Approximately 65,000 Medicaid beneficiaries in the five states investigated visited six or more doctors to acquire prescriptions for the same type of controlled substances in the selected states during fiscal years 2006 and 2007. These individuals incurred approximately $63 million in Medicaid costs for these drugs, which act as painkillers, sedatives, and stimulants. In some cases, beneficiaries may have a justifiable reason for receiving prescriptions from multiple medical practitioners, such as visiting specialists or several doctors in the same medical group. However, our analysis of Medicaid claims found at least 400 of them visited 21 to 112 medical practitioners and up to 46 different pharmacies for the same controlled substance. In these situations, Medicaid beneficiaries were likely seeing several medical practitioners to support and disguise their addiction or fraudulently selling their drugs. Our analysis understates the number of instances and dollar amounts involved in the potential abuse related to multiple medical practitioners. First, the total we found does not include related costs associated with obtaining prescriptions, such as visits to the doctor’s office and emergency room. Second, the selected states did not identify the prescriber for many Medicaid claims submitted to CMS. Without such identification, we could not always identify and thus include the number of unique doctors for each beneficiary that received a prescription. Third, our analysis did not focus on all controlled substances, but instead targeted 10 types of the most frequently abused controlled substances. Table 1 shows how many beneficiaries received controlled substances and the number of medical practitioners that prescribed them the same type of drug. We found 65 medical practitioners and pharmacies in the selected states had been barred or excluded from federal health care programs, including Medicaid, when they wrote or filled Medicaid prescriptions for controlled substances during fiscal years 2006 and 2007. Nevertheless, Medicaid approved the claims at a cost of approximately $2.3 million. The offenses that led to their exclusion from federal health programs included Medicaid fraud and illegal diversion of controlled substances. Our analysis understates the total number of excluded providers because the selected states either did not identify the prescribing medical practitioner for many Medicaid claims (i.e., the field was blank) or did not provide the taxpayer identification number for the practitioner, which was necessary to determine if a provider was banned. Our analysis of matching Medicaid claims in the selected states with SSA’s DMF found that controlled substance prescription claims to over 1,800 beneficiaries were filled after they died. Even though the selected state programs stated that beneficiaries were promptly removed from Medicaid following their deaths based on either SSA DMF matches or third party information, these same state programs paid over $200,000 for controlled substances during fiscal years 2006 and 2007 for postdeath controlled substance prescription claims. In addition, our analysis also found that Medicaid paid about $500,000 in Medicaid claims based on controlled substance prescriptions “written” by over 1,200 doctors after they died. The extent to which these claims were paid due to fraud is not known. For example, in the course of our work, we found that certain nursing homes use long-term care pharmacies to fill prescriptions for drugs. One long- term care pharmacy dispensed controlled substances to over 50 beneficiaries after the date of their death because the nursing homes did not notify the pharmacy of their deaths prior to delivery of the drugs. The nursing homes that received the controlled substances, which included morphine, Demerol, and Fentanyl, were not allowed to return them because, according to DEA officials, the Controlled Substances Act of 1970 (CSA) does not permit the return of these drugs. Officials at two selected states said that unused controlled substances at nursing homes represent a waste of Medicaid funds and also pose risk of diversion by nursing home staff. In fact, officials from one state said that the certain nursing homes dispose of these controlled substances by flushing them “down the toilet,” which also poses environmental risks to our water supply. In addition to performing the aggregate-level analysis discussed above, we also performed in-depth investigations for 25 cases of fraudulent or abusive actions related to the prescribing and dispensing of controlled substances through the Medicaid program in the selected states. We have referred certain cases to DEA and the selected states for further investigation. The following provides illustrative detailed information on four cases we investigated: Case 1: The beneficiary used the identity of an individual who was killed in 1980 to receive Medicaid benefits. According to a state Medicaid official, he originally applied for Medicaid assistance in a California county in January 2004. During the application process, the man provided a Social Security card to a county official. When the county verified the Social Security Number (SSN) with SSA, SSA responded that the SSN was not valid. The county enrolled the beneficiary into Medicaid provisionally for 90 days under the condition that the beneficiary resolve the SSN discrepancy with SSA within that time frame. Although the beneficiary never resolved the issue, he remained in the Medicaid program until April 2007. Between 2004 and 2007, the Medicaid program paid over $200,000 in medical services for this beneficiary, including at least $2,870 for controlled substances that he received from the pharmacies. We attempted to locate the beneficiary but could not find him. Case 2: The physician prescribed controlled substances to the beneficiary after she died in February 2006. The physician stated that the beneficiary had been dying of a terminal disease and became unable to come into the office to be examined. The physician stated that in instances where a patient is compliant and needs pain medication, physicians will sometimes prescribe it without requiring an examination. A pharmacy eventually informed the physician that the patient had died and the patient’s spouse had continued to pick up her prescriptions for Methadone, Klonopin, and Xanax after her death. According to the pharmacy staff, the only reason they became aware of the situation was because an acquaintance of the spouse noticed him picking up prescriptions for a wife who had died months ago. The acquaintance informed the pharmacy staff of the situation. They subsequently contacted the prescribing physician. Since this incident, the pharmacy informed us that it has not filled another prescription for the deceased beneficiary. Case 3: A mother with a criminal history and Ritalin addiction used her child as a means to doctor shop for Ritalin and other similar controlled stimulants used to treat attention-deficit/hyperactivity disorder (ADHD). Although the child received overlapping prescriptions of methylphenidate and amphetamine medications during a 2-year period and was banned (along with his mother) from at least three medical practices, the Illinois Medicaid program never placed the beneficiary on a restricted recipient program. Such a move would have restricted the child to a single primary care physician or pharmacy, thus preventing him (and his mother) from doctor shopping. Over the course of 21 months, the Illinois Medicaid program paid for 83 prescriptions of ADHD controlled stimulants for the beneficiary, which totaled approximately 90,000 mg and cost $6,600. Case 4: Claims indicated that a deceased physician “wrote” controlled substance prescriptions for several patients in the Houston area. Upon further analysis, we discovered that the actual prescriptions were signed by a physician assistant who once worked under the supervision of the deceased physician. The pharmacy neglected to update its records and continued filling prescriptions under the name of the deceased prescriber. The physician assistant has never been a DEA registrant. The physician assistant told us that the supervising physicians always signed prescriptions for controlled substances. After informing her that we had copies of several Medicaid prescriptions that the physician assistant had signed for Vicodin and lorazepam, the physician assistant ended the interview. Although states are primarily responsible for the fight against Medicaid fraud and abuse, CMS is responsible for overseeing state fraud and abuse control activities. CMS has provided limited guidance to the states on how to improve the state’s control measures to prevent fraud and abuse of controlled substances in the Medicaid program. Thus, for the five state programs we reviewed, we found different levels of fraud prevention controls. For example, the Omnibus Budget Reconciliation Act (OBRA) of 1990 encourages states to establish a drug utilization review (DUR) program. The main emphasis of the program is to promote patient safety through an increased review and awareness of prescribed drugs. States receive increased federal funding if they design and install a point-of-sale electronic prescription claims management system to interact with their Medicaid Management Information Systems (MMIS), each state’s Medicaid computer system. Each state was given considerable flexibility on how to identify prescription problems, such as therapeutic duplication and overprescribing by providers, and how to use the MMIS system to prevent such problems. The level of screening, if any, states perform varies because CMS does not set minimum requirements for the types of reviews or edits that are to be conducted on controlled substances. Thus, one state required prior approval when ADHD treatments like Ritalin and Adderall are prescribed outside age limitations, while another state had no such controlled substance requirement at the time of our review. Under the Deficit Reduction Act (DRA) of 2005, CMS is required to initiate a Medicaid Integrity Program (MIP) to combat Medicaid fraud, waste, and abuse. DRA requires CMS to enter into contracts with Medicaid Integrity Contractors (MIC) to review provider actions, audit provider claims and identify overpayments, and conduct provider education. To date, CMS has awarded umbrella contracts to several contractors to perform the functions outlined above. According to CMS, these contractors cover 40 states, 5 territories, and the District of Columbia. CMS officials stated that CMS will award task orders to cover the rest of the country by the end of fiscal year 2009. CMS officials stated that MIC audits are currently under way in 19 states. CMS officials stated that most of the MIP reviews will focus on Medicaid providers and that the state Medicaid programs handle beneficiary fraud. Because the Medicaid program covers a full range of health care services and the prescription costs associated with controlled substances are relatively small, the extent to which MICs will focus on controlled substances is likely to be relatively minimal. The selected states did not have a comprehensive fraud prevention framework to prevent fraud and abuse of controlled substances paid for by Medicaid. The establishment of effective fraud prevention controls by the selected states is critical because the very nature of a beneficiary’s medical need—to quickly obtain controlled substances to alleviate pain or treat a serious medical condition—makes the Medicaid program vulnerable to those attempting to obtain money or drugs they are not entitled to receive. Instead of these drugs being used for legitimate purposes, these drugs may be used to support controlled substance addictions and sale of the drugs on the street. As shown in figure 1 below, a well-designed fraud prevention system (which can also be used to prevent waste and abuse) should consist of three crucial elements: (1) preventive controls, (2) detection and monitoring, and (3) investigations and prosecutions. In addition, as shown in figure 1, the organization should also use “lessons learned” from its detection and monitoring controls and investigations and prosecutions to design more effective preventive controls. Preventive Controls: Fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse. Thus, controls that prevent fraudulent health care providers and individuals from entering the Medicaid program or submitting claims are the most important element in an effective fraud prevention program. Effective fraud prevention controls require that where appropriate, organizations enter into data-sharing arrangements with organizations to perform validation. System edit checks (i.e., built-in electronic controls) are also crucial in identifying and rejecting fraudulent enrollment applications or claims before payments are disbursed. Some of the preventive controls and their limitations that we observed at the selected states include the following. Federal Debarment and Exclusion: Federal regulation requires states to ensure that no payments are made for any items or services furnished, ordered, or prescribed by an individual or entity that has been debarred from federal contracts or excluded from Medicare and Medicaid programs. Officials from all five selected states said that they do not screen prescribing providers or pharmacies against the federal debarment list, also known as the Excluded Parties List System (EPLS). Further, officials from four states said when a pharmacy claim is received, they do not check to see if the prescribing provider was excluded by HHS OIG from participating in the Medicaid program. Drug Utilization Review: As mentioned earlier, states perform drug utilization reviews (DUR) and other controls during the prescription claims process to promote patient safety, reduce costs, and prevent fraud and abuse. The drug utilization reviews include prospective screening and edits for potentially inappropriate drug therapies, such as over-utilization, drug-drug interaction, or therapeutic duplication. In addition, selected states also require health care providers to submit prior authorization forms for certain drug prescriptions because those medications have public health concerns or are considered high risk for fraud and abuse. Each state has developed its DUR differently and some of the differences that we saw from the selected states include the following. Officials from certain states stated that they use the prospective screening (e.g., over-utilization or overlapping controlled substance prescriptions) as an automatic denial of the prescription, while other states generally use the prospective screening as more of an advisory tool for pharmacies. The types of drugs that require prior authorization vary greatly between the selected states. In states where it is used, health care providers may be required to obtain prior authorization if a specific brand name is prescribed (e.g., OxyContin) or if a dosage exceeds a predetermined amount for a therapeutic class of controlled substances (e.g., hypnotics, narcotics). Detection and Monitoring: Even with effective preventive controls, there is risk that fraud and abuse will occur in Medicaid regarding controlled substances. States must continue their efforts to monitor the execution of the prescription program, including periodically matching their beneficiary files to third-party databases to determine continued eligibility, monitor controlled substance prescriptions to identify abuse, and make necessary corrective actions, including the following: Checking Death Files: After enrolling beneficiaries, Medicaid offices in the selected states generally did not periodically compare their information against death records. Increasing the Use of the Restricted Recipient Program: In the course of drug utilization reviews or audits, the State Medicaid offices may identify beneficiaries who have abused or defrauded the Medicaid prescription drug program and restrict them to one health care provider or one pharmacy to receive the prescriptions. This program only applies to those beneficiaries in a fee-for-service arrangement. Thus, a significant portion of the Medicaid recipients (those in managed care programs) for some of the selected states are not subject to this program. Fully Utilizing the Prescription Drug Monitoring Program: Beginning in fiscal year 2002, Congress appropriated funding to the U.S. Department of Justice to support Prescription Drug Monitoring Programs (PDMP). These programs help prevent and detect the diversion and abuse of pharmaceutical controlled substances, particularly at the retail level where no other automated information collection system exists. If used properly, PDMPs are an effective way to identify and prevent diversion of the drugs by health care providers, pharmacies, and patients. Some of the limitations of PDMPs at the selected states include the following: Officials from the five selected states said that physician participation in PDMP is not widespread and not required. In fact, one state did not have a Web-based PDMP; the health care provider has to put in a manual request to the agency to have a controlled substance report generated. No nationwide PDMP exists, and only 33 states had operational prescription drug monitoring programs as of June 2009. According to a selected state official, people would sometimes cross state borders to obtain prescription drugs in a state without a program. Investigations and prosecutions: Another element of a fraud prevention program is the aggressive investigation and prosecution of individuals who defraud the federal government. Prosecuting perpetrators sends the message that the government will not tolerate individuals stealing money and serves as a preventive measure. Schemes identified through investigations and prosecution also can be used to improve the fraud prevention program. The Medicaid Fraud Control Unit (MFCU) serves as the single identifiable entity within state government that investigates and prosecutes health care providers that defraud the Medicaid program. In the course of our investigation however, we found several factors that may limit its effectiveness. Federal regulations generally limit MFCUs from pursuing beneficiary fraud. According to MFCU officials at one selected state, this limitation impedes investigations because agents cannot use the threat of prosecution as leverage to persuade beneficiaries to cooperate in criminal probes of Medicaid providers. In addition, the MFCU officials at this selected state said that this limitation restricts the agency’s ability to investigate organized crime related to controlled substances when the fraud is perpetrated by the beneficiaries. Federal regulations do not permit federal funding for MFCUs to engage in routine computer screening activities that are the usual monitoring function of the Medicaid agency. According to MFCU officials at one selected state, this issue has caused a strained working relationship with the state’s Medicaid OIG, on whom they rely to get claims information. The MFCU official stated that on the basis of fraud trends in other states, they wanted the Medicaid OIG to provide claims information on providers that had similar trends in their state. The Medicaid OIG cited this prohibition on routine computer screening activities when refusing to provide these data. In addition, this MFCU official also stated that its state Medicaid office and its OIG did not promptly incorporate improvements that it suggested pertaining to the abuse of controlled substances. DEA officials stated that although purchases of certain schedules II and III controlled substances by pharmacies are reported to and monitored by DEA, they do not routinely receive information on written or dispensed controlled substance prescriptions. In states with a PDMP, data on dispensed controlled substance prescriptions are collected and maintained by a state agency. In the course of an investigation on the diversion or abuse of controlled substances, information may be requested by DEA from a PDMP. In those states without a PDMP, DEA may obtain controlled substance prescription information during the course of an inspection or investigation from an individual pharmacy’s records. To address the concerns that I have just summarized, we made four recommendations to the Administrator of CMS in establishing an effective fraud prevention system for the Medicaid program. Specifically, we recommended that the Administrator evaluate our findings and consider issuing guidance to the state programs to provide assurance on the following: (1) effective claims processing systems prevent the processing of claims of all prescribing providers and dispensing pharmacies debarred from federal contracts (i.e., EPLS) or excluded from the Medicare and Medicaid programs (LEIE); (2) DUR and restricted recipient program requirements adequately identify and prevent doctor shopping and other abuses of controlled substances; (3) effective claims processing system are in place to periodically identify both duplicate enrollments and deaths of Medicaid beneficiaries and prevent the approval of claims when appropriate; and (4) effective claims processing systems are in place to periodically identify deaths of Medicaid providers and prevent the approval of claims when appropriate. CMS stated that they generally agree with the four recommendations and that it will continue to evaluate its programs and will work to develop methods to address the identified issues found in the accompanying report. Mr. Chairman, this concludes my prepared statement. Thank you for the opportunity to testify before the Subcommittee on some of the issues addressed in our report on continuing indications of fraud and abuse related to controlled substances paid for by Medicaid. I would be happy to answer any questions from you or other members of the Subcommittee. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: This testimony discusses (1) continuing indications of fraud and abuse related to controlled substances paid for by Medicaid; (2) specific case study examples of fraudulent, improper, or abusive controlled substance activity; and (3) the effectiveness of internal controls that the federal government and selected states have in place to prevent and detect fraud and abuse related to controlled substances. To identify whether there are continuing indications of fraud and abuse related to controlled substances paid for by Medicaid, we obtained and analyzed Medicaid claims paid in fiscal years 2006 and 2007 from five states: California, Illinois, New York, North Carolina, and Texas. To identify indications of fraud and abuse related to controlled substances paid for by Medicaid, we obtained and analyzed Medicaid prescription claims data for these five states from the Centers for Medicare & Medicaid Services (CMS). To identify other potential fraud and improper payments, we compared the beneficiary and prescriber shown on the Medicaid claims to the Death Master Files (DMF) from the Social Security Administration (SSA) to identify deceased beneficiaries and prescribers. To identify claims that were improperly processed and paid by the Medicaid program because the federal government banned these prescribers and pharmacies from prescribing or dispensing to Medicaid beneficiaries, we compared the Medicaid prescription claims to the exclusion and debarment files from the Department of Health and Human Services Office of Inspector General (HHS OIG) and the General Services Administration (GSA). To develop specific case study examples in selected states, we identified 25 cases that illustrate the types of fraudulent, improper, or abusive controlled substance activity we found in the Medicaid program. To develop these cases, we interviewed pharmacies, prescribers, law enforcement officials, and beneficiaries, as appropriate, and also obtained and reviewed registration and enforcement action reports from the Drug Enforcement Administration (DEA) and HHS. To identify the effectiveness of internal controls that the federal government and selected states have in place to prevent and detect fraud and abuse related to controlled substances, we interviewed Medicaid officials from the selected state offices and CMS. More details on our scope and methodology can be found in our report that we issued today. We conducted this forensic audit from July 2008 to September 2009, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We conducted our related investigative work in accordance with standards prescribed by the Council of the Inspectors General on Integrity and Efficiency (CIGIE). We found 65 medical practitioners and pharmacies in the selected states had been barred or excluded from federal health care programs, including Medicaid, when they wrote or filled Medicaid prescriptions for controlled substances during fiscal years 2006 and 2007. Nevertheless, Medicaid approved the claims at a cost of approximately $2.3 million. The offenses that led to their exclusion from federal health programs included Medicaid fraud and illegal diversion of controlled substances. Our analysis of matching Medicaid claims in the selected states with SSA's DMF found that controlled substance prescription claims to over 1,800 beneficiaries were filled after they died. Even though the selected state programs stated that beneficiaries were promptly removed from Medicaid following their deaths based on either SSA DMF matches or third party information, these same state programs paid over $200,000 for controlled substances during fiscal years 2006 and 2007 for postdeath controlled substance prescription claims. In addition, our analysis also found that Medicaid paid about $500,000 in Medicaid claims based on controlled substance prescriptions "written" by over 1,200 doctors after they died. In addition to performing the aggregate-level analysis discussed above, we also performed in-depth investigations for 25 cases of fraudulent or abusive actions related to the prescribing and dispensing of controlled substances through the Medicaid program in the selected states. We have referred certain cases to DEA and the selected states for further investigation. The selected states did not have a comprehensive fraud prevention framework to prevent fraud and abuse of controlled substances paid for by Medicaid. The establishment of effective fraud prevention controls by the selected states is critical because the very nature of a beneficiary's medical need--to quickly obtain controlled substances to alleviate pain or treat a serious medical condition--makes the Medicaid program vulnerable to those attempting to obtain money or drugs they are not entitled to receive. Fraud prevention is the most efficient and effective means to minimize fraud, waste, and abuse. Thus, controls that prevent fraudulent health care providers and individuals from entering the Medicaid program or submitting claims are the most important element in an effective fraud prevention program. Effective fraud prevention controls require that where appropriate, organizations enter into data-sharing arrangements with organizations to perform validation. System edit checks (i.e., built-in electronic controls) are also crucial in identifying and rejecting fraudulent enrollment applications or claims before payments are disbursed.