Contractors have a long-standing and essential role in administering the Medicare program, including conducting program integrity activities, such as postpayment claims reviews, which are integral to protecting the Medicare program from improper payments or fraud. The four types of contractors we examined conducted about 1.4 million claims reviews that involved examining documentation sent in by providers in 2012, which represented less than one percent of all FFS claims in that year. MACs conduct postpayment claims reviews on a small percentage of paid claims to determine if the payments were proper based on the underlying documentation. MACs use the findings from postpayment claims reviews to help prevent future payment errors, for example, by reviewing claims received from specific providers or for specific services with a history of improper payments to determine whether additional action is needed to As of February 2014, prevent similar improper payments in the future.12 A/B MACs processed Medicare Part A and Part B claims from providers in each of 12 jurisdictions nationwide, and 4 DME MACs processed DME claims from providers in each of 4 jurisdictions nationwide. In 2012, A/B and DME MACs conducted 84,070 postpayment claims reviews, or 6 percent of about 1.4 million total postpayment claims reviews conducted that year. The mission of the ZPICs is to identify and investigate potentially fraudulent FFS claims and providers in each of seven geographic jurisdictions, which are called zones. They use several methods to investigate potentially fraudulent claims and providers, including postpayment claims reviews. In 2012, ZPICs conducted 107,621 postpayment claims reviews, or 8 percent of the total postpayment claims reviews that year. The CERT contractor conducts postpayment claims reviews on a nationwide random sample of claims, which are used to annually estimate the national Medicare FFS improper payment rate. This helps CMS comply with legal requirements for improper payment reporting.reviews are used to estimate the national Medicare improper payment rate, and to estimate the improper payment rate for each MAC and by type of service and provider. In 2012, the CERT contractor conducted 41,396 postpayment claims reviews used to estimate the improper payment rate, or 3 percent of the total postpayment claims reviews conducted that year. The mission of the RAs is to conduct postpayment claims reviews to identify improper payments not previously identified through MAC claims processing or other contractors’ reviews. Following a demonstration of recovery auditing required by the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, the Tax Relief and Health Care Act of 2006 established the National RA program. Use of RAs expands the capacity for claims reviews without placing additional demands on CMS’s budget, because the RAs are paid from funds recovered rather than appropriated funds. As a result of lessons learned during the RA demonstration project and to establish tighter controls on RAs, CMS imposed certain postpayment requirements unique to the RAs when it implemented the national program that it has not imposed on the other contractors. For example, prior to widespread use, RAs must submit to CMS for review and approval descriptions of the types of claims that they propose to review. CMS expects the RAs to select only those claims with the highest risk of improper payments. RAs must also submit the basis for assessing whether the claims for those services are proper. CMS established national RA operations in 2009 with one RA in each of four regions that together cover the United States. Federal law requires CMS to pay RAs on a contingency basis from Medicare overpayments recouped. However, if an RA’s overpayment determination is overturned on appeal, the RA is not paid for that claim. In contrast, MACs, ZPICs, and the CERT contractor are paid on the basis of the costs for the tasks performed. CMS reported that overpayments collected from the RAs increased from about $75 million in fiscal year 2010 to about $2.29 billion in fiscal year 2012. In 2012, the RAs conducted over 1.1 million postpayment claims reviews, or 83 percent of the total postpayment claims reviews that year. CMS provides guidance to its contractors on how they should analyze data to select claims for review. Within that guidance, contractors select the specific claims to review. Each of the four types of contractors selects claims for postpayment claims review using somewhat different bases for selection. (See table 1.) The potential for duplicative reviews exists because claims may be selected by more than one contractor. CMS officials told us that, in some cases, duplication is appropriate. For example, CMS officials told us that the CERT contractor may review a claim that has already been reviewed by another contractor because it must select a random sample of claims to estimate the Medicare improper payment rate. Once a contractor selects a claim for review, the contractor notifies the provider that a particular claim is under postpayment review and requests documentation from the medical record to substantiate the claim. When the contractor receives the documentation, a trained clinician or coder evaluates the documentation in light of all applicable Medicare coverage policy and coding guidelines to determine whether the payment for the services or items claimed was proper. If a MAC or another contractor determines that an overpayment was made, the MAC will seek repayment and send the provider what is referred to as a demand letter. In the event of an underpayment, the MAC will return the balance in a future remittance. Providers may appeal the contractors’ determinations. CMS developed the Recovery Audit Data Warehouse to track RA review activities and to prevent RAs from duplicating other contractors’ claims reviews. Since most of the postpayment claims reviews were conducted by RAs, RA review would be most likely to cause any potential duplications. To prevent RAs from duplicating reviews, the MACs, ZPICs, the CERT contractor, and other entities can enter the claims they have reviewed into the Recovery Audit Data Warehouse, and the database stores them as excluded claims (or exclusions). Exclusions are permanent, meaning that excluded claims are not supposed to ever be available for review by the RAs. In addition, the ZPICs and law enforcement entities, such as the HHS Office of Inspector General (OIG), can upload claims into the Recovery Audit Data Warehouse that they may, but not necessarily will, select for postpayment review as part of a fraud investigation and the database stores them as suppressions.While a claim is suppressed, it is unavailable for RA review. When a ZPIC or law enforcement agency concludes its investigation, the suppressions are required to be lifted. CMS then requires formerly suppressed claims for which medical records were requested to be excluded and thus become ineligible for RA review; all other formerly suppressed claims are to be released for possible future postpayment review. CMS requires ZPICs and law enforcement agencies to renew their suppressions every 12 months. If not renewed, the Recovery Audit Data Warehouse is to automatically release the suppressed claims. Before an RA begins postpayment claims reviews, it enters the claims it is considering for review into the Recovery Audit Data Warehouse. The database then checks to see if any of the claims the RA entered match the excluded or suppressed claims already stored in the database. If there is a match, the claim is not available for the RA to review and the Recovery Audit Data Warehouse will not allow the RA to enter any additional information about the claim. Although the other postpayment review contractors also are able to check the Recovery Audit Data Warehouse to see if the claims they are considering for review have already been reviewed by other contractors, the database is intended primarily to prevent RAs from conducting duplicative reviews. According to CMS officials, the amount of duplicative claims reviews among the four types of contractors is likely to be very small. Internal controls can help ensure that contractors are conducting postpayment claims reviews efficiently and effectively. Internal controls are the plans, methods, and procedures used to meet an organization’s mission, goals, and objectives, and help provide reasonable assurance that an organization achieves effective and efficient operations. For example, monitoring helps agencies ensure that contractor activities follow agency requirements. CMS requirements for contractors performing postpayment claims reviews and the manner in which the agency delegates authority and responsibility through these requirements help establish the control environment and control activities. Contractor requirements also establish the mechanisms that contractors use to communicate and interact with providers. Ineffective or inefficient requirements for claims reviews or insufficient monitoring and oversight create the risk of generating false findings of improper payments and an unnecessary administrative and financial burden for Medicare- participating providers and the Medicare program. The process of postpayment claims review requires contractors to interact and communicate with Medicare providers that directly provide medical services to beneficiaries. Executive Order 13571—Streamlining Service Delivery and Improving Customer Services—was issued in April 2011 to improve government services to individuals and private entities by requiring agencies to develop customer service plans in consultation with OMB. OMB issued implementing guidance for agencies for those services that the agencies plan to focus on improving.calls on agencies to improve customers’ experiences by a number of activities, including developing a process for ensuring consistency across the agency’s interactions with customers and coordinating with other agencies serving the same customers, as well as identifying opportunities to use common materials and processes. Collaboration is important when multiple contractors that conduct similar activities are overseen by different CMS units. Previous GAO work has identified practices that can help federal agencies collaborate effectively when they work together to achieve goals. This work highlighted, for example, the importance of agreeing on roles and responsibilities; establishing compatible policies, procedures, and other means to operate across organizational boundaries; and establishing mutually reinforcing or joint strategies to help align activities, processes, and resources to achieve a common outcome. These collaboration practices can also be useful when multiple offices within an agency—or an agency’s contractors—work together toward a common purpose. CMS lacks reliable data to estimate the number of duplicative claims reviews that are conducted. The Recovery Audit Data Warehouse was not designed to estimate the number of duplicative reviews among all four types of contractors, and not all contractors have been entering information consistently into the database. CMS has not monitored contractors’ data entry into the Recovery Audit Data Warehouse to ensure that it is complete and correct. CMS also has not issued complete guidance for MACs and ZPICs on whether it is appropriate for them to conduct duplicative reviews. CMS does not have reliable data to estimate the total number of duplicative claims reviews by all four types of contractors. In part, this is because CMS did not design the Recovery Audit Data Warehouse to estimate the total number of duplicative reviews. The RAs performed more than 80 percent of the claims reviews in 2012 and the Recovery Audit Data Warehouse was designed to track RA claims review activities and to prevent RAs from duplicating other contractors’ claims reviews; it was not designed to track and prevent duplicate claims reviews by the other three contractor types. For example, the Recovery Audit Data Warehouse does not show whether contractors other than RAs, such as a MAC and a ZPIC, duplicated each others’ claims reviews. Therefore, the Recovery Audit Data Warehouse data are not sufficient and reliable for accurately estimating the number of duplicative reviews by all four types of contractors. Another reason the Recovery Audit Data Warehouse cannot be used to estimate the amount of duplication is that not all of the four types of contractors consistently enter data into the database. For example, in response to our analysis that showed anomalies in the distribution of apparently duplicated claims, CMS officials told us that some MACs have been entering data from appeals reviews into the Recovery Audit Data Warehouse as exclusions.Data Warehouse data were used to estimate duplication, claims reviews for which MACs entered appeals of claims as exclusions would appear to be duplicative reviews. The officials noted that if Recovery Audit Similarly, we found that, in 2012, more than half of the ZPICs did not enter claims they reviewed into the Recovery Audit Data Warehouse as exclusions, which makes the database less effective in preventing the RAs from duplicating other contractors’ claims reviews. CMS provided data to us that showed that five of the six ZPICs had not entered any claims into the Recovery Audit Data Warehouse as exclusions in 2012, although these ZPICs had performed postpayment claims reviews. officials told us they do not monitor contractors’ entry of exclusions and suppressions to ensure this information is accurate or complete, although they recognized, before we examined the Recovery Audit Data Warehouse exclusion data with CMS, that some ZPICs may not enter claims they review as exclusions. These officials stated that if ZPICs did not exclude these claims, they would be available for an RA to review, which could lead to inappropriate duplication. CMS officials told us that they had held meetings with all of the ZPICs to educate them about the available options in the Recovery Audit Data Warehouse that could augment their antifraud activities. Although there are seven ZPIC zones, only six ZPICs are operational and four program safeguard contractors conduct reviews in one zone. RA of an ongoing investigation either by suppressing affected claims in the Recovery Audit Data Warehouse or through any other methods of coordination. Checking the accuracy of data is part of a strong internal control environment and provides an agency with assurance that the data needed for operations are reliable and complete. CMS has issued guidance for RAs and the CERT contractor about whether they may conduct duplicative claims reviews. CMS’s Medicare Program Integrity Manual states that RAs are prohibited from reviewing claims that have been reviewed by other contractors.manual for the CERT contractor states that it should select and review a random sample of claims regardless of whether they have been reviewed by other contractors, in order to establish the Medicare improper payment rate accurately. In contrast, CMS’s However, CMS has not developed complete guidance for MACs and ZPICs about whether they are permitted to duplicate other contractors’ claims reviews. Although a CMS official told us that MACs are not permitted to conduct duplicative reviews and are required to check the Recovery Audit Data Warehouse to prevent duplication, CMS guidance states only that MACs are not permitted to duplicate the ZPICs’ claims reviews and does not address whether MACs are permitted to duplicate RA claims reviews. The guidance also does not address whether MACs are expected to check the Recovery Audit Data Warehouse to prevent duplication. Furthermore, representatives from two of the three MACs we spoke with believed that CMS permitted them to duplicate some contractors’ reviews. A CMS official stated that clear guidance could be helpful for contractors. In the absence of complete guidance, officials from CMS and representatives from a ZPIC and MAC differed in their understanding of whether ZPICs could conduct duplicative reviews. CMS officials, including those who oversee ZPICs, provided conflicting information about whether CMS permits ZPICs to conduct duplicative reviews, and CMS officials were unable to provide guidance to clarify whether duplication is allowed. Representatives from a ZPIC and some CMS program integrity officials told us that CMS permits ZPICs to conduct duplicative claims reviews because ZPICs must be able to review any claim they deem necessary to investigate potential fraud. However, CMS program integrity officials told us that ZPICs may not duplicate reviews conducted by RAs or MACs because overpayment for an improperly paid claim cannot be collected twice. Written guidance stating explicitly which contractors may conduct duplicative claims reviews and when the different contractor types should check the Recovery Audit Data Warehouse to avoid duplication is important to prevent inappropriate duplication among the contractors and to minimize confusion among CMS staff, CMS contractors, and stakeholders, such as providers, about what is permitted. It is also consistent with federal internal control standards, agencies to establish control activities that enforce management’s directives. Without complete guidance for all postpayment claims review contractors about when duplicative reviews are permitted, CMS does not have assurance that MACs and ZPICs understand when and how to avoid duplicative reviews. Absence of such guidance can also leave providers confused about whether a duplicative review is appropriate. See GAO/AIMD-00-21.3.1 and GAO-01-1008G, sections related to control activities. Several factors may reduce the efficiency and effectiveness of contractors’ correspondence with providers. First, CMS’s requirements differ across contractors for the content of two types of correspondence contractors often send to providers during postpayment review, and therefore contractors do not have to convey the same type of information to providers. Second, for the correspondence we reviewed, we found that contractors did not comply consistently with all applicable requirements. Third, the extent of CMS’s oversight of contractor correspondence differed across contractor types. CMS requires contractors to include certain content in the correspondence they send to providers, but the requirements sometimes differ. All four types of contractors send providers an ADR if a provider’s claim is selected for postpayment review. Upon completing their review, MACs, ZPICs, and RAs notify providers of their findings in correspondence we refer to as results letters. The CERT contractor does not send results letters.correspondence include the reason the claim was selected for review, the information the provider must submit, the contractor’s findings, and steps providers may take in response to those findings. CMS’s requirements for these types of Some CMS requirements for correspondence are similar across all contractor types. For example, CMS requires that ADRs for all contractors specify the number of days the provider has to submit documentation in response to a contractor’s request. Similarly, CMS requires that all contractors’ results letters regarding an overpayment describe the issues leading to the overpayment as well as any recommended corrective actions the provider can take to avoid similar billing errors in the future. However, other CMS requirements for correspondence differ by contractor type. For example, ADRs from MACs, RAs, and the CERT contractor, but not those from ZPICs, must give providers the option of submitting documentation via paper, fax, CD/DVD, or electronically. Similarly, results letters from MACs and ZPICs regarding claims that were overpaid are required to include the overpayment amount for each claim, but CMS officials told us RAs are not required to include these amounts.MACs’ and ZPICs’ results letters are required to include the signature of a person to contact with inquiries about the correspondence, whereas RAs’ results letters are not required to contain this information. (Table 2 shows examples of CMS’s requirements for results letters.) In addition, inconsistencies in CMS’s guidance made it difficult to identify some of the requirements and their applicability. CMS conveys requirements through statements of work contained in the contracts, and in manuals that provide additional guidance on what contractors must do and that may be specifically referenced in a statement of work. For ADRs and results letters, we identified requirements in the RA statement of work (which applies to RAs), the Medicare Program Integrity Manual, the Medicare Contractor Beneficiary and Provider Communications Manual (which applies to MACs and ZPICs), and the CERT Manual and CERT statement of work (which apply to the CERT contractor). These documents sometimes contained differing guidance about the information the correspondence from different contractors must include. For example, the RA statement of work in effect during our review specifically required RA results letters to explain the procedures for recovering any overpayments and providers’ rights to appeal, but the Medicare Program Integrity Manual did not include these requirements for RAs. CMS officials told us that the RA statement of work was the primary guiding document for RA requirements; however, they also told us that they were not requiring the RAs to include some of the content requirements listed for results letters in the RA statement of work. As another example, the Medicare Program Integrity Manual contains some differing guidance to the MACs about their ADRs. While chapter 3 of the Medicare Program Integrity Manual instructs MACs to notify providers in ADRs that they have 45 days to respond to the request for documentation, this manual also includes a sample ADR that MACs may use for postpayment review that includes language informing providers that they have 30 days to respond to the documentation request. In addition, the Medicare Program Integrity Manual’s list of results letter requirements includes one statement indicating that the MACs and ZPICs must include appeals information in their results letters, as well as a different statement right next to it indicating that only MACs must do so. Without consistent and specific requirements for the content across contractor types, CMS does not have assurance that, consistent with federal internal control standards, providers receive similar and sufficient information during claims reviews to understand their responsibilities in responding or their rights if their claims are denied. Establishing consistent processes to communicate with providers is also aligned with OMB guidance to agencies to streamline service delivery and improve customer service, which can increase administrative efficiency. Further, inconsistencies in CMS’s requirements in contractors’ statements of work and the Medicare Program Integrity Manual could make it difficult for contractors to easily identify the most current set of requirements that apply to contractor correspondence. CMS officials told us in October 2013 that the agency has begun to explore making requirements for the content of ADRs more consistent across contractor types, such as by standardizing the introduction for the letters used by each contractor. Compliance with CMS requirements was not consistent across contractor types for the correspondence we reviewed. Our examination of 67 ADRs found that, on average, contractor ADRs overall complied with 94 percent of their applicable CMS requirements, but the compliance rate varied by contractor type. RAs had the highest compliance rate (100 percent) and the CERT contractor had the lowest rate (86 percent) (see fig. 1). Unlike the ADRs from the other three contractor types, the ADRs that the CERT contractor sends to providers are uniform and based on form letters written by CMS. (See app. I for a list of the requirements we analyzed for each type of contractor and each type of correspondence.) While all four types of contractors met most or all of their ADR requirements, compliance sometimes varied by requirement. For example, though representatives of several provider associations have reported that providers do not understand the reason their claims were selected for review, all the MAC and RA ADRs we reviewed complied with applicable requirements to identify the basis for the claim’s selection. All of the contractors’ ADRs that were required to include instructions for how to submit documentation to support the claim also complied. However, not all contractor ADRs complied with a requirement that had the potential to affect the timeliness of providers’ responses to the ADRs: about 50 percent of the MAC ADRs, 30 percent of the ZPIC ADRs, and 100 percent of the CERT contractor ADRs gave providers fewer than the required number of days to submit documentation. Similar to ADRs, the number of requirements for results letters differed by contractor type. On average, 18 requirements were applicable to each MAC results letter, 14 for each ZPIC results letter, and 8 for each RA results letter. with the requirement to document in the letter a reason for conducting the review or the rationale for good cause for having reopened the claims; instead, the letters directed the provider to the contractor’s website or to the ADR sent by the contractor previously. Also, 40 percent of the ZPICs’ results letters complied with the requirement to cite a reason for noncoverage or incorrect coding for each claim. Contractors’ inconsistent compliance with CMS’s correspondence requirements may lead to provider confusion and increased administrative burden, and is not consistent with federal internal control standards to have control activities to ensure that management’s directives are carried out and to monitor the performance of agency activities. For example, several provider associations indicated that it was burdensome to pull together complete documentation quickly. Therefore, giving providers response times that are shorter than required in ADRs can add to providers’ burden. In addition, it can lead to less efficient claims reviews—and potentially unnecessary claims denials—if providers do not submit complete information (or respond) within the shorter time frame. When providers are not notified of their rights in results letters as required, they may have more difficulty exercising their rights within required time frames, which could have financial consequences for them. The extent of CMS oversight of the content of contractors’ postpayment review-related correspondence differs by type of contractor. For MACs, CMS staff may review correspondence with providers during their annual evaluations of each MAC’s performance. CMS staff indicated that they do not review ZPIC postpayment claims review correspondence. An independent RA validation contractor that evaluates RAs’ claims reviews also assesses each RA’s correspondence for clarity and accuracy by reviewing results letters associated with reviews included in a random sample of up to 100 claims per RA per month, and CMS officials noted that they review a sample of the RA correspondence during quarterly RA performance assessments. According to CMS officials, the CERT contractor’s ADRs are uniform and based on form letters written by CMS. CMS officials stated that they did not believe they needed to monitor the content of these ADRs since most of the text was a standard template written by CMS. Our findings that contractors did not comply consistently with CMS’s requirements for the correspondence we reviewed indicate that CMS’s monitoring efforts in this area are not adequate to meet federal internal control standards to monitor contractors’ activities. Without adequate monitoring of contractors’ compliance with correspondence content, CMS’s internal control is weakened and the agency does not have assurance that the correspondence is accurate and includes all of the content required. CMS requires quality assurance processes for each of the contractor types to help ensure the accuracy of their claims review decisions about whether claims were paid properly, but the processes differ by contractor type. These processes can be internal, external, or both. CMS requires the four contractor types we reviewed to have some type of internal quality assurance process to verify the accuracy of their claims review decisions about whether claims were paid properly. In addition, for the MACs, ZPICs, and RAs, CMS has implemented external validation reviews in which staff from CMS or an independent contractor review a selection of those contractors’ claims reviews. CMS requires the four contractor types to establish an internal quality assurance process for verifying the accuracy of their claims review decisions about whether the claim was proper to pay because the service was medically necessary and billed properly according to Medicare coverage and billing rules. In addition, CMS specifically requires the MACs, ZPICs, and CERT contractor to conduct interrater reliability (IRR) assessments—assessments that compare multiple decisions by their staff reviewers about the same claim to determine the extent of their agreement about whether the claim was paid properly or not—as part of their overall quality assurance efforts. CMS officials told us that for the new RA contracts the agency expects to award in 2014, CMS will also require RAs to conduct IRR assessments as part of their efforts. Contractors have discretion in how they conduct their IRR assessments, according to CMS officials. CMS monitors the results of contractors’ IRR assessments to varying degrees but has not collected that information routinely from all contractor types. CMS officials said they review monthly reports from the CERT contractor about its IRR assessment results. CMS officials also told us they expect to see a roughly 98 percent accuracy rate for each month’s IRR assessment, which they said the CERT contractor usually achieves. Beginning with the new contracts expected to be awarded in 2014, RAs also will be expected to provide monthly information to CMS about their IRR assessments, according to CMS officials. In contrast, CMS does not routinely collect information from the MACs or ZPICs about their IRR assessments. According to CMS officials, CMS does not require MACs to report regularly on their IRR assessments, but agency officials may, at their discretion, discuss MACs’ IRR assessments during their routine on- CMS revised its requirements in October 2013 to site visits with MACs. state that MACs must report their IRR assessment results to CMS as directed, and CMS officials indicated that they will request MACs’ IRR information on an as-needed basis rather than requiring all MACs to provide specific IRR information on a predetermined schedule. Similarly, CMS officials may discuss ZPICs’ IRR assessments during ZPICs’ annual performance assessments or at other times, but have not collected information routinely about ZPICs’ IRR assessment results, according to CMS officials we spoke with. CMS has implemented additional quality assurance processes in which the MACs, ZPICs, and RAs have a sample of their claims reviews undergo external validation by CMS or an independent contractor, using clinical staff or coders, to assess the appropriateness of the contractors’ claims review decisions about whether the claim was paid properly according to Medicare coverage and billing rules. These validation efforts differ in frequency and process. While CMS has not implemented a separate external validation of the CERT contractor’s claims reviews, CMS officials told us that they have several other mechanisms to gauge the appropriateness of those reviews. MACs: According to CMS officials, in 2010, CMS implemented the Accuracy Project to learn more about MACs’ claims review processes and decision making, and to identify areas in which contractor training might be needed or where CMS could clarify or modify its guidance. For this project, a team of CMS clinical staff conducted validation reviews for a selection of MACs’ claims reviews. In 2010 and 2011, CMS reviewed more than 200 claims per year, and in each year CMS staff concurred with all but one of the MACs’ claims review decisions. In 2012, CMS increased the number of Accuracy Project staff and from September 2012 through February 2014 reviewed 1,160 claims and concurred with over 90 percent of the MACs’ decisions, according to CMS. CMS officials noted that this has been a limited effort to date, most recently focused on DME claims—specifically, power mobility devices. CMS officials said they plan to broaden this effort to include other services. For this broader effort, CMS plans to have the CERT contractor conduct validation reviews of a random sample of 100 claims per MAC. The CERT contractor will review the documentation the MACs used to reach decisions for those claims, such as medical records, and evaluate the accuracy of MACs’ decisions by determining whether the MACs properly paid, adjusted, or denied the claims on the basis of Medicare coverage, coding, and billing rules. In April 2014, CMS officials told us that the CERT contractor had just begun conducting validation reviews for several MACs. ZPICs: To assess the appropriateness of the ZPICs’ claims reviews, CMS staff examine a sample of those reviews when they conduct each ZPIC’s annual performance assessment. For each ZPIC, CMS staff select 5 investigations or cases of particular providers and then select 5 claims for each investigation or case, for a total of 25 claims. CMS clinical staff then assess whether the ZPICs’ decisions were consistent with CMS guidance and clinical judgment. According to CMS officials, they typically find that ZPICs’ claims reviews decisions are satisfactory. RAs: CMS has established an external validation process in which the independent RA validation contractor uses licensed clinical professionals and coders to assess the quality of each RA’s claims reviews. Each month the RA validation contractor reviews a random sample of up to 400 RA-reviewed claims (up to 100 claims per RA) that are proportional to the provider types that each RA determined had been paid improperly. CMS officials told us that the RA validation contractor sends monthly reports to CMS on the RAs’ claims review accuracy rates. According to CMS’s most recently published report to Congress on the RAs, the cumulative accuracy rates for fiscal year 2012 were between about 93 and 97 percent for the RAs. CERT contractor: While CMS does not require a separate external validation of the CERT contractor’s claims reviews, CMS officials told us that the expansion of the Accuracy Project to involve CERT contractor reviews of MACs’ claims will give them increased ability to examine the CERT contractor’s claims review decisionmaking. They added that they review the CERT contractor’s decisions on an as-needed basis, such as when MACs dispute the CERT contractor’s findings of the MACs’ improper payment rates, or if a provider raises a concern to CMS about a CERT contractor decision. CMS has strategies to coordinate internally among relevant CMS offices in developing the requirements for postpayment claims review contractors’ activities and has strategies to facilitate coordination among the contractor types. However, differences in contractor requirements have continued and there is less coordination between ZPICs and RAs compared to the coordination among other contractors. CMS has established strategies for coordination among the three CMS offices that oversee postpayment review contractors—the Center for Medicare, the Office of Financial Management, and the Center for Program Integrity—to review proposed new or updated requirements for contractors’ activities. This internal coordination is important because contractors have many postpayment claims review activities in common, but responsibilities for overseeing postpayment review contractors are distributed across seven components within three CMS offices. (See fig. 3.) Thus, coordination strategies among CMS’s offices are critical to help ensure that contractor requirements are consistent when possible and that the four types of contractors are conducting postpayment claims reviews efficiently and effectively. According to CMS officials, the Enterprise Electronic Change Information Management Portal system is formal in that it provides a uniform entry and validation process before any changes to CMS documents are finalized. In addition, there are written instructions for how CMS officials are to submit, share, and sign off on documents in the Enterprise Electronic Change Information Management Portal. contractors they were responsible for managing. As a result, one office can make changes to requirements for the contractors they manage that might lead to differences among the four types of contractors’ requirements, but these changes might not be thoroughly reviewed by all the offices. However, CMS’s internal coordination strategies have not resolved long- standing differences in requirements across contractor types. In our July 2013 report, we reported that inconsistencies in contractor requirements may impede efficiency and effectiveness of claims reviews by increasing administrative burden on providers. For example, contractors had different time frames for providers to submit documentation, which might confuse providers and reduce compliance. CMS has begun to take steps to make contractor requirements more consistent, where appropriate. For example, in October 2013, CMS began requiring MAC, RA, and CERT contractor ADRs to all give providers the same options for submitting documentation. In addition, CMS officials said that their new RA contracts will require RAs to establish an IRR process to assess their claims reviews. Our findings in this report indicate that variations in requirements continue to exist. Such variations may result in inefficient processes and present challenges for providers for responding to documentation requests. Variation in requirements across contractors also is inconsistent with OMB’s executive-agency guidelines to streamline service delivery and with having a strong internal control environment. Further, this variation does not follow a practice that we have identified to help facilitate and enhance collaborative efforts across organizational boundaries. CMS has established multiple strategies to facilitate coordination among postpayment claims review contractors. In addition to using the Recovery Audit Data Warehouse to help prevent duplicative claims reviews, CMS requires MACs, RAs, and ZPICs operating in the same geographic jurisdiction to establish Joint Operating Agreements (JOA) to facilitate coordination. CMS also sponsors meetings between different types of contractors. According to CMS officials, the JOA is a mechanism for different types of contractors to document how they plan to work together. For example, CMS officials told us JOAs are used by MACs and RAs to agree on methods of communication and levels of service related to improper payments, such as data sharing, file transmissions, data warehouse uploads, and appeals. Officials also said ZPICs use the JOAs to come to an agreement with the other contractors on how they will coordinate to avoid duplicating claims reviews and to exchange information on potential fraud. determined all the JOAs between the different contractor types had been agreed upon by the contractors and were actively in use. We reported previously that when implementing coordination strategies, agencies benefit from having participants document their agreement for how they will collaborate and that agencies should consider whether all relevant participants have been included in and regularly attend collaboration- related activities. Although CMS guidance on what should be included in these agreements varies by the contractors’ relationships to each other, in general, JOAs are to specify how the contractors intend to interact with one another. For example, CMS guidance states that JOAs between MACs and RAs should include a communication process and time frames for adjustments, recoupment, appeals, inquiries, and receipt of provider names and addresses. In addition to requiring JOAs, CMS holds regular meetings between different types of contractors to help them coordinate their workloads and to facilitate discussions of vulnerabilities and issues related to postpayment claims reviews. Depending on the meeting, some types of contractors are required to attend, while others are invited. For example, to help MACs and RAs better target their claims selection to identify improper payments, CMS has required these contractors to meet weekly to discuss vulnerabilities identified by RAs. CMS officials said that ZPICs also are invited to these meetings, but they are not required to attend. CMS also requires the MACs, CERT contractor, and RAs to attend CMS’s annual medical review training conference, where CMS and contractor staff discuss CMS policy, program integrity vulnerabilities, and other medical review issues. Although ZPICs are not required to attend this conference, some do. Other than CMS’s annual medical review training conference, ZPICs and RAs do not have structured meetings with each other to share information on vulnerabilities and potential fraud. All three ZPICs we spoke with said they meet with MACs on a regular basis to discuss medical review strategies, operational issues, and their JOAs with the MAC. According to one ZPIC, the interactions with the MAC ensure they are sharing best practices and receiving information expeditiously. However, two of the ZPICs we spoke with also said they do not coordinate with the RAs in their geographic jurisdictions. HHS’s OIG recently recommended that to ensure that RAs refer all appropriate cases of potential fraud, CMS should facilitate increased collaboration between RAs and ZPICs, such as by coordinating regular meetings to share information about potentially fraudulent coding or billing schemes and to advise RAs of emerging fraud schemes.recommendation. CMS officials also told us that the new RA statement of work for the upcoming procurement will include a requirement for the RAs to meet with the ZPICs in their geographic jurisdictions quarterly, at a minimum, to discuss trends in possible fraudulent billing. According to the OIG report, CMS concurred with OIG’s Established JOAs and regular meetings between different contractor types provide more assurance that postpayment claims reviews are conducted as efficiently and effectively as possible and opportunities to further reduce improper payments are not overlooked. Coordination among the contractors promotes sharing of information that can be critical to identifying vulnerabilities to improper payments. For example, while reviewing claims, each contractor may be identifying vulnerabilities to improper payment that may also be present in other jurisdictions, as well as improper payment issues that could be better addressed by another type of contractor. In addition, MACs’ and RAs’ claims reviews sometimes identify instances of potential fraud, which they are expected to refer to ZPICs for further investigation. Postpayment claims review contractors play an important role in helping CMS reduce improper payments in the Medicare program. Because different types of contractors conduct similar claims reviews, CMS guidance, oversight, and coordination of them is essential to maintaining an appropriate balance between detecting improper payments effectively and efficiently and avoiding unnecessary administrative burdens. CMS has taken a number of steps to guide, oversee, and coordinate its contractors’ postpayment claims review efforts. However, further actions by CMS could help improve the efficiency and effectiveness of its contractors’ efforts. CMS does not have sufficient information to determine whether its contractors are conducting inappropriate duplicative claims reviews. We found that CMS has conducted insufficient data monitoring to prevent the RAs from conducting inappropriate duplicative reviews. If the Recovery Audit Data Warehouse information on excluded claims is inaccurate, as we found is sometimes the case, the Recovery Audit Data Warehouse’s effectiveness in preventing the RAs from conducting inappropriate duplicative claims reviews is limited. In addition, while CMS has issued clear guidance for RAs and the CERT contractor about whether they are permitted to conduct duplicative reviews, it has not issued similar guidance for the MACs and ZPICs. If CMS does not intend for the MACs and ZPICs to conduct duplicative reviews, issuing complete guidance stating so is important to prevent inappropriate duplication. Furthermore, having consistent guidance and ensuring that contractors comply with the requirements that apply to them can improve the efficiency and effectiveness of contractors’ communication with providers. It is important that providers understand the postpayment claims review process, including what documentation they need to send to contractors, the steps in the review process, and their rights. More consistent requirements and better monitoring of contractors’ compliance with correspondence content guidance would increase CMS’s assurance that providers are given similar and sufficient information during claims reviews and that the correspondence is accurate and includes all of the content required. Although CMS has strategies to coordinate internally among the CMS offices that oversee postpayment claims review contractors—as well as strategies to facilitate coordination among the contractors themselves— differing requirements for the postpayment claims reviews conducted by different types of contractors continue to exist. CMS is currently working to address some of the differences, but will need to remain vigilant as requirements are updated in the future. Moreover, CMS must ensure that its current methods for ensuring effective collaboration among contractors are working as intended. The comparatively limited amount of required communication between ZPICs and other contractors addressing improper payment issues reduces CMS’s assurance that the four types of postpayment contractors that we reviewed are coordinating as effectively as possible to reduce improper payments and fraud. In order to improve the efficiency and effectiveness of Medicare postpayment claims review efforts and simplify compliance for providers, we recommend that the Administrator of CMS take the following four actions: monitor the Recovery Audit Data Warehouse to ensure that all postpayment review contractors are submitting required data and that the data the database contains are accurate and complete; develop complete guidance to define contractors’ responsibilities regarding duplicative claims reviews, including specifying whether and when MACs and ZPICs can duplicate other contractors’ reviews; clarify the current requirements for the content of contractors’ ADRs and results letters and standardize the requirements and contents as much as possible to ensure greater consistency among postpayment claims review contractors’ correspondence; and assess regularly whether contractors are complying with CMS requirements for the content of correspondence sent to providers regarding claims reviews. We provided a draft of this report to HHS and received written comments, which are reprinted in appendix II. In its comments, HHS agreed with our findings and concurred with all four recommendations. HHS also described steps it plans to take to remedy the issues we identified. We also provided portions of the draft report for review and comment to the contractors in our sample. We received responses via email from all but one contractor. The contractors generally agreed with our findings as applicable to their contractor type. Representatives from all four RAs commented on our finding that none of the RA results letters met the requirement to document in the letter a reason for conducting the review or the rationale for good cause for reopening the claims. Representatives from two RAs commented that they believed their results letters did sufficiently indicate the reason for the review, and representatives from three RAs pointed out that CMS had reviewed and approved the text of their letters. However, as we noted in the draft report, we determined that none of the RA results letters met this requirement because the text was not sufficient to provide a reason for review or rationale for good cause. In response to comments from the RAs, we have modified the text in the report to more prominently note that the results letters do refer providers to the contractor’s website or to the ADR to obtain the reason for the review. HHS and the contractors also provided technical comments, which we incorporated into the report as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix III. This appendix gives additional detail about two aspects of our methodology for addressing the report’s objectives. Specifically, we explain our methodology for selecting and assessing the sample of postpayment claims review contractors we interviewed as part of our work to address all four objectives. We also provide information on our methodology for selecting the correspondence—additional documentation requests (ADR) and results letters—from the contractors in the sample we used to examine how CMS’s requirements for contractor correspondence with providers help ensure effective communication. To learn about postpayment claims review contractors’ claims review efforts, we interviewed representatives from 11 postpayment review contractors. We selected all four Recovery Auditors (RA) because they conduct substantially more postpayment claims reviews than all the other contractors combined, and the Comprehensive Error Rate Testing (CERT) contractor, which reviews a nationwide random sample of claims. We also selected a nongeneralizable sample of 3 of the 16 Medicare Administrative Contractors (MAC), including 2 of the 12 MACs that process Part A and B claims and 1 of the 4 MACs that process claims for durable medical equipment. We selected these 3 MACs because they had been in operation for at least 6 months, performed postpayment claims reviews in 2012, and were geographically diverse. We selected a nongeneralizable sample of 3 of the 6 Zone Program Integrity Contractors (ZPIC) that had been in operation for at least 1 year and whose service areas included some of the same states served by the 3 MACs in our sample. To assess the extent to which CMS requirements for the content of contractors’ correspondence with providers help ensure effective communication, we focused our review on ADRs and results letters. We reviewed the Medicare Program Integrity Manual, Medicare Claims Processing Manual, Medicare Financial Management Manual, Medicare Contractor Beneficiary and Provider Communications Manual, CERT Manual, and the contractors’ statements of work to identify CMS requirements for this correspondence. Because there were some discrepancies and issues of clarity in the requirements for these sources, we confirmed the requirements with CMS. To assess the correspondence against these requirements, we asked the contractors in our sample to provide us with all correspondence associated with four claims they determined had been paid improperly and two claims that had been paid properly. To prevent bias, we asked them to select claims for which the ADR had been sent on a date that we randomly selected. If they had not sent ADRs on that date, we asked them to choose the closest date on which they had sent ADRs. Upon receiving the sample of contractor correspondence, we chose two frequently used postpayment review- related forms of correspondence—ADRs and results letters—to assess compliance. We limited our review of results letters to assess compliance for those that reported improper payments. The final sample we reviewed included 67 ADRs and 47 results letters. We assessed compliance with CMS requirements in effect as of the date on the letter. Each letter was reviewed by two of our staff working independently. The reviewers compared each requirement with each letter’s content to determine if a requirement was “met,” “not met,” “not applicable,” or “unknown.” Afterward, the reviewers met to resolve any differences in their scores. Their final score was checked by a third reviewer. We calculated a compliance rate for each letter by dividing the total number of applicable requirements that were met (numerator) by the total number of applicable requirements that were met or not met (denominator). An average compliance rate for each type of contractor was based on the sum of the contractors’ letter-specific numerators divided by the sum of the letter-specific denominators. Requirements for ADRs are listed in table 3 and for review results letters in table 4. We note in the tables several requirements that we did not include in our assessment of compliance and why. In addition to the contact named above, Sheila. K. Avruch, Assistant Director; Robin Burke; Carrie Davidson; Iola D’Souza; Carolyn Garvey; Leslie V. Gordon; Richard Lipinski; Elizabeth Morrison; Amanda Pusey; and Jennifer Whitworth made key contributions to this report. Medicare Program Integrity: Contractors Reported Generating Savings, but CMS Could Improve Its Oversight. GAO-14-111. Washington, D.C.: October 25, 2013. Medicare Program Integrity: Increasing Consistency of Contractor Requirements May Improve Administrative Efficiency. GAO-13-522. Washington, D.C.: July 23, 2013. GAO’s 2013 High-Risk Update: Medicare and Medicaid. GAO-13-433T. Washington, D.C.: February 27, 2013. Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment. GAO-13-102. Washington, D.C.: November 13, 2012. Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012. Program Integrity: Further Action Needed to Address Vulnerabilities in Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.: June 7, 2012. Medicare Integrity Program: CMS Used Increased Funding for New Activities but Could Improve Measurement of Program Effectiveness. GAO-11-592. Washington, D.C.: July 29, 2011. Improper Payments: Reported Medicare Estimates and Key Remediation Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Status of Fiscal Year 2010 Federal Improper Payments Reporting. GAO-11-443R. Washington, D.C.: March 25, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Medicare: Program Remains at High Risk Because of Continuing Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 2011. Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010. Medicare Contracting Reform: Agency Has Made Progress with Implementation, but Contractors Have Not Met All Performance Standards. GAO-10-71. Washington, D.C.: March 25, 2010.

Summary: Several types of Medicare contractors conduct postpayment claims reviews to help reduce improper payments. Questions have been raised about their effectiveness and efficiency, and the burden on providers. GAO was asked to assess aspects of the claims review process. Building on GAO's July 2013 report on postpayment claims review requirements, this report examines, among other things, the extent to which CMS has (1) data to assess whether contractors conduct duplicative postpayment claims reviews, (2) requirements for contractor correspondence with providers to help ensure effective communication, and (3) strategies for coordination of claims review activities. GAO reviewed CMS's requirements for claims reviews; interviewed CMS officials, selected contractors, and provider associations; analyzed CMS data; assessed a nongeneralizable sample of 114 pieces of contractor correspondence for compliance with requirements; and assessed CMS's requirements and oversight against federal internal control standards and other guidance. The Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) has taken steps to prevent its contractors from conducting certain duplicative postpayment claims reviews—reviews of the same claims that are not permitted by the agency—but CMS neither has reliable data nor provides sufficient oversight and guidance to measure and fully prevent duplication. The four types of contractors GAO reviewed that examine providers' documentation to determine whether Medicare's payment was proper included Medicare Administrative Contractors (MAC), which process and pay claims; Zone Program Integrity Contractors (ZPIC), which investigate potential fraud; Recovery Auditors (RA), tasked with identifying on a postpayment basis improper payments not previously reviewed by other contractors; and the Comprehensive Error Rate Testing (CERT) contractor, which reviews claims used to annually estimate Medicare's improper payment rate. CMS implemented a database to track RA activities, designed in part to prevent RAs, which conducted most of the postpayment reviews, from duplicating other contractors' reviews. However, the database was not designed to provide information on all possible duplication, and its data are not reliable because other postpayment contractors did not consistently enter information about their reviews. CMS has not provided sufficient oversight of these data or issued complete guidance to contractors on avoiding duplicative claims reviews. CMS requires its contractors to include certain content in postpayment review correspondence with providers, but some requirements vary across contractor types and are not always clear, and contractors vary in their compliance with their requirements. These factors can lead to providers receiving less information about the reviews and thus decrease effective communication with them. In addition, the extent of CMS's oversight of correspondence varies across contractors, which decreases assurance that contractors comply consistently with requirements. In the correspondence reviewed, GAO found high compliance rates for some requirements, such as citing the issues leading to an overpayment, but low compliance rates for requirements about communicating providers' rights, which could affect providers' ability to exercise their rights. CMS has strategies to coordinate internally among relevant offices regarding requirements for contractors' claims review activities. The agency also has strategies to facilitate coordination among contractors, such as requiring joint operating agreements between contractors operating in the same geographic area. However, these strategies have not led to consistent requirements across contractor types or full coordination between ZPICs and RAs. GAO previously recommended that CMS increase the consistency of its requirements, where appropriate, and the HHS Office of Inspector General has recommended steps to improve coordination between ZPICs and RAs. GAO recommends that CMS take actions to improve the efficiency and effectiveness of contractors' postpayment review efforts, which include providing additional oversight and guidance regarding data, duplicative reviews, and contractor correspondence. In its comments, the Department of Health and Human Services concurred with the recommendations and noted plans to improve CMS oversight and guidance.