e., the LEIE) maintained by HHS OIG. As stated in the report, both of these databases are required to be used by the states before they pay prescription claims. We did not recommend that states use the DEA registration database in the processing of Medicaid controlled substance claims, and thus we do not make any recommendations to DEA at this time. In response to CMS’s comment about screening for deceased providers and beneficiaries, we agree with CMS that SSA data can be used in determining the eligibility of Medicaid beneficiaries and providers. In developing its guidance to the states, we believe that CMS should consider SSA death records and other sources to identify deceased Medicaid providers and beneficiaries. We incorporated the technical comments made by DEA and CMS into the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. We will then send copies of this report to interested congressional committees and the Acting Administrators of CMS and DEA. The report also will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-6722 or kutzg@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Table 5, in the main portion of the report, provides data on 15 detailed case studies. Table 6 provides details of the remaining 10 cases we selected. As with the 15 cases discussed in the body of this report, we also found fraudulent, improper, and abusive controlled substances activities in Medicaid for these 10 cases. In addition to the contact named above, the following individuals made major contributions to this report: Matthew Harris, Assistant Director; Matthew Valenta, Assistant Director; Erika Axelson; Paul Desaulniers; Eric Eskew; Dennis Fauber; Alberto Garza; Robert Graves; Barbara Lewis; Olivia Lopez; Steve Martin; Vicki McClure; Kevin Metcalfe; Gloria Proa; Chris Rodgers; Ramon Rodriguez; and Barry Shillito.

Summary: One significant cost to Medicaid is prescription drugs, which accounted for over $23 billion in fiscal year (FY) 2008, or about 7 percent of total Medicaid outlays. Many of these drugs are susceptible to abuse and include pain relievers and stimulants that are on the Drug Enforcement Administration's (DEA) Schedule of Controlled Substances. As part of the American Recovery and Reinvestment Act of 2009 (ARRA), the Medicaid program will receive about $87 billion in federal assistance based on a greater federal share of Medicaid spending. GAO was asked to determine (1) whether there are indications of fraud and abuse related to controlled substances paid for by Medicaid; (2) if so, examples of fraudulent, improper, and abusive activity; and (3) the effectiveness of internal controls that the federal government and selected states have in place to prevent fraud and abuse related to controlled substances. To meet these objectives, GAO analyzed Medicaid controlled substance claims for fraud and abuse indications for FY 2006 and 2007 from five selected states. GAO also interviewed federal and state officials and performed investigations. GAO found tens of thousands of Medicaid beneficiaries and providers involved in potential fraudulent purchases of controlled substances, abusive purchases of controlled substances, or both through the Medicaid program in California, Illinois, New York, North Carolina, and Texas. About 65,000 Medicaid beneficiaries in the five selected states acquired the same type of controlled substances from six or more different medical practitioners during fiscal years 2006 and 2007 with the majority of beneficiaries visiting from 6 to 10 medical practitioners. Such activities, known as doctor shopping, resulted in about $63 million in Medicaid payments and do not include medical costs (e.g., office visits) related to getting the prescriptions. In some cases, beneficiaries may have justifiable reasons for receiving prescriptions from multiple medical practitioners, such as visiting specialists or several doctors in the same medical group. However, GAO found that other beneficiaries obtained these drugs to support their addictions or to sell on the street. In addition, GAO found that Medicaid paid over $2 million in controlled substance prescriptions during fiscal years 2006 and 2007 that were written or filled by 65 medical practitioners and pharmacies barred, excluded, or both from federal health care programs, including Medicaid, for such offenses as illegally selling controlled substances. Finally, GAO found that according to Social Security Administration data, pharmacies filled controlled substance prescriptions of over 1,800 beneficiaries who were dead at that time. GAO performed in-depth investigations on 25 Medicaid cases and found fraudulent, improper, or abusive actions related to the prescribing and dispensing of controlled substances. These investigations uncovered other issues, such as doctors overprescribing medication and writing controlled substance prescriptions without having required DEA authorization. States are primarily responsible for the fight against Medicaid fraud; however, the selected states did not have a comprehensive fraud prevention framework to prevent fraud and abuse of controlled substances. CMS is responsible for overseeing state fraud and abuse control activities but has provided limited guidance to the states to prevent fraud and abuse of controlled substances.