To address Medicare’s vulnerability to fraud, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) established the Medicare Integrity Program (MIP). In particular, HIPAA required the Secretary of HHS to enter into contracts to promote the integrity of the Medicare program. In exercising its authority to identify and combat improper payments, CMS created 18 Program Safeguard Contractors (PSC) to identify and investigate potential fraud in specific parts of Medicare, such as Part A, in particular states or regions. In 2008, as part of the implementation of broader agency contracting reform, CMS began replacing PSCs with ZPICs, reducing the total number of contractors and giving additional responsibilities to ZPICs to investigate potential fraud across the Medicare fee-for-service program. In September 2008, CMS awarded the first two ZPIC contracts for Zones 4 and 7. As of September 2013, all but one of the ZPICs— Zone 6—was in operation. PSCs continue to operate in Zone 6 because of protest-related delays with respect to the Zone 6 ZPIC contract. The term of each ZPIC contract is generally for a 1-year base period followed by 4 option years, enabling CMS to extend each contract through 5 years of performance. (See table 1 for contract performance timelines and fig. 1 for a map of the seven ZPIC zones.) In 2010, CMS established the Center for Program Integrity (CPI), which oversees the agency’s program integrity efforts, including ZPICs. CPI’s stated mission is to ensure that correct payments are made to legitimate providers for covered, appropriate, and reasonable services for eligible beneficiaries. CPI has undertaken an effort to try to move beyond the “pay and chase” approach—which focused on the recovery of funds lost due to payments of fraudulent claims—to focusing on fraud prevention. To enhance these efforts, the Small Business Jobs Act of 2010 appropriated funds for and required CMS to implement predictive analytics technologies, which are automated systems and tools that can help identify patterns of potentially fraudulent claims before they are paid. In turn, CMS developed the Fraud Prevention System (FPS), an electronic system in which Medicare claims data are compared against models of potentially fraudulent behavior to identify and prioritize for investigation providers with aberrant billing patterns. As part of implementing FPS, CPI modified ZPICs’ work. They are to continue to investigate and quickly initiate actions to protect Medicare, but are also charged with investigating certain referrals from FPS. To detect and investigate potential fraud within each zone, ZPICs develop leads, investigate them, and initiate appropriate actions against suspect providers, suppliers, and others. ZPICs do this with teams of investigators, data analysts, and medical reviewers. Investigators perform a range of actions to examine potential fraud, including conducting provider audits, making site visits to suspect providers’ offices, and interviewing Medicare beneficiaries. Data analysts, including statisticians, examine Medicare claims and other data to support investigations and search for potential fraud and new schemes. Medical reviewers, primarily nurses, provide clinical knowledge to support the work of investigators and data analysts. ZPICs identify potential targets for fraud investigations using three categories of sources: 1. Reactive sources. Reactive sources are notifications of potential fraud submitted to ZPICs, which may result in a ZPIC conducting an investigation. A number of entities refer potential fraud to ZPICs for investigation. These entities include Medicare Administrative Contractors (MAC), which examine their contacts with beneficiaries for indications of potential fraud and may forward the contacts to ZPICs for additional scrutiny. In addition, HHS OIG operates a fraud hotline and may refer calls from it to the MACs for initial screening and then to the ZPICs for further investigation. Other sources include investigations ZPICs receive directly from CMS. 2. Proactive sources. ZPICs are required to maintain at least 3 years of Medicare claims data for analysts to examine for potential fraud using a variety of analytic tools and methods. For example, analysts examining these data may identify providers that, compared with their peers, have aberrant billing patterns, which can indicate potentially fraudulent behavior. If analysts identify such patterns, those findings may result in a ZPIC investigation. 3. FPS. FPS identifies providers for ZPICs to investigate, with the goal of identifying aberrant billing patterns early so that ZPICs can investigate suspect providers before they generate large amounts of potentially fraudulent claims. ZPICs prioritize their investigations according to CMS guidance, which states that ZPICs should give priority to investigations with the greatest program impact and/or urgency. CMS’s Program Integrity Manual defines such investigations as those involving patient abuse or harm, multistate fraud, high dollar amounts of potential overpayments, likely increase in the amount of fraud or enlarged pattern of fraud, and complaints made by Medicare supplemental insurers. In addition, with the implementation of FPS in July 2011, CMS directed the ZPICs to investigate certain high-risk leads from that system. As part of their investigations, ZPICs initiate administrative actions against Medicare providers or suppliers, coordinating with CMS and MACs to carry out those actions, which may result in Medicare savings. (See table 2 for the administrative actions ZPICs may initiate as part of their investigations.) For example, ZPICs may initiate payment suspensions that allow CMS to stop payment on suspect claims and prevent the payment of future claims until an investigation is resolved. In addition, a ZPIC may recommend to CMS that the agency revoke a provider’s Medicare billing privileges and will coordinate with a MAC to implement that action following CMS approval. In addition to administrative actions, ZPICs may forward vulnerabilities identified during an investigation to CMS for consideration as possible local or national prepayment edits. In addition to administrative actions, if a ZPIC investigation uncovers suspected instances of fraud, the ZPIC must refer the investigation to HHS OIG for further examination and, if HHS OIG declines to investigate, the ZPIC may refer the issue to the FBI or any other interested law enforcement entity, such as a U.S. Attorney’s Office. A ZPIC investigation that is referred to and accepted by law enforcement for further exploration and potential prosecution is then called a case. As long as law enforcement entities have not closed a case, it is considered open by both law enforcement and ZPICs. CMS also requires ZPICs to support HHS OIG, the Department of Justice (DOJ), and other law enforcement entities with their Medicare fraud investigations. This support can be for these entities’ own, independently initiated cases, or for those that ZPICs initiated and then referred to law enforcement. ZPICs provide support on ZPIC-initiated and non-ZPIC- initiated cases by responding to law enforcement requests for information. These requests may be for data analysis; provider enrollment records, which ZPICs obtain from MACs; medical review; or other investigative support. ZPIC contracts cover three areas of work: 1. Fee-for-service program integrity work. ZPICs are to identify and investigate potential fraud in Medicare fee-for-service. The contracts for this work outline four categories of investigations: Part A, Part B, durable medical equipment (DME), and home health and hospice. Although DME providers and home health and hospice suppliers provide services covered under Medicare Parts A and B, the ZPIC contracts identify them separately and ZPICs track their fee-for- service program integrity work based on these four categories. 2. Medicare-Medicaid Data Match Program (Medi-Medi). Medi-Medi is a joint effort between CMS and states to identify providers with aberrant Medicare and Medicaid billing patterns through analyses of claims for individuals with both Medicare and Medicaid coverage. States participate voluntarily and ZPIC Medi-Medi work and funding is dependent on the number of states, if any, actively participating in each zone. 3. Special projects. CMS may also fund ZPICs for special zone- or fraud- specific projects. Special projects can vary in duration and can be as short as several months or run for multiple years. The total award amount for the six operating ZPIC contracts through all option years is more than $600 million. Of that amount, $411 million is for fee-for-service program integrity work, $169 million is for Medi-Medi, and $62 million is for special zone- and fraud-specific projects over the life of the contracts. (See fig. 2.) The contract award amounts for the six operating ZPIC contracts (inclusive of option years) range from $67 million to $182 million, which reflects variations between the zones in terms of their size, exposure to fraud risk, and receipt of special projects. For example, Zone 7 covers a geographically small area comprising one state and one territory, but is an area CMS considers to be at high risk for fraud. In comparison, Zone 2 is a geographically large but predominantly rural area comprising 14 states and including areas that may be at a lower risk of fraud. In addition, although not all ZPICs currently receive funding for a special project, all six operating ZPICs have at some time received such funding. For example, one ZPIC was awarded almost $50 million for an ongoing state-specific fraud hotline and another received almost $3 million for a completed project specifically examining potential fraud among home health providers. CMS primarily oversees ZPICs through the coordinated efforts of CPI and the Office of Acquisition and Grants Management (OAGM). The ZPIC Contracting Officer in OAGM is responsible for ensuring effective contracting, and the Contracting Officer’s Representatives (COR) are in CPI. Each ZPIC is assigned a different COR, who helps oversee ZPIC contractor compliance through ongoing reviews. Among other things, the CORs use CMS ARTS to review their ZPICs’ monthly invoices and aggregate workload, such as the total number of new investigations, administrative actions, and dollar amounts recouped in a month. Each ZPIC contract includes award fee provisions, which give contractors the opportunity to earn all or some of the award fee allowed under their contracts, depending on their level of performance. CMS evaluates each ZPIC’s performance annually and determines how much of its award fees it will receive. CMS first evaluates whether a ZPIC is eligible for an award fee. For these reviews, CMS instructs its CORs on how to assess specific areas of their ZPICs’ performance by interviewing ZPIC and other staff; reviewing a sample of open and closed investigations and cases, as well as other documents; reviewing data in CMS ARTS, FID, and other systems; and making observations during ZPIC site visits. If in this review CMS finds that a ZPIC meets certain performance thresholds, the CORs move to the second step: using their annual review findings to recommend the amount of award fees a ZPIC should receive. The ZPICs’ contracts specify through Award Fee Plans the criteria against which CMS will measure ZPICs’ performance to earn their fees. These criteria fall into two overarching areas: (1) quality of service measures that apply to all ZPICs, worth 60 percent of the award fee, and (2) ZPIC-specific plans drafted in the prior year by each ZPIC and approved by CMS on how the ZPIC will improve its administrative actions—Award Fee Administrative Action Plans—worth 40 percent. ZPICs can receive all or part of their proposed award fees based on how well they perform in each of the elements within the two areas. CMS paid the six operating ZPICs about $108 million in calendar year 2012, including about $1.3 million in award fees for each ZPIC’s most recent contract year evaluation. CMS’s payments were primarily to reimburse contractors for fee-for-service work, comprising $77 million of the $108 million paid. ZPICs reported spending most of their fee-for-service funding in 2012 on fraud case development, primarily for investigative staff. (See fig. 3 for the breakdown of ZPIC fee-for-service spending.) According to CMS officials, fraud case development costs are those related to identifying and investigating potential Medicare fraud. These costs include those associated with developing proactive sources, and addressing potential fraud identified by FPS. Personnel accounts for most of these costs, with ZPICs reporting that half their fraud case development staff are investigators and the other half are split between medical reviewers and data analysts. ZPIC officials told us that identifying and investigating potential Medicare fraud can be labor intensive, which is why the largest direct cost was for personnel. In 2012, ZPICs reported that their investigations included 3,600 beneficiary interviews, 777 onsite inspections, prepayment reviews of 190,000 suspended claims and postpayment reviews of 32,000 paid claims. Additionally, ZPICs added more than 1,100 providers to prepayment review and almost 300 providers to postpayment review. In calendar year 2012, ZPICs reported more than $250 million in savings to Medicare by stopping payment on suspect claims and recouping money from overpayments. However, it is unclear if ZPICs could save more money by taking swifter actions since CMS lacks information on the speed of those actions. ZPICs took these actions based primarily on reactive sources, such as tips and complaints. Example of investigations resulting in a revocation: One ZPIC described that investigations involving “false fronts”—meaning there is no provider at the designated address—allow the ZPIC to quickly initiate revocations of those providers’ billing privileges. ZPICs reported initiating administrative actions that led to more than $250 million in savings or money recovered to Medicare in calendar year 2012 (see table 3). These savings represent nearly $100 million in claims flagged for review and then denied before payment; almost $100 million in auto-denial edits for suspect providers, suppliers, and beneficiaries; and almost $60 million recouped by MACs at the request of ZPICs. In addition, ZPICs placed more than $14 million in suspense accounts while the claims for that money were reviewed. ZPICs also reported taking actions that could result in savings that may not be easily quantifiable. For example, in 2012 ZPICs reported implementing more than 160 revocations and deactivations. Although these actions represent no direct CMS has reported that revocations are the most effective fraud savings,prevention tool because they prevent providers from submitting additional potentially fraudulent claims. (See app. II for more information on ZPICs’ actions, including by provider type.) ZPICs coordinate with law enforcement entities on ZPIC-initiated and other investigations, resulting in additional savings to Medicare and other results. In 2012, ZPICs reported that law enforcement entities accepted more than 130 new cases from them, with HHS OIG as the primary entity accepting the cases, followed by the FBI. In addition, ZPICs reported completing almost 1,800 requests for information for cases initiated by law enforcement and almost 700 for cases that had been initiated by ZPICs, primarily for data analysis. ZPICs also reported that, as a result of their cases being accepted and prosecuted by law enforcement, convicted providers were ordered to pay almost $80 million in court- determined fines, settlements, and/or restitutions. Cases can also result in prison sentences and other actions, though CMS does not consistently track those outcomes. ZPICs are to track information on the results of their cases in FID, but the system contains few outcomes. CMS officials said that they are aware of this issue and have taken steps to both improve ZPICs’ use of FID and integrate the system with CMS ARTS and other systems to improve the data in FID. As of August 2013, CMS officials reported that the agency was testing the integration of the systems and expected the integration to be completed by late 2013. According to CMS, ZPICs are to take immediate action to protect Medicare funds, but CMS may be missing opportunities for additional savings to Medicare because the agency lacks information on the timeliness of certain ZPIC actions. ZPIC officials reported taking actions and preventing potentially fraudulent payments before they were made, in line with CMS fraud strategies, and CMS ARTS data show ZPICs implementing some aspects of these strategies. For example, ZPIC officials reported focusing on prepayment reviews of claims—preventing potentially fraudulent payments—and 2012 CMS ARTS data showed that, of the providers whom ZPICs reviewed in 2012, almost five times as many had their claims reviewed on a prepayment basis rather than a postpayment basis. However, CMS does not track information on the swiftness of these actions, such as the length of time between a ZPIC’s receipt of a complaint about a suspect provider and the ZPIC’s visit to that provider, or between identifying a potentially fraudulent provider and initiating an administrative action. Federal internal control standards state that agencies’ management should have information on performance relative to established objectives so that actual performance can be continually compared against goals and differences can be analyzed. Because CMS does not have information on ZPICs’ timeliness for these types of activities, the agency cannot benchmark any changes in timeliness or measure the effectiveness of its strategies, such as whether ZPICs are limiting unnecessary losses to Medicare from suspect providers continuing to receive potentially fraudulent Medicare payments while awaiting investigative or administrative actions. Reactive sources—primarily complaints—were the major source of new ZPIC investigations in 2012, accounting for almost 90 percent of the almost 5,000 new investigations that year. (See fig. 4 for the sources of ZPIC investigations.) In 2012, ZPICs received almost 5,000 complaints, 45 percent of which were from MACs and over 50 percent from other sources, primarily the HHS OIG hotline, as reported by ZPIC officials. Proactive projects and FPS each accounted for less than 10 percent of investigations. Examples of proactive projects include analyzing data to identify spikes—large, rapid increases—in providers’ billing patterns; aberrant providers, such as those with unusual billing patterns; and schemes related to stolen beneficiary identities. ZPIC officials reported that their proactive data analysis projects are valuable because they find zone-specific fraud or new fraud schemes that reactive sources or FPS may not identify. For example, one ZPIC that covers multiple frontier states conducted a proactive project related to critical access hospitals, 40 percent of which are in that ZPIC’s geographic zone. ZPIC officials reported that as a result of this project, they identified overpayments to several hospitals that had opened new psychiatric units, as well as opportunities for education to improve patient care. (See app. II for more information on the sources of ZPIC investigations.) Although ZPIC officials previously reported issues with the quality of leads from FPS, as well as a decline in the number of proactive projects as a result of increased work to address FPS leads, officials have since reported improvements in FPS and their ability to address leads from the system. For example, officials from one ZPIC reported that the leads from FPS have improved and that the zone developed a new process for investigating those leads, thereby improving results. CPI officials reported that they will continue to direct ZPICs to investigate leads from proactive and reactive sources, as well as FPS, noting that the most successful ZPICs are those that can effectively address leads from all three categories. Based on CMS’s annual reviews, five of the six operating ZPICs were eligible for some portion of their contracts’ available award fees, and ZPICs received almost 70 percent of all fees for their most recent periods of performance.the annual reviews—elements that measure aspects of quality of service, cost control, business relations, and timeliness of certain activities— ranged from satisfactory to exceptional, meeting the award fee eligibility requirement of at least a satisfactory rating in all four of these elements. CMS awarded the five eligible ZPICs about two-thirds of the available award fees—$1.3 million out of $1.9 million—in the ZPICs’ most recent contract years based on ZPIC performance both on quality-of-service measures in the annual reviews and achievement of their Award Fee Administrative Action Plan goals. CMS officials reported that they assigned the majority of available award fee amounts—60 percent—to the quality-of-service measures in the annual evaluations because quality is the most important element of ZPICs’ work. CMS apportions the 60 percent of award fee amounts for quality of service across multiple The five ZPICs’ ratings for the elements considered in assessment criteria. Table 4 lists the quality-of-service measures for which ZPICs could earn award fees. Among the highest-value elements are how well ZPICs prioritize and document investigations, conduct medical reviews, and analyze data. ZPICs’ Award Fee Administrative Action Plan goals varied by ZPIC, and included goals such as developing a project to identify and prevent phantom provider schemes and improving the timeliness of initiating and implementing payment suspensions. CMS officials said that this portion of the award fee is intended to encourage ZPICs to develop more innovative ways to take administrative actions. CMS follows some best practices for its oversight of ZPICs, but does not clearly link ZPIC performance to agency performance measures and goals. The award fee evaluations allow CMS to assess key elements of ZPICs’ work, which follows federal best practices. Federal standards state that performance measures may address the type or level of program activities conducted (process), the direct products and services delivered by a program (outputs), or the results of those products and services (outcomes). CMS’s measures evaluate ZPICs’ processes and outputs, but not their outcomes. Moreover, these performance measures do not connect ZPIC work to agency performance measures that are linked to its goals, which is another best practice. One way that agencies examine the effectiveness of their programs is by measuring performance as required by the Government Performance and Results Act of 1993 (GPRA), as amended by the GPRA Modernization Act of 2010. One of CMS’s GPRA goals is to fight fraud and work to eliminate improper payments. Within that goal are two Medicare fee-for-service performance measures for determining progress toward that goal, and CMS officials reported that ZPICs are the primary actors for one of the measures: increasing the percentage of providers who are identified as high risk against whom CMS takes administrative actions. CMS’s fiscal year 2014 target for this performance measure is to increase the percentage of administrative actions taken for these high-risk providers from 27 percent to 36 percent. Federal standards state that entities should link performance measurements to goals and objectives, and previous GAO work found that leading organizations try to link the goals and performance measures for each organizational level to successive levels and ultimately to the organization’s strategic goals.none of the ZPICs’ performance measures link to the agency’s measures of increasing the percentage of administrative actions taken against high- risk providers, or to the other Medicare fee-for-service program integrity performance measure of reducing improper payments. Some ZPICs had goals in their Award Fee Administrative Action Plans related to the agency’s performance measures—for example, one ZPIC set a goal of increasing the value of its referrals of overpayments, which could reduce improper payments—but these were zone-specific and do not allow CMS to evaluate the overall impact of ZPICs on agency measures and, ultimately, goals. CMS officials told us in April 2013 that they are revising the ZPIC Award Fee Plans, but based on a draft of the revisions and discussions with CMS officials, the revised plans will continue to lack measures related to outcomes and will not tie performance to agency program integrity measures or goals. difficult and setting targets can be problematic, CMS could explicitly link ZPICs’ work to the agency’s progress toward meeting its performance measures and goals. Specifically, CMS officials reported that they are using FPS to identify and track high-risk providers for the performance measure of increasing the number of administrative actions taken against those providers. Although ZPICs are the primary users of FPS and have primary responsibility for initiating administrative actions, CMS does not link ZPICs’ use of FPS to that measure, hindering the agency’s ability to effectively oversee its progress toward meeting its goal of fighting fraud and working to eliminate improper payments. Given the vulnerability of the Medicare program to fraud and the lack of reliable estimates of the extent of fraud in the program, determining how well CMS is carrying out its fraud prevention strategy is a vital, if challenging, task. ZPICs, which are central to that strategy, reported that their efforts have yielded positive results, such as savings greater than their contract costs and multiple other actions that helped protect Medicare from potentially fraudulent providers, such as referring suspect providers to law enforcement. Yet little is known about how expeditiously ZPICs take action to save Medicare funds—an important consideration given that the longer a fraud scheme operates, the greater the potential financial losses. As a result, CMS would benefit from enhancing its collection and evaluation of information on the timeliness of ZPICs’ actions, including information on whether new tools or strategies have increased the speed with which ZPICs investigate potentially fraudulent providers or initiate administrative actions. In addition, as CMS attempts to achieve its agencywide program integrity goal of fighting fraud and eliminating improper payments in the Medicare program, it would benefit from knowing how ZPICs are contributing to efforts to achieve this goal. By linking the evaluation of ZPICs’ work to the agency’s program integrity performance measures—in particular the performance measure focused on administrative actions, which are a significant portion of ZPICs’ work— CMS would have greater assurance that its ZPIC activities are appropriately supporting CMS fraud prevention efforts. To help ensure that CMS’s fraud prevention activities are effective and that CMS is comprehensively assessing ZPIC performance, the Administrator of CMS should take the following two actions: Collect and evaluate information on the timeliness of ZPICs’ investigative and administrative actions, such as how soon investigations are initiated after ZPICs identify potential fraud and how swiftly ZPICs initiate administrative actions after identifying potentially fraudulent providers. Develop ZPIC performance measures that explicitly link their work to the agency’s Medicare fee-for-service program integrity performance measures and targets for its GPRA goal of fighting fraud and working to eliminate improper payments. We requested comments from HHS, but none were provided. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Acting Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. To determine Zone Program Integrity Contractors’ (ZPIC) contract costs and how ZPICs use those funds, we examined data from CMS’s Analysis, Reporting, and Tracking System (ARTS), an online system ZPICs use to submit invoices and report workload statistics and which CMS uses to track and analyze ZPIC workload, performance, and production. Specifically, we examined aggregated ZPIC invoices and workload statistics that specified how ZPICs allocate their funds, and interviewed ZPIC officials to confirm these data. We also reviewed the task orders outlining the scope of each zone’s work and obtained data from CMS on ZPIC contract amounts. To describe the results of ZPIC Medicare fee-for-service investigations, we examined data from CMS ARTS and the Fraud Investigation Database (FID), a secure system that contains details related to Medicare fraud and abuse investigations. We analyzed calendar year 2012 data for the six operating ZPICs on the sources of their investigations, the numbers of administrative actions taken, and dollar values of relevant actions. We reviewed CMS guidance on how ZPICs should prioritize their work and how to conduct investigations. We interviewed officials from the CMS Center for Program Integrity about how they review and track ZPIC administrative actions and their process of approval for actions, such as revocations. We interviewed officials from all six ZPICs to learn about their internal guidance on prioritizing and conducting their work, how they determine when to take administrative actions, and how they decide to refer a case to law enforcement. To examine the results of CMS’s evaluation of ZPICs’ performance and aspects of CMS’s evaluation practices, we reviewed the following: each ZPIC’s most recent Contractor Performance Assessment Report; each ZPIC’s most recently completed Award Fee Administrative Action Plan, which describes the ZPIC’s plans to improve administrative actions and how it will earn its award fee; and data from CMS on the percentage and amount of each zone’s award fee. We reviewed internal CMS guidance on how to evaluate ZPICs’ performance, as well as federal standards and best practices for measuring performance. We also interviewed CMS contracting and other officials to learn about the review process and how such guidance is applied, and to discuss changes to ZPIC evaluations and performance measures. We also interviewed ZPIC officials to learn more about how ZPICs determine their Award Fee Administrative Action Plan goals and how they evaluate themselves on these goals and other work. We assessed the reliability of the data we obtained from CMS ARTS and FID through interviews with agency officials and users, system demonstrations, and, in the case of CMS ARTS, direct use of the system. We shared with CMS and the relevant ZPIC any errors we identified through reviews of the data and comparisons with other sources to obtain corrected information. We found the data sufficiently reliable for the purposes of this review. We conducted this performance audit from October 2012 to September 2013 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The following table shows selected ZPIC activities and results reported by ZPICs in CMS ARTS. Durable medical equipment (DME) is covered under Medicare Part B, and home health and hospice under are covered under Part A, but ZPICs report data in CMS ARTS as monthly aggregates by Part A, Part B, DME, and home health and hospice. CMS ARTS data do not allow us to identify particular provider types, such as whether a Part B provider was a family physician or podiatrist. In addition to the contact named above, Karen Doran, Assistant Director; Matthew Gever; Elizabeth Morrison; Eden Savino; Kristin Van Wychen; and Jennifer Whitworth made key contributions to this report.

Summary: GAO has designated Medicare as a high-risk program, in part because its size and complexity make it particularly vulnerable to fraud. To help detect and prevent potential Medicare fraud, CMS--the agency within the Department of Health and Human Services (HHS) that administers the Medicare program--contracts with ZPICs. These contractors are to identify potential fraud, investigate it thoroughly and in a timely manner, and take swift action, such as working to revoke suspect providers' Medicare billing privileges and referring potentially fraudulent providers to law enforcement. GAO examined (1) ZPIC contract costs and how ZPICs use those funds, (2) the results of ZPICs' work, and (3) the results of CMS's evaluations of ZPICs' performance and aspects of CMS's evaluation practices. To do this, GAO examined ZPIC funding, contracts, and related documents; data on ZPICs' workloads, investigations, and results; and CMS evaluations of ZPICs as well as federal standards for performance measurement. GAO also interviewed CMS and ZPIC officials. The Centers for Medicare and Medicaid Services (CMS) paid its Zone Program Integrity Contractors (ZPIC) about $108 million in 2012. ZPICs reported spending most of this funding on fraud case development, primarily for investigative staff, who in 2012 reported conducting about 3,600 beneficiary interviews, almost 780 onsite inspections, and reviews of more than 200,000 Medicare claims. ZPICs reported that their actions resulted in more than $250 million in savings to Medicare in calendar year 2012 from actions such as stopping payment on suspect claims. ZPICs also reported taking other actions to protect Medicare funds, including having more than 130 of their investigations accepted by law enforcement for potential prosecution, and working to stop more than 160 providers from receiving additional Medicare payments in 2012. However, CMS lacks information on the timeliness of ZPICs' actions--such as the time it takes between identifying a suspect provider and taking actions to stop that provider from receiving potentially fraudulent Medicare payments--and would benefit from knowing if ZPICs could save more money by acting more quickly. ZPICs generally received good ratings in annual reviews, with five of six eligible for incentive awards. CMS follows some best practices for ZPICs' oversight, but the agency does not clearly link ZPIC performance to agency program integrity goals. The majority of the measures CMS uses to evaluate ZPICs relate to the quality of their work because, according to CMS officials, quality is the most important element. However, evaluation of such measures, while a best practice, does not connect ZPIC work to agency performance measures. For example, CMS aims to increase the percentage of actions taken against certain high risk Medicare providers--work central to ZPICs--but does not explicitly link ZPICs' work to the agency's progress toward that goal, another best practice that would allow the agency to better assess the ZPICs' support of CMS's fraud prevention efforts. GAO recommends that CMS collect and evaluate information on the timeliness of ZPICs' investigative and administrative actions, and develop ZPIC performance measures that explicitly link ZPICs' work to Medicare program integrity performance measures and goals. GAO requested comments from HHS on the draft report, but none were provided.