Most Medicare beneficiaries receive their care on an FFS basis, with providers submitting claims for payment for each service provided. In addition to the Part A/B and DME MACs that process and pay claims, CMS also employs other types of contractors to specifically address fraud and improper payments. These include: Recovery Audit contractors (RA), which review claims postpayment in four RA jurisdictions to identify improper payments and Zone Program Integrity Contractors (ZPIC), which review claims on a pre- and postpayment basis in seven ZPIC jurisdictions to identify potential fraud. All of these contractors use data analysis to identify providers who bill improperly, whether by mistake or intentionally, to help target their claims review. CMS has expanded its Integrated Data Repository, which was set up to integrate Medicare and Medicaid claims, beneficiary, provider, and other data, and is currently populated with 5 years of historical Part A, Part B, and Part D paid claims data. CMS’s contractors can use these data to analyze previously undetected indicators of aberrant billing activity throughout the claims processing cycle. CMS intends to develop shared data models and is pursuing data sharing and matching agreements with other federal agencies to identify potential fraud, waste, and abuse throughout federal health care programs. CMS has set expectations that RAs and ZPICs will provide information on types of potentially problematic claims to help the agency identify vulnerabilities. CMS has also recently developed a “Fraud Prevention System” which uses predictive modeling technology to screen all FFS claims before payment is made. Claims are streamed through the Fraud Prevention System prior to payment and analyzed on the basis of algorithms that include other information, such as past billing, to identify patterns of potentially fraudulent billing by providers. The billing is prioritized for risk of fraud, with the highest-priority cases investigated by ZPICs. Prior to applying predictive models to claims prepayment, CMS tests the algorithms to try to ensure that resources are targeted to the highest-risk claims or providers while payment of claims to legitimate providers continues to occur without disruption. Consistent with Medicare law, CMS sets national coverage and payment policies regarding when and how services will be covered by Medicare, as well as coding and billing requirements for claims.developed national payment policies related to MUEs to limit potentially CMS has improper and excess payments to providers for many services, especially those that are prone to potential fraud or that result from billing errors. A CMS MUE Workgroup, which includes staff from CMS and the MUE contractor, is responsible for developing the national MUE limits, in consultation with the medical community. MUE limits are developed as per-day limits on the number of units of a given service or medical product that can be provided by the same physician to the same beneficiary. The limits are developed on the basis of coding conventions defined in the American Medical Association’s (AMA) Current Procedural Terminology manual, national and local policies and edits, coding guidelines developed by national societies, analysis of standard medical and surgical practice, as well as an analysis of current provider billing practices. Prior to their implementation, proposed MUE limits are released for a review and comment period to the AMA, national medical/surgical societies, and other national health care organizations. However, unpublished MUEs are not released for comment. The MUE files are updated quarterly and new limits may be added at these times. Although MUEs were developed as limits on the number of units of a service a provider could bill for a beneficiary in a single day, as we previously reported they are not implemented as such. Specifically, they do not look at total units on all claims from one provider for the same beneficiary across an entire day, and the limits may therefore be exceeded. A claim can have multiple lines and providers may bill multiple units of the same service for the same beneficiary on the same day on multiple lines of a claim. In processing the claim, contractors’ automated systems only examine the number of units on each claim line. If the number of units on the claim line exceeds the MUE limit, the entire claim line is denied. However, as long as the units on a claim line are at or below the MUE limit, they are paid. Thus, the automated claims- processing systems allow the MUE per-day limits to be exceeded for a beneficiary if providers bill multiple units of the same service on multiple claim lines. The systems also allow limits to be exceeded for a beneficiary if a provider bills for multiple units of the same service performed on the same day on different claims. When claiming multiple units of the same service for one beneficiary, providers may, but are not required to, include a “modifier”— a special code that indicates why the additional units are medically necessary. MACs may develop local coverage policies as long as these policies are consistent with national policies. To implement these local policies, some MACs have developed local edits for certain services. Similar to the national MUEs, these local edits set limits on the maximum number of units that may be billed by a provider for the same beneficiary on the same day. Providers may not exceed the local limits by billing additional units on multiple claim lines, unless they include modifiers to explain why the additional units are medically necessary. The local edits were developed for services that may be overused or abused in their jurisdiction, including services for which the MUE limits were being frequently exceeded. Without these local edits, the MUE limits would be exceeded much more frequently. The local limits were developed on the basis of clinical input from the MAC’s medical directors and other clinicians, as well as analysis of claims data. The vast majority of Medicare payments in 2011 for services with unpublished MUEs were for services where the numbers of units were at or below the per-day MUE limits. However, because the MUE limits were not implemented as per-day limits, approximately $14 million was paid for services that exceeded MUE limits. Moreover, by applying on a national basis the more restrictive local limits used by some contractors, (which are implemented as per-day limits), we found that CMS could have lowered payments by an additional $7.8 million. We also found that payments exceeding unpublished MUE limits were concentrated within certain services and states. In 2011, Medicare paid approximately $23.9 billion for 1,845 types of services with unpublished MUEs. The vast majority—about 99.9 percent—was paid for services where the number of units providers billed was at or below the per-day MUE limits. The MUE contractor indicated that the limits were generally set high, so that the MUEs would not deny claims for medically necessary services. However, because MUEs were not implemented as per-day limits, approximately $14 million was paid for services where total units billed by a provider for a beneficiary on the same day exceeded the MUE limits. These payments were made for units of services exceeding MUE limits that were billed on multiple lines of a claim or across multiple claims. Although the automated claims-processing systems check each claim line, they do not check all units billed by a provider for a beneficiary on the same day to see if they exceed the limit. While providers may use modifiers on claim lines to indicate when it is medically necessary to exceed the MUE limits, no modifiers were included for the approximately $14 million in payments that we identified as exceeding the unpublished MUE limits to explain why the additional units were medically appropriate. CMS does not expect its contractors to check claims to determine if modifiers are included when billing additional units of services related to unpublished MUEs on multiple lines. CMS officials stated that because the MUEs are unpublished, providers may not know a given service has an MUE and therefore may not include a modifier when billing for services. See GAO-13-102. some MUEs that are likely to become DOS edits include those where it is anatomically impossible to exceed the MUE limit. For example, anatomical limits such as having only two eyes limits the number of times a given procedure could be performed for which a provider could submit a claim on the same day for the same patient. CMS officials told us that they probably will not apply this policy to some of the unpublished MUEs where clear anatomical or other restrictions may not exist, such as those for some Part B drugs and DME. Contractors that we interviewed were aware of the new policy, had seen the draft version, and were generally supportive of the effort. Our examination of 13 services where MACs developed more restrictive local edits than the unpublished MUEs showed Medicare payments could have been reduced had CMS examined these edits and adopted them as part of its program integrity responsibilities. If CMS had used these limits and implemented them as per-day edits, instead of using the unpublished MUE limits on these services, Medicare payments would have been lowered by an additional $7.8 million. This indicates that there is a potential for additional savings if some of these local edits were applied nationally. Four of the MACs from whom we requested local edits had implemented edits related to unpublished MUEs. At least three of the contractors had more restrictive limits for the 13 services we analyzed. Contractors told us that they had developed more restrictive edits because the MUE limits were being exceeded frequently or they had observed potentially fraudulent or abusive billing for these services. While the unpublished MUE limits were implemented at a claim-line level, contractors told us that their local limits were implemented as per-day limits. Contractors also told us that CMS does not request information on their local edits, nor do they routinely share them with CMS. The MUE contractor told us that the MUE Workgroup was aware of one contractor’s local edits for certain services with unpublished MUEs, but was not aware of other contractors’ local edits for these services. Because CMS has not communicated with its contractors regarding their local edits or monitored their use, it is not evaluating these local edits. As a result, it may be missing an opportunity to identify situations in which savings could be achieved by implementing some of the local edits nationally. Payments for services that exceeded the per-day MUE limits were concentrated within certain services. For example, of the over 1,800 services with unpublished MUEs, 717 had payments that exceeded the MUE limits. Of these, 20 services accounted for almost half of all payments that exceeded the MUE limits, with the top service alone accounting for over 8 percent of such payments. Many of these top 20 services were for prescription drugs, DME, and clinical laboratory services. Payments for services that exceeded the unpublished MUE limits also tended to be concentrated in certain states. Five states with the highest payments that exceeded the MUE limits (Arkansas, California, New York, Pennsylvania, and Texas) accounted for almost half of these payments, although they accounted for 30 percent of total payments for all services with unpublished MUEs. CMS and its contractors do not have a system in place for examining claims to determine the extent to which providers may be exceeding unpublished MUE limits and whether payments for such services were proper. Payments that exceeded MUE limits were concentrated among certain providers, which could facilitate such examination. CMS officials and contractors that we interviewed said they do not have a system in place for regularly examining claims related to services with unpublished MUEs from providers that most often exceeded MUE limits.While CMS has several strategies to reduce improper payments, and it reviews aberrant billing patterns at a provider level, that is, across all services billed by the provider, officials told us that they have no plans to review services specifically related to MUEs. Similarly, contractors told us that they do not examine claims specifically related to MUEs, although they do review claims to detect other aberrant billing patterns and identify emerging new vulnerabilities. For example, one contractor told us it evaluates weekly billing reports to examine whether its medical review strategies are appropriate and focused on problem areas. It also reviews data from multiple other sources including reports from the Office of the Inspector General and those we have issued, and findings from the RAs. However, the contractor’s reviews are conducted at a provider level, that is, across all services billed by the provider but not specifically for services with unpublished MUE limits. As a result, providers may be unlikely to have their billing reviewed more closely if they frequently bill above unpublished MUE limits, but do not have other aberrant billing patterns. We provided a list of 10 providers with payments of at least $3,000 that exceeded the unpublished MUE limits in each contractor’s jurisdiction to the contractors we interviewed to determine if they were scrutinizing these providers’ billing patterns. One contractor told us that it was reviewing claims submitted by 1 of the 10 providers that was included on the list we had forwarded to them. The contractor had received a potential fraud referral on this provider, although not specifically related to billings for services with unpublished MUEs. However, the remaining contractors were not reviewing any of the providers we identified. We found that a small number of providers accounted for a large share of payments for services that exceeded the unpublished MUE limits. For example, 419 providers received at least $5,000 for services that exceeded the unpublished MUEs in 2011. Of these, the 100 providers with the highest payments that exceeded the MUE limits accounted for nearly 44 percent of total excess payments, although they accounted for only about 1 percent of total payments for all services with unpublished MUEs. In addition, the provider with the highest payments that exceeded the unpublished MUE limits alone accounted for about 4 percent of these payments, although this provider accounted for less than 0.1 percent of total payments for all services with unpublished MUEs. Certain provider types were more likely to have payments that exceeded the MUE limits. About 26 percent of the top 100 providers exceeding unpublished MUE limits included clinical laboratories and DME providers. Researchers have noted that there is potential for fraud and abuse with some laboratory services that can be self-referred, such as certain pathology tests. For example, a pathologist examining a surgical pathology specimen may self-refer by ordering and performing additional tests on the pathology specimen without seeking the consent of the original ordering physician. Some contractors we interviewed told us that certain DME items, such as diabetic testing supplies, are prone to potentially fraudulent billing. CMS has also estimated improper DME billing of 66 percent in fiscal year 2012—higher than for any other service measured. Developing more cost-effective strategies for ensuring the appropriateness of Medicare payments could help ensure the long-term sustainability of the program. Although almost all payments for services with unpublished MUEs were made for services at or below the MUE limits, we found that there are still opportunities to realize savings. When analyzed on a per-day basis, payments that potentially should not have been made for services that exceeded the unpublished MUE limits totaled approximately $14 million. In November 2012, we recommended that CMS implement MUEs that assess all quantities of services provided to the same beneficiary by the same provider on the same day—in other words, as per-day limits—but allow the limits to be exceeded if the provider included modifiers to explain the medical necessity of exceeding the limits. The MUE contractor recently announced that CMS began implementing our recommendation for certain services as of April 1, 2013. However, CMS officials told us these are unlikely to be applied to some of the services with unpublished MUEs, such as Part B Drugs and DME services. We continue to believe that our recommendation should be implemented for all MUEs to help strengthen the financial health of the program. Continuously seeking new methods for improving oversight of provider payments is another important way to strengthen program integrity. Contractors’ local edits could serve as a resource for CMS to use in developing or revising MUEs and in reducing payments for services that are potentially improperly billed. Unpublished MUEs were developed for services and items that have been fraudulently or abusively billed in the past. Therefore, systematically examining billing information and claims from providers that exceed these limits and do not use modifiers to indicate the excess units are medically appropriate, could help identify improper payments and could inform CMS’s program integrity efforts. To improve the effectiveness of the unpublished MUEs and better ensure Medicare program integrity, we recommend that the CMS Administrator take the following two actions: examine contractor local edits related to unpublished MUEs to determine whether any of the national unpublished MUE limits should be revised; and consider periodically reviewing claims to identify the providers exceeding the unpublished MUE limits and determine whether their billing was proper. We provided a draft of this report to HHS for comment and received written comments, which are reprinted in appendix I. In its written comments, HHS concurred with both our recommendations. For the recommendation to examine contractor local edits related to unpublished MUEs, HHS concurred and indicated that CMS would review making revisions to the MUEs in order to ensure that the edit levels are appropriate on the basis of input from national health care organizations, providers, Medicare Administrative Contractors, and CMS personnel, as well as data analysis. For the second recommendation, HHS concurred and indicated that CMS would conduct further analysis to determine the appropriate actions, if necessary. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions regarding this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix II. In addition to the contact named above, Sheila K. Avruch, Assistant Director; Iola D’Souza; Eagan Kemp; Richard Lipinski; and Laurie Pachter made key contributions to this report.

Summary: CMS has estimated improper Medicare fee-for-service payments of $29.6 billion in fiscal year 2012. To help prevent improper payments, CMS has implemented national MUEs, which limit the amount of a service that is paid when billed by a provider for a beneficiary on the same day. The limits for certain services that have been fraudulently or abusively billed are unpublished to deter providers from billing up to the maximum allowable limit. GAO was asked to review issues related to MUEs. This report examines the extent to which CMS has (1) paid for services that exceeded the unpublished MUE limits and (2) examined billing from providers that exceeded unpublished MUE limits. GAO analyzed Medicare claims related to these limits in 2011, and interviewed CMS officials and selected contractors in states with high improper payments. Less than 0.1 percent of payments Medicare made in 2011 were for amounts of services that exceeded certain unpublished limits for excess billing and where the claims did not include information from the providers to indicate why the additional services were medically necessary. These limits are set by the Centers for Medicare & Medicaid Services (CMS)--an agency within the Department of Health and Human Services (HHS)--as a means to avoid potentially improper payments. To implement these limits, CMS established automated controls in its payment systems called Medically Unlikely Edits (MUE). These MUEs compare the number of certain services billed against limits for the amount of services likely to be provided under normal medical practice to a beneficiary by the same provider on the same day--for example, no more than one of the same operation on each eye. GAO analysis of 2011 claims data found approximately $14 million out of a total of $23.9 billion in Medicare payments for services that exceeded unpublished MUE limits and where the claims did not include information from the providers to indicate why the additional services were medically necessary. As GAO has previously reported, claims could exceed the limits because the MUEs are not set up as per-day limits that assess all services billed by a provider for a single beneficiary on the same day. CMS plans to begin implementing MUEs for some services as per-day limits for services where it would be impossible to exceed the limits for anatomical or other reasons. Medicare contractors that pay claims may develop local edits, which can set more restrictive limits for some services than the national unpublished MUE limits. GAO's analysis of claims data applying a few of these more restrictive local limits showed that by applying them instead of the relevant national MUE limits, CMS could have lowered payments by an additional $7.8 million. However, CMS is not evaluating these local edits to determine if these lower limits might be more appropriate. To the extent that these and other local edits are not evaluated more systematically, CMS may be missing an opportunity to achieve savings by revising some national MUEs to correspond with more restrictive local limits. CMS and its contractors did not have a system in place for examining claims to determine the extent to which providers may be exceeding unpublished MUE limits and whether payments for such services were proper. CMS officials and contractors told us that they examine aberrant billing patterns at a provider level, that is, across all services billed by the provider, but not specifically for services with unpublished MUE limits. GAO found that payments that exceeded MUE limits were concentrated among certain providers and types of specialties, in certain states, and for certain services. For example, the top 100 providers with payments that exceeded the MUE limits accounted for nearly 44 percent of total payments that exceeded the MUE limits, although they accounted for only about 1 percent of total payments for all services with unpublished MUEs. Moreover, about 26 percent of the top 100 providers included clinical laboratories and durable medical equipment providers, both of which have been identified in the past as having high potential for fraudulent billings. Because unpublished MUEs were developed for services and items that have been fraudulently or abusively billed in the past, without systematically examining billing information and claims from the top providers exceeding those limits CMS may be missing another opportunity to improve its program integrity efforts. GAO recommends that CMS examine contractor edits to determine if any national unpublished MUE limits should be revised; and consider reviewing claims to identify providers that exceed the unpublished MUE limits, and determine whether their billing was proper. In its written comments, HHS concurred with both our recommendations.