For the approximately 10,000 individuals who age into Medicare every day, the first opportunity to sign up for an MA plan may occur during their initial Medicare election period. After that, beneficiaries in FFS Medicare may enroll in MA—and MA beneficiaries may change their plan selection—during the annual election period from October 15 to December 7. Beneficiaries’ plan selections, effective January 1, are then “locked in” for that calendar year, with some exceptions. CMS grants certain special election periods (SEP) outside of the annual election period when beneficiaries may join MA or change their MA plan selection. For example, MA enrollees who move to states not served by their MA plans are entitled to an SEP to select new coverage. By offering comprehensive coverage and limiting out-of-pocket costs, MA has attracted a substantial number of Medicare beneficiaries. As of May 2015, nearly 16 million beneficiaries, or 30 percent of the Medicare population, were enrolled in approximately 3,800 plan options offered by about 500 MAOs. The Congressional Budget Office has projected that, as the Medicare-eligible population increases, MA enrollment will grow to 30 million beneficiaries, representing about 40 percent of Medicare, by 2025. A fundamental characteristic of MA is that most plans direct enrollees to a limited network of health care providers. The size of a provider network may range from very narrow to fairly broad, depending on the type of plan, the area of the country, and local market characteristics. For example, in urban areas, competition may allow MAOs to recruit providers who are willing to offer discounts on their usual fees in order to be included in the network, providing easy access to an MAO’s many enrollees. However, in rural areas, MAOs may have difficulty organizing an adequate network due to the more limited supply of providers in those areas. To provide beneficiaries with wide access to MA plans, CMS network adequacy requirements take into account differences in utilization, patterns of care, and supply of providers in urban and rural areas. In building their networks, MAOs contract directly with providers. To establish or renew a contract, MAOs negotiate with providers to find agreed-upon payment rates, terms, and duration. MAOs can initiate contracts with providers at any point during the year and can also terminate contracts with network providers at any point. These terminations can be made “for cause,” for such things as a loss of license or breach in contract, or “without cause”—requiring no explanation for the termination. Under Medicare rules, MAOs must give providers written notice at least 60 days in advance of terminating them without cause and must offer providers a process for appealing contract terminations. CMS does not take part in those appeals. To determine whether their current provider, or a provider they wish to use, participates in their MA plan network, beneficiaries commonly rely on provider directories. CMS has published a model directory template, which, though not mandatory, provides MAOs that use it with an expedited agency review. MAOs are required to provide enrollees with paper directories and maintain current directories on their websites at all times. However, research has shown that provider directories issued by insurers often contain inaccurate information and, as a consequence, may mislead beneficiaries about their provider options. The following are examples: The HHS Office of Inspector General reported that 35 percent of 1,800 primary care and specialty providers could not be found at the location listed by the selected Medicaid managed care organizations. The California Department of Managed Health Care called physician offices listed in the provider directories for two large plans in the state’s PPACA marketplace. For Anthem Blue Cross, it found that 12.5 percent of the listings had inaccurate locations and about 13 percent of physicians did not take Anthem Blue Cross patients. For Blue Shield of California, it found that about 18 percent of the listings had inaccurate locations and about 9 percent of physicians did not take Blue Shield of California patients. A study of 4,754 MA dermatology providers listed in directories of large MAOs in 12 metropolitan areas found that about 46 percent of the listings were duplicates and 8.5 percent of the unique providers had died, retired, or moved out of the area. Posing as patients, researchers phoned 360 in-network psychiatrists listed on a major insurer’s website and attempted to make appointments. Sixteen percent of the telephone numbers were wrong and 15 percent of practices were not accepting new patients. Through the annual MAO contracting process, MAOs must attest to the regulatory requirement that they “maintain and monitor a network of appropriate providers that is supported by written agreements and is sufficient to provide adequate access to covered services to meet the needs of the population served.” These networks must also conform to the local pattern of health care delivery. MAOs that do not comply with CMS requirements for network adequacy or do not maintain complete and accurate provider directories may be subject to enforcement actions, including civil monetary penalties or enrollment sanctions. Beginning with contract year 2011, CMS adopted network adequacy criteria designed to be more objective and defensible, as well as updated procedures for reviewing the criteria. Lewin analyzed utilization patterns and standards used by other entities, among other things, to develop the current criteria that CMS regional offices use in conducting their reviews of the MAO submissions. Lewin also revisits network adequacy criteria and CMS oversight processes annually, and provides recommendations for improvement, as needed. To update requirements for MAOs and its oversight of network adequacy, CMS sets forth new policies in its Medicare Managed Care Manual and Marketing Guidelines as well as in its annual Final Call Letter. For example, the 2015 Final Call Letter put forth several changes in network adequacy-related guidance, including a policy that allows an SEP when beneficiaries are affected by significant midyear provider network terminations initiated by MAOs without cause. Through its network adequacy criteria, CMS requires that MAOs have enough providers in their networks to ensure that enrollees can access care within specific travel time and distance maximums. The agency’s quantitative criteria take into account differences in utilization across provider types and patterns of care in urban and rural areas. However, contracting with a certain number and type of providers may not be the same as true provider availability—measured by appointment wait times, providers accepting new patients, or how often a provider practices at a particular location. To varying degrees, provider availability standards have been incorporated broadly into other programs and used in some states to more completely assess the adequacy of provider networks. Since 2011, CMS has defined an adequate MAO network as meeting two criteria: a minimum number of providers and maximum travel time and distance to those providers. These criteria are sensitive to local conditions in that they vary by type of provider and type of county. A minimum number of providers. To determine the minimum number of providers required, CMS considers such county-specific factors as the total number of Medicare beneficiaries and historical data on MA market share in similar counties. CMS sets minimum provider ratios per 1,000 beneficiaries by provider type in each county, for both primary care (including geriatrics and internal medicine) and specialty care (such as cardiology, gastroenterology, and oncology). These ratios differ by the county’s geographic designation as large metro, metro, micro, rural, or counties with extreme access considerations. Maximum travel time and distance. CMS’s time and distance criteria also vary substantially by provider type and county geographic designation. CMS developed these measures—such as 10 minutes/5 miles for primary care providers in large metro counties or 40 minutes/30 miles for primary care providers in rural counties—by juxtaposing beneficiary addresses with provider locations. At least 90 percent of beneficiaries in a county must have access to the appropriate number of providers within the required time and distance maximums. To count toward the threshold, network providers do not have to be located in the same county as beneficiaries as long as they are within the required proximity. Each year, CMS updates its network adequacy criteria for each county and provider type for the subsequent contract year. In advance of contract year 2016, CMS required that MAO networks comprise 55 provider types, including 6 specific primary care provider types, 26 specialty care types, and 23 facility types. For the minimum number of providers criterion, CMS counts each specialty care type separately, but counts all primary care provider types together as one group for mapping purposes. For example, in a metro county with nearly 32,000 total Medicare beneficiaries, each MAO—regardless of the number of plan enrollees—must include in its network at least 7 primary care providers, 2 cardiologists, 2 general surgeons, and 1 of each of the remaining specialty care types. Each MAO in this metro county must also include 47 acute inpatient beds per 1,000 beneficiaries, and one of each of the facility and transplant program types. (For more information on CMS’s network adequacy criteria for contract year 2016, see app. I.) Health care researchers have noted that network adequacy criteria measured by provider type and geographic designation serve to protect beneficiary access while preserving MAO flexibility in provider network design. Furthermore, some researchers have pointed out that quantitative standards derived from sound research provide clarity and certainty, and level the playing field among insurers. In addition, the CMS regional office officials we spoke with expressed a preference for the current criteria. Before 2011, the criteria CMS used were more ambiguous and did not allow for the more objective and consistent application they do now. One beneficiary advocacy group we interviewed described the MA network adequacy criteria as acceptable and appropriate parameters for the program. However, some medical associations we spoke with and recent research by the HHS Office of Inspector General have noted shortcomings in CMS’s reliance on geography-based provider ratios. Medical associations stated that CMS does not obtain information on whether providers in MAO networks are accepting new patients or if the appointment wait times reasonably ensure that patients can see a provider in a timely manner. In commenting on CMS’s draft Call Letter for contract year 2016, a number of medical associations collectively stated that a provider’s full-time equivalent status at a given location should be taken into account to ensure access to care without unreasonable delay. As the HHS Office of Inspector General recent study of Medicaid managed care standards found, when provider availability is not factored into network adequacy criteria, insurers may be able to meet network adequacy criteria even if their network providers are not readily available to all their enrollees. As noted by a Lewin representative, CMS’s priority in updating MA criteria has focused on the number and geographic distribution of providers over other measures of access. She noted, for example, the challenge in identifying network physicians who do not take new MA patients due to practice capacity constraints. Although physicians may choose to participate in multiple health plans or serve FFS patients, MAOs do not require that they report on their practice capacity—that is, the extent to which they contract with other MAOs or the size of their patient panel. Without such data it is difficult to determine the number of potential beneficiaries providers could reasonably serve. Additionally, medical associations told us that CMS’s provider type classifications in the MA criteria mask distinctions within specialties that could have consequences for how MAOs design their networks. The American Academy of Ophthalmology noted that MAOs do not make distinctions for retina or glaucoma specialties. Similarly, the American Society of Retina Specialists reported that it can be challenging for MA enrollees with certain eye conditions to receive treatment when MAOs are not required to include retina specialists in their networks. The American Academy of Dermatology said that dermatologists in plan networks may include subspecialists whose practices focus on certain populations, such as pediatric dermatology. Therefore, counting all specialists regardless of practice focus, as CMS’s criteria do, may overstate the actual number of specialists available to serve MA enrollees. Lewin acknowledged the difficulty in recognizing variation with medical subspecialties as the provider identification data used to establish ratios does not account for these type of breakdowns. For example, because retina specialists are not identified separately from other ophthalmologists in CMS data, there was no way for Lewin to develop subspecialty requirements. Network adequacy standards in other managed care programs we examined cover a variety of approaches to setting network adequacy criteria and differ, to some extent, from MA criteria. To measure the adequacy of provider networks, these standards generally include aspects of provider availability, along with time and distance maximums and provider-to-enrollee ratios. Most of the programs—NAIC’s model act, PPACA marketplaces, and Medicaid managed care—establish minimum network requirements, with states having flexibility to impose additional standards. Since 1996, NAIC has made available to states a model act for network adequacy. To update the model act, NAIC convened a group of state insurance regulators and other interested parties and expects to issue a new model act in 2015. The draft NAIC revised model suggests that states incorporate aspects of provider availability, such as wait times for visits with network providers. NAIC uses a subjective “reasonable access” standard instead of distinct time and distance maximums, which accommodates state differences in geographic accessibility and population dispersion. NAIC’s model act also suggests that states consider provider-to-enrollee ratios for primary and specialty care. While some groups, such as consumer advocates, called on NAIC to establish more quantitative requirements, it has chosen not to be as prescriptive as these groups recommend. QHPs offered in the PPACA marketplaces (whether state-based or federally facilitated) are subject to federal network adequacy standards, which CMS updates in annual rulemaking. CMS used the 1996 NAIC model act for network adequacy as the basis for the PPACA marketplace standards and intends to use the revised model to update requirements applicable to QHPs. States may also impose additional network adequacy requirements on QHPs. Federal rules for PPACA marketplaces do not address network provider availability. Federal regulations do specify that services be accessible without unreasonable delay, but do not include any maximum time or distance requirements. Also, federal regulations do not set any provider-to-enrollee ratios, although QHPs are generally required to contract with a sufficient number of essential community providers, such as federally qualified health centers and other providers that serve predominately low-income, underserved populations. A 2015 Commonwealth Fund study of plans in PPACA marketplaces found that 23 states have quantitative time or distance criteria, while fewer states have quantitative criteria for appointment wait times (11 states) and provider-to-enrollee ratios (10 states). Medicaid managed care organizations are subject to broad federal network adequacy requirements, and states may impose additional or more specific standards. Federal law generally requires a Medicaid managed care organization to provide adequate assurances it has sufficient capacity to serve expected enrollment in its service area. Federal Medicaid regulations contain standards covering different aspects of network adequacy, but do not include any quantitative measures. To address provider availability, regulations require that states consider the numbers of network providers who are not accepting new Medicaid patients. While the rules do not set specific time and distance maximums, regulations point to other access considerations—means of transportation and physical access to care for individuals with disabilities. Additionally, the law does not set specific provider-to-enrollee ratios, but requires that states consider other aspects that would factor into a ratio, including anticipated enrollment, expected utilization, and number and types of providers required to furnish services. In a review of 33 states with Medicaid managed care programs, the HHS Office of Inspector General reported that states typically set standards for appointment wait time, travel time and distance, as well as provider-to-enrollee ratios. These requirements varied widely among the states reviewed, with some differentiation by provider type (primary or specialty care) and location (urban or rural). For example, the states ranged from a maximum appointment wait time for a routine primary care visit of 10 business days in California and Pennsylvania to 45 calendar days in Massachusetts and Minnesota. CMS recently issued a proposed rule that would amend current Medicaid managed care standards to reduce variation in how states evaluate and define network adequacy, and would impose minimum time and distance standards for certain types of providers. TRICARE’s managed care access standards generally have a more quantitative approach. To address provider availability, TRICARE sets appointment wait time limits for routine visits, well-patient visits or specialty care referrals, and urgent care. TRICARE standards set maximum travel times at 30 minutes for primary care and 1 hour for specialty care under normal circumstances. The only aspect of network adequacy standards that TRICARE does not set specific requirements for are provider-to-enrollee ratios, where TRICARE generally requires a sufficient number and mix of specialists to reasonably meet the anticipated needs of enrollees. The inclusion of provider availability in other programs’ network adequacy requirements suggests CMS may be missing a key element for measuring access. In addition, recent health care research we examined and representatives of medical associations we spoke with have suggested that provider availability is a key element for measuring access to care, which most network-based programs have broadly incorporated into federal standards, state standards, or both. While the federal or nationwide requirements are largely broad and subjective, some states have set more quantitative criteria. MA criteria are more robust than those of other programs in terms of distinct travel time and distance for a defined set of providers, but CMS does not assess whether those providers are truly available to enrollees. CMS’s goal has been to set objective measures of network adequacy. Certain programs or states have demonstrated that quantifiable criteria can also extend to measures of provider availability, such as appointment wait time limits. One of CMS’s key MA oversight responsibilities is to ensure that MAOs maintain a network of providers sufficient to meet the needs of all their enrollees. However, CMS limits its annual application of its network adequacy criteria to only those provider networks in counties that MAOs propose to enter in the upcoming year—less than 1 percent of all networks. To facilitate its review of these networks, CMS has established standardized data collection via an automated system. However, the agency performs minimal validation of network data. MAO applicants cannot serve counties without meeting all network criteria, but they may seek—and often receive—exceptions from CMS. While CMS has established criteria defining network adequacy, the agency does not ensure that every network is meeting its current requirements. Instead, it has chosen to collect data for only a minimal subset of MAO networks during the annual application process. Rather than assessing all MAO county-based provider networks against its network criteria, CMS limits its use of the criteria by focusing exclusively on networks in counties that MAOs propose to enter in the upcoming year. During the annual MA application process, CMS’s criteria are only applied against proposed networks, not networks in counties that MAOs already serve. For contract years 2013 through 2015, the agency reviewed over 9,000 proposed networks. CMS approved about half of these networks, while the rest were either withdrawn by MAOs or denied by CMS. (See table 1.) The approval rate varied greatly across the 10 CMS regional offices, ranging from 68 percent at the Atlanta regional office to 22 percent at the San Francisco regional office. The proposed county-based provider networks that CMS approves constitute a fraction of MAO networks and account for a small percentage of enrollees. For contract years 2013 through 2015, new provider networks comprised 0.38 percent of all networks and served 1.99 percent of all MA enrollees during their initial year of operation (see table 2). The small scope of CMS’s network adequacy reviews raise questions as to the agency’s internal controls. For an agency to achieve its objectives, federal internal control standards provide that management must obtain relevant data in a timely manner based on identified information requirements. However, CMS only collects network information for proposed MAO networks during the annual application process. CMS has established a standardized process for collecting data on proposed county-based MAO provider networks. Each January, CMS posts on its website Health Services Delivery (HSD) reference tables that contain network adequacy criteria thresholds for each county. CMS requires MAO applicants to report network data using the HSD table format and transmit the data through the Health Plan Management System (HPMS)—the primary communication tool between CMS and MAOs. The HSD table template has fields to record each network provider’s name, address, provider type, medical affiliation, and employment status. Before submitting their applications to CMS in February, MAOs are able to determine the adequacy of their provider networks by comparing their HSD table data against the thresholds in the HSD reference tables. For example, MAOs planning to enter Cook County, Illinois, for contract year 2016 know from the HSD reference tables that they need at least 92 primary care providers within 10 minutes or 5 miles from at least 90 percent of beneficiaries’ homes in that county, and also know the thresholds for all other required provider types. If MAOs do not meet all the thresholds in Cook County, they may choose, among other options, to contract with more providers to build an adequate network or to not enter that county. After MAOs submit their applications, CMS evaluates their provider networks using an automated system. Through HPMS, CMS performs automated checks, which rely on the HSD reference tables, to determine whether provider networks meet each threshold and then generates two reports on the data errors detected. One report lists problematic address information, such as blank fields, duplicative records, and street addresses and zip codes that are not recognized by the system. The other HPMS report lists all providers shown as supporting the threshold for more than one type of specialty care within a given network. CMS regional office officials praised the automated checks for being far more thorough than the manual review process used before contract year 2011 and for requiring significantly less of their time. Beyond these system- generated reports, CMS does little else to assess the accuracy of the HSD data that MAOs submit. While the HPMS reports identify certain data errors and anomalies, challenges remain with verifying MAO provider network data submissions. In its review of provider submissions, Lewin raised concerns about the validity of addresses in the HSD tables and the overstatement of beneficiary access. In addition, CMS and MAOs both told Lewin they had difficulty verifying provider data. They noted that commonly used verification resources, such as public Medicare websites for comparing physicians or hospitals against quality and cost ratings, often contain incorrect data due to lags in updates and poor provider self-reporting. To address these concerns, Lewin recommended that CMS develop data verification tools to facilitate the accuracy and consistency of application data submissions and HSD table reviews and include more information on the strengths and limitations of commonly used verification resources in its standard operating procedures. While CMS officials said they developed a tool during the contract year 2015 application cycle to facilitate the consistency of submissions, they told us they have no plans to develop additional tools to determine the accuracy of submissions or add information to the standard operating procedures. Federal internal controls call for management to obtain relevant data that have a logical connection with, or bearing upon, identified information requirements; be reasonably free from error and bias; and faithfully represent what they purport to represent. For effective monitoring, management must also evaluate the reliability of data sources. However, CMS does not check the HSD data against other data sources to identify inconsistencies and other indications of error. Officials from one CMS regional office questioned the purpose of cross-checking the HSD data, but officials from another regional office noted that they occasionally call providers and perform Internet searches to verify the data. The lack of data validation is notable because provider directories, which contain the same elements as the HSD data, have been proven to be inaccurate, as previously discussed. Because the HSD data and provider directories are populated from the same source, according to the trade organization that represents MAOs, the HSD data likely contain the same inaccuracies. Inaccuracies in provider directories—and, as an extension, HSD tables— may be attributable to both MAOs and providers. According to the trade organization that represents MAOs, it is a challenge for health plans to ensure that provider directories are up-to-date and accurate because providers often do not notify the plans of changes, such as retirements and office relocations, in a timely manner. The American Academy of Dermatology representatives explained that MAOs are responsible for updating provider directories, in part because MAOs use networks to attract consumers and sell their insurance policies. Representatives from two medical associations reported that they were not aware of any MAO contract requirements regarding updates to directory information. The American Academy of Ophthalmology representatives told us that most providers inform MAOs of address changes, for example, but such notices are not always acted upon by the MAOs. To eliminate the hassle of notifying multiple MAOs of changes in office hours or locations, the representatives proposed the construction of an electronic portal accessible by all health plans to allow providers to update their information in one place. Medical association representatives also contended that MAOs are in a better position to detect when directories need to change, because the absence of claims for a specific period, such as 30 days, would indicate whether a provider has, for example, moved or died. In CMS’s 2016 Final Call Letter, the agency reported plans to conduct direct monitoring of online provider directories to verify the information MAOs include about network providers. The agency also indicated it will consider requiring MAOs to provide, and regularly update, network information in a standardized, electronic format for eventual inclusion in a nationwide provider database readily available to beneficiaries and others. March MAOs whose provider networks do not meet CMS’s network adequacy criteria are able to request exceptions from the criteria. CMS allows MAOs whose proposed networks fail to meet the adequacy criteria for a particular provider type in a county to request an exception from the criteria. After completing the automated checks, CMS provides an opportunity in March to MAOs whose provider networks did not pass the checks to request exceptions from its network criteria along with a justification. If MAOs’ provider networks do not initially pass the automated checks, CMS notifies them and requests updated data, if applicable. HPMS then generates a report that MAOs can use to prepare exception requests for each provider type deemed insufficient. According to CMS, exceptions are intended to be granted under limited circumstances, primarily when its network criteria are not in line with local patterns of care. CMS’s standard operating procedure for reviewing exceptions states that they may be allowed when an insufficient number of providers are located in or near the county, the pattern of care in the county does not support the need to have the required number of providers, or the services of the provider type can be rendered by another provider type. For each exception request, CMS requires MAOs to submit a detailed plan for ensuring access to the services of the provider type for which the exception is being made. MAOs must identify non-contracted providers in or near the county, explain why they have not contracted with those providers, specify the local patterns of care issues they identified, propose another provider type to offer services, and describe each data source used. Along with this information, MAOs must upload in HPMS lists of the network providers that can provide the services of the provider type and the closest network providers of the provider type. CMS’s policy is that an MAO’s refusal to contract with a provider or a provider’s refusal to contract with an MAO is not a valid reason for an exception. April CMS manually reviews the exception requests from MAOs. In April, regional offices—which CMS officials said best understand their markets—review and grant exception requests on a case-by-case basis. Regional office reviewers manually scrutinize each request for the counties in their region. While the Atlanta, Boston, Kansas City, and Philadelphia regional offices approved all the exception requests they reviewed during contract years 2013 through 2015, the San Francisco and Seattle regional offices each approved approximately 80 percent. According to the reviewers we interviewed, it can take 5 minutes to up to a day to review each one, depending on the experience and workload of the reviewer, the complexity and thoroughness of the exception request, and the availability of providers in a county. The reviewers may use Internet search engines and mapping tools to confirm whether providers are at the listed location and may call providers to determine the local pattern of care in a county. Some reviewers told us they also examine state and local medical board information, while others said they perform only spot checks for well-written exception requests. Asked if they considered analyzing Medicare FFS claims data for patterns of care, reviewers from one regional office said such analyses would not be helpful in determining where a county’s beneficiaries customarily obtain health services. They explained that determining the local pattern of care can be subjective and an understanding of the geographic area where exceptions are requested is all that is needed. CMS has approved most exception requests of those it has reviewed over the past 3 years. For contract years 2013 through 2015, CMS reviewed approximately 2,300 exception requests and approved 91.8 percent. For contract year 2015, CMS approved all but 1 of the 641 exception requests it reviewed. (See table 3.) While exceptions may be warranted under certain conditions, CMS never revisits its approved exceptions to see if they continue to be justified. Although provider networks and provider markets are constantly changing, exceptions that are based on a point in time hold indefinitely. Moreover, CMS officials noted that regional office account managers are often not aware of past exceptions that have been granted to existing MAOs. The number of exception requests CMS has reviewed has varied greatly across different types of counties. For contract years 2013 through 2015, less densely populated counties accounted for most exception requests. Approximately 23 percent of the requests were for provider types in counties with extreme access considerations, 24 percent in rural counties, 18 percent in micro counties, 27 percent in metro counties, and 8 percent in large metro counties. Although the time and distance requirements are more generous in less populated areas, the pattern of care may be unusual. Some provider types do not exist in certain rural areas, according to CMS officials, and it may not be unusual for beneficiaries to travel far distances to receive specialty care. In addition, since contract year 2013, the number of exception requests and the CMS approval rate have varied widely across provider types. Of the 2,304 exception requests CMS reviewed over the past 3 years, specialists accounted for 78 percent, facilities for 20 percent, and primary care providers for 2 percent. While the CMS approval rate for exception requests was 78 percent for facilities, it was 95 percent and 96 percent for specialists and primary care providers, respectively. The 4 types of providers with the greatest number of exception requests were gastroenterology (154), dermatology (151), outpatient dialysis facilities (132), and pulmonology (102). The CMS approval rate ranged from 12 percent for chiropractors to 100 percent for infectious diseases, physiatry and rehabilitative medicine, neurosurgery, and 12 other provider types. In addition to chiropractors, the approval rate was notably low for outpatient dialysis facilities (40 percent) and skilled nursing facilities (67 percent). April-May CMS approves or denies MAOs’ applications depending on the adequacy of their provider networks. After the manual review of exception requests ends in late April, CMS either approves the requests or issues a notice of intent to deny the requests. MAOs whose exception requests are not approved have the opportunity to submit revised requests in May, and then CMS makes its final decisions. The regional office reviewers we interviewed noted that they commonly deny requests from MAOs that do not follow the instructions, provide poorly written responses, or do not provide enough information on the local pattern of care. The reviewers explained that many denials are the result of MAOs trying to expand too quickly or being pressured by deadlines. MAOs may choose to withdraw their application for a particular county so that CMS does not deny their entire application. CMS’s regional account managers hold regular discussions with MAOs during which network adequacy issues are sometimes raised, but CMS does not routinely examine MAO information on provider networks to assess ongoing compliance with criteria. CMS recently added a requirement that MAOs disclose their plans to significantly narrow their networks, but the agency has not defined what it means to have a significant change, allowing each MAO to determine the need for disclosure. CMS further expects that evidence of problems related to any undisclosed network narrowing to appear as complaints to the agency, even though some complaints may not be accounted for. As part of its broader MAO oversight activities, CMS regularly holds teleconferences with MAOs, where network issues may or may not be discussed. The agency’s regional account managers monitor compliance with various aspects of MA contracts—such as issues with provider payments—but network adequacy is not always an item for discussion. At the regional offices we interviewed, CMS account managers met with MAOs in varying frequencies, with some meeting weekly and others meeting monthly. Officials from three of the five regional offices told us that account managers regularly prompt MAOs to discuss network issues, such as pending provider contract negotiations; officials at the remaining two told us that network adequacy discussions occur only on an as- needed basis. Moreover, CMS does not routinely collect or review provider network information from MAOs not subject to the application process, leaving nearly all—over 99 percent—of ongoing county-based provider networks unexamined against the current MA criteria. Internal control standards stipulate that agencies should establish and operate ongoing monitoring activities to assess quality performance over time; the standards also note that operating information is needed to determine whether agencies are achieving compliance with requirements under various laws and regulations. Because a plan’s network providers and enrollees change from year to year, the lack of regular review means CMS cannot be assured that MAO networks continue to be adequate, providing sufficient access for enrollees. CMS also never examined the networks that existed before 2011 against the current network adequacy criteria, and as a result, lacks the requisite information needed for proper oversight of network adequacy in the MA program. Lewin analyzed samples of these pre-existing networks and found that most, but not all, of the provider network specialties met current adequacy requirements. Lewin further concluded that more regular assessments of provider networks against the current network adequacy criteria could help ensure that MA plans continue to meet network adequacy criteria and would not be overly burdensome for MAOs. Lewin recommended to CMS that the agency develop a rigorous network monitoring program to ensure that all MAO networks—not just those entering a county for the first time—continue to meet network adequacy criteria. For example, Lewin suggested that CMS consider evaluating each MA plan on a cyclical basis, such as every 3 years. Additionally, officials from two regional offices noted that more regular assessments of adequacy based on HSD data submissions would be an effective monitoring tool. CMS told us that it does not have plans underway to review all networks for adequacy on a cyclical basis, but the agency has announced plans to include network adequacy as a part of its audit process on a pilot basis beginning in late 2015. Under the monitoring processes that CMS has put in place, MAOs must disclose efforts to significantly narrow provider networks, but the agency allows MAOs discretion in determining whether this disclosure is necessary. As of contract year 2015, MAOs must notify CMS at least 90 days prior to significant changes involving provider contract terminations. In deciding whether a network reduction is significant, CMS has not provided any explicit criteria but directed MAOs to take a conservative approach. According to CMS, leaving the definition of significant to each MAO stems from the lack of consensus among stakeholders—including beneficiary advocates and professional associations—about how to define a significant network change. In the event of a self-disclosed significant change, CMS requires MAOs to provide information demonstrating their continued compliance with network adequacy criteria, such as through the submission of updated HSD tables or automated reports. In addition, it requires MAOs to develop and submit a plan for ensuring continuity of care for affected enrollees. If CMS determines that access for a large number of enrollees has been impaired as a result of a significant network reduction, the agency may approve an SEP. This would allow those enrollees to switch MAOs or enroll in FFS Medicare outside the annual open election period. To make this determination, CMS takes into account the number of enrollees affected, the size of the area served, the timing of the termination, and information related to the enrollee notification, but also requires that enrollees demonstrate that they were affected by the loss of their network provider. Some CMS officials we spoke with asserted that MAOs have an incentive to self-disclose major provider network reductions because they are subject to more severe compliance actions if they are not forthcoming about changes impacting access to care. However, from 2011 to early 2015, CMS had taken only one compliance action—issuance of a warning letter—against an MAO for a network adequacy issue. Other MAOs, including Humana and Blue Cross Blue Shield affiliates, have conducted similar provider network narrowing efforts. UHC is presented here because it was the largest MAO in 2014, accounting for 20 percent of total MA enrollment. CMS relies on complaints it receives to identify any problems related to network changes that are not identified through MAO self-disclosure, but does not routinely review complaints made to MAOs directly or data on out-of-network service utilization. CMS tracks complaints from beneficiaries and providers made to its Medicare call center (1-800- MEDICARE), State Health Insurance Assistance Programs, congressional offices, or directly to its regional offices. Complaint information is compiled in CMS’s Complaints Tracking Module (CTM) and categorized by topic before being assigned to a regional office caseworker. Agency officials told us that any network adequacy issues not already disclosed by MAOs would be reflected as a spike in complaints reported by MA enrollees or providers. As a part of the agency’s ongoing monitoring responsibilities, CMS account managers are directed to analyze trends in the CTM data and investigate those trends that they believe need to be addressed, particularly as they relate to beneficiary access issues. Until recently, network adequacy was not a separate category in the CTM but may have been included under other categories, such as one for problems with plan enrollment. In 2014, CMS created a distinct category—”provider or network issues”—to better monitor trends in network-related complaints, but agency officials acknowledge that such complaints may still appear in several other categories. Furthermore, CMS does not routinely ask MAOs about the complaints they receive through their customer service lines or information about out- of-network utilization. In the event an MAO discloses significant network changes, CMS may follow up about the types of complaints the MAO subsequently receives, but the agency does not regularly do so. In addition, CMS does not collect data from MAOs on how frequently enrollees claim care from out-of-network providers, which would provide account managers an additional tool to evaluate access in provider networks. CMS requires that MAOs make a good faith effort to give enrollees advance written notice when a provider contract is terminated, but has not established information requirements for those notices. MAOs are expected to send a letter to affected enrollees at least 30 calendar days before the effective date of termination, and CMS suggests a longer notification period in the event of a significant change to a provider network. CMS issued guidance in its 2015 Final Call Letter that suggests that, as a best practice, MAOs include information on in-network providers to replace terminated providers in their notification letters to enrollees. CMS also recommended that notices indicate how enrollees can request continuation of ongoing medical care—such as chemotherapy or post-operative rehabilitation—from the enrollee’s current provider at in-network rates for a limited period of time. Unlike some other beneficiary communications, CMS has not developed a model template or list of required content for these notices. The agency maintains standards for other MAO material distributed to beneficiaries to ensure clarity and completeness. For example, CMS developed models for MAO marketing materials, including provider directories. MAOs may use a directory format different from the model directory, but it must contain, at a minimum, all the same information elements required in the model directory. Similarly, MA plans offering prescription drug coverage must mail standardized annual notices of change to enrollees that contain CMS-required elements about formularies and pharmacies. Yet, CMS does not require that enrollee notifications of provider terminations include all pertinent information in an understandable format. Furthermore, CMS does not regularly review sample notices of terminated providers sent to enrollees. For instance, officials at one regional office told us that MAO account managers would review enrollee notification letters only in the event of significant terminations. Officials at four other regional offices did not identify this as a triggering event for review. CMS officials explained that these notifications are considered ad hoc communications and are classified as materials that are not subject to marketing review. CMS regulations prohibit MAOs from engaging in marketing activities, including communications about provider networks, that could mislead or confuse Medicare beneficiaries. In addition, internal control standards state that management should ensure there are adequate means of communicating with, and obtaining information from, external stakeholders that may have a significant impact on the agency achieving its goals. Because CMS neither requires specific information elements nor reviews notifications, enrollees may receive inconsistent and potentially confusing or inaccurate information when their providers are terminated from MAO networks. For example, communication we examined indicated that enrollees had been told by their MAO to select a new provider long before the effective termination date for their current provider. An MAO wrote to a primary care physician on May 21, 2014, stating that his contract with the MAO would end May 11, 2015, the anniversary date of the agreement. Then the MAO sent a letter to that physician’s patient, dated June 3, 2014, stating that he must select a new primary care provider by July 8, 2014, or one would be chosen for him. Thus, although the enrollee could have continued receiving care from his network physician for another 10 months, the MAO shifted the physician’s patients to other providers. CMS is responsible for ensuring that Medicare beneficiaries can access timely care. To do this effectively, the agency must set appropriate MA network adequacy criteria, oversee MAOs’ adherence to its requirements, and ensure that enrollees are properly notified about MAO network changes. Yet, the rules and processes the agency has put in place— which lack certain elements used in other managed care programs and outlined in federal internal controls—cannot reasonably ensure that MAO networks continue to meet the needs of MA enrollees. CMS has established network adequacy criteria that put a premium on the number of providers in a network within county-based time and distance standards. The advantage of such quantitative criteria is that they can be operationalized through automated processes. However, unlike those of some other managed care programs, the CMS criteria ignore measures of provider availability. CMS does not consider whether an MAO’s contracted providers are part-time, work at their listed locations, or are taking new patients. As a result, provider networks may appear to regulators and beneficiaries as more robust than they actually are if not all providers are open for business. Under current CMS policy, the agency cannot be sure that all MAO networks either fully meet its current criteria or qualify for an exception. Although Medicare contracts with MAOs every year, CMS does not require that MAOs demonstrate compliance with network adequacy criteria every year. Instead, CMS performs systematic reviews of network adequacy for only a small fraction of MA networks, relying on information that is supplied by MAOs but is not fully checked for accuracy. For the vast majority of plans, MAOs annually attest that they have an adequate network, and CMS accepts that statement without verification. The agency’s approach to monitoring existing networks is largely reactive, relying on MAO disclosure of adequacy issues and beneficiary and provider complaints. Unless CMS verifies provider information submitted by MAOs and periodically requires evidence of compliance, for example every 3 years, the agency cannot be confident that MAOs are meeting network adequacy criteria. Furthermore, while CMS requires that MAOs make a good faith effort to notify enrollees in advance of a provider termination, the agency has no standards for those notices. Also, unlike some beneficiary communication and plan marketing materials, MAO notification letters are not subject to any minimum information requirements. Without greater standardization, the agency cannot ensure that MAO communications are clear, accurate, and complete, and MA enrollees remain at risk of receiving potentially confusing information. To improve its oversight of network adequacy in MA, we recommend that the Administrator of CMS augment MA network adequacy criteria to address provider verify provider information submitted by MAOs to ensure validity of the Health Services Delivery data; expand network adequacy reviews by requiring that all MAOs periodically submit their networks for assessment against current Medicare requirements; and set minimum requirements for MAO letters notifying enrollees of provider terminations and require MAOs to submit sample letters to CMS for review. We provided a draft of this report to HHS for comment. The agency provided written comments, which are printed in appendix II. In addition, CMS provided technical comments, which we incorporated as appropriate. HHS concurred with our recommendations. In its comment letter, the agency outlined several actions it plans to take, or is considering, to strengthen its oversight of MAO network adequacy. Because these efforts have yet to be implemented, it is too early to determine whether they will fully address the issues we identified. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution of it until 30 days from its date. At that time, we will send copies to the appropriate congressional committees, the Secretary of Health and Human Services, and the CMS Administrator. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. The Centers for Medicare & Medicaid Services (CMS) uses two criteria for determining network adequacy in Medicare Advantage (MA): minimum number of providers and maximum travel time and distance. There are several key elements CMS uses each year to update its requirements. One key element is the provider types that MA organizations (MAO) must include in their networks. Lewin—the agency contractor that developed the criteria—explained that CMS had an original list of provider types that it reviewed to see if the categorizations were appropriate. They found that CMS’s list was mostly aligned with frequently used facility types. The 55 provider types required in contract year 2016 are listed in table 4. For the minimum number of providers, CMS requires that MAOs demonstrate that their networks have a sufficient number of providers based on county characteristics. The five county classifications are based on population and density estimates from U.S. Census Bureau and Office of Management and Budget data. A county must meet both the population and density indicators to be included as that county type. CMS then multiplies three variables to determine the minimum number of providers. The first variable is the 95th percentile of MA market penetration rates for each county type. CMS chose the 95th percentile to estimate market share through work conducted by Lewin, which examined the market penetration in managed care and network-based private fee-for-service (FFS) plans. The percentiles are updated each year based on current enrollment. County type classifications and each county’s respective percentile for contract year 2016 are listed in table 5. The second variable in the formula is the number of Medicare beneficiaries—those in MA and FFS—in a specific county. Each year, CMS updates the total number of beneficiaries in each county. This variable is multiplied with that year’s 95th percentile of MA market penetration in the respective county type to determine the number of beneficiaries an MAO could reasonably serve in its initial year in the proposed county. For example, the 95th percentile for metro counties in contract year 2016 was 12.1 percent. For an MAO seeking to enter that county, the 95th percentile (0.121) would be multiplied by the total number of Medicare beneficiaries in the county the MAO proposes to enter to develop the number of beneficiaries the MAO must cover. The third and final variable in the calculation is the established ratios of provider types required per 1,000 beneficiaries for each county type. CMS bases the established ratios on primary and secondary research of utilization patterns and clinical needs of beneficiaries. To calculate the minimum number of each provider type in each county, CMS multiplies the ratio for each provider type by the number of beneficiaries an MAO must cover and then rounds up to the nearest whole number. Table 6 illustrates the calculation for a minimum number of providers for primary care in Muscogee, Georgia, which is a metro county. For maximum travel time and distance, CMS requires that MAOs ensure that their networks meet specific geographic metrics. CMS uses geo- mapping software to determine the distance between the locations of beneficiaries’ addresses and network provider practices. For each county MAOs propose to enter, they must show that at least 90 percent of beneficiaries in that county will have access to at least one provider of each type within CMS’s time and distance criterion for the applicable county type. In addition to the contact named above, Rosamond Katz, Assistant Director; Sandra George; David Grossman; Kate Nast Jones; and E. Jane Whipple made key contributions to this report.

Summary: MAOs contract with a network of providers to manage health care delivery to their enrollees. MAOs can initiate or terminate contracts with providers at any time for any reason. Recently, some MAOs have been narrowing their provider networks, prompting concerns about ensuring enrollee access to care and CMS's oversight of MAO compliance with network adequacy criteria. GAO was asked to review how CMS ensures adequate access to care for MA enrollees. This report examines (1) how CMS defines network adequacy and how its criteria compares with other programs, (2) how and when CMS applies its criteria, (3) the extent to which CMS conducts ongoing monitoring of MAO networks, and (4) how CMS ensures that MAOs inform beneficiaries about terminations. GAO reviewed CMS and other guidance on network adequacy, federal regulations, and standards for internal control. GAO also interviewed CMS officials and representatives of medical associations and beneficiary advocacy groups, and analyzed CMS data on oversight of MAO provider networks for contract years 2013 through 2015. The Centers for Medicare & Medicaid Services (CMS) is the agency within the Department of Health and Human Services (HHS) responsible for overseeing the Medicare Advantage (MA) program—Medicare's private plan alternative. Since 2011, CMS has defined an adequate MA provider network as meeting two criteria: a minimum number of providers and maximum travel time and distance to those providers. To reflect local conditions, the requirements are specific to different county types and a range of provider types. However, the MA criteria do not reflect aspects of provider availability, such as how often a provider practices at a given location. In contrast, other network-based health programs use provider availability measures to assess network adequacy. For example, federal Medicaid managed care rules address providers' ability to accept new patients and TRICARE criteria address appointment wait times for active duty servicemembers. Without taking availability into account, as is done in some other programs, MA provider networks may appear to CMS and beneficiaries as more robust than they actually are. CMS applies its network adequacy criteria narrowly. Rather than assessing all county-based provider networks against its criteria, CMS limits its annual application of the criteria to provider networks in counties that MA organizations (MAO)—private organizations that offer one or more health benefit plans—propose to enter in the upcoming year. From 2013 through 2015, CMS's reviews accounted for less than 1 percent of all networks. To facilitate its review of these networks, CMS has established standardized data collection via an automated system. However, CMS does little to assess the accuracy of the network data in applications MAOs submit, even though the submissions contain the same data elements as in provider directories, which have been shown to be inaccurate in a number of government and private studies. Until CMS takes steps to verify MAO provider information, as outlined in federal internal control standards, the agency cannot be confident that MAOs meet network adequacy criteria. For established provider networks, CMS does not require MAOs to routinely submit updated network information for review, but may learn of any adequacy issues through its broader oversight of MAOs. CMS recently required that MAOs disclose efforts to significantly narrow provider networks, allowing MAOs to determine when such disclosure is necessary. CMS also relies on complaints it receives to identify any problems related to network changes that are not otherwise identified. However, contrary to internal control standards, CMS does not measure ongoing MAO networks against its current MA criteria. Because a plan's providers may change at any time, CMS cannot be assured that networks continue to be adequate and provide sufficient access for enrollees until the agency collects evidence of compliance on a regular basis. While CMS requires that MAOs give enrollees advance notice when a provider contract is terminated, the agency has not established information requirements for those notices and does not review sample notices sent to enrollees. This lack of scrutiny appears inconsistent with the agency's oversight of other Medicare beneficiary communications and with internal controls. Without a minimum set of required information elements and a check on adherence to them, the agency cannot ensure that MAO communications are clear, accurate, and consistent. The Administrator of CMS should augment oversight of MA networks to address provider availability, verify provider information submitted by MAOs, conduct more periodic reviews of MAO network information, and set minimum information requirements for MAO enrollee notification letters. HHS concurred with the recommendations.