Since the Medicare program was created in 1965, it has been administered largely by private contractors under federal oversight. These contractors enroll and pay providers and suppliers while also maintaining the responsibility to help ensure Medicare program integrity. CMS currently contracts with 12 MACs, each of which is responsible for its own geographic region, known as a “jurisdiction.” Figure 1 shows the MACs’ jurisdiction areas. The NSC manages the DMEPOS suppliers’ enrollment, performs site visits for DMEPOS suppliers, and interacts with the durable medical equipment MACs, which pay claims for durable medical equipment items. MACs and the NSC are instructed by CMS to adhere to the processing guidelines of CMS’s manual to enroll providers, suppliers, and DMEPOS suppliers into PECOS. PECOS is CMS’s centralized database for Medicare provider and supplier enrollment information. Entities enrolled in PECOS are granted Medicare billing privileges and can be reimbursed for services rendered to Medicare beneficiaries. CMS provides additional guidance to the MACs and the NSC using directives such as technical direction letters and, in some cases, has monthly calls with the MACs to discuss new guidance or process changes. MACs and the NSC are responsible for updating PECOS after they have approved or revalidated enrollment for providers and suppliers. CMS requires all enrolled providers or suppliers to report changes to existing profile information within a certain period.practice location address, the provider must notify the MAC or the NSC of this change and the MAC or the NSC is responsible for verifying the new address information, and updating the provider’s profile in PECOS to reflect the current practice location address. PPACA requires all providers and suppliers to be subject to licensure checks. Applicants must provide copies of all applicable federal and state licenses and certifications. A licensure check consists of a MAC checking the provider’s license information with a state licensing board within its jurisdiction to determine whether the provider has an active license and any board disciplinary actions. PPACA also gives CMS the authority to require additional screening procedures beyond those each provider and supplier must undergo, such as criminal-background checks, depending on the type of risk presented by the provider or supplier type. Further, PPACA required new screening procedures based on risk of fraud, waste, and abuse. As a result of PPACA, CMS now assigns categories of providers and suppliers to limited-, moderate-, and high-risk levels; those in the highest level are subject to the most-rigorous screening. For example, whereas providers and suppliers in all three risk levels must undergo licensure checks, those in moderate- and high-risk levels are also subject to unannounced site visits. In addition, the NSC is required to conduct site visits to all of the DMEPOS suppliers (which are Table 1 shows the categories of categorized as moderate or high risk).Medicare providers and suppliers and their associated risk level. According to CMS, as of January 2015, there were 2,506 high-risk providers and suppliers, 105,558 moderate-risk providers and suppliers, and 1,649,779 limited-risk providers in PECOS. In addition, there were 15,885 high-risk DMEPOS suppliers and 74,372 moderate-risk DMEPOS suppliers. In 2011, CMS awarded two contracts to assist the MACs with performing aspects of the provider and supplier enrollment-screening process. The first was issued to an automated screening contractor that collects and analyzes license information and then provides the information to CMS for review. The data are then reviewed by a MAC for further determination. The second was issued to a site-visit contractor, who is in charge of performing site visits to all providers and suppliers, except DMEPOS suppliers. Prior to these awards, MACs were responsible for conducting all site visits and required to manually review individual state medical-licensing boards within their respective jurisdictions. Medicare provider and supplier enrollment entails other screening procedures based on the type of providers and suppliers. For example, MACs and the NSC need to validate the identify of individual providers, owners, and authorized/delegated officials using SSA validation; validate and verify the legal business names for organizations; and validate and verify the provider’s National Provider Identifier, among other things. For the purposes of our review, we will focus on the four specific screening procedures outlined in our report. Medicare provider and supplier enrollment entails other screening procedures based on the type of providers and suppliers. We identified weaknesses in two of the four screening procedures CMS implemented to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling in PECOS: the verification of practice location and of licensure status. CMS’s procedures to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs appear to be working, but we identified a few instances of ineligible or potentially fraudulent providers and suppliers that we referred to CMS for further review. Our examination of practice location addresses of providers and suppliers listed in PECOS as of March 2013 and DMEPOS as of April 2013 revealed thousands of questionable practice location addresses. We found limitations with CMS’s Finalist software used to validate practice location addresses. For example, Finalist does not provide flags to indicate whether the practice location is potentially ineligible to qualify as a legitimate location. Additional checks, such as checking for these addresses in Internet searches of sites such as 411.com, USPS.com, or Google Maps, or conducting site visits, are at times required to determine whether a practice location is legitimate. However, the revised screening procedures that CMS issued in March 2014 require MACs to do less verification of providers’ practice locations than before. Federal regulations stipulate the type of physical practice location that applicants must have. Specifically, providers and suppliers must be “operational” to furnish Medicare covered items or services. Federal regulations define “operational” as having a qualified physical practice location, being open to the public for the purpose of providing health care–related services, being prepared to submit valid Medicare claims, and being properly staffed, equipped, and stocked to furnish these items All providers and suppliers are required to list a physical or services.practice location address in their application, regardless of provider or supplier type.would be required to supply his or her own home address in the application. For example, a provider who renders in-home services Addresses that generally would not be considered a valid practice location include post office boxes, and those associated with a certain type of Commercial Mail Receiving Agency (CMRA), such as a United Parcel Service (UPS) store. Based on USPS guidance, a CMRA is a third-party agency that receives and handles mail for a client. Additionally, addresses that can be traced to a virtual office—that is, a company advertising mailboxes, telephone answering services, and dedicated workspaces—raise questions about whether the provider or supplier meets the CMS practice location requirements under CMS regulations. Vacant or invalid addresses are also ineligible for PECOS enrollment. A vacancy refers to a provider or supplier that is no longer at the location provided on the application form. USPS would flag a location as vacant if it used to deliver mail there and has not delivered mail there in more than 90 days. An invalid address is when an address is not recognized by USPS, was incorrectly entered in PECOS, or was missing a street number. Once enrolled in PECOS, providers and suppliers have the responsibility to self-report changes to their practice locations. CMS requires providers, suppliers, and DMEPOS suppliers to report a change in practice location within 30 days. Not all CMRAs would disqualify an applicant from the PECOS enrollment. For example, a hospital may be legitimately designated as a CMRA if it uses or acts as a third party that collects and distributes mail to its employees and would be considered an eligible practice location. Post office boxes and drop boxes are not acceptable except in some cases where the provider is located in rural areas. sites like 411.com and USPS.com, calling the official business telephone number listed on the application, and using software called Finalist to validate the practice location address.issued additional guidance to MACs that requires fewer verification techniques to verify a practice location. This new guidance is discussed later in the report. In March 2014, CMS Our examination of practice location addresses of the providers and suppliers listed in PECOS as of March 2013 and DMEPOS as of April 2013 (the most-current data available at the time of our review) revealed thousands of questionable addresses. Specifically, we checked PECOS practice location addresses for all records that contained an address using the USPS address-management tool, a commercially available software package that standardizes addresses and provides specific flags on the address such as CMRA, vacant, and invalid. The USPS address-management tool includes addresses as of December 15, 2013. This software is not currently being used by CMS. Instead, CMS uses the Finalist software to standardize practice location addresses. As part of our initial analysis using the USPS address-management tool, we identified 105,234 (about 11 percent) of the 980,974 addresses listed in PECOS appeared in the USPS address-management tool as a CMRA, a vacant address, or an invalid address. We took further steps to determine the number of these questionable addresses that could be determined to be ineligible for Medicare providers and suppliers. Specifically, we selected a generalizable stratified random sample of 496 addresses from the population of 105,234 that appeared in the USPS address-management tool as a CMRA, a vacant address, or an invalid address. For each selected or physical site address, we used Google Maps, Internet searches,visits to confirm whether the practice location address was an eligible address. On the basis of our additional analysis of the generalizable sample of 496 addresses, we estimate the following: About 23,400 (22 percent) of the 105,234 addresses that we initially identified as a CMRA, vacant, or invalid address are potentially ineligible for Medicare providers and suppliers. About 300 of the addresses were CMRAs, 3,200 were vacant properties, and 19,900 were invalid. Of the 23,400 potentially ineligible addresses, we estimate that, from 2005 to 2013, about 17,900 had no claims associated with the address, 2,900 were associated with providers that had claims that were less than $500,000, and 2,600 were associated with providers that had claims that were $500,000 or more per address. About 39,900 (38 percent) of the 105,234 addresses that we initially identified as a CMRA, vacant, or invalid address are potentially valid addresses and thus eligible for Medicare providers and suppliers.For example, in some instances, the USPS address-management tool flagged an address as a CMRA that we subsequently identified as a hospital, based on our Google Maps or related searches. A hospital may be considered a CMRA if it acts as a third party distributing mail to its staff. Although the hospital was correctly flagged as a CMRA, for the purposes of our review we considered these addresses to be valid, since they are likely practice locations. About 42,000 (40 percent) of the 105,234 addresses could not be identified as either eligible or ineligible using the methods described above, and may warrant further review to make an eligibility determination. Among those for whom we could not verify an address, we estimate that about 25,500 had no claims associated with the address, 9,500 were associated with providers that had claims that were less than $500,000, and 7,000 were associated with providers that had claims that were $500,000 or more per address, from 2005 to 2013. Some of these claims could be at risk of being ineligible Medicare payments. See figure 3 below for a breakdown of the identified addresses and our estimates of the number of ineligible addresses. During our review of the CMS internal controls intended to prevent and detect these potentially ineligible providers from enrolling or remaining in PECOS, we found limitations with the Finalist software being used to validate the addresses. As previously noted, the Finalist software is one of the techniques used by the MACs and the NSC to validate a practice location. According to CMS, Finalist is integrated into PECOS to standardize addresses and does so by comparing the address listed on the application to USPS records and correcting any misspellings in street and city names, standardizing directional markers (NE, West, etc.) and suffixes (Ave, Lane, etc.), and correcting errors in the zip code. However, the Finalist software does not indicate whether the address is a CMRA, vacant, or invalid—in other words, whether the location is potentially ineligible to qualify as a legitimate practice location. CMS does not have these flags in Finalist because the agency added coding in PECOS that prevents post office box addresses from being entered, and believed that this step would prevent these types of ineligible practice locations from being accepted. CMS officials agreed, however, that adding flags to the Finalist software to identify any potential issues that might make the practice location address ineligible, such as a CMRA, could be of value. Some CMRA addresses are not listed as post office boxes. For example, during our review of the practice location addresses in PECOS, we identified 46 out of the 496 sample addresses that were allowed to enroll in Medicare with a practice location that was inside a mailing store similar to a UPS store. These providers’ addresses did not appear in PECOS as a post office box, but instead were listed as a suite or other number, along with a street address. Businesses can purchase a post office box that is listed to the public as a suite number in a business district from some commercial mailing businesses. By doing so, businesses can mask the identity of the address as a post office box. Figure 4 shows an example of one of the providers that we identified through our search and site visits as using a mailbox-rental store as its practice location and where services are not actually rendered. This provider’s address appears as having a suite number in PECOS and was continuing to be used in the system as of January 2015. According to our analysis of CMS records, this provider was paid approximately $592,000 by Medicare from the date it enrolled in PECOS with this address to December 2013, which is the latest date for which CMS has claims data. Our review also found locations that were vacant addresses. For example, we identified a provider who used a hospital’s address as its practice location, but the hospital no longer exists. The USPS address- management tool flagged this address as vacant as of September 2013. When we conducted a site visit to this address in December 2014, we found that the hospital had been demolished (see fig. 5). According to the MAC, however, the provider went through the revalidation process using the demolished hospital address and was approved in January 2015. As of January 2015, therefore, this provider continued to use the vacant address as one of its practice locations. If the provider moved to another location, it was required to report the change of its practice location to the MAC within 30 days. This provider was not paid by Medicare from September 2013 through December 2013 data. However, by remaining in PECOS, this provider may be eligible to bill Medicare in the future. In another example in which we identified an address as vacant, we visited a provider’s stated practice location in December 2014 and found a fast-food franchise there (see fig. 6). Workers from the fast-food franchise said that they have been in the location for about 3 years. In addition, we found a Google Maps image dated September 2011 that shows this specific location as vacant. According to the MAC in charge of enrolling this provider, the provider was enrolled in PECOS in March 2010. As of January 2015, this provider had not updated its address in PECOS and continued to use the fast-food franchise as its practice location. As previously noted, CMS requires providers to report changes in practice locations within 30 days. Currently, this provider is enrolled in Medicare with an ineligible practice location because services can no longer be rendered at this address. This provider was not paid by Medicare from the date this practice location address was flagged as vacant in the USPS address-management tool to December 2013. However, by being enrolled in PECOS, this provider may be eligible to bill Medicare in the future. Providers’ submission of addresses that do not appear to be actual practice locations are an indicator of potential fraud. Without having flags in Finalist to better indicate the validity of the providers or suppliers’ practice locations, CMS misses an opportunity to focus on addresses that may be potentially illegitimate practice locations at enrollment or after enrollment. Using software that flags potentially ineligible addresses can help to identify potentially ineligible practice locations, but conducting additional research on addresses, including site visits, may be additionally helpful to determine whether the provider or supplier is located at the address provided at enrollment. As mentioned previously, MACs are only required to conduct a site visit to providers and suppliers that are listed as moderate or high risk, which is a cost-effective and practical option. However, there are more than 1.6 million limited-risk providers—which make up the vast majority of providers in PECOS—that will likely never receive a site visit to confirm the practice location unless their risk status changes. Of the 496 addresses in our sample that were flagged as potentially ineligible, 252 were categorized as limited risk. In specific instances where a limited-risk provider’s address is flagged as a CMRA, vacant, or invalid address, additional checks on these particular providers may be warranted. For example, when searching addresses in Google Maps, we could sometimes identify the building of the practice location, but not always visually confirm whether the suite number that the provider or supplier listed existed in the location. We visited 30 practice locations that the USPS address-management tool flagged as vacant or located at a CMRA. provider or supplier. According to our physical observation, 11 of the 30 locations appeared to be vacant; 6 appeared to be ineligible CMRAs; and 11 locations were inconclusive because we were not able to find the providers or suppliers at the address. Of these 30, we were able to confirm that 2 housed a legitimate We also identified 25 applicants out of our generalizable sample of 496 addresses that the USPS address-management tool flagged as a CMRA and that our additional research found to be located in places advertised as “virtual offices.” mailboxes, telephone-answering services, and a dedicated workspace to clients who are not physically located on the premises. While, according to CMS, a virtual office may be appropriate for some suppliers, it may not be appropriate for other types of providers and suppliers, since CMS requires the practice location to be open to the public for purposes of providing health care–related services and properly staffed, equipped, and stocked to furnish services or items. The 30 locations were selected based on the geographic proximity to the three MACs and the NSC we visited, and to GAO offices. These locations were selected independently of our generalizable sample of 496 addresses, and this selection is not generalizable to any set of addresses. These addresses were flagged as CMRA because they serve as a third party that handles their customers’ mail. We visited 5 of the 25 providers and suppliers in Maryland, Texas, and California that our research indicated were located in places advertised as virtual offices. Based on our observational visits, the 5 providers and suppliers were located in places that were advertised as virtual offices. In one instance, we took pictures of an office space in Texas that a provider had listed as its practice location. As previously noted, CMS requires the practice location to be open to the public for purposes of providing health care–related services and properly staffed, equipped, and stocked to furnish services or items. As shown in figure 7, at the time of our visit there was no actual office operating at the practice location address provided to CMS. As of May 2015, this provider had not updated its practice location address in PECOS or received a site visit because the provider falls into the limited-risk category. Without conducting additional reviews or a site visit, the MAC or CMS will not be able to confirm whether this provider is located at the practice location address listed in PECOS or whether this virtual office meets CMS’s eligibility requirements. In light of the advertised characteristics of many virtual office spaces, which may not meet practice location requirements, and what we observed about these addresses, virtual office practice locations may warrant a site visit or other detailed address check. However, 17 of the 25 provider or supplier applicants our research indicated were located in places advertised as virtual offices had not received site visits, primarily because most of these providers or suppliers were not classified as high or moderate risk. We referred the 25 cases of providers and suppliers with virtual office locations that we identified to CMS for further review. As previously noted, for the practice location addresses found in the PECOS data we obtained as of March 2013, CMS required MACs to verify practice location addresses using various techniques to obtain information about the practice location, such as searching the Internet using sites like 411.com and USPS.com, calling the official business telephone number listed on the application, and using Finalist to standardize the practice location address. In March 2014, however, CMS issued guidance to the MACs that revised the practice location verification methods.required to contact the person listed in the application to verify the practice location address and use the Finalist software that is integrated in PECOS to standardize the practice location address. Additional verification, such as using 411.com and USPS.com, which was required under the previous guidance, is only needed if Finalist cannot standardize the actual address. According to CMS officials, they revised the screening procedures to verify the practice location to reduce application processing time frames. Specifically, under the March 2014 guidance, MACs are Our findings suggest that the revised screening procedure of contacting the person listed in the application to verify all of the practice location addresses may not be sufficient to verify such practice locations. For example, we found two providers in our sample of 496 addresses that the USPS address-management tool flagged as CMRA, invalid, or vacant that underwent the revalidation process in 2014. The MAC used the new procedure of calling the contact person to verify the practice location. We found that each of these two providers had a UPS or similar store as its practice location. practice location by one of the providers that the MAC verified by contacting the provider by telephone. As we stated earlier in this report, conducting additional address-verification steps may be helpful to identify ineligible practice locations. Federal internal-control standards require management to identify risks that could impede an agency’s ability to achieve its objectives and then take appropriate steps to manage those risks. By using the new procedure of only calling the contact person listed in the application to verify the practice location, CMS has weakened its internal controls in this process and has increased the likelihood that it could miss identifying some potentially ineligible practice locations and could allow potentially ineligible providers and suppliers to enroll in Medicare. We identified these two providers by conducting Internet searches and also conducting a site visit to one of the two providers. All physicians applying to enroll in the Medicare program must hold an active license in the state in which they plan to practice. They must include that licensing information on their applications; however, CMS does not require that physicians also report licenses they might hold in They must also self-report any final adverse actions they other states.have received by any state licensing authority regardless of the state in which they plan to practice. Under federal law, a final adverse action can be a suspension or revocation of a license to provide health care by any state licensing authority due to a conviction for a federal or state felony offense that CMS has determined to be detrimental to the best interest of the program or revocation or suspension by an accreditation organization, among other actions. Applicants with an active license and a final adverse-action history may still enroll into the Medicare program depending on the severity of the actions and whether the applicant self-reported the action on his or her application. According to CMS guidance, when an applicant first enrolls into Medicare, MACs must corroborate adverse legal actions and licensure information directly with state medical boards using information located on the respective state medical board website and conduct follow- up research to ensure that the applicant retains an active license, as applicable, before allowing applicants to enroll in Medicare. CMS does not require MACs to independently identify and verify an applicant’s license status in areas other than the state where the applicant is enrolling. Further, CMS only requires MACs to verify final adverse actions that the applicant self-reported on the application. To improve oversight of the provider-license review process, in March 2014 CMS began providing the License Continuous Monitoring (LCM) report to MACs. CMS officials explained that because MACs must research all enrolled providers each month using multiple state medical board websites in their respective jurisdictions, CMS established the LCM report to provide consistency over the review process. It is designed to be used in a monitoring capacity to evaluate changes in current license The LCM report is generated from an information, according to CMS.external vendor that obtains license information directly from individual state medical boards. Each report is compiled monthly into an Excel spreadsheet and provides a nationwide snapshot of PECOS provider licensure status such as “suspended,” “surrendered,” “probation,” or “deceased.” The report does not change the overall review process; MACs are still required to access the state medical board website of each provider to verify licensure status. The LCM report that CMS provides to MACs includes the current provider license status but not the adverse-action history. MACs therefore cannot use the report to review a provider’s adverse-action history, but can use the report to research current changes in the provider’s license status on state medical websites and determine whether an adverse action was the cause. Further, the LCM report is limited to only those license numbers used to enroll into the Medicare program. Some licenses of providers with multiple medical licenses would not appear in the LCM report because they were not used to enroll into Medicare. A provider may be associated with various license numbers because of licenses in different states. We found instances in which providers could have been denied enrollment, based on our analysis of providers’ adverse-action histories. We used data from the Federation of State Medical Boards (FSMB) to examine physician license information and disciplinary actions. FSMB is a nonprofit organization that serves state medical boards in all U.S. states, Puerto Rico, Guam, and the Northern Mariana Islands; and 14 state boards of osteopathic medicine. FSMB data differ from the database that CMS uses in that the FSMB database includes a provider’s entire history of license revocations and suspensions, for all medical licenses, while the LCM report only includes the current license status of the licenses reported by providers in PECOS. We found that 321 out of about 1.3 million physicians with active PECOS profiles as of March 29, 2013 (the most-current data available at the time of our review) had received an adverse action from a state medical board related to conduct such as crimes against persons (e.g., battery, rape, or assault), financial or related crimes (e.g., extortion, embezzlement, income-tax evasion, or insurance fraud), and felony crimes outlined in section 1128 of the Social Security Act (e.g., substance abuse, health-care fraud, or patient abuse) that resulted in a revocation or suspension of their licenses sometime between March 29, 2003, and March 29, 2013. See appendix V for a breakdown of adverse actions identified in our review. We followed up with the MACs to determine whether these physicians self-reported final adverse actions or whether MACs had identified any actions and revoked these physicians from the Medicare program. For 174 of the 321 physicians we identified as having adverse actions, MACs either revoked and later reinstated the physician into the Medicare program after meeting eligibility requirements or determined that the adverse action did not affect the physician’s enrollment and allowed the physician to remain in the Medicare program. The remaining 147 physicians were either not revoked from the Medicare program until months after the adverse action or never removed. highlighted that delays in removing physicians from Medicare may occur due to MAC backlogs, delays in receipt of data from primary sources, or delays in the data-verification process. Figure 9 provides a breakdown of adverse actions related to the 147 physicians. We referred the 147 physicians to CMS for further review and action. To help ensure that Medicare maintains current enrollment information and to prevent others from utilizing the enrollment data of deceased providers and suppliers, MACs are required to check that providers and suppliers in PECOS are not deceased. Since January 2009, CMS sends the MACs a file containing a list of individuals who have been reported as deceased to the SSA, and MACs review the file monthly. For individual providers, CMS automatically applies the date of death to the PECOS enrollment record and deactivates the enrollment. For owners, authorized officials, and managing employees, MACs are required to manually update the enrollment record, according to CMS. We compared the list of about 1.7 million unique providers and suppliers in PECOS as of March 2013 and DMEPOS suppliers as of April 2013 with SSA’s full death file and found 460 (about 0.03 percent) who were identified as deceased. In September and October 2014, we followed up with the MACs to obtain additional information on these providers and suppliers. Of the 460 providers and suppliers our analysis had identified as deceased, CMS or the MACs found 409 (89 percent) to be deceased between March 2013 to February 2015. According to the MACs’ responses, the remaining 51 of the 460 deceased providers and suppliers were not identified as deceased by the MACs or CMS. Some MACs noted that due to our work they confirmed that the provider or supplier was deceased and will take further action. Even though the MAC or CMS identified 409 of the 460 providers and suppliers that were deceased from March 2013 to February 2015, there were some instances when much more time elapsed before the MAC or CMS identified the provider as deceased. For example, we found that a provider died in April 2008, but the MAC identified the provider as deceased and duly updated the PECOS record in July 2014. Further, we found that for 162 of the 409 providers, CMS or the MAC took a year or more to identify the provider as deceased. According to CMS, some of the delays in identifying the deceased providers occurred because SSA may take a long time to report an individual as deceased. Not identifying a provider or supplier as deceased exposes the Medicare program to fraud. A provider or supplier can be paid after the date of death for services performed before the date of death. Therefore, CMS is required to check that no claims are paid for services provided after the date of death. We found that the 38 out of the 460 providers and suppliers we found to be deceased were paid about $80,700 by Medicare for services performed after their date of death until December 2013, which is the date CMS had Medicare claims data available. It is unclear what caused the delay or omission by CMS and the MACs in identifying these individuals as deceased or how many overpayments they are in the process of recouping. We referred these cases to CMS for further review. MACs are required to check the Medicare Exclusion Database and the General Services Administration debarment list known as System for Award Management to ensure that the applicant and other individuals listed in an application have not been suspended or debarred from participating in a federal contract or a Medicare or Medicaid program. If a MAC identifies the applicant as debarred or suspended, it is required to document the finding and confirm whether it is an accurate match. Applicants found on the System for Award Management website are not automatically excluded; the MAC needs to contact the agency that issued the exclusion or suspension action and confirm that the applicant is the same person. In addition, the applicants can be excluded or suspended for a certain period, but once the suspension period expires, the applicant can apply to enroll in Medicare. According to CMS, in April 2010, it began providing the MACs a report each month on any providers and suppliers that have been sanctioned on the Medicare Exclusion Database. On the basis of our analysis of relevant data, we found about 0.002 percent (40) of providers and suppliers listed in the HHS OIG List of Excluded Individuals and Entities (LEIE), which feeds into the Medicare Exclusion Database and PECOS, as of March 2013. These individuals were excluded from participating in health care–related programs. We found that 16 of the 40 excluded providers and suppliers were paid approximately $8.5 million by Medicare for services rendered after their exclusion date until the MAC or the NSC found them to be excluded. In September and October 2014, we followed up with the MACs to determine the status of these providers and suppliers in PECOS. Of the 40 providers we found, MACs had removed 38 providers and suppliers from PECOS from March 2013 to October 2014. However, for two matches that we identified, the MACs did not take any action. According to CMS, one of two providers was not found in the Medicare Exclusion Database or LEIE using specific identifiers such as National Provider Identifier, last name, and Social Security number. This provider is currently approved in PECOS. According to CMS, the other provider was found in LEIE using the specific identifiers, but the middle initial did not match. Because the MAC could not determine an exact match to the excluded provider, it did not take any action. Since May 2014, this provider was deactivated due to requesting to be withdrawn from the Medicare program. However, this provider billed Medicare about $22,000 during the period for which she should have been ineligible to participate in the Medicare program. We referred these two providers to CMS for further review and action. As part of an overall effort to enhance program integrity and reduce fraud risk, effective enrollment-screening procedures are essential to ensure that ineligible or potentially fraudulent providers or suppliers do not enroll in the Medicare program. CMS has taken steps to develop and implement such procedures, but our analysis found limitations in two key areas that have allowed potentially ineligible providers and suppliers to enroll in Medicare. First, CMS software to validate the applicant’s practice location address does not contain specific flags that can help identify questionable practice locations. Without those flags, CMS misses an opportunity to identify questionable practices that might warrant further review. In addition, the absence of those flags along with CMS’s recently revised guidance—in which the MACs contact the person listed in a provider’s or supplier’s application to verify an address—call into question the overall effectiveness of CMS’s procedures to ensure that applicants have a legitimate practice address. Similarly, CMS’s efforts to improve the oversight of physician license reviews by providing the MACs with the License Continuous Monitoring (LCM) report are a good first step. However, the report only provides MACs with the current status of the license that the provider used to enroll in the Medicare program. Without collecting license information on all medical licenses, regardless of the state the provider enrolled in, CMS may be missing an opportunity to identify potentially ineligible providers who have license revocations or suspensions in other states, which can put Medicare beneficiaries at risk. Utilizing additional resources, such as the Federation of State Medical Boards (FSMB), could help CMS identify whether providers or suppliers have additional licenses in other states that have ever been revoked or suspended. These resources would enable CMS and the MACs to access a provider’s entire adverse-action history and could provide the MACs with a more-complete picture when enrolling or revalidating a Medicare provider. To help improve the Medicare provider and supplier enrollment-screening procedures, we recommend that the Acting Administrator of CMS take the following three actions: 1. modify the CMS software integrated into PECOS to include specific flags to help identify potentially questionable practice location addresses, such as Commercial Mail Receiving Agency (CMRA), vacant, and invalid addresses; 2. revise CMS guidance for verifying practice locations to include, at a minimum, the requirements contained in CMS’s guidance in place prior to March 2014 so that MACs conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a CMRA, vacant, or invalid to better ensure that the address meets CMS’s practice location criteria; and 3. collect information on all licenses held by providers that enroll in PECOS by using data sources that contain this information, including licenses obtained from other states, and expand the License Continuous Monitoring (LCM) report to include all licenses, and at least annually review databases, such as that of the Federation of State Medical Boards (FSMB), to check for disciplinary actions. We provided a draft of this report for review to HHS and received written comments that are summarized below and reprinted in appendix VI. HHS also provided technical comments, which we incorporated as appropriate. In addition, we provided excerpts of this draft report to the 12 MACs, NSC, SSA, USPS, and FSMB to help ensure the accuracy of our report. We received technical comments from these parties, which we have incorporated, as appropriate. In its comments, HHS concurred with two of our three recommendations, but disagreed with the recommendation to revise its guidance. We continue to believe this action is needed, as discussed below. Specifically, HHS concurred with our recommendation to modify CMS’s software already integrated into PECOS to include specific flags to help identify potentially questionable practice location addresses, such as CMRA, vacant, and invalid addresses. HHS stated that it will configure the provider and supplier address-verification system in PECOS to flag CMRAs, vacancies, invalid addresses, and other potentially questionable practice locations. HHS did not agree with the recommendation to revise its guidance for verifying practice locations to include, at a minimum, the requirement contained in CMS’s guidance in place prior to March 2014 so that MACs conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a CMRA, vacant, or invalid. In its written comments, HHS stated that the March 2014 guidance was updated to remove redundant practices, such as the use of 411.com and USPS.com to verify practice locations because the provider and supplier address-verification system in PECOS performed the same checks. Further, HHS noted that removing these requirements allowed HHS to reduce provider and supplier burden and eliminate duplication of effort without reducing the effectiveness of its program-integrity efforts. The agency noted that, if a MAC is unable to validate the practice location using the software incorporated in PECOS, it is permitted to request clarifying information from the provider/supplier or request an unannounced site visit. However, our audit work shows that additional checks on addresses flagged by the address matching software as a CMRA, vacant, or invalid address can help to verify whether the addresses are ineligible. For example, when the USPS address-management tool flagged a practice location address as a CMRA, we took further steps, such as conducting Google Maps searches or physical site visits, to determine whether the address was ineligible. On the basis of these steps, we were able to confirm that the addresses were legitimate in some cases, while in other cases the practice locations in PECOS were ineligible addresses, such as a UPS store or similar establishments. We continue to believe that our recommendation will help ensure that HHS conducts this type of additional research on practice location addresses, when necessary. This additional research can include Google Map searches, Internet searches, site visits, or the additional steps HHS highlighted in its response. We are concerned that HHS’s 2014 guidance does not describe any of these specific types of additional methods or techniques, beyond contacting the person listed in the application, and some of the MACs that we contacted were no longer taking the types of additional steps outlined above after issuance of HHS’s 2014 guidance. Further, as our report highlighted, we identified providers with potentially ineligible addresses that were approved by MACs using the process outlined in that guidance. Therefore, we continue to believe that the agency should update its 2014 guidance to reflect the need to conduct the types of additional address research that we cite in our report and that the agency cites in its response, on addresses that are flagged as potentially ineligible practice locations. HHS also concurred with our draft recommendation to require applicants to report all license information including those obtained from other states and expand the LCM report to include all licenses, and at least annually review databases, such as that of FSMB, to check for disciplinary actions. HHS noted that it will take steps to make certain that all applicants’ licensure information is evaluated as part of the screening process by MACs and the LCM report as appropriate and will regularly review other databases for disciplinary actions against enrolled providers. HHS further stated, however, that it does not have the authority to require providers to report licenses for states in which they are not enrolled. As shown in our report, having a provider’s complete licensing history is a way to determine whether a provider has a history of final adverse actions. Without obtaining all licenses from a provider, as we did, CMS does not have the ability to verify whether all final adverse actions were reported. Without collecting license information on all medical licenses, regardless of the state the provider enrolled in, it is unclear how HHS will obtain the information it needs to identify past disciplinary actions, as the agency indicated it will do in its response to our report. Instead, HHS may continue to miss an opportunity to identify potentially ineligible providers who have license revocations or suspension in other states, which can put Medicare beneficiaries at risk. While providers are not currently required to list out-of-state license information in the enrollment application, CMS can independently collect this information by using other resources. For example, CMS can compare the provider’s information to license databases, such as FSMB’s, that identify all licenses associated with an individual. For the purposes of our work, we compared the provider’s SSN and name with FSMB’s data to determine whether enrolled providers had disciplinary actions that might make them ineligible for Medicare enrollment and found instances in which providers could have been denied enrollment. Therefore, we clarified our recommendation to state that CMS should collect information on all licenses held by providers that enroll in PECOS by using data sources that contain this information. Doing so will help HHS to develop a more-complete picture of individual providers. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the appropriate congressional committees, the Acting Administrator of CMS, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix VII. GAO was asked to assess Medicare’s provider and supplier enrollment- screening procedures to determine whether the Provider Enrollment, Chain and Ownership System (PECOS) was vulnerable to fraud. This report examines the extent to which Centers for Medicare & Medicaid Services (CMS) enrollment-screening procedures are designed and implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers; suppliers; and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers into PECOS. To assess the extent to which CMS’s enrollment-screening procedures are designed to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers, suppliers, and DMEPOS suppliers into PECOS, we reviewed CMS procedural manuals and directives including the Program Integrity Manual that outlines the procedures that Medicare Administrative Contractors (MAC) and the National Supplier Clearinghouse (NSC) should use to determine provider and supplier enrollment eligibility. We also interviewed CMS officials about provider and supplier enrollment-screening procedures, including procedures that were developed and implemented as a result of the Patient Protection and Affordable Care Act’s (PPACA) provisions. In addition, we conducted interviews with five MACs, to learn about the enrollment-screening procedures. We selected the five MACs to include some with larger numbers of physicians serviced, some that met and some that did not meet the accuracy threshold in CMS’s provider enrollment performance evaluation, some that participated in the automated screening process and some that did not (to capture additional possible checks that some MACs performed on providers’ enrollment information through this process), and some that served more than one jurisdiction to maximize the number of states included in our review. We also interviewed NSC officials responsible for enrolling DMEPOS suppliers to learn about the DMEPOS supplier enrollment-screening procedures. We contacted by e-mail the remaining seven MACs to obtain additional information on the provider enrollment-screening procedures to verify applicants’ practice location addresses and validate applicants’ licensure and accreditation information. To assess the extent to which CMS implemented enrollment-screening procedures to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers, suppliers, and DMEPOS suppliers into PECOS, we matched the list of providers and suppliers present in PECOS on March 29, 2013, and DMEPOS suppliers on April 6, 2013— the most-current data available at the time of our review—to four specific databases listed below. 1. The United States Postal Service (USPS) Address Matching System Application Program Interface, which is a commercially available USPS software package that standardizes addresses and provides specific flags such as Commercial Mail Receiving Agency (CMRA), vacant, or invalid addresses to determine the validity of the providers’ or suppliers’ practice location addresses. Specifically, we submitted 980,974 PECOS practice location addresses to the USPS address-management tool. The USPS address-management tool contained valid addresses as of December 15, 2013. Of the 980,974 addresses, 105,234 (about 11 percent) appeared in the USPS address-management tool as a CMRA, a vacant address, or an invalid address. For those addresses that the tool flagged as a CMRA, vacant, or invalid, we selected a generalizable stratified random sample. Specifically, we sampled 496 addresses from the population of 105,234. We stratified the population addresses by the type of match (CMRA, vacant, or invalid) and by the type of provider (individual practitioner, organization, or DMEPOS supplier). This resulted in nine mutually exclusive strata. We computed sample sizes to achieve a precision of plus or minus 10 percentage points or fewer, at the 95 percent confidence level for each of the three types of matches. Because we followed a probability procedure based on random selections, our sample is only one of a large number of samples that we might have drawn. Since each sample could have provided different estimates, we express our confidence in the precision of our particular sample’s results as a 95 percent confidence interval (e.g., plus or minus 10 percentage points). This is the interval that would contain the actual population value for 95 percent of the samples we could have drawn. To confirm whether each of the 496 sampled practice location addresses was an eligible address, we used Google Maps, Internet searches including searching the provider’s website, or physical site visits. On the basis of the results of our work on the sample, we produced estimates of how many addresses were likely to be ineligible, potentially valid, or inconclusive. The estimates are based on our generalizable stratified random sample of 496 addresses and have a margin of error at the 95 percent confidence level of plus or minus 10 percentage points or fewer. To calculate the amount of Medicare claims paid to providers and suppliers we confirmed to have an ineligible practice location, we ran the provider and supplier National Provider Identifier against the claims paid from 2005 to 2013, the period for which CMS has claims data. For addresses that were located at an ineligible CMRA, we calculated the claims data from the date the provider or supplier enrolled into PECOS using the address to December 2013. For addresses flagged as vacant by the USPS address-management tool, we calculated the claims data from September 2013 to December 2013.at least 90 days to be flagged as vacant in the USPS address- management tool. For the invalid addresses, we calculated the claims According to USPS guidance, an address must be vacant for data from the date the provider or supplier enrolled into PECOS using the address to December 2013. The Medicare claims paid to providers and suppliers with ineligible addresses may be understated because some of the providers and suppliers enrolled in PECOS with a potential ineligible address prior to 2005. 2. The Federation of State Medical Boards (FSMB) licensure data from March 31, 2014, to determine whether enrolled providers or suppliers had disciplinary actions that might make them ineligible for Medicare enrollment. We matched the providers and suppliers in PECOS with the FSMB licensure data by Social Security number and provider name. We then validated the FSMB licensure information against individual state medical licensing boards. We then calculated Medicare claims for those physicians that received a suspension or revocation of their medical license while enrolled in PECOS. This included the time the physician was actively suspended or revoked and in some cases the time when the provider could have been barred from the Medicare program for not reporting an adverse action. We calculated the Medicare claims data paid from 2005 to 2013, which are the years CMS had the claims data available. 3. The Social Security Administration’s (SSA) full death file containing updates through April 2013, to determine whether enrolled providers or suppliers were deceased. We matched the providers and suppliers with the SSA full death file by Social Security number and provider’s last name. We also matched the providers and suppliers we identified as deceased with the Medicare claims by National Provider Identifier. We calculated the Medicare claims data paid from 2005 to 2013, which are the years CMS had the claims data available, to the deceased providers by considering only claims paid for services rendered after the date of death. 4. The Department of Health and Human Services (HHS) Office of Inspector General (OIG) List of Excluded Individuals and Entities (LEIE) as of September 17, 2012, to determine whether providers or suppliers were excluded from doing business with the federal government or health care–related programs.match by comparing the provider’s Social Security number and provider’s last name. We also matched the providers and suppliers we identified as being excluded with the Medicare claims data by using the provider and supplier National Provider Identifier. We calculated the Medicare claims data paid from 2005 to 2013, which are the years CMS had the claims data available, to the excluded providers and suppliers by considering only claims paid for services rendered after the exclusion date through the date the MAC or CMS found the provider to be excluded. The Medicare claims paid to excluded providers and suppliers may be understated in cases where these providers and suppliers were excluded prior to 2005. We also contacted the NSC and those MACs responsible for enrolling any of the individuals and entities that appeared in our four sets of matches. Since our PECOS data were as of March 29, 2013, for providers and suppliers and April 6, 2013, for DMEPOS suppliers, we requested updated information during the months of September 2014 to October 2014. This information included whether the providers or suppliers were revalidated or changed their PECOS profile information. We also requested providers’ and suppliers’ application files including site-visit reports from the MACs when appropriate to corroborate MACs’ responses. We also selected 30 locations for a physical site visit to confirm whether the practice location address was an eligible address. The 30 locations were selected based on the geographic proximity to the five MACs and the NSC we visited, and to GAO offices. These locations were selected independently of our generalizable sample of 496 addresses and this selection is not generalizable to any set of addresses. We assessed the reliability of the PECOS data, USPS address- management tool, FSMB licensure data, SSA full death file, HHS LEIE, and Medicare claims data by reviewing relevant documentation, interviewing knowledgeable agency officials, and performing electronic testing to determine the validity of specific data elements in the data. Specifically, for the USPS address-management tool, we selected a generalizable stratified random sample of 496 addresses that the tool flagged as a CMRA, vacant, or invalid and used Google Maps, Internet searches, or physical site visits to confirm the address. For the FSMB licensure data, we selected a random, nongeneralizable sample of 153 licenses and traced the license information, including disciplinary actions when applicable, to the appropriate state licensing medical board for confirmation. We determined that these databases were sufficiently reliable for the purpose of our work. We conducted this performance audit from January 2014 to June 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following table outlines the steps in the enrollment-screening process depicted in figure 2. Federal regulations require that applicants have a physical practice location that is open to the public for providing health care–related services that is properly staffed, equipped, and stocked to furnish the services for which they will be receiving Medicare funds. Providers and suppliers are required to list a physical practice location address in the enrollment application regardless of their provider or supplier type. The practice location address provided in the application depends on the type of services the provider or supplier renders. Table 3 describes the type of practice locations allowed based on the services the provider or supplier renders. We selected a generalizable stratified random sample of 496 addresses from the population of 105,234 that appeared in the United States Postal Service (USPS) address-management tool as a Commercial Mail Receiving Agency (CMRA), a vacant address, or invalid address. For each selected address, we used Google Maps, Internet searches, or physical site visits to confirm whether the practice location address was an eligible address. For the 496 addresses we reviewed, we confirmed the following: 120 of the 496 addresses had an ineligible address, of which 46 addresses were determined to be CMRAs, 29 were vacant properties, and 45 were invalid. We contacted the Medicare Administrative Contractors (MAC) and the National Supplier Clearinghouse (NSC) to determine whether the 120 addresses were updated, because providers and suppliers can submit changes to their addresses or update them during the revalidation process, since the time we obtained the list of providers and suppliers in the Provider Enrollment, Chain and Ownership System (PECOS). The MACs and the NSC noted that 92 of the 120 addresses we found to be ineligible have not been updated in PECOS from March 30, 2013, to October 2014. We found that from the time a provider enrolled in PECOS with the ineligible practice location through December 2013 or the date the provider updated the address, the Medicare program has paid providers associated with these 120 addresses approximately $122.4 million. 162 of the 496 addresses were determined to be valid addresses and thus eligible for Medicare. 214 of the 496 addresses cannot be determined as either eligible or ineligible using these methods. The numbers of addresses presented in this appendix are unweighted counts of results obtained from the stratified random sample of 496 cases. These numbers do not represent estimates of the population. The estimated percentages included in the body of the report were computed using methods appropriate for a stratified random sample and have been weighted to account for the sample design. As a result, percentages computed from the numbers presented in this appendix are not expected to match the estimated percentages included in the body of the report. During our review, we found that 321 physicians in the Provider Enrollment, Chain and Ownership System (PECOS) have received some type of revocation or suspension from March 29, 2003, to March 29, 2013. Of the 321 physicians, 147 were either not revoked from the Medicare program until months after the adverse action or never removed. Below in table 4 is a breakdown of the adverse actions identified in our review. Seto J. Bagdoyan, (202) 512-6722 or bagdoyans@gao.gov. In addition to those mentioned above, the following staff members made significant contributions to this report: Latesha Love, Assistant Director; Gloria Proa, Analyst-in-Charge; Ariel Vega; and Georgette Hagans. Additionally, Colin Fallon, Maria McMullen, and Marcus Corbin provided technical support; Shana Wallace and James Ashley provided methodological guidance; and Brynn Rovito and Barbara Lewis provided legal counsel.

Summary: In fiscal year 2014, Medicare paid $554 billion for health care and related services. CMS estimates that $60 billion (about 10 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.8 million providers and suppliers were in PECOS as of December 2014, according to CMS. GAO was asked to assess Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This report examines the extent to which CMS's enrollment-screening procedures are designed and implemented to prevent enrollment of ineligible or potentially fraudulent Medicare providers. GAO reviewed relevant documentation, interviewed CMS officials, and contacted the 12 CMS contractors that evaluate provider applications. GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used 2005–2013 Medicare claims data to verify whether they were paid during this period. GAO examined the implementation of four enrollment screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). Two of CMS's procedures appear to be working to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs. However, GAO identified the following weaknesses in the other two procedures: CMS's verification of provider practice location and physician licensure status. First, Medicare providers are required to submit the address of the actual practice location from which they offer services. GAO's examination of 2013 data found that about 23,400 of 105,234 (22 percent) of practice location addresses are potentially ineligible. The computer software CMS uses as a method to validate applicants' addresses does not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid addresses. In addition, CMS's March 2014 guidance has reduced the amount of independent verification conducted by contractors, thereby increasing the program's vulnerability to potential fraud. For example, the figure below shows a mailbox located within a UPS store that an applicant reported as a practice location, which CMS contractors inaccurately verified as an authentic practice location under CMS's new guidance, which allows contractors to use phone calls as the primary means for verifying provider addresses. Second, physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice and self-report final adverse actions, such as a suspension or revocation by any state licensing authority. CMS requires its contractors to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. In March 2014, CMS began providing a report to its Medicare contractors to improve their oversight of physician license reviews. However, the report only includes the medical license numbers providers use to enroll into the Medicare program, but not adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO found 147 out of about 1.3 million physicians listed as eligible to bill Medicare who, as of March 2013, had received a final adverse action from a state medical board for crimes against persons, financial crimes, and other types of felonies but were either not revoked from the Medicare program until months after the adverse action or never removed. GAO recommends that CMS incorporate flags into its software to help identify potentially questionable addresses, revise its 2014 guidance for verifying practice locations, and collect additional license information. The Department of Health and Human Services concurred with two of the three recommendations, but did not agree with the recommendation to revise its guidance. GAO continues to believe the recommendation is valid, as discussed in the report.