Since 1996, Congress has taken important steps to increase program integrity funding and oversight, including the establishment of both the Medicaid and Medicare Integrity Programs. Table 1 summarizes several key congressional actions. CMS and the states are continuing to strengthen provider enrollment standards and procedures, as well as developing adequate controls to detect improper claims before they are paid. While CMS has made progress in collaborating more closely with states on federal postpayment claims reviews by shifting the focus to state-identified targets, it is too early to assess the potential for Medicaid recovery audit contractors (RAC) to avoid duplicating efforts of ongoing state and federal provider audits. Finally, the agency has not established a robust process for incorporating RAC-identified vulnerabilities in state corrective action plans. CMS and the states continue efforts to strengthen the standards and procedures for enrolling Medicaid providers, which could help reduce the risk of enrolling providers intent on defrauding or abusing the program. Since 2007, CMS has monitored states’ Medicaid provider enrollment standards and procedures—as well as other aspects of their programs— through comprehensive state program integrity reviews. The Patient Protection and Affordable Care Act (PPACA) also included several provisions aimed at strengthening Medicaid provider enrollment standards and procedures.conduct certain provider screening procedures, such as verifying provider For example, PPACA required states to licenses and terminating individuals or entities from Medicaid participation under certain circumstances. Our analysis of final reports from CMS’s most recent comprehensive reviews for all 51 states found 230 instances of non-compliance with federal laws or federal regulatory requirements related to states’ provider enrollment standards and procedures. Most of the reviews we analyzed were conducted prior to CMS’s final rule implementing PPACA provider enrollment provisions. CMS cited at least 1 instance and as many as 8 instances of non-compliance for each state reviewed, with 31 states receiving 4 or 5 citations. About half of the citations were generally due to states’ failures to verify provider licenses, or collect or disclose required ownership and related information.2011 comprehensive reviews, CMS noted that provider enrollment has been the most frequently cited area of non-compliance since it began these reviews in 2007. While these problems were identified in nearly every state, CMS also reported that it had noticed a positive trend in states’ awareness of regulatory requirements and knowledge of how to implement the requirements. In the introduction to its summary of In addition to identifying areas in which states needed to improve their provider enrollment standards and procedures, CMS’s most recent comprehensive reviews of all 51 states identified a total of 53 instances CMS credited of effective or noteworthy provider enrollment practices.29 states with having at least one effective or noteworthy practice, and deemed 1 state to have five. For example, CMS found that this state had an innovative software package that automated the verification of licenses of potential Medicaid providers, which ensures that Medicaid does not allow payments to nonqualified health care providers; a team dedicated to conducting criminal background checks prior to approving a provider application; and a requirement that managed care providers be enrolled in Medicaid before they are eligible to become a member of a participating managed care plan’s provider network, which ensures that such providers will have had a criminal background check conducted by the state. In addition to the comprehensive reviews, CMS provided guidance periodically to states. In August 2010, CMS issued guidance to states on best practices related to provider enrollment. Among other things, this guidance recommended that states meet regularly and coordinate enrollment policy with provider enrollment personnel, ensure that provider enrollment forms request all required disclosures, and report to the HHS Office of Inspector General (OIG) any adverse actions taken on providers’ Medicaid participation and providers’ criminal convictions. In July 2011, the Medicaid Integrity Institute—CMS’s national Medicaid training program for state program integrity officials—sponsored a symposium on PPACA’s program integrity enhancements—including the provider enrollment provisions—and discussed strategies to achieve their timely implementation. While states are responsible for paying claims and conducting prepayment reviews of claims, CMS is responsible for ensuring that states have adequate controls to detect improper claims before they are paid. Two ways CMS provides this oversight are through (1) an examination of states’ prepayment review processes, which occurs during CMS’s comprehensive state program integrity reviews, and (2) the provision of guidance to states on their use of predictive analytics, which use algorithms and models to simultaneously analyze large numbers of claims from multiple data sources before payment is made in order to identify unusual or suspicious patterns or abnormalities in provider networks, claims billing patterns, and beneficiary utilization. Although not all of CMS’s comprehensive reviews included information on states’ prepayment review processes, our analysis of the most recent comprehensive reviews for all 51 states noted vulnerabilities in the processes of 5 states and regulatory compliance issues in 1 state. For example, CMS found that 1 state did not conduct prepayment reviews or suspend or withhold payments to providers suspected of fraud and abuse. Rather, the state only withheld provider payments after determining that it had overpaid a provider. For another state, a very limited prepayment review process was seen as one of many issues contributing to what CMS characterized as the state’s ineffective program integrity oversight and operations. These comprehensive reviews also noted effective and noteworthy prepayment review processes in 7 states. For example, CMS highlighted one state’s prepayment edit process that included an automated edit system to deny claims that failed to meet certain standards. For another state, CMS recognized the state’s efforts to effectively communicate program integrity concerns throughout its Medicaid agency; these communications included the establishment of an agencywide committee—with representation from the program integrity division—that regularly discussed current and proposed edits for inclusion in prepayment reviews. According to CMS officials, they have had discussions with and provided guidance and technical assistance to states regarding the use of predictive analytics to identify and prevent improper payments both informally and during three recent Medicaid Integrity Institute symposiums. CMS officials also told us that states are in varying stages of implementing predictive analytics; based on Medicare’s experience, the Small Business Jobs Act of 2010 requires the use of predictive analytics in Medicaid beginning in 2015. Our prior work found that postpayment reviews are critical to identifying and recouping overpayments, but the importance of collaboration and coordination to avoid duplication has grown because of the increase in the number of entities other than states now conducting such reviews. In 2011, we reported that collaborative audits were a promising approach to avoiding duplication of federal and state audit efforts. As directed by the Deficit Reduction Act of 2005, CMS established a federal program to audit state Medicaid claims. Since implementing federal audits in 2008, CMS’s contractors have conducted a total of 1,662 postpayment audits, 1,550 of which were federal audits where CMS identified the audit targets and 112 of which were collaborative audits where CMS relied on state Medicaid integrity programs to identify audit Our analysis shows that since shifting to a more collaborative targets. approach in 2010, the focus of audits has changed from an emphasis on hospitals to an emphasis on long-term care and pharmacy (see table 2). We are currently examining the effectiveness of CMS’s audits of Medicaid claims—both the federal audits and CMS’s redesign of those audits, which CMS refers to as collaborative audits. Specifically, we are examining (1) the effectiveness of CMS’s implementation of the national federal audit program, under which it conducted federal audits and (2) its efforts to redesign the national federal audit program, primarily through implementation of collaborative audits. We plan to issue this report in June 2012. Column does not add up to 100 due to rounding. PPACA requires state Medicaid programs to establish contracts with RACs, consistent with state law and similar to the contracts established for the Medicare program, subject to exceptions or requirements provided by CMS. One or more of these RACs are to identify and recoup overpayments and identify underpayments made for services provided by state Medicaid programs. The National Association of Medicaid Directors (NAMD) in March 2012 noted concern about the potential for overlap between federal and state program integrity activities, particularly with respect to provider audits, and observed that the deployment of Medicaid RACs increased the potential for duplication.collaborative federal audits should help resolve the potential for duplication of state audit efforts because states identify the collaborative audit targets. However, a few states that we discussed the Medicaid RAC program with voiced concerns about the potential for duplication with their own audits. In its September 2011 final rule implementing the Medicaid RAC program, CMS disagreed with similar public comments that the CMS’s shift to Medicaid RAC program would duplicate efforts of the federal national audit program because federal audit targets are vetted with states. In this final rule, CMS acknowledged the potential for the duplication of efforts among different auditing entities and required states to coordinate their RAC efforts with other auditing entities. According to CMS, RACs are an efficient way to identify payment errors, while federal audits may be more effective in identifying or preventing fraudulent practices. CMS defined implementation of state RAC programs to mean that states must have a signed contract in place with their selected contractors by January 1, 2012. According to agency officials, 32 states had signed contracts with RAC vendors as of May 31, 2012, but few states’ Medicaid RAC programs were operational. In addition, officials told us that 17 states had requested exceptions due to implementation delays. The few states with operational RAC programs had not yet reported on whether RACs had increased state collections of improper payments. As a result, it is too early to assess the initial results and the potential for duplication, including the steps CMS and the states will take to avoid duplication. Our prior work has demonstrated that CMS had not developed a robust process to specifically address identified vulnerabilities that lead to improper payments in Medicaid. Previously we reported that CMS, in its proposed rule for the Medicaid RAC program, did not include steps for states to collect information on RAC-identified vulnerabilities and to develop a corrective action plan to address them.Medicaid agencies to have a corrective action process as part of their activities to reduce their Medicaid error rates. Information from the Medicaid RAC program could be incorporated into these processes. In response to a comment on the proposed rule noting this weakness, CMS acknowledged the importance of having RAC-identified vulnerabilities incorporated in state program integrity activities, observing, “if Medicaid CMS requires state RACs identify program vulnerabilities as a result of their findings, we encourage RACs to share this information with States so that they can implement corrective action, such as pre-payment edits or other similar system fixes.” However, CMS did not incorporate a process for states to evaluate and address RAC-identified vulnerabilities into its final rule. CMS has made progress strengthening several of the strategies to better ensure the integrity of the Medicare program, such as implementing changes to provider enrollment. However, CMS has not completed other actions that could be helpful in addressing improper payments and reducing fraud, waste and abuse in the Medicare program, including implementation of some relevant PPACA provisions and some of our prior recommendations. To address past weaknesses that allowed entities intent on committing fraud from enrolling in Medicare, PPACA authorized CMS to implement several actions to strengthen provider enrollment, some of which have been completed. Specifically, CMS has added screenings of categories of provider enrollment applications by risk level and new national enrollment screening and site visit contractors. Screening Provider Enrollment Applications by Risk Level: CMS and the HHS-OIG issued a final rule with comment period in February 2011 to implement many of the new screening procedures required by PPACA.CMS designated three levels of risk—high, moderate, and limited—with different screening procedures for categories of Medicare providers at each level. Providers in the high-risk level are subject to the most rigorous screening. Based in part on our work and that of the HHS-OIG, CMS designated newly enrolling home health agencies and durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers as high risk and designated other providers at lower levels. Providers at all risk levels are screened to verify that they meet specific requirements established by Medicare, such as having current licenses or accreditation and valid Social Security numbers. High- and moderate-risk providers are additionally subject to unannounced site visits. Further, depending on the risks presented, PPACA authorizes CMS to require fingerprint-based criminal history checks, and the posting of surety bonds for certain providers. CMS indicated in the discussion of the final rule that the agency will continue to review the criteria for its screening levels on an ongoing basis and would publish changes if the agency decided to update the assignment of screening levels for categories of Medicare providers. Doing so could become important because the Department of Justice (DOJ) and HHS reported multiple convictions or other legal actions against types of providers not currently at the high-risk level, including medical clinics and physical therapy practices. CMS’s implementation of accreditation for DMEPOS suppliers, and of a competitive bidding program, including in areas thought to have high fraud rates, may be helping to reduce risk of DMEPOS fraud.vigilance on DMEPOS suppliers is warranted, other types of providers may become more problematic in the future. We are currently examining the types of providers involved in fraud cases investigated by the HHS- OIG and DOJ, which may help illuminate risk to the Medicare program from different types of providers. As a result, while continued New National Enrollment Screening and Site Visit Contractors: CMS contracted with two new types of entities at the end of 2011 to assume centralized responsibility for two functions that had been the responsibility of multiple contractors. One of the new contractors will be conducting automated screening to check that providers and suppliers have valid licensure, accreditation, a valid National Provider Identifier (NPI), and no presence on the HHS-OIG list of providers and suppliers excluded from participating in federal health care programs. The second contractor has begun conducting site visits of providers to determine if sites are legitimate and the providers meet certain Medicare standards.officials told us that the agency expects that these new contractors will provide more efficiency and consistency in their reviews. However, our prior work found that CMS had not implemented other enrollment screening actions authorized by PPACA. These actions could help further reduce the enrollment of providers and suppliers intent on defrauding the Medicare program. They include issuing a rule to implement surety bonds for providers, completing contract awards to begin fingerprint-based criminal background checks, issuing a rule on provider and supplier disclosure requirements, and establishing the core elements for provider and supplier compliance programs. Surety Bond: PPACA authorizes CMS to require a surety bond for certain types of at-risk providers. Surety bonds may serve as a source for recoupment of erroneous payments. CMS has not developed a proposed rule to require surety bonds as conditions of enrollment to implement this requirement. Extending the use of surety bonds to these new entities would augment a previous statutory requirement for DMEPOS suppliers to post a surety bond at the time of enrollment. While CMS had required surety bonds from DMEPOS suppliers since 2009, CMS did not issue instructions for recovering overpayments through surety bonds, until January 2012, to take effect in February 2012. As of May 2012, CMS had not collected any funds from surety bond companies. Fingerprint-based Criminal Background Checks: CMS officials told us that they are working with the Federal Bureau of Investigation to arrange a contract that will enable the agency to access information to help conduct fingerprint-based criminal background checks of high-risk providers and suppliers, which is a tool authorized by PPACA. The agency expects to have the necessary contract in place by early 2013. Providers and Suppliers Disclosure: CMS had not completed development of regulations for increased disclosures of prior actions taken against providers and suppliers enrolling or revalidating enrollment in Medicare, such as whether the provider or supplier has been subject to a payment suspension from a federal health care program.officials indicated that developing the additional disclosure requirements was complicated by provider and supplier concerns about what types of information will be collected, what CMS will do with it, and how the privacy and security of this information will be maintained. Agency Compliance Program: CMS had not established the core elements of compliance programs for providers and suppliers, as required by PPACA. Agency officials indicated that they had sought public comments on the core elements, which they were considering, and were also studying criteria found in HHS-OIG model plans for possible inclusion. Increased efforts to review claims on a prepayment basis can better prevent payments that should not be made. As claims go through Medicare’s electronic claims payment systems, they are subjected to prepayment edits, most of which are fully automated; if a claim does not meet the criteria of the edit, it is automatically denied. Other prepayment edits are manual; they flag a claim for individual review by trained staff who determine if it should be paid. Due to the volume of claims, CMS has reported that less than 1 percent of Medicare claims are subject to manual medical record review by trained personnel. Having effective prepayment edits that deny claims for ineligible providers and suppliers depends on having timely and accurate information about them, such as whether the providers are currently enrolled and have the appropriate license or accreditation to provide specific services. We have previously identified flaws in the timeliness and accuracy of data in the Provider Enrollment Chain and Ownership System (PECOS)—the database that maintains Medicare provider and supplier enrollment information, which may result in CMS making improper payments to ineligible providers and suppliers.frequency with which CMS’s contractors update enrollment information and the timeliness and accuracy of information obtained from outside These weaknesses are related to the entities, such as state licensing boards, the HHS-OIG, and the Social Security Administration’s Death Master File, which contains information on deceased individuals that can be used to identify deceased providers in order to deactivate their NPI. CMS has indicated that its new national screening contractor should improve the timeliness and accuracy of the provider and supplier information in PECOS by centralizing the process, increasing automation of the process, checking databases more frequently, and incorporating new sources of data, such as financial, business, tax, and geospatial data. We are planning to review the accuracy of PECOS information. Having effective edits to implement coverage and payment policies before payment is made can also prevent improper payments. The Medicare program has defined categories of items and services eligible for coverage and excludes from coverage items or services that are determined not to be “reasonable and necessary for the diagnosis and treatment of an illness or injury or to improve functioning of a malformed body part.” how items and services will be covered by Medicare, as well as coding and billing requirements for payment, which can be implemented in the payment systems through edits. Our prior work found certain gaps in Medicare’s prepayment edits based on coverage and payment policies and made recommendations for improvement, which have not all been implemented. For example, CMS has not developed edits to identify abnormally rapid increases in billing by DMEPOS suppliers, which is associated with fraudulent billing.implementation of edits on coverage and payment policies. 42 U.S.C. § 1395y(a)(1)(A). Jobs Act of 2010. According to CMS, FPS may enhance CMS’s ability to identify potential fraud because it simultaneously analyzes large numbers of claims from multiple data sources nationwide before payment is made, thus allowing CMS to examine billing patterns across geographic regions for those that may indicate fraud. The results of FPS could lead to the initiation of payment suspensions, implementation of automatic claim denials, and identification of additional prepayment edits, investigations, or the revocation of Medicare billing privileges. CMS began using FPS to screen all FFS claims nationwide prior to payment as of June 30, 2011. Because FPS is relatively new, and we have not completed our work, it is too soon to determine whether FPS will improve CMS’s ability to address fraud. Adding new RACs into the Medicare program may help in identifying under or overpayments, and in recouping overpayments. Prior to PPACA, CMS began a national RAC program in March 2009 for FFS Medicare.recouped due to these contractors’ efforts from October 2009 through March 2012. As of May 2012, CMS reported that $1.86 billion was PPACA required the expansion of Medicare RACs to Parts C and D. CMS has implemented a RAC for Part D, but not for Part C. The agency awarded a Part D RAC task orderperiod that began in January 2011, and 4 option years. The Part D RAC is modeled after the Medicare FFS RACs and conducts postpayment review of Part D claims for prescription drugs based on specific criteria determined by CMS. CMS has approved the Part D RAC to conduct postpayment review of claims to identify several issues leading to improper payments, such as payments to excluded providers and duplicate payments. To ensure that the Part D RAC is making correct determinations of any improper payments, CMS has included a validation contractor to review Part D RAC determinations. CMS officials stated that the Part D RAC has started its review of 2007 claims data for prescription drug events and has identified potential overpayments to recoup. CMS has not yet awarded a Part C RAC task order or contract. Agency officials indicated that they are still considering different options for implementing a Part C RAC program to address improper Medicare Advantage plan payments. Plans are paid a monthly capitated per-person payment for enrolled beneficiaries, based on an approved bid amount and risk adjusted based on individual beneficiaries’ health status. Most of the Part C payment errors are driven by errors in the risk adjustment data (clinical diagnosis data) submitted by the plans, due to diagnoses not supported by the medical records. CMS is currently auditing Part C plans’ reporting of risk adjustment data. CMS officials indicated concern that adding additional contractors to identify Medicare Advantage plan payment errors would duplicate current efforts. Further actions are also needed to improve use of two CMS information technology systems that could help analysts identify fraud after claims have been paid. The Integrated Data Repository (IDR) became operational in September 2006 as a central data store of Medicare and other data needed to help CMS program integrity staff and contractors detect improper payments of claims. However, we found IDR did not include all the data that were planned to be incorporated by fiscal year 2010, because of technical obstacles and delays in funding. Further, as of December 2011, the agency had not finalized plans or developed reliable schedules for efforts to incorporate these data, which could lead to additional delays. One Program Integrity (One PI) is a web-based portal intended to provide CMS staff and contractors with a single source of access to data contained in IDR, as well as tools for analyzing those data. Although One PI is operational, as of May 2011, CMS had trained few program integrity analysts and the system was not being widely used. GAO recommended that CMS take steps to finalize plans and reliable schedules for fully implementing and expanding the use of both IDR and One PI and to define measurable benefits. The agency has initiated activities to incorporate additional data into IDR and expand the use of One PI through additional user training. For example, CMS officials indicated that they began incorporating additional Medicare claims data into IDR in September 2011 and as of November 2011, had trained over 200 analysts who were using One PI. CMS officials reported having provided additional training in 2012. However, as of April 2012, CMS had not fully addressed our recommendations—for example, the agency had not finalized plans for adding Medicaid data into IDR. Having mechanisms in place to resolve vulnerabilities that lead to improper payments is critical to effective program management, but our work has shown weaknesses in CMS’s processes to address such Our March 2010 report on the RAC demonstration vulnerabilities.program found that CMS had not established an adequate process during the demonstration or in planning for the national program to ensure prompt resolution of identified vulnerabilities in Medicare. Further, most vulnerabilities identified during the demonstration were not addressed. We therefore recommended that CMS develop and implement a corrective action process that includes policies and procedures to ensure the agency promptly (1) evaluates findings of RAC audits, (2) decides on the appropriate response and a time frame for taking action based on established criteria, and (3) acts to correct the vulnerabilities identified. In December 2011, the HHS-OIG found that CMS had not resolved or taken significant action to resolve 48 of 62 vulnerabilities reported in 2009 by CMS contractors specifically charged with addressing fraud. The HHS-OIG made several recommendations, including that CMS have written procedures and time frames to assure that vulnerabilities were resolved. CMS has indicated that it is now tracking vulnerabilities identified from several types of contractors through a single vulnerability tracking process, and the agency has developed some written guidance on the process. We are currently examining aspects of CMS’s vulnerability tracking process and will be reporting on it soon. CMS and the states must continue and improve their efforts to reduce improper payments. Identifying the nature, extent, and underlying causes of improper payments, and developing adequate corrective action processes to address vulnerabilities, is an essential prerequisite to reducing them. Although Medicaid presents different challenges, we believe that many of the lessons learned from our Medicare work could be applied to strengthen Medicaid program integrity. These lessons can be applied as CMS and the states begin to use the additional tools to identify and recoup Medicaid improper payments provided through recent legislation. As CMS and the states implement these PPACA and Small Business Jobs Act provisions, additional evaluation and oversight will help determine whether the provisions are implemented as intended and have the desired effect on better ensuring proper payments. Moreover, we are continuing to monitor CMS and state efforts as the implementation process proceeds. Notably, we have work under way assessing CMS’s efforts to support and strengthen Medicaid program integrity through its Medicaid Integrity Program. We are also examining the effectiveness of different types of prepayment edits in Medicare, including CMS’s oversight of its contractors in implementing those edits, and CMS’s implementation of predictive analytics through FPS. The level of importance placed on effectively implementing our recommendations and the provisions of recent laws will be critical to reducing improper payments in the Medicaid and Medicare programs, and ensuring that federal funds are used efficiently and for their intended purposes. Chairman Platts, Ranking Member Towns, and Members of the Subcommittee, this completes our prepared statement. We would be pleased to respond to any questions that you may have at this time. For further information about this statement, please contact us at (202) 512-7114 or kingk@gao.gov and yocomc@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Sheila K. Avruch and Walter Ochinko, Assistant Directors; Sean DeBlieck; Kaycee Glavich; Leslie V. Gordon; Drew Long; Jasleen Modi; Lisa Rogers; and Jennifer Whitworth were key contributors to this statement. Medicare: Review of the First Year of CMS’s Durable Medical Equipment Competitive Bidding Program’s Round 1 Rebid. GAO-12-693. Washington, D.C.: May 9, 2012. Medicare: The First Year of the Durable Medical Equipment Competitive Bidding Program Round 1 Rebid. GAO-12-733T. Washington, D.C.: May 9, 2012. Medicaid: Federal Oversight of Payments and Program Integrity Needs Improvement. GAO-12-674T. Washington, D.C.: April 25, 2012. Medicare: Important Steps Have Been Taken, but More Could Be Done to Deter Fraud. GAO-12-671T. Washington, D.C.: April 24, 2012. Medicare Program Integrity: CMS Continues Efforts to Strengthen the Screening of Providers and Suppliers. GAO-12-351. Washington, D.C.: April 10, 2012. Improper Payments: Remaining Challenges and Strategies for Governmentwide Reduction Efforts. GAO-12-573T. Washington, D.C.: March 28, 2012. 2012 Annual Report: Opportunities to Reduce Duplication, Overlap and Fragmentation, Achieve Savings, and Enhance Revenue. GAO-12-342SP. Washington, D.C.: February 28, 2012. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Expand Efforts to Support Program Integrity Initiatives. GAO-12-292T. Washington, D.C.: December 7, 2011. Medicaid Program Integrity: Expanded Federal Role Presents Challenges to and Opportunities for Assisting States. GAO-12-288T. Washington, D.C.: December 7, 2011. Medicare Part D: Instances of Questionable Access to Prescription Drugs. GAO-12-104T. Washington, D.C.: October 4, 2011. Medicare Part D: Instances of Questionable Access to Prescription Drugs. GAO-11-699. Washington, D.C.: September 6, 2011. Medicare Integrity Program: CMS Used Increased Funding for New Activities but Could Improve Measurement of Program Effectiveness. GAO-11-592. Washington, D.C.: July 29, 2011. Improper Payments: Reported Medicare Estimates and Key Remediation Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011. Fraud Detection Systems: Additional Actions Needed to Support Program Integrity Efforts at Centers for Medicare and Medicaid Services. GAO-11-822T. Washington, D.C.: July 12, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. Medicaid Managed Care: CMS’s Oversight of States’ Rate Setting Needs Improvement. GAO-10-810. Washington, D.C.: August 4, 2010. Medicaid: Ongoing Federal Oversight of Payments to Offset Uncompensated Hospital Care Costs Is Warranted. GAO-10-69. Washington, D.C.: November 20, 2009. Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-1004T. Washington, D.C.: September 30, 2009. Medicaid: Fraud and Abuse Related to Controlled Substances Identified in Selected States. GAO-09-957. Washington, D.C.: September 9, 2009. Improper Payments: Progress Made but Challenges Remain in Estimating and Reducing Improper Payments. GAO-09-628T. Washington, D.C.: April 22, 2009. Medicare: Thousands of Medicare Providers Abuse the Federal Tax System. GAO-08-618. Washington, D.C.: June 13, 2008. Medicaid: CMS Needs More Information on the Billions of Dollars Spent on Supplemental Payments. GAO-08-614. Washington, D.C.: May 30, 2008. Medicare: Competitive Bidding for Medical Equipment and Supplies Could Reduce Program Payments, but Adequate Oversight Is Critical. GAO-08-767T. Washington, D.C.: May 6, 2008. Improper Payments: Status of Agencies’ Efforts to Address Improper Payment and Recovery Auditing Requirements. GAO-08-438T. Washington, D.C.: January 31, 2008. Medicaid Demonstration Waivers: Recent HHS Approvals Continue to Raise Cost and Oversight Concerns. GAO-08-87. Washington, D.C.: January 31, 2008. Improper Payments: Federal Executive Branch Agencies’ Fiscal Year 2007 Improper Payment Estimate Reporting. GAO-08-377R. Washington, D.C.: January 23, 2008. Medicaid Financing: Long-Standing Concerns about Inappropriate State Arrangements Support Need for Improved Federal Oversight. GAO-08-255T. Washington, D.C.: November 1, 2007. Medicaid Financing: Federal Oversight Initiative Is Consistent with Medicaid Payment Principles but Needs Greater Transparency. GAO-07-214. Washington, D.C.: March 30, 2007. Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies. GAO-07-59. Washington, D.C.: January 31, 2007. Medicaid Financial Management: Steps Taken to Improve Federal Oversight but Other Actions Needed to Sustain Efforts. GAO-06-705. Washington, D.C.: June 22, 2006. Medicaid Integrity: Implementation of New Program Provides Opportunities for Federal Leadership to Combat Fraud, Waste, and Abuse. GAO-06-578T. Washington, D.C.: March 28, 2006. Medicare: More Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment Suppliers. GAO-05-656. Washington, D.C.: September 22, 2005. Medicaid Financing: States’ Use of Contingency-Fee Consultants to Maximize Federal Reimbursements Highlights Need for Improved Federal Oversight. GAO-05-748. Washington, D.C.: June 28, 2005. Medicaid Fraud and Abuse: CMS’s Commitment to Helping States Safeguard Program Dollars Is Limited. GAO-05-855T. Washington, D.C.: June 28, 2005. Medicare: CMS’s Program Safeguards Did Not Deter Growth in Spending for Power Wheelchairs. GAO-05-43. Washington, D.C.: November 17, 2004. Medicaid Program Integrity: State and Federal Efforts to Prevent and Detect Improper Payments. GAO-04-707. Washington, D.C.: July 16, 2004. Medicare: CMS Did Not Control Rising Power Wheelchair Spending. GAO-04-716T. Washington, D.C.: April 28, 2004. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In 2011, CMS estimated that Medicaid and Medicare had improper payments of $21.9 billion and almost $43 billion, respectivelyamong the largest for all federal programs. Both health care programs are on GAOs list of high-risk programs. Over the years, Congress has passed legislation designed to help address program integrity issues in the two programs but they remain vulnerable to fraud, waste, and abuse. The program integrity challenges are different for Medicaid and Medicare. With 51 distinct state-based programs, Medicaid has complex challenges for finding the appropriate balance between state and federal efforts. Medicare uses contractors to help administer the program and CMS must oversee their efforts. This statement examines the progress made and important steps still to be taken in these programs. GAO focused on four key strategies and recommendations that were designed to facilitate them that were identified in prior work and that could help reduce improper payments: (1) strengthening provider enrollment standards and procedures to ensure that only legitimate providers participate in the program; (2) improving prepayment controls; (3) improving postpayment claims review and recovery of improper payments; and (4) developing a robust process for addressing identified vulnerabilities. This statement is based on GAO products issued from April 2004 through May 2012 and interviews with agency officials and other stakeholders. In May 2012, GAO also received additional information from CMS on agency actions. GAO received technical comments from CMS officials and incorporated them into this statement. For the Medicaid program, the Centers for Medicare & Medicaid Services (CMS) and the states have taken some actions related to GAOs four key strategies but more needs to be done. CMSs comprehensive state program integrity reviews identified provider enrollment as the most frequently cited area of concern but the agency has noted a positive trend in states awareness of regulatory requirements. CMS noted vulnerabilities in the prepayment reviews of claims in five states and effective practices in seven others. In anticipation of new analytic tools to predict vulnerabilities before claims are paid, the agency has initiated discussions with and provided guidance to states. CMS has begun collaborating with states to identify targets for federal postpayment audits, which should help to avoid duplication of federal and state audit efforts. CMS has not established a robust process for states to evaluate and address vulnerabilities identified by the states new recovery audit contractors brought in to identify improper payments and recoup overpayments. For the Medicare program, CMS has acted to strengthen several of its strategies to better ensure program integrity, but other actions remain undone. Congress authorized CMS to implement several new or improved enrollment safeguards, including screening enrollment applications for categories of Medicare providers by risk level. CMS has issued a final rule to implement this and other changes, but has not completed other final rules and additional actions that could further strengthen enrollment procedures, such as rules to implement new surety bond provisions and provider and supplier disclosures. GAOs prior work found certain gaps in Medicares prepayment edits based on coverage and payment policies and made recommendations for improvement, such as adding edits to identify abnormally rapid increases in medical equipment billing. GAO is currently evaluating new CMS efforts in this area. CMS has begun using recovery auditing in its prescription drug program but not for its Medicare managed care plans. GAO recommended that CMS establish an adequate process to ensure prompt resolution of identified vulnerabilities in Medicare and is currently evaluating steps that CMS has taken recently. It is critical that CMS and the states continue working on reducing improper payments. While both have made efforts to reduce improper payments, further action is needed. Although Medicaid presents different challenges, GAO believes that many of the lessons learned from its work on Medicare could be applied to strengthen Medicaid program integrity. These lessons can be applied as CMS and the states begin to use the additional tools provided through recent legislation. As the implementation process proceeds, GAO is continuing to monitor these issues. Effectively implementing provisions of recent laws and GAOs recommendations will be critical to reducing improper payments and ensuring that federal funds are used efficiently and for their intended purpose.