In 2003, Congress passed the MMA, which created the Medicare Part D program. The MMA requires that all Part D sponsors have a program to control fraud, waste, and abuse. CMS is responsible for safeguarding the Part D program from fraud, waste, and abuse. In 2003, Congress passed the MMA, which created a prescription drug benefit known as Medicare Part D. Voluntary enrollment in the Medicare Part D program began November 15, 2005, and the benefit went into effect January 1, 2006. Although the Medicare Part D program is overseen by CMS, Part D drug benefit plans are administered by private companies that apply to CMS to participate in the program. When approved, these private companies contract with the federal government to be Part D sponsors and market Part D drug plans directly to Medicare beneficiaries. The MMA includes a requirement that all Part D sponsors have a program to control fraud, waste, and abuse in Part D; CMS regulations establish the requirements for comprehensive compliance plans for Part D plan sponsors. To guide Part D sponsors in designing a fraud and abuse program that addressed Part D risks, in April 2006, CMS issued recommendations for Part D sponsors’ fraud and abuse programs based on input from various sources, including law enforcement and industry representatives. The guidance, issued as chapter 9 in the Prescription Drug Benefit Manual, contains further interpretation and guidelines on the steps sponsors should take to detect, correct, and prevent fraud, waste, and abuse in Part D. CMS required Part D sponsors to have fraud and abuse programs operational and in effect at the time their Part D contracts were awarded and expected sponsors to adopt the recommendations in chapter 9 by January 1, 2007. Table 1 describes the required elements of a comprehensive compliance plan and selected recommended measures for addressing fraud, waste, and abuse specific to Part D in each of the required compliance plan elements. In the chapter 9 guidance, CMS recommends that Part D sponsors design their fraud, waste, and abuse programs to safeguard against identified risk areas and identifies examples of fraud, waste, and abuse risks associated with Part D stakeholders, including internal and external parties. Internal parties include Part D sponsors and their employees; external parties include physicians, pharmacies, and Medicare beneficiaries. Chapter 9 also states that sponsors’ preexisting fraud and abuse programs should be focused on controlling fraud by external parties submitting claims to the sponsor, and stated that Part D sponsors are to identify and address internal fraud, waste, and abuse by the sponsor and its employees as well. In chapter 9, CMS also identified examples of potential fraud, waste, and abuse by Part D sponsors, such as marketing schemes to improperly enroll Medicare beneficiaries in Part D plans or deliberately using inaccurate data to receive improper payments from CMS. CMS identified examples of potential fraud, waste, and abuse by Medicare beneficiaries, such as beneficiaries misrepresenting their identity to illegally obtain the drug benefit or engaging in doctor shopping, where a patient seeks prescriptions from multiple physicians with the intent to abuse or sell drugs. CMS identified potential examples of fraud, waste, and abuse by pharmacies, citing improper billing practices, such as billing for nonexistent prescriptions. Regulations and the chapter 9 guidance recognize that contractors can be significant stakeholders in sponsors’ Part D operations. CMS permits Part D sponsors to use contractors to perform various Part D functions. However, CMS regulations and chapter 9 state that the Part D sponsor is ultimately responsible for fulfilling the terms and conditions set out in the sponsor’s contract with CMS, even if the sponsor delegates a Part D function to a contractor. In addition, Part D rules establish contractual obligations for Part D sponsors that delegate tasks to contractors. CMS is responsible for safeguarding the Part D program from fraud, waste, and abuse, including ensuring sponsors’ compliance with applicable requirements. While many groups within CMS are responsible for overseeing different aspects of the Part D program, two divisions provide oversight of Part D sponsors’ fraud and abuse programs. OFM is the lead office for program integrity and financial oversight, including responsibility related to oversight of fraud, waste, and abuse in the Part D program. OFM developed the chapter 9 guidance for sponsors’ fraud and abuse programs and is responsible for reviewing and approving fraud and abuse program plans when organizations first apply to become Part D sponsors. CBC is the lead office for operational oversight of Part D, including sponsor management, program audits, and enforcement actions. OFM and CBC are responsible for conducting audits of Part D sponsors’ compliance with fraud and abuse program requirements. CBC is responsible for conducting broad Part D program audits that include, but are not limited to, Part D sponsors’ implementation of their compliance plans, including fraud and abuse programs. In contrast, OFM is responsible for financial audits and audits of Part D sponsors’ fraud and abuse programs. CMS contracted with the MEDICs to support OFM’s audit, oversight, and antifraud and abuse efforts in Part D. In October 2005, CMS issued its Oversight Strategy for overseeing Part D sponsors, particularly with regard to mitigating fraud, waste, and abuse. In the strategy, CMS noted that in conducting oversight of Part D sponsors CBC would rely on self-reported, unaudited data provided to CMS by Part D sponsors. However, in the strategy, CMS also acknowledged that program audits conducted by CBC would be necessary to ensure compliance and to document that CMS has fulfilled its program oversight responsibilities. According to the Oversight Strategy, CBC would follow a 3-year audit cycle that would include both desk audits—reviews of documents requested from Part D sponsors—and on-site audits covering all aspects of the Prescription Drug Benefit Manual over the 3 years. In December 2006, HHS’s OIG conducted a review of Part D sponsors’ compliance plans that found that many Part D sponsors’ compliance plans did not address all of CMS’s compliance plan requirements, including fraud and abuse program plans. In response, CMS reported that “CMS will begin these compliance plan audits in 2007, and sponsors will be accountable for meeting all requirements.” OFM’s oversight of Part D sponsors relies on the MEDICs to audit Medicare Part D fraud and abuse programs. CMS has entered into contracts under which task orders were issued to three MEDICs to conduct various activities related to Part D. The first MEDIC began its work in November 2005, and the other two MEDICs began work in December 2006. At that time, OFM estimated that the MEDICs would conduct audits of Part D sponsors’ fraud and abuse programs in the first years of Part D. In 2005 and 2006, CMS estimated that at least 10 audits of fraud and abuse programs would be conducted by each of the MEDICs each year under task orders to be issued under the contract. Specifically, CMS estimated that the first MEDIC would complete 10 of these audits during the 2005—2006 contract year and that the three MEDICs would complete 35 of these audits during the 2006—2007 contract year. The five Part D sponsors we reviewed had not completely implemented all of CMS’s seven required compliance plan elements and selected recommended measures for Part D fraud and abuse programs. All Part D sponsors had the required elements and recommended measures for written policies, procedures, and standards of conduct (element 1); effective lines of communication (element 4); and enforcement of standards through disciplinary guidelines (element 5). However, Part D sponsors varied in their implementation of the remaining required elements and selected recommend measures. Table 2 illustrates the variation in the extent to which the five Part D sponsors implemented the required elements and selected recommended measures for their fraud and abuse programs. All five Part D sponsors we reviewed completely met the requirements for written policies, procedures, and standards of conduct. All five had the required written policies, procedures, or the standards of conduct that articulated a commitment to comply with all applicable federal and state standards. All three Part D sponsors that relied on a first-tier entity in carrying out its Part D responsibilities had included provisions in their contract with the entity requiring compliance with all applicable federal laws, regulations, and CMS instructions. All five Part D sponsors completely met the selected recommended measures by having written policies, procedures, or standards of conduct that applied to detecting, correcting, and preventing fraud, waste, and abuse. All five had standards of conduct that were available to employees on the Part D sponsors’ internal Web sites. In addition, Part D sponsors reported that information regarding written policies, procedures, or standards of conduct was disseminated through training or employees had to sign attestations that they had reviewed and understood the policies, or both. Four of the five Part D sponsors completely met the requirements for having both a compliance officer and compliance committee accountable to senior management. The remaining Part D sponsor only partially met the requirement because it did not have a compliance committee. Of the five Part D sponsors’ compliance officers, three of the compliance officers had been in that role since the Part D benefit was implemented in January 2006. The other two compliance officers started in their roles during 2007. All of the Part D compliance committees that existed were overseen by the compliance officer, were accountable to senior management, and were responsible for advising the compliance officer on various issues, ranging from implementing compliance plans to developing their Part D operations. For example, one Part D compliance committee was involved in monitoring the implementation of the activities outlined in the compliance plan, providing regular reports to senior management, and providing input on training. Another Part D sponsor used its corporate compliance committee instead of a separate Part D compliance committee to address Part D issues; a formal Part D compliance committee had not been implemented. The corporate compliance committee meetings included senior executives and the Part D compliance officer. Three Part D sponsors completely met the selected recommended measures for a compliance officer and committee. Two Part D sponsors partially met the recommended measures. Of these, one sponsor’s compliance officer did not report to senior management on at least a quarterly basis. The compliance officer from this Part D sponsor stated that he or she did not report regularly to senior management because the Part D sponsor had yet to have any cases that were determined to be fraud, waste, or abuse. The remaining Part D sponsor’s compliance committee did not meet on at least a quarterly basis. All five Part D compliance officers were responsible for overseeing and monitoring the implementation and maintenance of fraud and abuse programs, as recommended. The range of activities and responsibilities for the Part D compliance officers varied. Two compliance officers were directly involved in fraud and abuse program activities, while the other three delegated those responsibilities to other staff, or some components of their role were a function of another department or were delegated to a contractor. For example, one compliance officer was involved in decisions regarding fraud, waste, and abuse investigations and corrective actions, while another compliance officer delegated this responsibility. We found that four of the five Part D sponsors provided their Part D employees with general fraud, waste, and abuse training that covered Part D. Two of these sponsors completely met the requirements for education and training by also providing or ensuring that their Part D employees and first-tier entity, if applicable, received general fraud, waste, and abuse training. Two other sponsors partially met the requirements— they provided general fraud, waste, and abuse training to Part D employees, but they did not provide this training to their first-tier entity or ensure that the entity’s employees received it. One Part D sponsor did not meet the requirements because it did not provide a general training that covered Part D fraud, waste, and abuse to its employees. However, this sponsor reported that a general fraud, waste, and abuse training module on Part D was in development. The training curriculums of the Part D sponsors covered common fraud risks and vulnerabilities; federal laws related to fraud, waste, and abuse; and the sponsors’ protocols for detection and referral to government authorities. However, the extent of information about detecting, correcting, and preventing fraud in Part D varied among the curriculums. For example, one sponsor’s corporate-wide Ethics and Compliance training course contained a section on health-care fraud that had one reference to Part D. Similarly, another sponsor added a section to its preexisting healthcare fraud and abuse training curriculum for identifying Part D violations, such as enrolling a Medicare beneficiary in a plan different than the one the beneficiary selected. In contrast, one sponsor developed a fraud and abuse training that was entirely devoted to Part D and that discussed in detail CMS’s requirements and recommendations for an effective Part D fraud and abuse program and how the sponsor was meeting those standards. In addition, this sponsor’s curriculum was the only one that identified the potential for misconduct at the sponsor level. Specifically, this sponsor’s curriculum provided hypothetical scenarios of risks that employees may encounter on the job—such as a supervisor asking an employee to falsify Part D data submitted to the government to inflate enrollment. Only one Part D sponsor completely met the selected recommended measures for education and training by providing general training that covered Part D fraud, waste, and abuse to its employees on at least an annual basis and providing specialized training to its employees whose responsibilities or departments, such as marketing, put them at greater risk of encountering fraud, waste, or abuse. This sponsor provided employees in its pharmacy benefit management department with a specialized training on the government’s guidelines for preventing fraud, waste, and abuse in Part D. Three sponsors partially met the recommended measures; two did not provide specialized training to their Part D employees and three did not ensure that this training was provided to first-tier entities. One Part D sponsor did not meet any of the selected recommended measures for effective training and education. Additionally, we found that one sponsor’s interpretation of CMS’s recommendation for specialized training differed from CMS’s expectations. An official from this sponsor considered that operational training in a particular job function met this recommendation, even though the training did not include a reference to fraud, waste, and abuse. All five Part D sponsors completely met the requirements for effective lines of communication by having lines of communication between the compliance officer and the organization’s management, employees, and contractors. While the lines of communications may not have been directed to the compliance officers, all of these officers had access to information received on these lines. In addition, all five Part D sponsors met the selected recommended measures. Specifically, all five Part D sponsors used reporting mechanisms to receive reports of potential fraud, waste, and abuse and had investigated these reports within two weeks, as recommended. All five had confidential or anonymous mechanisms, such as hotlines, for receiving compliance questions, reports of potential risks, and reports of potential fraud, waste, or abuse from internal and external parties. All five sponsors we reviewed had separate reporting mechanisms for internal parties, including employees, and for external parties, including beneficiaries, to report potential offenses. All five Part D sponsors made information about the methods for reporting potential offenses available to internal and external parties, as recommended. For internal parties, all five Part D sponsors provided information to employees regarding the methods for reporting potential offenses on their companies’ internal Web sites. In addition, four Part D sponsors provided information regarding the hotline number and other methods for reporting to employees during their Medicare Part D fraud and abuse training. For external parties, two of the compliance officers for the Part D sponsors in our review reported that beneficiaries were typically informed of the methods for reporting potential fraud and abuse on their explanation of benefits. One Part D sponsor provided promotional material to one of their first-tier entities with the hotline number for reporting potential fraud, waste, or abuse. All five Part D sponsors had investigated concerns and reports of potential offenses received through the internal or external reporting mechanisms, as recommended. One Part D sponsor delegated investigation activities to a first-tier entity. Only two of the five Part D sponsors had received Part D fraud reports through the internal reporting mechanism. One Part D sponsor stated that Part D concerns may not have been reported through the internal mechanism because employees were bypassing the internal hotline and using other mechanisms for reporting, such as directly reporting a potential case of fraud, waste, or abuse to the special investigations unit. An official from another Part D sponsor reported that it had yet to receive any calls related to Medicare Part D on its internal reporting mechanism. All five Part D sponsors in our review had addressed or responded to reports of potential offenses received through their external reporting mechanism, including reports of potential offenses by beneficiaries and pharmacy providers. For example, one Part D sponsor received a report from a pharmacy that a family member of one of the sponsor’s beneficiaries was filling prescriptions for a drug for his own use and paying for them with the beneficiary’s Medicare Part D benefit. Other Part D sponsors received reports that beneficiaries were doctor shopping or selling their prescription drugs. The requirements for the enforcement through disciplinary guidelines were completely met by all five Part D sponsors. All five of the Part D sponsors in our review enforced standards through well-publicized disciplinary guidelines for individuals, as required. Most sponsors’ disciplinary guidelines were corporate policies that applied to all company products, including the Part D prescription drug plan. All five Part D sponsors promoted the disciplinary guidelines to encourage reporting of potential offenses, as recommended. Officials for all five Part D sponsors reported that disciplinary guidelines were incorporated into training courses or were available on the sponsor’s internal Web sites, or both. To publicize enforcement of disciplinary standards, one sponsor used its Ethics and Compliance Newsletter to communicate that disciplinary actions had been taken. Three Part D sponsors completely met the requirements by having procedures for internal monitoring and auditing at the sponsor and first- tier entity level, when applicable. One Part D sponsor partially met the requirements because, although it had procedures for internal monitoring and auditing, this sponsor did not have the monitoring and auditing procedures for its first-tier entity. One Part D sponsor did not meet the requirements because it did not provide us with internal monitoring and auditing procedures that met the criteria. Sponsors’ monitoring procedures were often broadly-focused departmental manuals that generally did not specifically refer to Part D. Auditing procedures included work plans with time frames for completion or processes for responding to auditing results. Three Part D sponsors completely met the recommended measures for internal auditing and monitoring because they implemented procedures for monitoring and auditing at the sponsor and first-tier entity, when applicable, and conducted data analysis and risk assessments. One Part D sponsor partially met the recommended measures because it had not monitored or audited its first-tier entity. One Part D sponsor did not meet any of the recommended measures. The data-monitoring activities of the sponsors in our review typically focused on protecting corporate assets against fraudulent claims by third parties, rather than detecting fraud, waste, or abuse at the sponsor level as well, as recommended to protect the Medicare program and its beneficiaries. Sponsors’ data monitoring for Part D typically focused on the conduct of external parties, such as monitoring pharmacies’ dispensing patterns, beneficiaries’ drug utilization, and physicians’ prescribing patterns, and did not monitor internal practices by the sponsor or its employees that also posed risks for Medicare, such as double billing of Medicare. Similarly, sponsors’ monitoring activities for Part D often reflected activities in place before Part D for their other lines of business, such as regular analyses of prescriptions claims data from pharmacies in their network, and did not generate a separate analysis of Part D claims. In our review, we found that only one sponsor targeted its monitoring efforts specifically to detect fraud, waste, and abuse in a Part D risk area. This sponsor mined Part D claims for irregular activities, such as signs of doctor shopping among beneficiaries prescribed narcotics. The sponsor’s compliance officer also noted that the special investigations unit sometimes engaged in additional Part D data monitoring if prompted by a suspected case of fraud, waste, or abuse. We found that four of the five sponsors conducted internal audits for Part D, as recommended. The audits generally focused on Part D operations and did not specifically audit for fraud, waste, or abuse. In general, sponsors’ Part D audit subjects related to operational issues or risks to company assets, such as the accuracy and completeness of the Part D membership process, Part D disenrollment issues, and the completeness and accuracy of pharmacy claims data. For example, one Part D sponsor’s audit identified administrative issues in collecting unpaid premiums from Part D beneficiaries and lack of timely processing of beneficiary applications. A Part D audit by another sponsor identified inaccurate pharmacy claims as potentially leading to overpayments of claims by the sponsor as opposed to Medicare. Only one sponsor’s audit specifically cited detection of possible fraud, waste, and abuse in Medicare Part D as the purpose of the audit. This audit of 20,000 pharmacy claims identified more than $1.2 million in Part D overpayments for recovery from pharmacies. This was the only example provided to us that identified funds for possible repayment to Medicare. Of the three sponsors that had a first-tier entity for Part D—such as a pharmacy benefit manager—two monitored and audited their first-tier entity, as recommended. One sponsor official said that because billing was a high-risk area for fraud, they check for billing irregularities in audits of their first-tier entity. Four sponsors conducted risk assessments to identify risk areas associated with their Part D programs. Sponsors’ risk assessments cited internal issues that pose risks for fraud, waste, and abuse in Part D—such as proper reporting of overpayments to CMS, accuracy and truthfulness of the data submitted to CMS for the purpose of federal reimbursement, and sales conduct that may mislead or confuse beneficiaries, or misrepresent the product. One Part D sponsor had undertaken internal audits that reflected the internal Part D fraud, waste, and abuse risks cited in its risk assessment, as recommended. Four sponsors completely met the requirements for prompt responses and corrective action initiatives by developing the respective procedures and conducting timely and reasonable inquiry into potential offenses. One sponsor only partially met the requirements because this sponsor had not developed corrective action procedures in the event that fraud, waste, or abuse was detected. The corrective action procedures provided by Part D sponsors varied in the level of detail and information provided. For example, one sponsor cited its employee disciplinary guidelines as its corrective action procedures, while another sponsor’s corrective action procedures addressed various stakeholders—pharmacy providers and beneficiaries—and the possible actions to be taken in the event of a compliance violation or detected offense. All Part D sponsors reported initiating inquiries into reported potential offenses as required. Four Part D sponsors reported that they had cases that warranted corrective action. Only one sponsor reported the need to take disciplinary action against one of its employees. This Part D sponsor reported terminating an employee for being involved in an identity-theft scheme using the personal identification information of beneficiaries. This Part D sponsor also reported terminating a pharmacy technician after the technician stole a beneficiary’s prescription from the pharmacy refill center and attempted to sell it to the beneficiary at a discounted price. As a result of criminal proceedings, this individual was sentenced to 2 years of probation, and ordered to pay restitution for the cost of the drug. Finally, three sponsors reported repaying CMS an overpayment, as required. The four sponsors that reported taking disciplinary or corrective actions varied in their understanding and use of such actions. One Part D sponsor reported that instead of taking corrective or disciplinary action itself, most often cases were turned over to the MEDICs or local law enforcement to determine the necessary course of action. Another Part D sponsor reported that its understanding of taking a corrective action was reporting the case to the MEDIC. Three of the Part D sponsors completely met the selected recommended measures in our review by: (1) having procedures that specified that an investigation into a detected offense would begin within two weeks after it was reported; (2) having procedures to voluntarily self-report any findings of potential fraud or misconduct to CMS or the appropriate government authority; and (3) self-reporting any findings of potential fraud or misconduct to CMS or the appropriate government authority, if warranted. Two Part D sponsors only partially met the recommended measures because they did not have procedures specifying that an investigation into a detected offense would begin within 2 weeks after it was reported. All five Part D sponsors we reviewed had procedures in place for voluntarily self-reporting fraud or misconduct to the MEDICs or CMS, as recommended. All five sponsors had also self-reported potential Part D fraud or misconduct to the MEDICs. For example, an official from a Part D sponsor reported that the sponsor referred a case to the MEDIC after conducting an investigation that identified a “phantom pharmacy” billing over $2 million in false claims. CMS’s oversight of Part D sponsors’ fraud and abuse programs has been limited. CMS’s oversight activities to date have included the review and approval of fraud and abuse program plans that Part D sponsors submit as part of their initial Part D sponsor applications. Although CMS indicated that it planned to conduct audits to monitor Part D sponsors’ implementation of fraud and abuse programs, CMS has not yet conducted these audits. CMS’s oversight activities to date have been limited to review and approval of Part D sponsors’ compliance plans detailing their fraud and abuse program plans submitted as part of their initial Part D sponsor applications. A CMS official reported that in 2005, the first year program plans were reviewed, some sponsors submitted plans that did not meet the agency’s requirements and recommendations specific to fraud, waste, and abuse in Part D. When starting the Part D program, a CMS official reported that CMS expected that sponsors would understand the regulations and that sponsors would articulate clearly how their compliance plans addressed fraud, waste, and abuse specific to Part D. However, this official told us that after reviewing the components of sponsors’ compliance plans that were included in their Part D applications, CMS officials realized that sponsors needed more guidance. For example, a CMS official told us that some sponsors’ applications needed follow-up on all of the components of their fraud and abuse programs. According to CMS officials, in many cases, Part D sponsors initially submitted corporate-wide compliance plans that did not address fraud, waste, and abuse specific to Part D, as CMS expected. Rather than disapproving these sponsors’ fraud and abuse program plans, CMS officials reported that they worked with the sponsors to help them develop fraud and abuse program plans that would be approved in that first year. CMS’s review of fraud and abuse program plans was limited to the initial contract-application process. CMS officials reported that sponsors with approved fraud and abuse program plans prior to the issuance of chapter 9 in April 2006 were not required to resubmit program plans in order for CMS to verify that sponsors’ plans were in accordance with the new guidance. In addition, CMS officials told us that CMS did not require Part D sponsors to submit new or updated fraud and abuse program plans during the contract renewal process for program year 2007 or 2008, which limited CMS’s ability to ensure that existing Part D sponsors continued to maintain compliance with this requirement. CMS also provided technical assistance, such as guidance and information sessions to Part D sponsors to help them understand the agency’s expectations regarding the development and implementation of fraud and abuse programs. CMS also clarified its expectations regarding sponsors’ fraud and abuse programs by issuing a final rule in December 2007. In addition, CMS provided information sessions, such as the Compliance Conference in August 2006 that included Part D and an Open Door Forum in May 2006, to discuss the guidance for Part D sponsors regarding the development and implementation of fraud and abuse programs. CMS has not conducted oversight activities of Part D sponsors’ program implementation, such as audit and enforcement actions, to ensure compliance with fraud and abuse program requirements. CMS has taken a collaborative rather than an enforcement approach with Part D sponsors to implement the Part D program and safeguard it from fraud, waste, and abuse. In its Part D Oversight Strategy, issued in 2005, CMS stated that it would reserve enforcement activities to large, repeated, or extreme Part D program violations. Part D oversight responsibilities are shared between two CMS offices. First, the CBC has responsibility for Part D operational oversight, including sponsor compliance with all Part D program rules. In April 2006, CMS’s CBC issued a Part D Audit Protocol identifying 14 program areas for its audits of Part D sponsors, such as sponsors’ implementation of CMS’s fraud and abuse program requirements. However, in November 2006, CBC issued a short-term audit strategy stating that it had limited resources for auditing Part D programs due to the increasing number of organizations contracting with CMS to offer Medicare products. CBC noted that it did not have the resources to audit every plan, across every program attribute, every 3 years as originally stated in its 2005 Oversight Strategy. CBC reported that it would identify the minimal level of effort needed to meet its oversight responsibilities and ensure that Medicare stakeholders remained confident in the program. CBC stated that to conserve resources it would be conducting desk audits as much as possible, which would consist of reviews of documents requested from Part D sponsors. In 2007, the CBC initiated program audits based upon the short-term audit strategy it issued in November 2006. In 2007, these CBC program audits assessed Part D sponsors’ compliance with selected program areas, but the CBC audits did not assess sponsors’ implementation of fraud and abuse programs. Moreover, CBC does not plan to audit sponsors’ implementation of fraud and abuse programs in 2008. In June 2007, CBC conducted a self-assessment survey of Part D sponsors regarding the implementation of their fraud and abuse programs. A CBC official reported that the purpose of the survey was to help CMS identify the degree to which sponsors implemented compliance plan requirements and recommended measures. In a follow up survey conducted in March and April 2008, CBC found that nearly all prescription drug plans (PDP) reported that they fully met CMS’s compliance plan requirements. Secondly, CMS’s OFM has a targeted role in oversight that focuses on financial oversight and program integrity, such as Part D fraud prevention and detection. CMS contracted with the MEDICs, which are overseen by OFM, to assist with OFM’s program integrity efforts for Part D. Audits of Part D sponsors’ compliance plans are part of the current MEDIC statement of work. However, no task orders specific to auditing sponsors’ fraud and abuse programs have been issued. Accordingly, no audits of sponsors’ fraud and abuse programs have been initiated since the Part D program began. In comments on a draft of this report, CMS stated that each MEDIC will begin audits of Part D sponsors’ compliance plans by the end of summer 2008. The MEDICs will use the Compliance Plan Audit Chapter of the Part D Audit Guide to perform this work. An OFM official told us that OFM has limited funding for the MEDICs’ fraud and abuse program audits. OFM explained that under funding levels as of April 2008, the MEDICs receive and investigate reports of fraud, but the MEDICs did not have the staff to conduct audits of sponsors’ programs to control fraud, waste, and abuse. We have designated the overall Medicare program as high risk, and the size, nature, and complexity of the Part D program make it a particular risk for fraud, waste, and abuse. In spite of this risk and 3 years after the start of the Part D program, CMS has not conducted oversight activities to monitor sponsors’ implementation of fraud and abuse programs. CMS has acknowledged that program compliance and integrity audits conducted by CMS are necessary to ensure compliance and document CMS’s program oversight responsibilities. In particular, the agency reported that it would conduct audits of fraud and abuse programs in 2007. However, although both offices have the responsibility to do so, CBC has not conducted these audits, and OFM has not initiated MEDIC audits of fraud and abuse programs as it had planned. Our review of five Medicare Part D sponsors’ implementation of fraud, waste, and abuse programs supports the need for such oversight. We found that none of these five sponsors, which cover more than a third of Part D enrollees, completely implemented all of the required compliance plan elements and selected recommended measures for their fraud and abuse programs. Lack of CMS oversight of Medicare Part D sponsors’ implementation of programs to prevent fraud, waste, and abuse risks significant misuse of funds in this $39 billion program. We believe that CMS oversight of Medicare Part D sponsors’ programs could increase the completeness of sponsors’ implementation of required compliance plan elements and selected recommended measures and, as a result, reduce the risk to Medicare. To help safeguard the Medicare Part D program from fraud, waste, and abuse, we recommend the Administrator of CMS ensure that CMS conducts timely audits of Part D fraud and abuse programs to monitor sponsors’ implementation of these programs. CMS provided written comments on a draft of this report. CMS stated that it concurred with our recommendation and that it is prioritizing its oversight activities to ensure sponsors’ compliance with CMS’s policies. CMS also agreed with our finding regarding the extent to which Part D sponsors have implemented programs to control fraud, waste, and abuse. CMS disagreed with our finding that the agency’s oversight has been limited. However, CMS’s comments did not provide additional evidence of audits of sponsors’ fraud, waste, and abuse programs, or of oversight activities beyond those described in the report. We believe that such audits are necessary to ensure sponsors’ compliance. In addition, CMS stated that insufficient resources have been one of the primary impediments to its implementation of a robust oversight strategy. CMS noted that Congress did not respond to its request for additional program integrity funds in fiscal year 2006 through fiscal year 2008. However, we believe that program integrity will remain at risk until CMS conducts timely audits to monitor Part D sponsors’ implementation of fraud and abuse programs. CMS’s written comments are reprinted in appendix II. CMS also provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from the date of this report. We will then send copies to the Administrator of CMS, appropriate congressional committees, and other interested parties. We will also make copies available to others upon request. This report is also available at no charge on GAO’s Web site at http://www.gao.gov. If you or your staff have questions about this report, please contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Office of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. To examine the extent to which certain Part D sponsors implemented programs to control fraud, waste, and abuse, we conducted on-site reviews at five Part D sponsors. We selected these five sponsors for our review because they each offered a stand-alone Part D prescription drug plan that provided nationwide coverage, varied in enrollment size, and collectively provided coverage for a sizeable proportion of Part D beneficiaries. These five national prescription drug plans (PDP) selected for our review from these five sponsors represented about 35 percent of total Medicare Part D enrollment as of April 2007. Our sample is not generalizable to the entire Part D sponsor population. Four of the five sponsors we reviewed were private health insurance companies and one was a pharmacy benefit manager. For these on-site reviews, we developed a data collection instrument based on: (1) the required compliance plan elements and certain recommended measures for fraud and abuse programs outlined in regulations and chapter 9 of the Part D Prescription Drug Benefit Manual and (2) additional input provided by the Centers for Medicare & Medicaid Services (CMS). CMS’s regulations provided the core required elements of a compliance plan and established a framework for fraud and abuse programs. CMS’s chapter 9 guidance provided several recommendations for how sponsors should implement a program within that framework to control fraud, waste, and abuse as part of an effective Part D compliance plan. Our data collection instrument did not include all of CMS’s recommended measures. We selected recommended measures for inclusion in our data collection instrument based on a variety of factors, such as measures that we judged were the most helpful to fulfilling the purpose of the requirements, measures that were recommended by the OIG and subject-matter experts for compliance program evaluations, including government officials from Veterans’ Affairs (VA) and an industry representative, measures that helped tailor a fraud and abuse program to Part D, and measures that indicated that a required component or procedure had been implemented. For example, CMS required procedures for internal monitoring and auditing, but provided a variety of recommendations on the types of internal monitoring and auditing that could be implemented. We selected the recommendations we considered to be the most helpful to fulfilling the requirements, such as the recommendation to conduct an audit, rather than the recommendation regarding the size, scope, and structure of the internal audit department. This study extends beyond a previous report from the Office of the Inspector General (OIG), which reviewed Part D sponsors’ compliance plans to assess whether the plans addressed all of the requirements and selected recommendations. The OIG limited its assessment to a document review of the compliance plans submitted to CMS and did not assess the extent to which the compliance plans had been implemented. However, we assessed the implementation of the compliance plans by reviewing documentary evidence on-site to examine how sponsors addressed fraud, waste, and abuse specific to Medicare Part D for each of the required elements of each Part D sponsor’s compliance plan. This included the compliance plan and any additional documents, such as procedures, that were referenced in the compliance plan. To complete our data collection instrument, we used documentary evidence to verify implementation of each element. We requested at least one document pertaining to each of the required elements and selected recommended measures. For example, we asked the sponsors to provide a copy of the required auditing procedures and evidence that the Part D sponsor had implemented the auditing procedures as recommended by providing a copy of the findings from at least one audit related to Part D that had been conducted. Our determination of whether sponsors met the criteria for a requirement or recommendation was based on the document’s applicability to Part D and the specific element under review, not the extensiveness of the document’s content. For example, some evidence we accepted contained one section referencing the requirement or recommendation, while other documents were more detailed. All the policies and procedures in the documents we reviewed were implemented by sponsors and in use at the time of our on-site reviews. In addition, we determined that the sponsors’ met the requirements or selected recommendations if they implemented the required element or selected recommended measures in their compliance plan. We also conducted interviews with Part D sponsor senior administrators, and compliance and other staff, including contractors’ employees. To gain a comprehensive picture of the sponsor’s fraud and abuse activities, in some cases, we also interviewed additional staff members involved in Part D functions, including staff from departments such as special investigations, monitoring and auditing, ethics, and pharmacy benefit management. In addition to the contact named above, Martin T. Gahart, Assistant Director; Jennifer Apter; Catina Bradley; Jawaria Gilani; Jennel Harvey; Joy Kraybill; Amy Shefrin; and Jennifer Whitworth made key contributions to this report.

Summary: The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) established a voluntary outpatient prescription drug benefit, known as Medicare Part D. The Centers for Medicare & Medicaid Services (CMS) contracts with private companies to serve as Part D sponsors and administer the Part D prescription drug benefit plans. To protect beneficiaries and the fiscal integrity of the program, the MMA requires Part D sponsors to implement programs to control for fraud and abuse in Part D. Subsequent regulations and guidance from CMS contain requirements and recommended measures for these programs. This report examines (1) the extent to which certain Part D sponsors have implemented programs to control fraud, waste, and abuse and (2) the extent of CMS's oversight of Part D sponsors' programs to control fraud, waste, and abuse. GAO conducted on-site reviews of five of the largest Part D sponsors' fraud and abuse programs. GAO also interviewed officials from CMS and reviewed CMS documents. The five Part D sponsors in GAO's review had not completely implemented all of CMS's required compliance plan elements and selected recommended measures for Part D fraud and abuse programs. All Part D sponsors had completely implemented the requirements and selected recommendations for three of the seven required compliance plan elements. However, Part D sponsors varied in their implementation of the remaining required elements and selected recommended measures. CMS oversight of Part D sponsors' fraud and abuse programs has been limited. To date, CMS's activities have been limited to the review and approval of sponsors' fraud and abuse program plans submitted as part of the initial Part D applications. For example, CMS officials reported that they worked with sponsors to help them develop fraud and abuse program plans that met the agency's compliance plan requirements and recommendations specific to fraud and abuse. However, CMS has not conducted oversight to assess Part D sponsors' implementation of fraud and abuse programs. Officials from CMS stated that the agency had not audited sponsors' implementation of fraud and abuse programs in 2007, and as of April 2008, no audits of these programs had been conducted.