The FEHBP is the largest employer-sponsored health insurance program in the country. In 2012, it provided $42.6 billion in health care benefits to about 8 million individuals. OPM contracts with carriers to provide this coverage. Carriers offer plans in which eligible individuals may enroll to receive health care coverage. For the 2012 plan year, FEHBP options included 10 fee-for-service plans that were available nationwide, 4 plans available only to employees of certain federal agencies (e.g., the Foreign Service), 164 plans offered by health maintenance organizations that were available in certain regions (but not the entire country), 15 high- Most enrollees could deductible plans, and 13 consumer-driven plans.choose from about 6 to 15 plans. The majority of FEHBP policyholders— more than 60 percent—were in plans offered by the Blue Cross and Blue Shield Association. The next largest carriers or groups of carriers in terms of FEHBP enrollment were GEHA and Kaiser Permanente, each with between 5 percent and 10 percent of FEHBP policyholders. Through their contributions toward premiums, the federal government and enrollees bear a portion of the cost of FEHBP fraud and abuse programs. Generally, as set by statute, the government pays 72 percent of the average premium across all FEHBP plans, but no more than 75 percent of any particular plan’s premium. Enrollees pay the balance. Premiums are intended to cover enrollees’ health care costs, plans’ administrative expenses (including expenses associated with fraud and abuse programs), reserve accounts specified by law, plan profits, and OPM’s administrative costs. OPM negotiates plan premiums with carriers and establishes premiums in one of two ways: Experience-rated carriers set their premiums based on their experience, that is, their actual costs of providing health care services and the costs of administrative services. Experience-rated carriers may offer fee-for-service plans or they may be local health maintenance organizations. Of the $42.6 billion in expenses incurred by the FEHBP in 2012, the majority—84 percent—was for the benefits and administrative expenses of experience-rated carriers. Community-rated carriers are generally health maintenance organizations that set their FEHBP premiums based on a documented methodology that is applied to other groups of insured individuals in the same geographic community. These carriers receive fixed payments—the premiums—for each enrollee, rather than receiving payments for services rendered. Administrative costs are included in the payment rate. In fiscal year 2012, the FEHBP paid $6.7 billion to community-rated carriers. Carriers’ costs for fraud and abuse programs are included with other administrative costs (for experience-rated carriers) or within the fixed payments (for community-rated carriers). As a result, the amounts that carriers spend to prevent, detect, or correct fraud and abuse are not clearly identifiable. OPM is required to administer contingency reserve funds for FEHBP carriers, which can help avoid major fluctuations in the FEHBP premiums from year to year. OPM administers a contingency reserve fund in the U.S. Treasury for each FEHBP plan, and unexpended contingency reserves are carried forward. Experience-rated carriers may draw upon their individual contingency reserve funds if claims are larger than anticipated, or, if the balance is large enough, to avoid or reduce a premium increase for the following year. For community-rated carriers, OPM may negotiate an adjustment to the plan’s rates under certain circumstances and use the contingency funds to pay for the adjustment. For example, if the community rate changes between the time the carrier estimated its rates (generally in spring) and the time that coverage through the plan became effective (the following January), OPM negotiates an adjustment. OPM can adjust carriers’ profits based on performance, including the performance of fraud and abuse programs, using mechanisms that differ by the type of plan. There is no minimum profit. For experience-rated carriers, OPM negotiates the plan’s profit rate by determining a service charge using a process outlined in regulation that takes the plan’s The service charge (or profit) for performance into consideration. experience-rated carriers may not exceed 1.1 percent of the plan’s projected claims and administrative fees. For community-rated carriers, profits reflect the difference between the premiums and the actual costs. Because they are not capped at a percentage of projected costs, profits for community-rated carriers may be greater than profits for experience- rated carriers. Regulations specify a process for OPM to consider a community-rated plan’s performance and assess a penalty of up to 1 percent of the total premium payment. These penalties, which reduce the carrier’s profits, may be assessed for noncompliance with contract requirements, including fraud and abuse program requirements. (Service charges apply only to experience-rated plans, while penalties apply only to community-rated ones.) Fraud and abuse in FEHBP plans affect the government, enrollees, and carriers because fraud and abuse can add to premium costs, reduce program reserves, or both. incentive to minimize fraud and abuse because raising premiums may make their plans less appealing to potential enrollees than plans offered by FEHBP carriers that have less fraud and abuse. Community-rated carriers, which receive fixed payments for each enrollee rather than payments for services rendered, have an additional financial incentive to establish effective fraud and abuse programs because they can keep any savings above and beyond the cost of establishing and maintaining the programs. In general, however, carriers have an All carriers are susceptible to fraud and abuse, although the specific vulnerabilities vary by the type of carrier. Experience-rated carriers that offer fee-for-service plans are at particular risk for forms of fraud or abuse associated with excess payments for care, for example, through billing for services that are not medically necessary. Community-rated carriers, which receive fixed payments for each enrollee rather than payments for services rendered, are at particular risk for forms of fraud or abuse that reduce the costs of providing care, for example, through inappropriate dilution of medications. If a carrier’s reserves are insufficient to cover its costs, including costs associated with fraud or abuse, the carrier must fund its losses. According to OPM officials, losses due to fraud and abuse would have to be substantial relative to legitimate costs for a carrier’s reserves to prove insufficient. Two offices within OPM have key responsibilities involving fraud and abuse within the FEHBP. The Healthcare & Insurance—Federal Employee Insurance Operations office, the contracting office, is responsible for administering the FEHBP, contracting with carriers, and overseeing carriers’ compliance. Oversight of carriers’ compliance with requirements and guidance related to fraud and abuse is part of the broader responsibility to ensure compliance. According to OPM officials, 7 contract officers, 16 contract specialists, and 7 audit resolution staff within the contracting office have general and discrete oversight responsibilities, in addition to staff in the office’s supporting branches (such as those providing program analyses and systems support). The OIG has responsibilities that involve two aspects of FEHBP fraud and abuse efforts. First, as a law enforcement agency, the OIG’s Office of Investigations may investigate potential fraud and abuse within the FEHBP. (App. I provides information on carrier and OIG fraud and abuse reporting requirements.) Second, as an oversight entity, the OIG’s Office of Audits conducts audits of FEHBP carriers. OIG officials told us that until recently the OIG’s audits of FEHBP carriers generally focused on audits of carriers’ claims and payments and not on the extent to which the plans comply with fraud and abuse program requirements. The OIG has begun including an in-depth examination of a carrier’s fraud and abuse program in some of its audits. These audits have included reviews of policies and procedures and reviews of files to determine whether potential fraud and abuse cases were reported as required. After conducting in-depth audits of the fraud and abuse programs of three of the larger FEHBP experience-rated carriers, the OIG questioned their effectiveness, in part because the programs’ outcomes, in terms of the prosecution of fraud cases and recovery of defrauded funds, were minimal. The OIG's findings from these audits included instances of failure to provide required notice of potential fraud or abuse, failure to report the amount of all recoveries of defrauded funds, and failure to include all relevant expenses when reporting the cost of anti-fraud activities. OPM requires FEHBP carriers to establish programs to prevent, detect, and eliminate fraud and abuse. FEHBP contracts contain minimum requirements for fraud and abuse programs; according to officials from OPM’s contracting office, these requirements accommodate differences in carrier characteristics and so allow flexibility in fraud and abuse program implementation. Each carrier is required by contract to: conduct a program to assess vulnerability to fraud and abuse; operate a system designed to detect, eliminate, and follow up on fraud submit a report on fraud and abuse by March 31 of each year; demonstrate that a statistically valid sampling technique is used routinely to compare FEHBP claims against the carrier’s quality assurance standards and its fraud and abuse prevention standards; maintain records of fraud prevention activities; implement any corrective actions ordered by an OPM contracting officer to correct a deficiency in its fraud prevention program; provide timely notification to the OIG of credible evidence of a violation of federal criminal law involving fraud found in Title 18 of the U. S. Code by a principal, employee, agent, or subcontractor; and provide timely notification to the contracting officer of any significant event, including fraud, that might reasonably be expected to have a material effect on the carrier’s ability to meet its obligations. OPM also uses letters to carriers to issue requirements and guidance. For example, one carrier letter imposes requirements for reporting potential fraud and abuse when a carrier has a reasonable suspicion that fraud against the FEHBP has occurred or is occurring. (As indicated above, app. I provides more information on carrier and OIG fraud and abuse reporting requirements.) Another carrier letter presented guidance on certain nonrequired standards for fraud and abuse programs. Specifically, OPM identified a set of eight industry standards for fraud and abuse programs (see text box), and in 2003, it issued a letter to carriers indicating that it would like carriers to implement these standards. Federal Acquisition Regulations require that each FEHB carrier must perform the contract in accordance with prudent business practices, which include timely compliance with OPM instructions and directives. 48 C.F.R. § 1609.7001(b)(1), (c)(4). Therefore, carriers must comply with requirements contained in carrier letters. OPM’s contracting office staff conduct several activities to monitor carriers’ compliance with fraud and abuse program requirements and agency guidance, including reviewing carriers’ annual reports to OPM’s contracting office, conducting site visits, reviewing and resolving OIG audit findings, and reviewing disputed claims and enrollee complaints. Contract officers use the information from these efforts to oversee carriers and to determine carriers’ service charges and penalties. Officials from OPM’s contracting office told us that contracting office staff assess carriers’ compliance with fraud and abuse program requirements and guidance, and monitor carriers’ performance by reviewing annual reports from carriers. In one routinely submitted report, the carrier describes its fraud and abuse program, including operational information; organizational structure; certain budget and cost allocation information; and performance indicators, such as how the carrier measures the performance of its antifraud efforts. Officials from OPM’s contracting office told us that they review this report and assess the information contained in the report against fraud and abuse program requirements to determine the extent to which carriers met, and were thus in compliance with, requirements. For example, OPM contracting office staff assess the reported information, such as the criteria the carrier uses for notifying the OIG of a potential fraud case, against OPM’s requirements for reporting cases of potential fraud to the OIG. A second report, specifically required by contract, provides additional information about the carrier’s fraud and abuse program and the carrier’s fraud and abuse activities and outcomes involving the FEHBP during the year. The report contains a checklist showing which of the nonrequired fraud and abuse industry standards the carrier and any subcontractors implemented. Officials from OPM’s contracting office told us that they assess this information against the fraud and abuse program guidance to determine the extent to which carriers implemented the recommended standards and to follow up with those that have not implemented them. For example, according to officials from OPM’s contracting office, a contracting officer contacts a carrier whose report indicates that it did not implement one of the components of a fraud and abuse program, such as having an antifraud policy statement. In following up with the carrier, the contracting officer indicates that OPM expects the carrier to implement the component and may conduct a site visit, request an OIG audit, or meet with the carrier to review evidence to confirm that the carrier has come into compliance with OPM’s expectation. Our review of a summary of carriers’ reports containing their responses to the industry standards checklist for 2012 indicated that most carriers submitted the report as required and their responses indicated compliance with fraud and abuse program guidance. Officials from OPM’s contracting office told us that, as part of their oversight, contracting officers follow up with carriers whose reports suggest possible noncompliance for the purpose of bringing them into compliance. However, OPM contracting office staff did not follow up with carriers that had not submitted their reports or whose reports indicated program deficiencies until July 2013, after we inquired about these carriers’ reports. Specifically, although 5 carriers did not submit reports by March 31, as required by contract, OPM contracting office staff did not begin following up with 4 of these carriers until July 2013, in response to our inquiry about OPM’s follow-up actions to obtain these reports. Based on 2011 enrollment data, we estimate that these carriers together accounted for about 0.1 percent of FEHBP enrollees. Most carriers submitted timely reports indicating that either they or a subcontractor had implemented the recommended, nonrequired industry standards for fraud and abuse programs. However, 7 carriers submitted reports indicating that neither they nor a subcontractor had implemented one or more of those standards. For example, 2 of the 7 carriers indicated that neither they nor a subcontractor had implemented a strategy for educating enrollees about fraudulent and abusive practices and 1 of these carriers had not published an antifraud policy statement or conducted formal fraud awareness training with all its employees. Based on 2011 enrollment data, we estimate that these 7 carriers together accounted for 0.8 percent of FEHBP enrollees. OPM contracting staff did not begin following up with these carriers until July 2013, after our inquiry, and as of August 2013 were still following up with 1 of these carriers. OPM contracting office staff also assess carriers’ compliance with fraud and abuse program requirements and guidance during periodic site visits. In contrast to the reviews of annual reports, which are performed remotely, site visits provide an opportunity for contracting office staff to collect, inspect, and follow up on fraud and abuse program information on-site. During site visits, OPM contracting office staff review carriers’ fraud and abuse program documents and information systems, conduct face-to-face meetings with carrier staff, and evaluate the extent to which the carrier’s program meets fraud and abuse program requirements and guidance. For example, during a site visit, OPM contracting office staff may review the carrier’s program and system for fraud prevention and detection, staffing, fraud awareness training, and examples of fraud and abuse program activities. As a result of their review, contracting office staff may recommend areas for improvement or note best practices. OPM contracting office staff conducted site visits that covered 96 carriers’ plans from 2008 through 2012 using a risk-based site selection strategy that included carrier type, enrollment, and special circumstances. Officials from OPM’s contracting office told us that although contracting officers select experience-rated carriers for site visits every 3 to 5 years, they may also select any experience-rated carrier for a site visit if the carrier experiences consistent or urgent problems. According to officials from OPM’s contracting office, in 2012, the 20 experience-rated carriers selected for site visits accounted for 69 percent of FEHBP enrollment.addition, the officials told us that OPM contracting office staff select community-rated carriers, which generally have smaller enrollments, for In site visits at their discretion and as OPM resources allow.7 community-rated carriers selected for site visits accounted for 0.55 percent of FEHBP enrollment, according to OPM contracting office officials. OPM contracting office staff review and resolve OIG audit findings as part of their oversight of carriers’ fraud and abuse programs. In comparison to reviews of annual reports of carriers’ self-reported compliance by OPM contracting office staff, OIG audit findings identify areas of noncompliance through an independent, on-site evaluation. Although site visits by both OPM contracting office staff and the OIG assess carrier compliance, only OIG audits assess the extent to which requirements and guidance have been implemented as the agency intended, according to OPM contracting office and OIG officials. OIG audits may also result in recommendations to OPM contracting officers to oversee carriers’ implementation of corrective actions intended to bring carriers into compliance. OPM contracting office staff provide input to the OIG on planned audits as part of the OIG’s risk-based audit selection strategy and may also request that the OIG conduct a special audit on an area of concern. For example, OPM contracting staff asked the OIG to assess one carrier’s internal controls for preventing and detecting illegal practices and made a request for a special audit to ensure one carrier’s compliance with contractual requirements. In June 2013, OIG officials told us that they had conducted eight audits that included findings related specifically to a carrier’s compliance with fraud and abuse program requirements. OPM contracting office staff address audit recommendations by overseeing carriers’ implementation of corrective action(s) in response to audit findings. To do so, contracting office staff review OIG audit findings and carriers’ responses to audit findings, including corrective actions and documentation supporting their implementation. For example, in one audit we reviewed, the OIG recommended that an OPM contracting officer verify that a carrier implements current policies and procedures regarding communication of information about potential fraud and abuse and develops and implements criteria for follow-up actions on reported cases of potential fraud or abuse. Officials from OPM’s contracting office told us that the carrier provided extensive documentation of its corrective actions in response to audit findings. The officials also reported that OPM contracting office staff are working with other carriers to address findings from recent audits and close the resulting recommendations. In addition to oversight of individual carriers, officials from OPM’s contracting office told us that audit findings and recommendations help them identify fraud and abuse program areas to focus on more broadly. For example, OPM contracting office staff identified carriers’ sharing of information about potential fraud and abuse as an area of concern after audit findings indicated that certain carriers were not communicating information about their fraud and abuse program activities as required. As a result, officials from OPM’s contracting office told us that they are reviewing documents from the OIG related to reporting and are in the process of working to determine whether the current reporting requirements are sufficient. As of August 2013, officials did not have a timeline for completion of this activity. OPM contracting office staff review disputed claims and enrollee complaints to identify indicators of potential fraud or abuse, among other things. Officials told us that contracting officers’ reviews of disputed claims may reveal suspicious patterns of drug utilization, multiple complaints involving a single provider, or other indicators of potential In addition to reviews of enrollees’ disputed claims, fraud or abuse.OPM contracting office staff review enrollees’ complaints about other aspects of the FEHBP, which could also indicate potential fraud or abuse, and they intervene as necessary. For example, in response to an FEHBP enrollee’s complaint regarding a carrier’s request for sensitive information, OPM contracting office staff examined and confirmed the legitimacy of the request. OPM’s contracting office staff use information from their monitoring activities—including their reviews of carriers’ annual reports, site visits, reviews of OIG audit findings, and reviews of disputed claims and enrollee complaints—when they determine carriers’ service charges or penalties. Officials from OPM’s contracting office told us that service charges or penalties may be adjusted to reflect noncompliance with fraud and abuse program requirements. For experience-rated carriers, up to 45 percent of the service charge is based on contractor performance, which includes failure to comply with contractual requirements. For community-rated carriers, 30 percent of the penalty determination is based on compliance with contractual requirements, with about half of that based on the timeliness of report submissions, including submissions of fraud and abuse reports. Officials from OPM’s contracting office provided us with several examples of their use of information from their monitoring activities when determining service charges: OPM contracting office staff used an experience-rated carrier’s failure to meet site visit scheduling, goals, and turn-around time as a negative factor and the carrier’s reduction in the total number of disputed claims submitted to OPM as a positive factor when determining the carrier’s 2012 service charge. OPM contracting office staff used the OIG’s audit findings that a carrier was not in compliance with fraud and abuse reporting requirements as a negative factor when determining the service charge for that carrier in 2013. OPM contracting office staff review certain outcomes of carriers’ fraud and abuse programs, but program outcomes do not provide complete information about program effectiveness. Instead, the program outcomes that OPM contracting office staff review provide partial information about carriers’ fraud and abuse programs and may be useful for reporting program accomplishments. For example, in 2011, carriers reported that the outcomes of their fraud and abuse programs included 29 criminal convictions and more than $23 million in recoveries to FEHBP. However, program outcomes do not measure the success of strategies intended to prevent or minimize fraud and abuse such as systems for preauthorization or precertification. OPM officials reported that although they are concerned about program outcomes that reflect the past, they place emphasis on ensuring that carriers have preventive antifraud strategies, such as prepayment controls (including system edits, preauthorizations, and precertifications), in place to prevent future occurrences of fraud and abuse. OPM contracting office staff also collect information about how carriers assess their antifraud activities, in part to determine whether carriers routinely assess their own antifraud programs. OPM contracting office staff reported that they have not adopted specific measures of program effectiveness for FEHBP fraud and abuse programs because they have not identified an appropriate way to measure the effectiveness of antifraud programs. Several factors contribute to difficulties in developing a measure of the effectiveness for health care antifraud programs. These factors include the following: A lack of information about the baseline amount of fraud and abuse in health care. We have previously reported that there is no reliable baseline estimate of the amount of health care fraud in the United States. Similarly, officials from OPM’s contracting office told us that they cannot estimate the amount of fraud within FEHBP. A baseline estimate could provide an understanding of the extent of fraud and, with additional information on fraud and abuse program activities, could help to clarify the effectiveness of antifraud program activities. The difficulty of establishing a causal link between antifraud activities and the amount of health care fraud or abuse. Although the efforts of federal agencies and nongovernment entities may help to reduce health care fraud, it is difficult to isolate the effect of any individual action or to clearly establish that any change in the amount of fraud was due to any specific cause. Thus, for example, a carrier’s implementation of a specific fraud detection strategy may deter certain types of fraud, but a reduction in those types of fraud could also have been due to other causes, such as changes in laws or in prosecutorial practice. The difficulty of measuring the effect of efforts to prevent or deter fraud and abuse. Officials from OPM’s contracting office reported that they believe that FEHBP fraud and abuse program requirements and their oversight of these programs have helped to limit the amount of fraud in FEHBP. Officials and industry experts said, however, that it is difficult to measure how much fraud or abuse is deterred or prevented. For example, FEHBP carriers may place restrictions on their provider networks to prevent individuals who are intent on fraud from enrolling as providers, but it is difficult to measure the amount of fraud or abuse that was prevented as a result of such restrictions. Despite the challenges involved in assessing the effectiveness of antifraud activities, OPM officials acknowledged the importance of ensuring the prevention, detection, and correction of fraud and abuse within the FEHBP. Others in the health care sector also acknowledge the importance of measuring the effectiveness of antifraud activities and are working to develop appropriate measures. For example, CMS recently began an effort to estimate probable fraud involving specific home health care services in Medicare that could provide information on the extent of fraud that currently exists and, in coming years, how it has changed over time. Establishing a baseline may make it feasible to study how antifraud activities affect the level of home health care fraud. In addition, OPM told us that they are continuing to monitor public and private sector efforts to develop measures of the effectiveness of antifraud activities. If reliable and valid measures of the effectiveness of antifraud programs are identified, it will be important for OPM to determine whether those measures are appropriate for the FEHBP. OPM and the OPM OIG reviewed a draft of this report and provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Acting Director of OPM, appropriate congressional committees, and other interested parties. The report also will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. There are requirements and procedures for reporting potential fraud and abuse that apply to both the carriers that offer health care plans through the Federal Employees Health Benefits Program (FEHBP) and the Office of Personnel Management (OPM). These requirements and procedures include communication between the carriers and OPM as well as communication with law enforcement agencies and others, such as Congress. Carriers are required to report to both OPM’s Office of the Inspector General (OIG) and OPM’s Healthcare & Insurance—Federal Employee Insurance Operations office, which we refer to as the contracting office. Carriers are required to report potential fraud and abuse to the OIG. According to a letter OPM sent to carriers in 2011, carriers are required to provide written notice to the OIG within 30 working days of becoming aware of possible fraud or abuse. Carriers are to notify the OIG regardless of the amount of money involved and without waiting to determine whether there is sufficient evidence to substantiate the allegation. The notice is generally to include information about the identity of the suspected health care provider(s) or enrollee(s) and a brief description of the allegation, among other things. The notice may request that the OIG monitor a case being developed in preparation for a pending referral, or it may request that the OIG decline the case so that the carrier may participate in a class action lawsuit. According to OIG officials, the notice may also include a referral to the OIG (i.e., a request that the OIG evaluate the case). As shown in figure 1, the carrier’s reporting requirements after providing initial notice of potential fraud or abuse depend on the OIG’s response: If the OIG decided to monitor the case and asked the carrier to continue its investigation, then the carrier is to provide the OIG with written status updates when it has additional information to substantiate or refute the allegation. If the OIG declined the case, the carrier may proceed with its investigation without further contact with the OIG unless (1) the carrier develops significant new information and believes that the OIG should reconsider; (2) the case is accepted for investigation by one or more other federal, state, or local law enforcement agencies; or (3) the case is accepted for prosecution at the federal level, such as by a U.S. Attorney’s Office or by the Department of Justice. If any of these events occurs, the carrier is to provide the OIG with a written status update. If the OIG requested a referral, the carrier is to submit the referral within 120 days or to provide monthly status updates starting on day 121. Upon request, all carriers must furnish the OIG with FEHBP claims information and supporting documentation relevant to open criminal, civil, or administrative investigations and, absent extenuating circumstances, must do so within 30 calendar days. The carrier may refer the case to the OIG at any time and does not need a request from the OIG to do so. Carriers are to submit status updates, which summarize new information, to the OIG when: the carrier develops significant new information that the carrier believes would aid the OIG in determining whether to request a referral or decline the case; the carrier determines that the allegation had no merit or that no false or fraudulent activity took place as alleged; the carrier closes its inquiry; the carrier wishes to proceed with administrative debt collection, recovery, or settlement of an FEHBP overpayment; or the OIG requests a status update. When the carrier refers the case to the OIG (whether the referral was solicited by the OIG or not), the referral is to be in writing and to include (among other things) information about the identity of the suspected health care provider(s) or enrollee(s); a comprehensive description of the suspected fraud or abuse; and copies of any analyses, documents, or other information the carrier has that is relevant to the allegation. Each carrier files two annual reports with the OPM contracting office; these reports provide information about the carrier’s fraud and abuse program and summarize relevant activities. In one report, the carrier is to respond to a questionnaire that OPM’s contracting office staff use to obtain information about the carrier’s procedures for reporting potential fraud, including its criteria for notifying law enforcement agencies and the OIG of potential fraud and how it manages referrals from hotlines, law enforcement agencies, and others. (This annual report also covers other aspects of the carrier’s fraud and abuse program—its organization, certain budget information, performance indicators, and other operational information.) A second report provides additional information about the fraud and abuse program and covers the carrier’s fraud and abuse activities and outcomes involving the FEHBP during the year—the number of cases it opened, dollars recovered, number of criminal convictions, and so forth. OPM is required to provide information to the carriers that notified it of potential fraud or abuse and, depending on the case, may be required to report information to other law enforcement entities. In addition, OPM may share information about fraud or abuse with other carriers and antifraud entities. When the OIG receives a carrier’s notification of potential fraud or abuse, or when the OIG receives a status update about an instance of potential fraud and abuse from a carrier, the OIG is to respond in writing within 30 calendar days to inform the carrier of its level of interest in the case. Specifically, the OIG may (1) monitor the case, asking the carrier to continue investigating and provide status updates as appropriate, (2) decline the case, or (3) request a referral. (The OIG does not need a referral from a carrier to pursue a case; it has the authority to pursue any allegations of fraud or abuse that involve the FEHBP.) According to OIG officials, when reaching a decision about its response to the carrier, the OIG weighs information about patient safety; the type of fraud that is potentially at issue (e.g., whether it seems to involve a pattern of potentially fraudulent activity or not and whether it seems to be local or is potentially widespread); the evidence in support of the allegation; the dollar value of the alleged fraud or abuse; the resources that would likely be required to pursue the case; and whether a prosecutor is likely to pursue the case. Depending on the case, there may be requirements or procedures for the OIG to report information about potential fraud or abuse to other law enforcement entities, including the Federal Bureau of Investigation (FBI), U.S. Attorneys, or state or local prosecutors. According to the OIG’s investigative manual, preliminary evaluation of information regarding potential health care fraud involves determining whether there is enough risk of patient harm or enough risk of financial exposure to continue investigating the allegation. The OIG may also initiate a preliminary inquiry proactively, for example, when its review of information about a program yields information that suggests potential fraud or abuse. If a preliminary inquiry indicates credible evidence that a criminal, civil, or administrative violation may have occurred, the OIG decides whether to initiate an investigation, refer the allegation to another law enforcement agency, or seek to conduct a joint investigation with another law enforcement agency. The OIG may refer the allegation to another law enforcement agency when (1) the subject matter is by law investigated by another agency; (2) the allegation does not involve OPM employees, contractors, programs, or property; (3) the allegation involves OPM indirectly, while having a major impact on another agency; or (4) the allegation involves a According to the OIG’s threat to the safety of a high government official.investigative manual, these referrals are to include a presentation of the complaint or allegation and any facts developed by the OIG. Reporting to the FBI. According to the OIG’s investigative manual, the OIG is to refer a case to the FBI when appropriate. In addition, if the OIG determines that there is sufficiently credible evidence to convert a preliminary inquiry into a criminal investigation, guidance from the Office of the Attorney General specifies that the OIG is to notify the FBI within 30 days, absent exigent circumstances. According to OIG officials, when reaching a decision about whether to convert a preliminary inquiry into a criminal investigation, the OIG weighs patient safety, the extent of likely FEHBP exposure, the extent to which the allegations appear to be supportable, and the likelihood of prosecution (either criminal or civil). Reporting to U.S. Attorneys. According to the OIG’s investigative manual, if the OIG determines that a case should be referred to a U.S. Attorney’s Office, a formal presentation normally occurs after the OIG has completed its investigation. The OIG expects its agents to establish and maintain working relationships with U.S. Attorneys’ Offices, and expects them to consult as soon as they have information that indicates that an investigation may corroborate an allegation. According to the OIG, early consultation allows the OIG to focus its investigative efforts on and support prosecutive potential. If early consultation results in acceptance of a case for prosecution, the OIG is to provide the prosecutor with a preliminary investigation report. Reporting to state or local prosecutors. If a case is declined by U.S. Attorneys, the OIG may refer the case to state or local prosecutors. Under the Inspector General Act of 1978, as amended, the OIG is required to report its activities and accomplishments (including those related to fraud and abuse) to Congress semiannually, and the agency is required to submit a response to each semiannual report. The OIG may also prepare reports in response to requests from other federal agencies (including GAO) or from congressional committees or members. The OIG may notify multiple carriers of suspected fraud or abuse and may share information about potential fraud and abuse through participation in interagency health care fraud task forces or other fraud detection and prevention organizations. Consistent with the Health Insurance Portability and Accountability Act, which encourages coordination and information sharing between federal, state, and local law enforcement programs to control health care fraud and the sharing of related information with the private sector,shares information with several antifraud entities: The OIG participates as a law enforcement liaison to the National Health Care Anti-Fraud Association (NHCAA). According to OIG officials, the OIG works with the NHCAA and its members (which include many FEHBP carriers) on training, education, and sharing information about trends in health care fraud and participates in NHCAA-sponsored training and conferences, and the OIG liaison to the NHCAA participates on NHCAA committees and meets with the NHCAA on a regular basis. The OIG organizes and operates an FEHBP Carrier Task Force that includes the OIG and representatives of the largest FEHBP carriers. According to OIG officials, this task force meets on a quarterly basis to share information about cases and fraud trends and to discuss emerging fraud-related issues. In addition to the contact named above, key contributors to this report were Kristi Peterson, Assistant Director; Kristen Joan Anderson; George Bogart; and Jennel Lockley.

Summary: The FEHBP provides health care coverage to millions of federal employees, retirees, and their dependents through health insurance carriers that contract with OPM. Carriers offer plans in which eligible individuals may enroll to receive health care benefits. OPM negotiates these contracts; requires that each carrier establish a program to prevent, detect, and eliminate fraud and abuse; and oversees carriers' fraud and abuse programs. Although the extent of fraud and abuse in the FEHBP is unknown, any fraud or abuse that does occur contributes to health care costs and may be reflected in the premiums for FEHBP enrollees. GAO was asked to review OPM's oversight of FEHBP fraud and abuse programs. This report describes (1) oversight of fraud and abuse programs by OPM's contracting office and (2) the OPM contracting office's approach to measuring the effectiveness of FEHBP carriers' fraud and abuse programs. To do so, GAO reviewed documents that specify program requirements and guidance, such as carrier contracts and letters from OPM to carriers; documents that assist oversight of fraud and abuse programs, such as annual reports that OPM requires from carriers; and documents demonstrating oversight of carriers, such as memos to carriers from OPM contracting office staff regarding carriers' compliance. GAO also reviewed published work about measuring the effectiveness of antifraud programs. GAO interviewed OPM officials and officials from entities with expertise related to antifraud programs and measurement. The Office of Personnel Management (OPM) Healthcare & Insurance--Federal Employee Insurance Operations office, which we refer to as OPM's contracting office, monitors Federal Employees Health Benefits Program (FEHBP) carriers' compliance with requirements and other guidance for preventing, detecting, and eliminating fraud and abuse. These requirements include establishing a program to assess vulnerability to fraud and abuse, reporting annually on program outcomes, reporting potential fraud to OPM's Office of Inspector General (OIG), and implementing corrective actions to address deficiencies in fraud prevention programs. OPM's guidance encourages carriers to implement certain program standards, such as formal fraud awareness training for all employees. To monitor carriers' compliance with these requirements and other guidance, OPM's contracting office staff conducts the following activities. Review carriers' annual reports: Staff review information contained in annual reports from carriers that describe the carriers' fraud and abuse programs and their outcomes. Officials told us that they assess information in carriers' annual reports against program requirements and guidance and follow up with carriers whose reports suggest possible noncompliance. Conduct site visits: Staff also inspect and follow up on carriers' fraud and abuse programs during periodic site visits. Using a risk based site selection strategy, OPM contracting office staff conducted site visits of 27 carriers whose plans covered about 70 percent of FEHBP enrollees in 2012. Review and resolve OIG audit findings: Staff review and resolve OIG audit findings that identified areas of carriers' noncompliance. Review disputed claims and enrollee complaints: Staff review disputed claims and enrollee complaints to identify indicators of potential fraud or abuse, such as suspicious patterns of drug utilization. OPM contracting office staff review certain outcomes of carriers' fraud and abuse programs, but several factors contribute to the challenge of assessing program effectiveness. Program outcomes in 2011 included 29 criminal convictions and more than $23 million in recoveries to the FEHBP, but program outcomes do not provide complete information about program effectiveness because they do not measure the success of efforts to prevent or minimize fraud and abuse. OPM contracting office staff reported that they have not adopted specific measures of program effectiveness for FEHBP fraud and abuse programs because they have not identified an appropriate way to measure the effectiveness of antifraud programs. Several factors contribute to difficulties in assessing the effectiveness of health care antifraud programs. These factors include lack of information about the baseline amount of fraud and abuse, difficulty establishing a causal link between antifraud activities and the amount of fraud and abuse, and difficulty measuring the effect of efforts to prevent or deter fraud and abuse. OPM and the OPM OIG provided technical comments, which we incorporated as appropriate.