Before 1996, Medicare program integrity activities were subsumed under Medicare’s general administrative budget and performed, along with general claims processing functions, by insurance companies under contract with CMS, which led to certain problems. The level of funding available for program integrity activities was constrained, not only by the need to fund ongoing Medicare program operations—such as the costs for processing medical claims, but also by budget procedures imposed under the Budget Enforcement Act of 1990. In the early and mid-1990s, we reported that such funding constraints had reduced Medicare contractors’ ability to conduct audits and review medical claims. HHS advocated for a dedicated and stable amount of program integrity funding outside of the annual appropriations process, so that CMS and its contractors could plan and manage the function on a multiyear basis. HHS also asserted that past fluctuations in funding had made it difficult for contractors to retain experienced staff who understood the complexities of, and could protect, the financial integrity of Medicare program spending. Beginning in fiscal year 1997, HIPAA established MIP and provided CMS with dedicated funding to conduct program integrity activities. HIPAA stipulated a range of funds available for these activities from the Medicare trust funds each year. For example, for fiscal year 1997, the law stipulated that at least $430 million and not more than $440 million should be used. The maximum amount of MIP funds rose from $440 million in fiscal year 1997 to $720 million in fiscal year 2003. For fiscal year 2003, and every year thereafter, the maximum amount that HIPAA stipulated for MIP was $720 million. (See app. II, table 2, for additional information on the MIP funding ranges.) As a result of the increases stipulated in HIPAA, from fiscal years 1997 through 2005, total MIP expenditures increased about 63 percent—from about $438 million to $714 million, as figure 1 shows. HIPAA authorized MIP funds to be used to enter into contracts to “promote the integrity of the Medicare program.” The statute also listed the various program integrity activities to be conducted by contractors. CMS allocates MIP funds primarily to support its contractors’ program integrity efforts for the traditional Medicare program, known as fee-for- service Medicare. Among these contractors are fiscal intermediaries (intermediaries), carriers, PSCs, and Medicare administrative contractors (MAC). MACs are a new type of contractor that will replace all intermediaries and carriers by October 2011, as required by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA). MMA required CMS to conduct full and open competition to select MACs. CMS refers to this change as contracting reform. CMS has contracted with intermediaries, carriers, and MACs to perform two types of activities—claims processing and program integrity. Their claims processing activities include receiving and paying claims. These activities are classified as program management and are funded through a program management budget. In addition, intermediaries and carriers have been charged with conducting some program integrity activities under MIP, including performing medical review of claims. The four MACs selected in January 2006 will not conduct medical review activities. CMS plans to assign responsibility for medical review of claims to the MAC selected in July 2006 and to the other MAC contracts to be awarded in the future. MIP provides funds to support these program safeguard efforts. In addition, CMS uses MIP funds to support the activities of PSCs, which perform medical review of claims and identify and investigate potential fraud cases; a coordination of benefits (COB) contractor, which determines whether Medicare or other insurance has primary responsibility for paying a beneficiary’s health care costs; the National Supplier Clearinghouse (NSC), which screens and enrolls suppliers in the Medicare program; and the data analysis and coding (DAC) contractor, which maintains and analyzes Medicare claims data for durable medical equipment (DME), prosthetics, orthotics, and supplies. Contractors receive MIP funds to perform one or more of the following five program integrity activities: Audits involve the review of cost reports from institutions, such as hospitals, nursing homes, and home health agencies. Cost reports play a role in determining the amount of providers’ Medicare reimbursement. Medical review includes both automated and manual prepayment and postpayment reviews of Medicare claims and is intended to identify claims for noncovered or medically unnecessary services. The secondary payer activity seeks to identify primary sources of payment--such as employer-sponsored health insurance, automobile liability insurance, and workers’ compensation insurance--that should be paying claims mistakenly billed to Medicare. Secondary payer activities also include recouping Medicare payments made for claims not first identified as the responsibility of other insurers. Benefit integrity involves efforts to identify, investigate, and refer potential cases of fraud or abuse to law enforcement agencies that prosecute fraud cases. Provider education communicates information related to Medicare coverage policies, billing practices, and issues related to fraud and abuse both to providers identified as having submitted claims that were improper, and to the general provider population. CMS also uses MIP to fund support for the five activities, such as certain information technology systems, fees for consultants, storage of CMS records, and postage and printing. The agency allocates the cost of this support to the five activities, depending on which of the activities is receiving support. Table 1 provides information on specific MIP activities performed by the contractors. Appendix III provides examples of key tasks performed by each of these contractors. For fiscal years 1997 through 2005, CMS generally increased the amount of funding for each of its five program integrity activities, but the amount of the funding provided and the percentage increase have varied among the activities. Provider education received the largest percentage increase in funds, while audit and medical review received the largest amount of funds overall. (See fig. 2.) CMS increased its allocation for provider education by about 590 percent from fiscal year 1997 through fiscal year 2005. This increase was due, in part, to CMS’s decision in fiscal year 2002 to use MIP funds for outreach activities to groups of like providers, which had not previously been funded through MIP. CMS will be able to further increase expenditures for program integrity in fiscal year 2006. In addition to the maximum of $720 million originally appropriated under HIPAA for fiscal year 2006, DRA increased the maximum by an additional $112 million, for a total of $832 million. CMS plans to use some of the $112 million to address potential fraud, waste, and abuse in the new Medicare prescription drug benefit. In each year from fiscal year 1997 through fiscal year 2005, CMS generally increased the amount of MIP funds spent for each of its five program integrity activities, as figure 2 shows. In addition to the increase in the amount of funding for provider education, the expenditures for audit increased 45 percent during the same period. As figure 3 shows, expenditures for medical review increased from fiscal year 1997 to fiscal year 2001 to almost $215 million—about 81 percent—and, since fiscal year 2001, decreased to about $166 million, or about 23 percent. Overall, expenditures for medical review increased 40 percent from fiscal year 1997 to fiscal year 2005. During this period, expenditures for secondary payer increased 49 percent, and for benefit integrity, expenditures increased 89 percent. (See fig. 3 for the amount of expenditures by activity in fiscal years 1997, 2001, and 2005 and app. II, table 3, for more detailed information on the amount of expenditures for each activity in each year.) Increased spending for provider education stemmed, in part, from provider concerns about an increased burden on them in the medical review process. In 2001, we reported that as CMS increasingly focused on ensuring program integrity, providers were concerned about what they considered to be inappropriate targeting of their claims for review. Further, providers asserted that they may have billed incorrectly because of their confusion about Medicare’s program rules. To address these concerns, CMS developed a more data-driven approach for conducting medical review and also increased its emphasis on provider education. CMS officials explained that medical review would help identify providers that were billing inappropriately, and provider education would focus on individuals’ specific billing errors to eliminate or prevent recurrence of the problems. In addition, beginning in fiscal year 2002, spending for the provider education activity increased significantly because CMS began to use MIP funds for what the agency called provider outreach. Provider outreach focuses on communicating with groups of providers about Medicare policies, initiatives, and significant programmatic changes that could affect their billing. This information is conveyed through seminars, workshops, articles, and Web site publications. Previously, provider outreach had been funded outside of MIP, as part of CMS’s program management budget. Provider education spending increased from $17 million in fiscal year 2001—before provider outreach was added to the provider education activity—to $53.5 million in fiscal year 2002. In fiscal year 2005, funding for the provider education activity reached $70 million. In comparing the share of funds spent on each program integrity activity, from fiscal year 1997 through fiscal year 2005, we found that CMS generally spent the largest share on audit, averaging about 31 percent, and on medical review, averaging about 27 percent. CMS spent less on secondary payer, averaging 21 percent, and benefit integrity, averaging 15 percent. In contrast, during this period, CMS spent the smallest percentage on provider education, which averaged about 6 percent of MIP expenditures. See figure 4 for information on the percentage of funds allocated to each activity. (For more detail, see table 4 in app. II.) CMS officials told us that they generally had allocated MIP funds to the five activities based predominantly on historical funding, but sometimes considered high-level priorities. However, this approach does not take into account data or information on the effectiveness of one activity over the other in ensuring the integrity of Medicare or allow CMS to determine if activities are yielding benefits that are commensurate with the amounts spent. For example, while CMS has noted that benefit integrity and provider education activities have intangible value, the agency has not routinely collected information to evaluate their comparative effectiveness. Furthermore, CMS has not fully assessed whether MIP funds are appropriately allocated within the audit, medical review, benefit integrity, and provider education activities. For example, audit’s role has changed as Medicare’s payment methods have changed in the last decade, but it continues to have the largest share of MIP funding. According to agency officials, CMS allocates funds for the five activities based primarily on an analysis of previous years’ spending and may also consider other information when developing the MIP budget, such as current expenditures by individual contractors. CMS officials told us that they may also consider the agency’s high-level priorities. For example, in fiscal year 2004, CMS began to increase funds to expand the scope of its annual study to estimate Medicare improper payment rates, and in fiscal year 2002, it increased its MIP allocation for provider education. CMS does not have a means to compare quantitative data or qualitative information on the relative effectiveness of MIP activities that it could use in allocating funds. Instead, it calculates the quantitative benefits for two, and assesses the qualitative benefits—which are not objectively measured—for the other three. In fiscal year 2005, for its medical review and secondary payer activities, CMS tracked dollars saved in relation to dollars spent—a quantitative measure that the agency calls a return on investment (ROI). Having an ROI figure is useful because it measures the effectiveness of an individual activity so that its value can be compared with that of another activity. As of fiscal year 2005, secondary payer had an ROI of $37 for every dollar spent on the activity, and medical review had an ROI of $21 for every dollar spent. CMS tracked the ROI for audit, but by fiscal year 2002, audit’s reported contribution to ROI fell to almost zero. (See fig. 5 and app. II, table 5, for additional ROI details.) CMS officials told us that the decrease in the ROI for audit was due to the implementation of prospective payment systems (PPS), under which Medicare pays institutional providers fixed, predetermined amounts that vary according to patients’ need for care. Until fiscal year 2001, audits had achieved an ROI that was generally $9 or more for every dollar spent conducting them, by disallowing payment for individual costs that should not have been paid by Medicare under the previous payment method. Under PPS, CMS’s methods for paying providers changed. However, the information system that had been used to track ROI began to incorrectly calculate the savings from audit because it had not been adjusted for the new payment method. According to agency officials, CMS is implementing a different way to track audit savings, and an overall ROI. It will focus on the savings from disallowing items that directly affect an individual provider’s payment under a PPS, such as bad debts and the number of low- income patients hospitals serve. It will track the amounts related to these add-on payments actually paid by Medicare to, or recouped from, the provider after an audit. The difference between the amount paid prior to the audit and the amount paid after the audit (assuming there has been an adjustment) would be the savings. However, all audit functions do not result in measurable savings. For example, in its written comments on a draft of this report, CMS noted that many audit functions funded by MIP do not have an ROI. CMS stated that these include processing cost reports for data collection purposes, correcting omissions on providers’ cost reports, implementing court decisions, and issuing notifications concerning Medicare payments. In addition, CMS stated that some of these activities are mandated by law, while others have significant value to the Medicare Payment Advisory Commission (MedPAC), which is an independent federal commission; providers; provider associations; and actuaries. From fiscal year 1997 through fiscal year 2005, CMS developed qualitative assessments of the impact of benefit integrity and provider education. According to CMS, the agency develops such assessments when the savings generated by MIP activities are impossible or difficult to identify. Nevertheless, CMS officials told us that these activities provide value to the program in helping to ensure proper Medicare payments. For example, CMS officials said that benefit integrity contributes to the work of federal law enforcement agencies, which investigate and prosecute Medicare fraud and abuse. CMS officials also noted that they consider benefit integrity to have a sentinel effect in discouraging entities that may be considering defrauding the Medicare program, but this effect is impossible to measure. CMS indicated that trying to measure the results of the contractors’ benefit integrity activities could create incentives that undermine the value of their work. For example, counting the number of cases referred to law enforcement for further investigation could lead the contractors to refer more cases that were less fully developed. However, other agencies that investigate or prosecute fraud, such as HHS and the Department of Justice, keep track of their successful cases, recoveries, and fines to demonstrate their results. Similarly, CMS could assess the degree to which each of its contractors had contributed to HHS and the Department of Justice’s successful investigations and prosecutions. In regard to educating providers on appropriate billing practices, CMS may be missing opportunities to evaluate its contractors’ performance. Provider education can help reduce billing errors, according to CMS. However, according to an OIG report, CMS has not evaluated the strategies used to modify the behavior of providers through education to determine if these strategies are achieving desired results. CMS has noted the intangible value inherent in benefit integrity and provider education activities, but the agency has not routinely collected information to evaluate their comparative effectiveness in ensuring program integrity. Further, as discussed earlier, correct information on audit’s effectiveness, based on an ROI, has not been available for the last several years. Consequently, CMS is not able to determine if some of the funds spent for benefit integrity, provider education, and audit—about $396 million, or 56 percent of MIP funds in fiscal year 2005—could be better directed to secondary payer or medical review. Nevertheless, CMS officials told us that they plan to decrease the allocation to medical review and increase the allocation to provider education. CMS officials stated that they are developing two initiatives that will give the agency objective measures of the results of the audit and provider education activities. As discussed earlier, CMS is implementing a revised methodology for calculating the ROI for audit. In addition, it is trying to develop information on the effectiveness of provider education. A CMS official explained that the agency is adding a provider education component to its program integrity management reporting system. This component will potentially allow CMS to develop an ROI figure for provider education by correlating educational efforts to a decrease in claim denials and provide a measure of the quantitative benefits of this activity. This component is scheduled to begin operating in the summer of 2006. After CMS has allocated funds to each of the five MIP activities, it must decide how to further distribute those funds to pay contractors that carry out each one. For example, in fiscal year 2004, after CMS allocated about $135 million for medical review to be conducted by intermediaries and carriers, it then distributed those funds to pay 28 intermediaries and 24 carriers that were conducting medical review at that time. However, given vulnerabilities for improper payment, contractor workload, and the relative effectiveness of activities performed, CMS has not always taken steps to ensure that it has allocated funds in an optimal way within its activities. Nevertheless, CMS has used information on relative savings to decide on funding allocations within the secondary payer activity. Medical review, provider education, and benefit integrity are activities for which allocation of MIP funds may not be optimal, because our analysis suggests that CMS has not allocated funds within these activities based on information concerning contractor vulnerabilities. Such vulnerabilities include the potential for fraudulent billing in different locations and the amount of potential benefit payments at risk in the contractor’s jurisdiction. For example, CMS estimated that the contractor that handled claims for DME, orthotics, prosthetics, and supplies in a jurisdiction that included Texas and Florida—two states experiencing high levels of fraudulent Medicare billing—improperly paid 11.5 percent of its 2004 claims—or $474.9 million—which was a higher improper payment rate than that of other contractors paying these types of claims. As we previously reported, our analysis indicated this contractor received almost a third less funds for medical review per $100 in submitted claims in fiscal year 2003 than the amount given to contractors in other regions with less risk of fraudulent billing. Our most recent analysis indicated that the imbalance in fund allocation did not change in fiscal years 2004 and 2005. We could not determine the rationale for this allocation beyond what was historically budgeted for this contractor. The amount of medical review funds allocated to individual contractors is not directly tied to the amount of benefits that they pay, which is a key measure of potential risk. For example, in fiscal year 2004, one contractor paid out $66 million in benefits and received about 28 cents in medical review funds for each $100 in benefits paid. In contrast, another contractor paid out considerably more in benefits—about $5 billion in fiscal year 2004—and received about 7 cents in medical review funds for each $100 in benefits paid. Further, CMS has not adjusted the amount of funding for individual contractors to educate providers based on their relative risks. A CMS official told us that the amount of provider education funding is generally aligned with the amount allocated for medical review, regardless of the value of the benefits that the contractor pays. Similarly, the amount of MIP funds provided to PSCs is not directly tied to the amount of benefits paid in jurisdictions for which they have responsibility for benefit integrity. For example, CMS spent about $75 million for work performed by PSCs under 13 benefit integrity task orders. The PSCs averaged about 3 cents for each $100 in paid claims in the jurisdictions for which they conducted benefit integrity tasks. However, the amount of MIP funding paid to the PSCs to conduct benefit integrity activities varied from about 1 cent to about 7 cents for each $100 in claims paid. Further, our analysis showed no clear relationship between funds provided to PSCs and their responsibilities for conducting benefit integrity activities in jurisdictions with high incidences of fraudulent Medicare billing. For example, one PSC received about 4 cents for conducting benefit integrity work for each $100 in paid claims for benefit integrity work in a jurisdiction that included Florida, which is at high risk for fraudulent billing. In contrast, PSCs received the same level of funding to conduct benefit integrity work in states at lower risk for fraudulent billing, including Iowa, Montana, Pennsylvania, and Wyoming. During the last decade, Medicare has significantly changed how it pays institutional providers—such as hospitals and nursing homes—that it audits. To align with the payment method changes, CMS has modified its audit focus to items in the cost report that can affect payments under a PPS. However, these audits can affect a much smaller proportion of Medicare’s payments under a PPS than audits of costs under the previous payment method. Given the magnitude of the payment method change, CMS has not evaluated whether funds within the audit activity should be further reallocated to potentially generate greater savings to the Medicare program by addressing the accuracy of reported costs that may be used to determine payment increases. CMS distributes funds to its contractors to conduct certain tasks, such as inputting data from; reviewing; and, if needed, auditing cost reports submitted by its institutional providers in order to settle, or agree upon, the reported costs. CMS’s audit contractors are also required to conduct wage index reviews and assist with intermediary hearings and appeals of settled cost reports. For several years, CMS has had a backlog of cost reports to settle, and the agency has made a priority of reducing the backlog. Other priorities include more closely scrutinizing those providers that are still paid based on their costs—such as critical access hospitals— and conducting required audits. For providers paid under a PPS, CMS has shifted its audit focus to the few items that could affect a provider’s payments if disallowed. These include bad debt, payments for graduate medical training, and the number of low- income patients that hospitals serve. CMS has also shifted more audit resources to hospitals because more items on their cost reports can affect calculations of a provider’s add-on payments. CMS does not know the amount of MIP funds that are associated with audits of different types of providers or specific issues, such as bad debt. However, in fiscal year 2004, CMS began to separately track some audit costs, such as those for desk reviews, audits, and wage index reviews. This provided some information on how audit funds were being spent. According to CMS officials, tracking the costs of individual audits at a provider or issue level would be difficult and costly because multiple issues are audited at the same time and the complexity of individual audits varies for the same provider type. Nevertheless, more detailed information on audit costs—such as at the provider level—than CMS currently tracks could provide it with a better understanding of the value of its current mix of tasks, particularly if it could associate the costs with the savings from the audits. This could provide CMS with information on whether it needs to change the balance of funding for those tasks—for example, whether it should focus more attention on bad debt or other areas of the cost report for specific types of providers. Further, CMS’s audit function continues to focus on verifying specific aspects of the provider’s cost report that affect its individual payment. This type of audit generally addresses a small portion of providers’ Medicare payments, while under a PPS, a much greater portion of the payments are based on overall industry costs. Each year, MedPAC advises the Congress on whether the Medicare PPS rates for institutional providers should increase, decrease, or remain constant. However, MedPAC generally does not have a set of audited cost reports that validate the information it uses in its assessments of providers, such as hospitals’ allocations of their costs. According to MedPAC, the current audit process reveals little about the accuracy of the Medicare cost information. For example, while CMS audits individual providers through full or partial audits, it does not allocate funds to audit a panel of providers, such as hospitals, which could provide a means to highlight areas where cost reporting accuracy is problematic. Without accurate information, CMS cannot ensure that payments to hospitals properly reflect their costs and provide reliable information that can be a factor in determining whether rates should change or remain constant. CMS might find it cost-effective to gather additional information because audits have the potential to give the Congress better information on hospitals’ costs. For example, by law, CMS is required to periodically conduct audits of end-stage renal disease (ESRD) facilities, which care for patients who must rely on dialysis treatments to compensate for kidney failure. CMS broadened its audit plan for these facilities to include a review not only of bad debts, but also to validate the costs of a selected number of items that are paid through PPS. CMS officials indicated that their audits of these facilities generated only limited savings, usually related to bad debts, so they did not consider these audits very valuable. However, as a result of these audits, MedPAC officials stated in 2005 that these facilities had a greater margin—or ratio of Medicare payments to costs—than their cost reports suggested. This information was factored into MedPAC’s recommendation about the amount of payment increase needed in calendar year 2007. Setting appropriate payment increases for hospitals is potentially more important to Medicare than for ESRD facilities because payments to participating inpatient hospitals represented about $116 billion, or about 40 percent of Medicare’s benefit payments in fiscal year 2004. CMS officials agreed that gathering this information might be valuable, but indicated that they did not currently have sufficient funding to conduct this data validation in addition to their current efforts funded as part of audit. In contrast to provider education and audit, CMS collects information on the relative savings from specific secondary payer functions and has used this information to decide on funding allocations within the secondary payer activity. CMS allocates funds to, and calculates savings for, about 16 secondary payer functions. Among these functions are (1) a data match that helps identify instances when a Medicare beneficiary was covered by other insurance and (2) the initial enrollment questionnaire, which gathers insurance information on beneficiaries before they become eligible for Medicare. Within secondary payer, for fiscal year 2005, savings for the 16 functions ranged from less than 1 percent to 49 percent of savings of over $5 billion for all of the functions. CMS officials told us that they have used relative savings information for secondary payer functions as one factor in determining whether to increase, decrease, or terminate funding for the functions within this activity. For example, according to CMS officials, in fiscal year 2005, savings for one secondary payer function—voluntary reporting of primary payer information to CMS by health insurance companies—increased by about 65 percent over fiscal year 2004. Further, savings from this effort continue to increase. CMS is planning to maintain or expand funding to it. However, CMS officials said that after confirming their relatively low savings, they had terminated certain other efforts to identify secondary payer claims. The terminated efforts included (1) a second questionnaire sent as follow-up to determine whether a beneficiary who is claiming Medicare benefits for the first time has other health insurance that would be responsible for paying the claim and (2) an effort to determine whether certain trauma codes contained in a claim could indicate that another insurer, such as worker’s compensation, could be the primary payer. The Medicare program is undergoing significant changes for which there is little precedent. These include the addition of the new Part D prescription drug benefit and the reform of Medicare contracting. Both will require CMS to make new choices in how it should allocate its MIP funds to best address its program integrity challenges. CMS’s current allocation approach—which agency officials characterized as primarily relying on previous fiscal year funding allocations for each activity, and to each contractor, to determine current allocations—will not be adequate to address emerging program integrity risks and ongoing programmatic changes. In addition, as contracting reform proceeds, CMS intends to increase its use of MIP funds to reward contractors to encourage superior performance. However, the usefulness of award payments as a tool to encourage contractors to perform MIP tasks effectively depends on how well CMS can develop, and consistently apply, performance measures to gauge differences in the quality of performance. CMS’s current allocation approach will not be adequate to address Medicare’s emerging program integrity risks related to the prescription drug benefit. Over the next 10 years, total expenditures for the prescription drug benefit, which was implemented in January 2006, are projected to be about $978 billion, while total expenditures for the Medicare program are projected to be about $6.1 trillion. CMS and others have stated that the prescription drug benefit is at risk for significant fraud and abuse. In December 2005, an assistant U.S. attorney noted that the Medicare prescription drug benefit would be vulnerable to a host of fraud and abuse schemes unless better detection systems are developed. According to CMS, the prescription drug benefit may be vulnerable to fraud and abuse in particular areas, including beneficiary eligibility, fraud by pharmacies, and kickbacks designed to encourage certain drugs to be included by the plans administering the benefit. To respond to these challenges, CMS has selected eight private organizations, called Medicare prescription drug integrity contractors (MEDIC), to support CMS’s benefit integrity and audit efforts. Because the Medicare prescription drug benefit is in the early stages of implementation, CMS does not yet have data to estimate the level of improper payments or information to determine the level of program integrity funds needed to address emerging vulnerabilities. As a result, it is not clear whether, in the future, CMS will need to shift funds from program integrity activities for Parts A and B to protect the Part D drug benefit from potential fraud and abuse. For fiscal year 2006, $112 million beyond the HIPAA limit of $720 million has been appropriated for CMS to support program integrity activities. The President’s Budget for fiscal year 2007 has also proposed additional funds for fiscal year 2007 and fiscal year 2008. CMS plans to use some of the additional funding provided under DRA for fiscal year 2006 to support Part D program integrity efforts. For example, CMS plans to spend $14 million over the next fiscal year to fund efforts by MEDICs to protect the prescription drug benefit by performing selected tasks, such as analyzing data to identify instances of potential fraud and abuse. In addition, CMS plans to spend about $33 million on Part D information technology systems to track data related to beneficiary eligibility and to collect, maintain, and process information on Medicare covered and noncovered drugs for Medicare beneficiaries participating in Part D. See appendix IV for more information. Another significant programmatic change that will affect future MIP funding allocations is Medicare contracting reform. MMA required CMS to transfer all claims administration work, which includes selected program integrity activities, to MACs by October 2011. CMS plans to transfer all work to the MACs by July 2009—about 2 years ahead of MMA’s specified time frame. Contracting reform will affect MIP funding allocations because of (1) changes in contractors’ responsibilities for program integrity activities and their jurisdictions, (2) the potential for operational efficiencies, and (3) increasing use of MIP funds for contractor award payments. The transition to MACs will change some contractors’ program integrity responsibilities and require reallocation of MIP funds among them. The new MACs will be responsible for paying claims that were previously processed by intermediaries and carriers, but CMS has decided that MACs will not be performing all of the MIP activities that they previously conducted. For example, PSCs performed medical reviews of claims in some contractors’ jurisdictions, but this activity will be performed by almost all of the MACs in the future. Further, contractors’ jurisdictions will change as 23 MACs assume the work previously performed by a total of 51 Medicare intermediaries and carriers, within the confines of 15 newly designated geographic jurisdictions. The PSCs conducting benefit integrity work will be aligned with the MACs in the 15 jurisdictions. In some cases, one PSC may be aligned with more than one MAC jurisdiction. According to CMS officials, Medicare contracting reform will lead to operational efficiencies and savings that would mostly be due to more effective medical review. For example, CMS anticipates that greater incentives for MACs to operate efficiently and adopt industry innovations in the automated medical review of claims will result in total estimated trust fund savings of $650 million for Medicare from fiscal year 2006 to fiscal year 2011. Having program integrity activities operate more effectively could give CMS additional flexibility to reallocate some funding while achieving reductions in improperly paid claims. However, we have not validated CMS’s estimate, and in our August 2005 report on CMS’s plan for implementing Medicare contracting reform, we raised concerns about the uncertainty of savings estimates, which were based on future developments that are difficult to predict. As part of contracting reform, CMS plans to increase its allocation of MIP funds that are used as award payments to encourage superior performance of program integrity activities by contractors. Award payments that are tied to appropriate performance measures could encourage contractors to conduct MIP activities effectively and introduce innovations, such as developing new analytical approaches to enhance the medical review process. Intermediaries and carriers, both of which conduct some program integrity activities, are currently paid on the basis of their costs, generally without financial incentives to encourage superior performance. In contrast, CMS currently offers award payments to other types of contractors that conduct program integrity activities, including four MACs that were selected in January 2006, PSCs, the COB contractor, NSC, and the DAC contractor. As early as 2009, or when all administrative work has been transferred to MACs, CMS will be offering the opportunity to be selected for award payments to all contractors that conduct program integrity activities. The usefulness of using MIP funding for award payments to encourage contractors to conduct program integrity tasks effectively depends on how well CMS can develop, and consistently apply, performance measures to gauge differences in the quality of performance. In 2004, CMS conducted a study to evaluate whether the agency could reduce improper payments by using award payments for contractors to lower their paid claims error rates, which represent the amount of claims contractors paid in error compared with their total fee-for-service payments. According to CMS, the outcome of that pilot was positive, and CMS plans to use award payments in the future as part of its strategy for reducing improper payments. However, as we reported in March 2006, CMS will need to refine its measure of contractor-specific improper payments, which would enhance its ability to evaluate their performance of medical review and provider education activities. Further, even when CMS has developed measures to assess the performance of contractors that conduct MIP activities, it has not always effectively or consistently applied them. For example, the OIG recently reviewed the extent and type of information provided in evaluation reports on PSCs’ performance in detecting and deterring fraud and abuse. The OIG found that although the evaluation reports were used as a basis to assess contractors’ overall performance, they did not consistently include quantitative information on the activities contractors performed or their effectiveness. We designated the Medicare program as high risk for fraud, waste, abuse, and mismanagement in 1990, and the program remains so today. To address this ongoing risk and reduce the program’s billions of dollars in improper payments, CMS must use Medicare’s program integrity funding as effectively as possible. Further, Medicare’s susceptibility to fraud is growing, as it addresses the challenges of adding a prescription drug benefit to the program. Despite Medicare’s increasing vulnerability, CMS has generally not changed its allocation approach for MIP funding. In 2006, a decade after MIP was established to support Medicare program integrity activities, CMS officials state that the primary basis for their allocation of funds is how they have been allocated in the past. However, programmatic changes for Medicare’s contractors and emerging risks for the Part D prescription drug benefit suggest that CMS needs to modify its approach for deciding on funding allocations for—and within—the five program integrity activities. Also supporting the need for CMS to assess its current allocation approach is that the agency’s funding decisions do not routinely take into account quantitative data or qualitative information on the relative effectiveness of its five program integrity activities or contractors’ vulnerabilities. Without considering information or data, CMS cannot judge whether funds are being spent as effectively as possible or if they should be reallocated. CMS is developing two new measures that may help the agency evaluate the relative effectiveness of provider education and the audit activity. Better information about MIP activities’ effectiveness should assist CMS in making more prudent management and funding allocation decisions. To better ensure that MIP funds are appropriately allocated among and within the five program integrity activities, we recommend that CMS develop a method of allocating funds based on the effectiveness of its program integrity activities, the contractors’ workloads, and risk. In its written comments on a draft of this report, CMS stated that it generally agreed with our recommendation to develop a method of allocating MIP funds based on the effectiveness of the agency’s program integrity activities, Medicare contractors’ workloads, and risk. However, the agency expressed concern that the report appeared to emphasize the use of ROI, a quantitative measure that tracks dollars saved in relation to dollars spent, as a way to allocate funds. CMS stated this quantitative measure can be an indicator of effectiveness, but noted that such a measure cannot serve as the sole basis for informing funding decisions. The agency stated that some of its MIP activities had benefits that could not be easily quantified. CMS agreed on the value of allocating funds based on risk and provided information on programmatic changes that would help it do so. The agency also noted the efforts it had recently made to strengthen program integrity. CMS expressed concern about our discussion in the draft report concerning the use of ROI as a way to quantitatively measure effectiveness and to allocate MIP funds. CMS stated that the agency cannot provide funding based exclusively on an ROI because some activities, including benefit integrity, do not lend themselves to an ROI measurement and others, such as audit, are governed by statutory requirements. CMS also stated that in allocating MIP funds, it is critical that it consider factors other than ROI, including historical funding, because MIP funding has not increased since 2003. Our report indicates that an ROI is an important factor that should be considered in allocating funds, but cannot be the sole consideration. Our conclusions reflect our support of an approach that takes into account the qualitative benefits of program integrity activities. Our report discusses agency officials’ views on the difficulty of developing quantitative measures for the benefit integrity activity. We also provide information on CMS officials’ qualitative assessments of the positive impact of benefit integrity and provider education. For example, our report notes that according to CMS officials, these benefits include discouraging entities that may be considering defrauding the Medicare program and helping to ensure proper Medicare payments. Both quantitative and qualitative assessments of effectiveness—to the extent they can be developed—could help CMS determine whether MIP funds are being wisely invested or if they should be reallocated. CMS also commented on the allocation of MIP funds to Medicare contractors based on workload and risk. CMS noted that contracting reform and the introduction of MACs will result in contractors’ workloads being more evenly distributed. In addition, CMS noted that it is developing award fee measures for contractors’ medical review activities, including establishing performance goals for the Comprehensive Error Rate Testing program contractor-specific error rate. CMS agreed with us that risk is a factor that should be considered in allocating funds. CMS stated that it is committed to identifying and investigating better approaches to allocate resources to support critical agency functions, including using its new contracting authority to introduce incentives for Medicare fee-for-service claims processing contracts and consolidating Medicare secondary payer activities. CMS also noted that it is using state- of-the-art systems and expertise to aggressively fight waste and abuse in the program, continues to work closely with its contractors to help ensure that providers receive appropriate education and guidance in areas where billing problems have been identified, and has expanded oversight of the new Medicare Part D prescription drug benefit. In addition, CMS discussed recent program integrity efforts and successes, including reducing the number of improper fee-for-service Medicare payments and addressing fraud across all provider types by coordinating the activities of CMS, law enforcement, and Medicare contactors in Los Angeles, California, and Miami, Florida. We have reprinted CMS’s letter in appendix V. CMS also provided us with technical comments, which we incorporated in the report where appropriate. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days after its date. At that time, we will send copies to the Secretary of HHS, the Administrator of CMS, appropriate congressional committees, and other interested parties. We will also make copies available to others upon request. This report will also be available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (312) 220-7600 or aronovitzl@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are Sheila K. Avruch, Assistant Director; Hazel Bailey; Krister Friday; Sandra D. Gove; and Craig Winslow. To provide information on the amount of funds allocated to the five Medicare Integrity Program (MIP) activities over time, we interviewed officials from the Centers for Medicare & Medicaid Services (CMS). We obtained information concerning MIP funding allocations for audit, medical review, secondary payer, benefit integrity, and provider education for fiscal years 1997 through 2005. We also analyzed allocations within these activities. Further, we obtained and analyzed related financial information, including CMS’s planned and actual expenditures, savings, and return on investment (ROI) calculations for fiscal year 1997 through fiscal year 2005; CMS financial reports; and presidential and Department of Health and Human Service (HHS) budget proposals for fiscal years 2006 and 2007. Because most MIP expenditures are for activities related to the Medicare fee-for-service plan, our analyses focused on those expenditures. We reviewed relevant legislation, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA); the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA); and the Deficit Reduction Act of 2005 (DRA). We reviewed pertinent reports and congressional testimony, including our own and those of CMS and the HHS Office of Inspector General (OIG), related to program integrity requirements. To examine the approach that CMS uses to allocate MIP funds, we interviewed CMS officials regarding factors they consider when allocating MIP funds. We reviewed related documentation provided to us by CMS, including budget development guidelines; manuals, such as the Financial Management Manual; operating plans; and selected workload data. We also reviewed information on individual projects, such as information technology systems. We also reviewed pertinent GAO reports and testimony and Medicare Payment Advisory Commission reports. We did not independently examine the internal and automated data processing controls for CMS systems from which we obtained data used in our analyses. CMS subjects its data to limited reviews and periodic examinations and relies on the data obtained from these systems as evidence of Medicare expenditures and to support CMS’s management and budgetary decisions. Therefore, we considered these data to be reliable for the purposes of our review. In addition, we interviewed CMS officials regarding changes in the Medicare program that may affect MIP funding allocations, including CMS’s plans to support activities to detect fraud and improper billing for the new Part D prescription drug benefit and MIP activities to be performed by contractors in the future. We also interviewed CMS officials concerning performance measures and evaluations of contractors. We reviewed related documentation, including the statement of work for the Medicare prescription drug integrity contractors; plans for Medicare contracting reform; policies and procedures associated with CMS’s measurement of contractor performance; standards and performance measures, such as the Comprehensive Error Rate Testing program; various manuals, including the Medicare Program Integrity Manual; and an OIG report on performance evaluations of program safeguard contractors (PSC). We also reviewed CMS’s evaluations of contractor performance. We performed our work from August 2005 through August 2006 in accordance with generally accepted government auditing standards. The following tables contain details on MIP funding, expenditures, allocations, and ROI. Table 2 shows MIP funding ranges under HIPAA. Table 3 shows the amounts of MIP expenditures allocated to each of the program integrity activities. Table 4 shows the percentage of MIP funds allocated to the program integrity activities. Table 5 shows the ROI for three of the program integrity activities. Hospitals, nursing homes, home health agencies, and other institutional providers that are—or have been— paid on a cost reimbursement basis submit cost reports to CMS. Cost reports provide a detailed accounting of what costs have been incurred, what costs the provider is charging to the Medicare program, and how such costs are accounted for by the provider. Contractors review all or part of the cost report to assess whether costs have been properly allocated and charged to the Medicare program. Contractors determine if the cost report is acceptable or if it needs further review. In some instances, contractors may conduct on-site cost report audits, which include the review of financial records and related documentation supporting costs and charges. Contractors identify billing errors made by providers through analysis of claims data; take action to prevent errors, address identified errors, or both; and publish local coverage policies to provide guidance to the public and medical community concerning items and services that are eligible for Medicare payment. Most medical reviews do not require a manual review of medical records. Often contactors conduct medical reviews simply by examining the claim itself, usually using automated methods. Coordination of benefits (COB) contractor, intermediaries and carriers, and Medicare administrative contractors (MAC) The COB contractor collects, manages, and maintains information regarding health insurance coverage for Medicare beneficiaries. To gather information to properly adjudicate submitted claims, the COB contractor sends questionnaires to newly enrolled Medicare beneficiaries and employers to solicit information about beneficiaries’ health insurance coverage. The COB contractor also collects secondary payer data from providers, insurers, attorneys, and some state agencies. The COB contractor uses data match programs to identify claims that should have been paid by another insurer. When information indicates that a beneficiary has other health insurance, the COB contractor initiates a secondary payer claims investigation. Intermediaries and carriers also conduct secondary payer operations, including prepayment activities in conjunction with the COB contractor, and they recover erroneous secondary payer payments. Contractors are tasked with preventing, detecting, and deterring Medicare fraud. PSCs conduct medical reviews to support fraud investigations, analyze data to support medical reviews, process fraud complaints, develop fraud cases, conduct provider education related to fraud activities, and support law enforcement entities. Once a case is developed, PSCs refer it to the OIG or to law enforcement for prosecution. NSC reviews and processes applications from organizations and individuals seeking to become suppliers of medical equipment and supplies in the Medicare program. NSC verifies suppliers’ application information; conducts on-site visits to the prospective suppliers; issues supplier authorization numbers, which allow suppliers to bill Medicare; and maintains a central data repository of information concerning suppliers. NSC also periodically reenrolls active suppliers and uses data to assist with fraud and abuse research. The DAC contractor conducts ongoing data analysis and reporting of trends related to supplier billing for medical equipment and supplies and provides ongoing feedback to the PSCs. When billing problems are identified through medical reviews, contractors take a variety of steps to educate providers about Medicare coverage policies, billing practices, and issues related to fraud and abuse. Contractors may conduct group training sessions, including seminars and workshops; send informational letters to providers; arrange for teleconferences; conduct site visits; and provide information on their Web sites. For fiscal year 2006, DRA provided $112 million in MIP funds beyond the annual HIPAA limit of $720 million. Of this amount, DRA specified that $12 million was for the Medi-Medi program and $100 million was for MIP in general. Table 6 provides information on CMS’s planned spending of $100 million in general MIP funds provided by DRA, including spending related to the Part D prescription drug benefit.

Summary: Since 1990, GAO has considered Medicare at high risk for fraud, waste, abuse, and mismanagement. The Medicare Integrity Program (MIP) provides funds to the Centers for Medicare & Medicaid Services (CMS--the agency that administers Medicare--to safeguard over $300 billion in program payments made on behalf of its beneficiaries. CMS conducts five program integrity activities: audits; medical reviews of claims; determinations of whether Medicare or other insurance sources have primary responsibility for payment, called secondary payer; benefit integrity to address potential fraud cases; and provider education. In this report, GAO determined (1) the amount of MIP funds that CMS has allocated to the five program integrity activities over time, (2) the approach that CMS uses to allocate MIP funds, and (3) how major changes in the Medicare program may affect MIP funding allocations. For fiscal years 1997 through 2005, CMS's MIP expenditures generally increased for each of the five program integrity activities, but the amount of the increase differed by activity. Since fiscal year 1997, provider education has had the largest percentage increase in funding--about 590 percent, while audit and medical review had the largest amounts of funding allocated. In fiscal year 2006, funding for MIP will increase further to $832 million, which includes $112 million in funds that CMS plans to use, in part, to address potential fraud and abuse in the new Medicare prescription drug benefit. CMS officials told us that they have allocated MIP funds to the five program integrity activities based primarily on past allocation levels. Although CMS has quantitative measures of effectiveness for two of its activities--the savings that medical review and secondary payer generate compared to their costs--it does not have a means to determine the effectiveness of each of the five activities relative to the others to aid it in allocating funds. Further, CMS has generally not assessed whether MIP funds are distributed to the contractors conducting each program integrity activity to provide the greatest benefit to Medicare. Because of significant programmatic changes, such as the implementation of the Medicare prescription drug benefit and competitive selection of contractors responsible for claims administration and program integrity activities, the agency's current approach will not be adequate for making future allocation decisions. For example, CMS will need to allocate funds for program integrity activities to address emerging vulnerabilities that could affect the Medicare prescription drug benefit. Further, through contracting reform, CMS will task new contractors with performing a different mix of program integrity activities. However, the agency's funding approach is not geared to target MIP resources to the activities with the greatest impact on the program and to ensure that the contractors have funding commensurate with their relative workloads and risk of making improper payments.