In our June 2015 and April 2016 reports examining CMS screening procedures, we found weaknesses in CMS’s verification of provider practice location, physician licensure status, providers listed as deceased or excluded from participating in federal programs or health care–related programs, and criminal-background histories. These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers. We made recommendations to address these weaknesses, which CMS has indicated it has implemented or is taking steps to address. Additionally, as a result of our work, we referred 597 unique providers and suppliers to CMS. According to CMS officials, they have taken some actions to remove or recover overpayments from the potentially ineligible providers and suppliers we referred to them in April 2015 and April 2016, but CMS’s review and response to the referrals are ongoing. In our June 2015 report, we found thousands of questionable practice location addresses for providers and suppliers listed in PECOS, as of March 2013, and DMEPOS suppliers, listed as of April 2013. Under federal regulations, providers and suppliers must be “operational” to furnish Medicare covered items or services, meaning that they have a qualified physical practice location that is open to the public for the purpose of providing health care–related services. The location must be properly staffed, equipped, and stocked to furnish these items or services. Addresses that generally would not be considered a valid practice location include post office boxes, and those associated with a certain type of CMRA, such as a United Parcel Service (UPS) store. We checked PECOS practice location addresses for all records that contained an address using the USPS address-management tool, a commercially available software package that standardizes addresses and provides specific flags on the address such as a CMRA, vacant, or invalid address. As illustrated in figure 1, on the basis of our analysis of a generalizable stratified random sample of 496 addresses, we estimate that about 23,400 (22 percent) of the 105,234 addresses we initially identified as a CMRA, vacant, or invalid address are potentially ineligible addresses. About 300 of the addresses were CMRAs, 3,200 were vacant properties, and 19,900 were invalid. Of the 23,400 potentially ineligible addresses submitted as practice locations, we estimate that, from 2005 to 2013, about 17,900 had no claims associated with the address, 2,900 were associated with providers that had claims that were less than $500,000 per address, and 2,600 were associated with providers that had claims that were $500,000 or more per address. Because some providers are associated with more than one address, it is possible that some of the claim amounts reported may be associated with a different, valid practice location. Due to how we compiled claims by the National Provider Identifier, we were unable to determine how much, if any, of the claim amount may be associated with a different, valid address. In our June 2015 report, we found limitations with CMS’s Finalist software used to validate practice location addresses. The Finalist software is one technique used by the Medicare Administrative Contractors (MAC) and the National Supplier Clearinghouse (NSC) to validate a practice location. According to CMS, Finalist is integrated into PECOS to standardize addresses and does so by comparing the address listed on the application to USPS records and correcting any misspellings in street and city names, standardizing directional markers (such as NE or West) and suffixes (such as Ave. or Lane), and correcting errors in the zip code. However, the Finalist software does not indicate whether the address is a CMRA, vacant, or invalid address—in other words, whether the location is potentially ineligible to qualify as a legitimate practice location. CMS does not have these flags in Finalist because the agency added coding in PECOS that prevents post office box addresses from being entered, and believed that this step would prevent these types of ineligible practice locations from being accepted. Further, some CMRA addresses are not listed as post office boxes. For example, in our June 2015 report we identified 46 out of the 496 sample addresses that were allowed to enroll in Medicare with a practice location that was inside a mailing store similar to a UPS store. These providers’ addresses did not appear in PECOS as a post office box, but instead were listed as a suite or other number, along with a street address. Figure 2 shows an example of one provider we identified through our search and site visits as using a mailbox-rental store as its practice location and where services are not actually rendered. This provider’s address appears as having a suite number in PECOS and remained in the system as of January 2015. According to our analysis of CMS records, this provider was paid approximately $592,000 by Medicare from the date it enrolled in PECOS with this address to December 2013, which was the latest date for which CMS had claims data at the time of our review. Our June 2015 report also found locations that were vacant or addresses that belonged to an unrelated establishment. For example, we visited a provider’s stated practice location in December 2014 and instead found a fast-food franchise there (see fig. 3—the name of the franchise has been blurred). In addition, we found a Google Maps image dated September 2011 that shows this specific location as vacant. Although the provider was not paid by Medicare from the date this practice location address was flagged as vacant, by remaining actively enrolled into PECOS, the provider may be eligible to bill Medicare in the future. In March 2014, CMS issued guidance to the MACs that revised the practice location verification methods by requiring MACs to only contact the person listed in the application to verify the practice location address and use the Finalist software that is integrated in PECOS to standardize the practice location address. Additional verification, such as using 411.com and USPS.com, which was required under the previous guidance, is only needed if Finalist cannot standardize the actual address. In our June 2015 report, we noted that our findings suggest that the revised screening procedure of contacting the person listed in the application to verify all of the practice location addresses may not be sufficient to verify such practice locations. For example, two providers in our sample of 496 addresses that the USPS address-management tool flagged as CMRA, invalid, or vacant successfully underwent a MAC revalidation process in 2014. The MAC used the new procedure of calling the contact person to verify the practice location. Each of these two providers had a UPS or similar store as its practice location. To help further improve CMS’s enrollment-screening procedures to verify applicants’ practice location, we made two recommendations to CMS in our June 2015 report. First, we recommended that CMS modify the CMS software integrated into PECOS to include specific flags to help identify potentially questionable practice location addresses, such as CMRA, vacant, and invalid addresses. The agency concurred with this recommendation. On May 16, 2016, CMS provided us with supporting documentation that shows that the agency replaced its current PECOS address verification software to include Delivery Point Verification (DPV)—which is similar to the software we used when conducting the work in the June 2015 report—as an addition to the existing functionality. According to CMS officials, this new DPV functionality flags addresses that may be CMRA, vacant, or invalid. By updating the address verification software, CMS can ensure that providers with ineligible practice location are not listed in PECOS. Second, we recommended in our June 2015 report that CMS revise its guidance for verifying practice locations to include, at a minimum, the requirements contained in the guidance in place prior to March 2014. Such a revision would require that MACs conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a CMRA, vacant, or invalid address to better ensure that the address meets CMS’s practice location criteria. The agency did not concur with this recommendation, stating that the March 2014 guidance was sufficient to verify practice locations. However, our audit work shows that additional checks on addresses flagged by the address-matching software as a CMRA, vacant, or invalid can help verify whether the addresses are ineligible. As our report highlighted, we identified providers with potentially ineligible addresses that were approved by MACs using the process outlined in the existing guidance. Therefore, we continue to believe that the agency should update its guidance for verifying potentially ineligible practice locations. In February 2016, CMS officials told us that, as part of configuring the PECOS address verification software to include the DPV functionality and flag CMRAs, vacancies, invalid addresses, and other potentially questionable practice locations, the agency plans to validate the DPV through site visits and follow its current process to take administrative action if the results are confirmed. CMS officials told us that they believe that by implementing the first recommendation by incorporating software flags and revising its guidance for verifying potentially ineligible practice location, if necessary, the second recommendation will be addressed. As of May 17, 2016, CMS had not provided us with details and supporting documentation of how it will revise its guidance. Accordingly, it is too early for us to determine whether the agency’s actions would fully address the intent of the recommendation. We plan to continue to monitor the agency’s efforts in this area. CMS has taken some actions to remove or recover overpayments from potentially ineligible providers and suppliers that we referred to it, based on our June 2015 report. On April 29, 2015, we referred 286 unique providers to CMS for further review and action as a result of our identification of providers with potentially ineligible practice location address. From August 2015 to May 2016, CMS has provided updates on these referrals. On the basis of our analysis of CMS’s updates, CMS has taken the following actions: taken administrative action to remove the provider or collect funds for 29 of the providers, corrected the invalid addresses for 70, determined that the questionable location was actually valid for 84, determined that the provider had already been removed from the program for 102. However, CMS did not take action on 1 provider because it was unable to find the practice location for this provider. In our June 2015 report, we found 147 out of about 1.3 million physicians with active PECOS profiles had received a final adverse action from a state medical board, as of March 2013. Adverse actions include crimes against persons, financial crimes, and other types of health care–related felonies. These individuals were either not revoked from the Medicare program until months after the adverse action or never removed (see fig. 4). All physicians applying to participate in the Medicare program must hold an active license in the state they plan to practice in and also to self- report final adverse actions, which include a license suspension or revocation by any state licensing authority. CMS requires MACs to verify final adverse actions that the applicant self-reported on the application directly with state medical board websites. We found that because physicians are required to self-report adverse actions, the MACs did not always identify unreported actions when enrolling, revalidating, or performing monthly reviews of the provider. As a result, 47 physicians out of the 147 physicians we identified as having adverse actions have been paid approximately $2.6 million by the Medicare program during the time CMS could have potentially barred them from the Medicare program between March 29, 2003, and March 29, 2013. Some of the adverse actions that were unreported by physicians occurred within the state where the provider enrolled in PECOS, while others occurred in different states. For example, we identified a physician who initially enrolled into Medicare in 1985 and was suspended for about 5 months in 2009 by the Rhode Island medical board. In 2011, his information was revalidated by the MAC. This provider did not self-report the adverse action, and the MAC did not identify it during its monthly reviews or when revalidating the provider’s information. CMS bars providers that are already enrolled in Medicare who do not self-report adverse actions for 1 year. This individual billed Medicare for about $348,000 during the period in which he should have been deemed ineligible. CMS officials highlighted that delays in removing physicians from Medicare may occur due to MAC backlogs, delays in receipt of data from primary sources, or delays in the data-verification process. In March 2014, CMS began efforts to improve the oversight of physician license reviews by providing the MACs with a License Continuous Monitoring report, which was a good first step. However, the report only provides MACs with the current status of the license that the provider used to enroll in the Medicare program. Without collecting license information on all medical licenses, regardless of the state the provider enrolled in, we concluded that CMS may be missing an opportunity to identify potentially ineligible providers who have license revocations or suspensions in other states, which can put Medicare beneficiaries at risk. To help improve the Medicare provider enrollment-screening procedures, in our June 2015 report we recommended that CMS require applicants to report all license information including that obtained from other states, expand the License Continuous Monitoring report to include all licenses, and at least annually review databases, such as that of FSMB, to check for disciplinary actions. The agency concurred with the recommendation, but stated it does not have the authority to require providers to report licenses for states in which they are not enrolled. While providers are not currently required to list out-of-state license information in the enrollment application, CMS can independently collect this information by using other resources. Therefore, we clarified our recommendation to state that CMS should collect information on all licenses held by providers that enroll into PECOS by using data sources that contain this information, which is similar to the steps that we took in our own analyses. In February 2016, CMS officials told us that CMS will take steps to ensure that all applicants’ licensure information is evaluated as part of the screening process by MACs and the License Continuous Monitoring report, as appropriate, and will also regularly review other databases for disciplinary actions against enrolled providers and suppliers. In May 2016, CMS officials stated that CMS has established a process to annually review databases and has incorporated the FSMB database into its screening process. On May 19, 2016, CMS officials provided us with supporting documentation that shows that the FSMB database was incorporated into its automatic screening process. By incorporating the FSMB database into its automatic screening process, CMS will be able to regularly check this database for licensure updates and disciplinary actions against enrolled providers and suppliers, as well as to collect all license information held by providers that apply to enroll in PECOS. On April 29, 2015, we referred the 147 unique providers to CMS for further review and action as a result of our identification of revoked licenses. On the basis of our analysis of CMS’s updates as of May 2016, CMS has taken the following actions: taken administrative action to remove the provider or collect funds for 21 providers, determined that the provider had already been removed from the determined that the adverse actions were disclosed or partially disclosed for 71, and has ongoing reviews of 6. CMS did not take action on 1 provider because it was unable to find the adverse action for this provider. In our June 2015 report, we found that about 460 (0.03 percent) out of the 1.7 million unique providers and suppliers in PECOS as of March 2013 and DMEPOS suppliers as of April 2013 were identified as deceased at the time of the data we reviewed. The MAC or CMS identified 409 of the 460 providers and suppliers as deceased from March 2013 to February 2015. Additionally, 38 out of the 460 providers and suppliers we found to be deceased were paid a total of about $80,700 by Medicare for services performed after their date of death until December 2013, which was the most-recent date CMS had Medicare claims data available at the time of our review. Not identifying a provider or supplier as deceased in a timely manner exposes the Medicare program to potential fraud. It is unclear what caused the delay or omission by CMS and the MACs in identifying these individuals as deceased or how many overpayments they are in the process of recouping. On April 29, 2015, we referred 82 unique providers to CMS for further review and action as a result of our identification of providers whose status was deceased. From August 2015 to May 2016, CMS has provided updates on these referrals. On the basis of our analysis of CMS’s updates, CMS has taken the following actions: taken administrative action to remove the provider for 4 of the providers, determined that the provider had already been removed from the determined that the provider had already been removed from the program but updated the provider’s PECOS profile to reflect the date of death for 22, and started but not completed the review on 31 providers that were reported to be deceased and had submitted claims for payments. We found in our June 2015 report that about 40 (0.002 percent) out of the 1.7 million unique providers and suppliers enrolled in PECOS were listed in LEIE, as of March 2013. These individuals were excluded from participating in health care–related programs. Of those 40 excluded providers and suppliers, 16 were paid approximately $8.5 million by Medicare for services rendered after their exclusion date until the MAC or the NSC found them to be excluded. When we followed up with the MACs in September and October 2014, we found that the MACs had removed 38 of the 40 providers and suppliers from PECOS from March 2013 to October 2014. However, for two matches that we identified, the MACs had not taken any action. Given the small number of cases identified (40) and the MACs’ removal of 38 out of these 40 providers during our review, we did not make a recommendation to CMS. On April 29, 2015, we referred the two providers that the MACs did not remove, as well as the 16 providers that were paid $8.5 million by Medicare for services rendered after their exclusion date, to CMS for further review and action. From August 2015 to May 2016, CMS has provided updates on these referrals. On the basis of our analysis of CMS’s updates, CMS did not take action on 2 providers because CMS deemed the providers eligible. Further, CMS has not completed the review on 14 providers that were reported to be excluded and had submitted claims for payments. As part of CMS’s enrollment-screening process, CMS has controls in place to verify criminal-background information for providers and suppliers in PECOS. CMS may deny or revoke a provider’s or supplier’s enrollment in the Medicare program if, within the 10 years before enrollment or revalidation of enrollment, the provider, supplier, or any owner or managing employee of the provider or supplier was convicted of a federal or state felony offense, including certain felony crimes against persons, that CMS has determined to be detrimental to the best interests of the program and its beneficiaries. In our April 2016 report, we found that 16 out of 66 potentially ineligible providers we identified with criminal backgrounds received $1.3 million in potential overpayments. These providers were convicted of drug and controlled substance, health-care, mail and wire fraud, or sex-related offenses and were enrolled in Medicare before CMS had implemented more-extensive background check processes in April 2014. Before CMS revised procedures for reviewing the criminal backgrounds of existing and prospective Medicare providers and suppliers in April 2014, the agency relied on verifying applicants’ self-reported adverse legal actions by checking whether providers and suppliers had previously lost their licenses because of a conviction such as a crime against a person. CMS also checked whether the HHS OIG had excluded providers and suppliers from participating in federal health-care programs. According to CMS, it also relied on Zone Program Integrity Contractors (ZPIC) to identify providers and suppliers with a conviction history. However, CMS did not always have access to federal or state offense information that identified the cause of a provider’s or supplier’s license suspension or exclusion from participating in federal health-care programs, which could have led to an earlier ineligibility date. In our April 2016 report, we found 52 providers whose offenses occurred before the removal effective date that was provided to us by the MACs and 14 additional providers that CMS did not remove. As mentioned earlier, out of these 66 providers, 16 were paid about $1.3 million by Medicare through the fee-for-service program. Specifically, 10 providers were paid about $1.1 million between the time they were initially convicted of a crime and the time that they were officially removed from the program, and six other providers that were not removed were paid about $195,000 during the year after their conviction. We referred all 66 cases to CMS for further review and requested an initial status update on these providers by June 20, 2016. On May 16, 2016, CMS stated that it determined that 52 of the providers had already been deactivated or revoked; however, our report indicates that these providers were deactivated and revoked and the effective removal date needed review. Further, CMS indicated that it will continue to review these providers to determine whether additional updates or actions are needed since we found that theses providers had offenses that occurred before the removal effective date that was provided by the MACs. Further, CMS informed us that it will continue to review the remaining 14 providers. Additionally, in April 2016, we reported that in April 2014 CMS implemented steps that provide more information on the criminal backgrounds of existing and prospective Medicare providers and suppliers than it obtained previously. Specifically, CMS supplemented its criminal-background controls by screening provider and supplier criminal backgrounds through an automated screening process. Under this revised process, MACs are to review an applicant’s self-reported license information and whether the applicant has been excluded from participating in federal health-care programs. In addition, CMS receives information from ZPICs, which provide a conviction history on providers and suppliers they investigate. The automated-screening contractor is to supplement these controls by conducting criminal-background checks on providers, suppliers, and organization principals (i.e., individuals with 5 percent or more ownership in the business). The contractor uses third- party vendor applications available to the public to conduct the criminal- background checks. As a result, CMS and its contractors obtain greater access to data about federal and state offenses and the ability to conduct a more-comprehensive review of provider and supplier criminal backgrounds than in the past. Chairman Murphy, Ranking Member DeGette, and Members of the subcommittee, this concludes my prepared remarks. I look forward to answering any questions that you may have at this time. If you or your staff have any questions about this testimony, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals making key contributions to this testimony were Latesha Love, Assistant Director; Gloria Proa; Ariel Vega; and Georgette Hagans. Additionally, Marcus Corbin; Colin Fallon, and Maria McMullen provided technical support; Shana Wallace, Jim Ashley, and Melinda Cordero provided methodological guidance; and Brynn Rovito and Barbara Lewis provided legal counsel. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: In fiscal year 2015, Medicare paid $568.9 billion for health care and related services. CMS estimates that $59.6 billion (about 10.5 percent) of that total was paid improperly. To establish and maintain Medicare billing privileges, providers and suppliers must be enrolled in a CMS database known as PECOS. About 1.9 million providers and suppliers were in PECOS as of December 2015, according to CMS. GAO published reports in June 2015 and April 2016 that examined Medicare's provider and supplier enrollment-screening procedures to determine whether PECOS was vulnerable to fraud. This testimony discusses the extent to which selected enrollment-screening procedures are designed and implemented to prevent and detect the enrollment of ineligible or potentially fraudulent Medicare providers and suppliers into PECOS. In its reports, GAO matched providers and suppliers in PECOS, as of March 2013, to several databases to identify potentially ineligible providers and suppliers, and used Medicare claims data to verify whether they were paid during this period. GAO also examined relevant documentation, interviewed CMS officials, and obtained information from the CMS contractors that evaluate provider applications. From August 2015 through May 2016, GAO obtained updated information from CMS staff and reviewed documents related to actions. CMS has taken or has plans to take some actions to address all of GAO's recommendations and referrals of potentially ineligible providers and suppliers. In June 2015 and April 2016, GAO reported on CMS's implementation of enrollment-screening procedures that the Centers for Medicare & Medicaid Services (CMS) uses to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling into its Provider Enrollment, Chain and Ownership System (PECOS). GAO identified weaknesses in CMS's verification of provider practice location, physician licensure status, and criminal-background histories. These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers. Specifically, in June 2015, GAO's examination of 2013 data found that about 23,400 (22 percent) of 105,234 of practice location addresses were potentially ineligible. The computer software CMS used as a method to validate applicants' addresses did not flag potentially ineligible addresses, such as those that are of a Commercial Mail Receiving Agency (such as a UPS store mailbox), vacant, or invalid. GAO recommended that CMS incorporate flags into its software to help identify potentially questionable addresses, among other things. CMS concurred with this recommendation and has replaced the PECOS address verification software. Also, in June 2015, GAO found that, as of March 2013, 147 out of about 1.3 million physicians listed in PECOS had received a final adverse action against their medical license from a state medical board for various felonies that may have made them ineligible to bill Medicare. However, they were either not revoked from the Medicare program until months after the adverse action or never removed because CMS only collected information on the medical license numbers providers used to enroll into the Medicare program. CMS also did not collect adverse-action history or other medical licenses a provider may have in other states that were not used to enroll into Medicare. GAO recommended that CMS collect and review additional license information. CMS has incorporated a new database to obtain additional license history. In April 2016, GAO reported on CMS's process to conduct criminal-background checks on Medicare providers and suppliers and found that opportunities exist for CMS to recover about $1.3 million in potential overpayments made to 16 out of 66 potentially ineligible providers with criminal backgrounds. In April 2014, CMS implemented procedures to obtain greater access to data to verify criminal backgrounds of existing and prospective Medicare providers and suppliers than it obtained previously; however, the results of GAO's review of the 2013 data identified an opportunity for CMS to recover potential overpayments that were made prior to putting the revised procedures in place. In addition to its actions in response to GAO's recommendations, CMS has taken some actions to remove or recover overpayments from potentially ineligible providers and suppliers that GAO referred to it in April 2015 and April 2016, but its review and response to the referrals are ongoing.