To advance CMS’s efforts to prevent fraud, waste, and abuse in the Medicare fee-for service program, the Small Business Jobs Act of 2010 appropriated $100 million for CMS to implement a data analytic system. The law required CMS to implement a system that could analyze claims prior to payment to identify suspect claims and provider billing patterns and prevent payment of improper and potentially fraudulent claims, among other things. In April 2011, CMS awarded almost $77 million to a contractor to implement, operate, and maintain FPS and design analytic models for the system. CMS awarded about $13 million to a second contractor in July 2011 to develop additional analytic models for FPS. As the original FPS contract was set to end, CMS awarded a nearly $92 million contract in April 2016 for a new, upgraded FPS system—FPS 2.0. FPS 2.0 was fully implemented in March 2017. CMS’s Center for Program Integrity (CPI)—which oversees the agency’s Medicare program integrity efforts—employs FPS as a key component of its strategy to move beyond the “pay and chase” approach of recovering improper and potentially fraudulent payments to focusing on prevention. FPS screens fee-for-service claims prior to payment in order to help identify and prevent improper and potentially fraudulent payments by performing two primary functions: Develop leads for fraud investigations. FPS compares provider billing patterns and other data against models of potentially fraudulent behavior to identify providers with suspect billing patterns. For example, an FPS model identifies providers that bill for a disproportionate number of services in a single day relative to other providers. FPS simultaneously risk-scores providers identified by the models to prioritize them for potential investigation. In developing these leads, FPS is intended to help CMS prevent potentially fraudulent payments by furthering the agency’s ability to more quickly identify and investigate suspect providers, and take more timely corrective actions. Execute automated prepayment edits. FPS edits deny certain improper payments, and some edits compare information from multiple claims to do so. For example, FPS may deny physician outpatient claims based on information from an inpatient claim associated with the same episode of care. CMS submitted three annual reports on FPS’s implementation to Congress in response to requirements established by the Small Business Jobs Act of 2010. In these reports, CMS provided information on the corrective actions taken and savings achieved from FPS. In its most recent report, CMS reported that FPS had cumulatively helped prevent or identify nearly $1.5 billion in improper and potentially fraudulent payments from its implementation through the end of calendar year 2015. CMS uses contractors to support the agency’s program integrity activities, including program integrity contractors to identify and investigate providers engaged in potential Medicare fee-for-service fraud. CMS is currently in the process of transitioning Medicare program integrity contracts from ZPICs to new contract entities, UPICs. ZPICs operated in seven geographical jurisdictions across the country. UPICs will operate in five jurisdictions and combine Medicare and Medicaid program integrity efforts under a single contracting entity (fig. 1 depicts the geographic jurisdictions of ZPIC and UPIC zones). As of May 2017, two of the five UPICs—the Midwestern and Northeastern—were operational. The program integrity contractors identify leads for provider investigations from three categories of sources: Referrals. A number of entities, including CMS, law enforcement agencies, and the MACs, refer leads about suspect providers to the program integrity contractors. The program integrity contractors also receive leads based on beneficiary and provider complaints and allegations. Program integrity contractor data analysis. Program integrity contractors use postpayment claims to conduct their own data analyses to identify providers with suspect billing patterns. FPS. FPS identifies providers with suspect billing patterns and prioritizes leads based on provider risk-scores. The program integrity contractors generally have a triage process to review leads and determine whether the leads are indicative of potential fraud (see fig. 2 for information on program integrity contractor investigation processes). Leads that are determined to be suspect become formal investigations, and the program integrity contractors perform a range of investigative activities to gather evidence and determine if providers are engaged in potential fraud. These activities include conducting beneficiary and provider interviews, site visits of provider facilities, and manual reviews of provider claims. Based on their investigations, the program integrity contractors may take corrective actions by referring providers engaged in potential fraud to law enforcement and initiating administrative actions. Specifically, if the program integrity contractors uncover evidence of potential fraud, they refer the investigation to the Department of Health and Human Services Office of Inspector General (HHS OIG) for further examination, which may lead to possible criminal or civil prosecution by the Department of Justice. The program integrity contractors may also recommend a range of administrative actions to CMS for approval and implementation. Such actions include revocation of providers’ billing privileges and payment suspensions (table 1 describes the administrative actions the program integrity contractors may recommend against providers). CMS’s claims processing systems apply prepayment edits to all Medicare fee-for-service claims in an effort to pay claims properly. Most of the prepayment edits are automated, meaning that if a claim does not meet the criteria of the edit, it is automatically denied. Other prepayment edits flag claims for manual review, in which trained clinicians and coders examine claims and associated medical records to ensure that the claims meet Medicare rules and requirements. Many improper and potentially fraudulent claims can be identified only by manually reviewing associated medical records and beneficiary claim histories, and exercising clinical judgment to determine whether services were reasonable and necessary. Whereas automated edits are applied to all claims, manual edits are applied to very few—less than 1 percent of claims undergo manual review. CMS contracts with the MACs to process and pay Medicare fee-for- service claims and implement prepayment edits in the Medicare claims processing systems. The claims processing systems consist of three systems—the MAC front-end systems, shared systems, and Common Working File—that carry out a variety of functions and execute prepayment edits (see fig. 3). When implementing FPS, CMS integrated FPS with the claims processing systems and claims are screened by FPS prior to payment. Unlike the claims processing systems, CPI maintains FPS. HFPP is a voluntary public-private partnership established by HHS and the Department of Justice to facilitate collaboration in addressing healthcare fraud. The membership includes Medicare- and Medicaid- related federal agencies and several state agencies, other federal agencies with responsibility for federal health care programs such as the Department of Defense and Department of Veterans Affairs, law enforcement agencies, private payers, and antifraud and other healthcare organizations. HFPP was established, in part, to help payers identify schemes and providers engaged in potential fraud that individual payers may not be able to identify alone. HFPP began in 2012 with 20 members and, as of June 2017, had grown to 79 members. As of the end of calendar year 2016, CMS had cumulatively spent $30.3 million on HFPP. ZPIC officials stated that FPS helps them identify suspect providers quickly. Because FPS analyzes claims prior to payment, providers with suspect billing patterns can be identified quickly relative to other sources of leads. In particular, several ZPIC officials stated that the leads they develop from their data analyses of postpayment claims are not as timely. Officials from two ZPICs estimated that the postpayment claims they use for their analyses may have been for services rendered 1 to 2 months prior, while the claims analyzed by FPS may have been for services recently rendered. ZPIC officials also said the information associated with FPS leads allows them to examine and triage those leads quickly to determine whether to initiate investigations. FPS leads provide specific information about the type of potential fraud identified, along with claims data and other supporting information. ZPIC officials further stated that they use information from FPS when triaging leads from other sources. In contrast to FPS leads, several ZPIC officials noted that reviewing and triaging leads based on referrals often necessitates additional time and resources. In particular, allegations associated with some referrals can be vague, which makes it difficult for ZPICs to identify the relevant provider claims data and other information needed to assess the validity of the allegations. However, once an investigation is initiated, officials stated that FPS has generally not sped up the process for investigating providers. Several ZPIC officials noted that investigations based on FPS leads are similar to those from other sources in that they require further investigation, such as manual claim reviews or site visits of provider facilities, to substantiate the leads and gather evidence of potential fraud. However, while ZPIC officials said that FPS does not speed up investigations, officials from several ZPICs noted that FPS can help improve the quality of beneficiary interviews. Since FPS leads are based on prepayment claims data, ZPICs can conduct beneficiary interviews shortly after the services have been rendered, when beneficiaries may be better able to recall details about their care. CMS has not tracked data to assess FPS’s effect on the timeliness of investigation processes. CMS has lacked such timeliness data because of limitations with its IT system for managing and overseeing ZPICs. However, as of May 2017, CMS was in the process of implementing a new IT system that could be used to assess FPS’s effect on the timeliness of program integrity contractor investigation processes. In transitioning to UPICs, CMS is implementing a new contractor workload management system that will capture data on the timeliness of UPIC investigation processes. For example, the system will be able to capture information on the amount of time it takes a UPIC to evaluate a lead or conduct an investigation. CMS officials said that the agency plans to use the information tracked by the system to monitor program performance, including assessing FPS’s effect on UPIC investigation processes and the timeliness of corrective actions. The officials also stated that they may not be able to conduct such an assessment for several years as CMS is still in the process of transitioning to UPICs and implementing the new IT system. Further, the officials said that they subsequently would want to collect several years’ worth of such data to ensure a reliable assessment. In fiscal years 2015 and 2016, about 20 percent of ZPIC investigations were initiated based on FPS leads, according to our analysis (see table 2). In both years, nearly half of ZPIC investigations were based on referrals. The proportion of investigations based on FPS leads is poised to increase as CMS changes program integrity contractor requirements for using FPS with the transition from ZPICs to UPICs. CMS has required the ZPICs to review all FPS leads that met high-risk thresholds. CMS is instead requiring that the UPICs derive 45 percent of new investigations from FPS. ZPIC officials stated that the new UPIC requirement should allow UPICs flexibility to focus their reviews on the FPS leads that are most applicable to their geographic region. For example, a UPIC with high levels of home health agency fraud within its jurisdiction can focus its reviews of FPS leads on those providers. For total actions, CMS tracked the number of investigations referred to law enforcement. For actions associated with FPS, CMS tracked the number of providers referred to law enforcement. These data are not directly comparable. In addition to tracking the corrective actions and savings associated with FPS, CMS also measures the extent to which investigations initiated from FPS leads result in actions against providers engaged in potential fraud. CMS reported that, in fiscal year 2015, 44 percent of FPS-initiated investigations resulted in administrative actions, which met the agency’s fiscal year goal of 42 percent of investigations leading to administrative actions. In fiscal year 2016, 38 percent of FPS-initiated investigations resulted in administrative actions, which did not meet the agency’s fiscal year goal of 45 percent. FPS prepayment edits screen individual claims to automatically deny payments that violate Medicare rules or policies. For example, some FPS edits deny claims that exceed coverage utilization limits for a service. FPS edits do not analyze individual claims to automatically deny payments based on risk alone or the likelihood that they are fraudulent. According to CMS officials, the agency does not have the authority to use FPS to automatically deny individual claims based on risk without further evidence confirming that the claims are potentially fraudulent. Although the prepayment edits in FPS are functionally similar to those in CMS’s claims processing systems, the FPS edits specifically target payments associated with potential fraud schemes. Like edits executed elsewhere in the claims processing systems, FPS edits deny payments based on rules or policies. Unlike the edits in the claims processing systems, all of the edits in FPS are designed to address identified payment vulnerabilities associated with potential fraud, according to CMS officials. Payment vulnerabilities are service- or system-specific weaknesses that can lead to improper payments, including improper payments that may be due to fraud. For example, CMS implemented an FPS edit that denies physician claims that improperly increase payments by misidentifying the location that the service was rendered. The payments are denied based on the rule that physician claims must correctly identify the place of service. The edit helped address a payment vulnerability identified by HHS OIG that found millions of dollars in overpayments. According to CMS officials, the advantage of using FPS to implement prepayment edits is that the system allows CMS to prioritize edits intended to address payment vulnerabilities associated with potential fraud. Because CPI maintains FPS, CMS can quickly implement edits into FPS. In contrast, edits that are implemented in the claims processing systems are queued as part of quarterly system updates, and may need to compete with other claims processing system updates. CPI is not subject to such limitations when implementing edits in FPS, and officials said that edits can be developed and implemented in FPS more quickly compared to the claims processing systems. As of May 2017, CMS had implemented 24 edits in FPS. CMS reported that in fiscal year 2015, FPS edits denied nearly 169,000 claims and saved $11.3 million. In fiscal year 2016, the edits denied nearly 324,000 claims and saved $20.4 million. CMS officials stated that the number of prepayment edits implemented in FPS thus far has been limited, but that the agency is taking steps to address certain challenges that would allow the agency to develop and implement edits more quickly. For example, because of their role and expertise in processing claims, the MACs advise CPI and help develop and test FPS edits before they are implemented in the system to ensure they will work as intended. However, CPI has been limited in the amount of MAC resources that it can engage to help develop FPS edits under existing contracts. According to officials, CPI is planning to take steps to more directly involve the MACs in FPS edit development, which officials said should accelerate the edit implementation process. Additionally, CMS officials said that they plan to utilize FPS functionality to implement new edits by expanding existing edits to apply to other services. All of the 24 current FPS edits were developed from the ground up, a time and resource consuming process, according to CMS officials. In contrast, developing new edits by expanding existing edits will allow CMS to more quickly develop and implement new edits. HFPP participants we interviewed, including CMS officials, reported that sharing data and information within HFPP has been useful to their efforts to address health care fraud. The principal activity of HFPP is generating studies that pool and analyze multiple payers’ claims data to identify providers with patterns of suspect billing across multiple payers. Study topics examine known fraud vulnerabilities important to the participating payers and are selected through a collaborative process. As an example, one study used pooled data to identify providers who were cumulatively billing multiple payers for more services than could reasonably be rendered in a single day. In another study, HFPP pooled payer information on billing codes that are frequently misused by providers engaged in potential fraud, such as codes commonly used to misrepresent non-covered services as covered. See table 4 for a description of HFPP’s completed studies as of May 2017. Participants reported that HFPP’s studies helped them to identify and take action against potentially fraudulent providers that would otherwise have gone unidentified. For instance, both public and private payers reported that HFPP’s non-operational providers report uncovered providers that they had not previously identified as suspect. CMS officials and one private payer we interviewed said that they used information from this study to conduct site visits of reportedly non-operational providers. CMS officials told us that they revoked a number of the providers after confirming that they were indeed non-operational. CMS officials also said that they review the results of HFPP studies and provide information on potentially fraudulent providers to ZPICs when appropriate. The information may either serve as new leads or help support existing investigations. Participants also reported that study results have helped them uncover payment vulnerabilities of which they might not otherwise have been aware. For example, CMS officials stated that they used the HFFP report on misused procedure codes to evaluate several Medicare payment vulnerabilities and then implemented edits to address them. In instances where participants reported that HFPP studies revealed suspect providers or schemes that were known to them, participants stated that HFPP study results helped them to confirm suspicions, better assess potential exposure, and prioritize and develop internal investigations. Several participants we interviewed noted that even though HFPP study results can help them identify suspect providers, they may still face challenges using the information to take corrective actions. HFPP participation rules require payers to examine their internal data and claims to investigate and build cases against suspect providers before taking any corrective actions, partly in order to minimize the risk of payers taking action on false positive study results. For certain types of fraud schemes, however, the participants’ internal information alone may not provide enough evidence of improper billing. For instance, although an HFPP study may reveal clear evidence that a provider is billing multiple payers for an unreasonable number of services in a single day, the provider may have only billed individual payers for a limited, reasonable number of services. Participants reported that HFPP has also facilitated both formal and informal information sharing among payers, and indicated that it has helped them learn about fraud vulnerabilities and strategies for effectively addressing them. Formal information sharing includes presentations at HFPP meetings and a whitepaper on how payers can help address beneficiary opioid abuse and reduce opioid-related fraud. HFPP also manages a web portal where participants can share individual best practices and post “fraud alerts” about emerging fraud schemes or suspect providers. Informal information sharing includes knowledge exchanged through the networking and collaboration that occurs among HFPP participants, both at in-person HFPP meetings and through collaboration that occurs via the web portal’s participant directory. Although HFPP began operations in 2012, participants we interviewed stated that much of the initial work of the partnership involved negotiating the logistics for collecting and storing participants’ claims data. CMS contracts with a trusted third party (TTP) entity to administer HFPP. The TTP consolidates, secures, and confidentially maintains the claims data shared by participants, and conducts studies that analyze the pooled data to identify potential fraud across payers. According to several participants we interviewed, some payers were initially reluctant to share claims data with the TTP because claims contain sensitive provider and beneficiary information and private payers may view them as proprietary. Accordingly, it took time for the TTP to demonstrate to payers its ability to securely store and use pooled claims data. Payers’ reluctance resulted in an early time- and resource-intensive data sharing strategy that relied upon payers submitting a limited amount of claims data on a study-by- study basis, in a particular format, stripped of beneficiaries’ personally identifiable information and protected health information. Recently, HFPP began to pursue a new data sharing strategy. According to the TTP and participants we interviewed, payers will send in generalized data, reducing the data sharing burden on payers and enabling HFPP to conduct new types of studies to combat fraud. The data can be submitted in various formats, relieving payers from the need to extract and clean study-specific data. All participant data will be pooled and stored, and multiple studies will be run on the data submitted. Payers may voluntarily submit data that includes beneficiaries’ personally identifiable information and protected health information. According to CMS officials, collection of personally identifiable information and protected health information will allow HFPP to conduct studies that involve identifying beneficiaries across payers, such as studies examining fraud schemes in which multiple providers fraudulently bill for the same beneficiaries. Several HFPP participants we spoke with indicated their support of the new strategy and willingness to provide beneficiaries’ personally identifiable information and protected health information for more in-depth HFPP studies. As of May 2017, 38 partners had signed data sharing agreements with the new TTP. However, not all payers that previously shared claims data have agreed to participate in the new data sharing strategy and those payers are still working with the TTP to formalize agreements regarding how their claims data will be stored and used. GAO provided a draft of this report to HHS. HHS provided technical comments, which GAO incorporated as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, appropriate congressional requesters, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix I. In addition to the contact named above, Martin T. Gahart (Assistant Director), Michael Erhardt (Analyst-in-Charge), Muriel Brown, Cathleen Hamann, Colbie Holderness, and Jennifer Whitworth made key contributions to this report.

Summary: CMS analyzes Medicare fee-for-service claims data to further its program integrity activities. In 2011, CMS implemented a data analytic system called FPS to develop leads for fraud investigations conducted by CMS program integrity contractors and to deny improper payments. In developing leads, FPS is intended to help CMS avoid improper payment costs by enabling quicker investigations and more timely corrective actions. Additionally, in 2012, CMS helped establish the HFPP to collaborate with other health care payers to address health care fraud. One of the key activities of the HFPP is to analyze claims data that are pooled from multiple payers, including private payers and Medicare. GAO was asked to review CMS's use of FPS and the activities of the HFPP. This report examines 1) CMS's use of FPS to identify and investigate providers suspected of potential fraud, 2) the types of payments that have been denied by FPS, and 3) HFPP efforts to further CMS's and payers' ability to address health care fraud. GAO reviewed CMS documents, including reports to Congress on FPS, contractor statements of work, and information technology system user guides, and obtained fiscal year 2015 and 2016 data on FPS fraud investigations and claim denials. GAO also interviewed CMS officials and CMS program integrity contractors regarding how they use FPS, and a non-generalizable selection of HFPP participants regarding information and data sharing practices, and anti-fraud collaboration efforts. Investigations initiated or supported by the Centers for Medicare & Medicaid Services' (CMS) Fraud Prevention System (FPS)—a data analytic system—led to corrective actions against providers and generated savings. For example, in fiscal year 2016, CMS reported that 90 providers had their payments suspended because of investigations initiated or supported by FPS, which resulted in an estimated $6.7 million in savings. In fiscal year 2016, 22 percent of Medicare fraud investigations conducted by CMS program integrity contractors were based on leads generated by FPS analysis of Medicare claims data. Officials representing Medicare's program integrity contractors told GAO that FPS helps speed up certain investigation processes, such as identifying and triaging suspect providers for investigation. However, the officials said that once an investigation is initiated, FPS has generally not sped up the process for investigating and gathering evidence against suspect providers. CMS has not tracked data to assess the extent to which FPS has affected the timeliness of contractor investigation processes. However, CMS is implementing a new information technology system that tracks such data, and officials said that they plan to use the data to assess FPS's effect on timeliness. FPS denies individual claims for payment that violate Medicare rules or policies through prepayment edits—automated controls that compare claims against Medicare requirements in order to approve or deny claims. FPS prepayment edits specifically target payments associated with potential fraud. For example, an FPS edit denies physician claims that improperly increase payments by misidentifying the place that the service was rendered, which helped address a payment vulnerability associated with millions in overpayments. FPS edits do not analyze individual claims to automatically deny them based on risk alone or the likelihood that they are fraudulent without further investigation. As of May 2017, CMS had implemented 24 edits in FPS. CMS reported that FPS edits denied nearly 324,000 claims and saved more than $20.4 million in fiscal year 2016. The Healthcare Fraud Prevention Partnership (HFPP) is a public-private partnership that began in 2012 with the aim of facilitating collaboration among health care payers to address health care fraud. The HFPP had 79 participants as of June 2017. Participants, including CMS officials, stated that sharing data and information within HFPP has been useful to their efforts to address health care fraud. HFPP conducts studies that pool and analyze multiple payers' claims data to identify providers with patterns of suspect billing across payers. Participants reported that HFPP's studies helped them to identify and take action against potentially fraudulent providers and payment vulnerabilities of which they might not otherwise have been aware. For example, one study identified providers who were cumulatively billing multiple payers for more services than could reasonably be rendered in a single day. Participants also stated that HFPP has fostered both formal and informal information sharing among payers. The Department of Health and Human Services provided technical comments on a draft of this report, which GAO incorporated as appropriate.