About three-quarters of all Medicare beneficiaries receive their care on a fee-for-service basis, with providers submitting claims for payment for each service provided. CMS contracts with claims administration contractors—primarily MACs—to process claims from over 1 million hospitals, physicians, and other health care providers. In fiscal year 2011, MACs and other claims administration contractors processed about 1.2 billion claims. Medicare claims administration contractors have had a role in determining coverage since 1965, when the Medicare program was enacted. At that time, Congress arranged for many Medicare functions to be contracted out to private insurers to allow the program to be implemented rapidly by organizations already processing claims for hospitals and physicians. Medicare law defines the categories of services covered by the program and provides the Secretary of the Department of Health and Human Services (HHS) with the authority to specify which services within these categories are covered and under what conditions.delegates this responsibility to CMS, which, in turn, carries out some of these responsibilities through MACs. Consistent with Medicare law, CMS sets national coverage, payment, and coding policies regarding when and how services will be covered by Medicare, as well as coding and billing The Secretary requirements for claims. CMS develops or implements the following types of national policies: NCDs, which CMS typically develops for services that have the potential to affect a large number of beneficiaries and that have the greatest effect on the Medicare program. For example, this can include new technologies introduced into health care practice, such as use of Positron Emission Tomography scans for diagnostic purposes. Development of NCDs is a lengthy process, which requires review of clinical evidence and allows for public comment. According to CMS, the agency has the resources to develop approximately 12 NCDs per year. As of February 2012, there were 328 NCDs. National payment policies that specify how payment will be made for covered services in certain situations—such as how physicians who collaborate on providing the same service to a beneficiary will be paid. National Correct Coding Initiative (NCCI) coding policies, which aim to reduce inappropriate payments through the use of automated edits that deny improperly coded claims. NCCI edits include code-pair edits, which deny payment for services that should not be billed together. NCCI edits also include Medically Unlikely Edits (MUE), which deny payment for services where the quantity billed is at a level not likely to be provided under normal medical practice, such as daily doses of drugs higher than the maximum amounts in the prescribing information or services that are anatomically impossible, such as more than one appendectomy on the same beneficiary. CMS allows exceptions to MUEs and some code-pair edits when providers believe the services provided are clinically appropriate. In such cases, special codes called modifiers are included on the claim to indicate why the services were clinically appropriate. MACs may develop local coverage policies as long as these policies are consistent with national policy. MACs develop the following types of local coverage policies: LCDs, which specify the circumstances under which services will be covered in a MAC’s jurisdiction. According to CMS, allowing MACs to develop LCDs allows for timely local reaction to changes in the practice of medicine. MACs also use LCDs to place limits on services that may be overused or abused in their jurisdictions. Before implementing or revising an LCD, a MAC must review clinical evidence and incorporate the information reviewed into the proposed LCD, provide notice of proposed changes on its website, and, in some cases, seek public input from potentially affected individuals or organizations, such as physicians whose billing could be affected by the policy. There are currently thousands of LCDs. Limits on quantities of services that will be covered in a MAC’s jurisdiction. A quantity limit may be included within an LCD or developed separately as a Clinically Unlikely Edit (CUE). CMS and its contractors have developed and implemented various types of prepayment edits based on national and local coverage policies. (See table 1.) MACs are responsible for processing and paying claims, generally in specific geographic jurisdictions, in compliance with coverage and payment policies. Health care providers generally submit claims to the MAC responsible for the geographic area where the services were delivered or the beneficiary resides.standardized coding system, known as the Healthcare Common Procedure Coding System (HCPCS), to identify the medical services, Providers submit claims using a equipment, and other goods provided.patient diagnoses, using a different coding system called the International Classification of Diseases (ICD). Medicare fee-for-service claims processing includes several basic steps that involve three types of systems: MAC front-end systems, shared systems, and the Common Working File (CWF). . Claims are submitted to MACs, whose front- end computer systems perform automated checks to determine whether claims meet certain requirements, such as that the data are complete. Shared systems. Claims that meet the initial requirements in the front- end systems are sent to one of three shared systems—depending on the type of claim—where they are subjected to prepayment edits based on coverage and payment policy criteria. Claims that do not meet these criteria are either automatically denied or flagged for review by trained staff. These systems also verify that providers are enrolled in Medicare. Claims that are not denied by automated edits or suspended for manual review by manual edits in the shared systems are then sent to the CWF, the central CMS system that authorizes payment. . The CWF verifies beneficiary eligibility, coordinates Part A and Part B benefits, and determines the extent of Medicare’s responsibility for payment, based on such factors as whether beneficiaries’ deductibles have been met or utilization limits have been reached. From there, claims are returned to the relevant shared system for final processing and then payments are sent to providers. The process of determining whether claims are consistent with Medicare coverage, payment, and medical coding policies—which includes the application of edits based on these policies, as well as manual review of flagged claims—is known as the medical review process. Of the two categories of prepayment edits used by MACs in this process— automated and manual—automated are less resource intensive. CMS policy requires that automated edits be used whenever possible. However, many improper claims can be identified only through more costly manual review, because staff may have to review associated medical records and claims history or exercise clinical judgment to determine whether a service is reasonable and necessary and therefore should be approved for payment. CMS officials indicated that there are about 17,000 prepayment edits related to medical coverage issues in PIMR. However, some edits—in particular, those that require manual review—may not be in use at any given time for various reasons, such as the staff costs associated with manual review, or because changes in provider behavior make the edit unnecessary. In addition, edits can vary in complexity and the policy issues covered, since some automated edits address only a portion of one coverage policy, while other automated edits address multiple policies. There are limitations to the use of prepayment edits and associated manual review as medical review strategies because some claims can be identified as improper only after a payment is made.recovery audit contractors (RAC) to find and correct overpayments and underpayments after claims have been processed. Although some of the improper payments identified by RACs could have been prevented by prepayment edits, others can be identified only after payment through review of medical records. CMS requires RACs to provide information, based on their analyses, about vulnerabilities, including those that could be addressed through prepayment edits. CMS’s oversight of MACs is governed by the terms of the MACs’ contracts, which in turn reflect provisions of the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA). The MMA includes a requirement for CMS to use competitive procedures to select contractors to process claims; to develop performance standards for these contractors, including standards for customer satisfaction; and to provide incentives for these contractors to provide high-quality service. CMS established the MAC contracts as cost-plus-award-fee contracts, a type of cost-reimbursement contract designed to provide sufficient motivation to encourage excellence in contract performance.Specifically, a MAC may earn an incentive, known as an award fee, based on performance, in addition to reimbursement for allowable costs and a base fee for the contract, which is fixed at the inception of the contract. Under the terms of these contracts, CMS sets requirements for MACs with respect to prepayment edits and other aspects of the medical review process. In general, CMS requires MACs to target medical review to areas that pose the greatest financial risk to the Medicare program and where their efforts are likely to produce the best return on investment, and also to implement automated prepayment edits whenever appropriate. CMS also requires MACs to assess the effectiveness of their edits and to submit their medical review strategies to CMS for review and approval. However, MACs have considerable discretion in developing local coverage policies and in deciding how to implement edits to address both local and national coverage policies. CMS assesses MACs’ performance in part through its Quality Assurance Surveillance Plan (QASP) review and its Award Fee Plan review. For the QASP review, which is generally conducted annually, CMS evaluates each MAC’s performance against a MAC-specific subset of performance standards in accordance with the statement of work and other requirements specified in related CMS policy documents. The Award Fee Plan identifies the criteria upon which the MAC will be evaluated and provides an explanation of when the MAC can potentially earn an incentive based on its performance. On an annual basis, CMS creates an award fee plan for each MAC that contains metrics that are generally more challenging to achieve than the requirements outlined in the statement of work. The pool of award fees available to each MAC is established during contract negotiations and depends in part on the negotiated division of fees between award fees and base fees. CMS monitors the accuracy of the MACs’ claims payment determinations through its Comprehensive Error Rate Testing (CERT) Program, which measures improper payments. Each year, CMS establishes a national error rate goal under the Government Performance and Results Act of 1993. To calculate error rates, CMS’s CERT Program contractor randomly samples Medicare fee-for-service claims and reviews them after payment. Currently, CMS publishes error rates by type of error, type of claim—for example, DME—and clinical setting, as well as nationally. Prior to 2009, CMS also published contractor-specific error rates. However, in that year, CMS implemented a new methodology for CERT claim reviews, and as a result, the error rates computed for 2009 were not comparable to those computed for previous years.contractor-specific error rates in award fee plan reviews in fiscal year 2011. CMS, like other agencies, is responsible for maintaining internal control— the component of an organization’s management that provides reasonable assurance that the organization achieves effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations. Internal control standards provide a framework for identifying and addressing major performance challenges and areas at greatest risk for mismanagement. As noted above, GAO has published guidelines for internal controls, and we used these guidelines to assess some of CMS’s processes. (See table 2 for the specific internal control standards and activities we used.) CMS reported that the use of prepayment edits saved Medicare $1.76 billion in fiscal year 2010, but the reported total is likely to be an underestimate because CMS does not collect information on savings from all of its current edits. Moreover, the savings could have been greater had prepayment edits been more widely used. Our analysis of Medicare data using only a limited number of national policies identified payments that appeared to be improper and that might have been prevented through wider use of automated edits. We also found that wider use of edits based on LCDs could have led to increased savings. Using just three MAC-issued LCDs as examples, we found that MACs in other geographic areas processed Medicare payments totaling more than $100 million for services that were not covered under the three policies we selected. Although CMS’s PIMR data indicate that Medicare savings from prepayment edits were $1.76 billion in fiscal year 2010, that total is probably an underestimate because CMS does not collect information on savings from all of its current edits. For example, although the savings total included $497 million in savings from some NCCI code-pair edits, it did not include savings from other NCCI code-pair edits or from MUEs. In addition to lacking complete information about total savings from edits, CMS also lacked reliable information about savings associated with particular types of edits. For example, PIMR did not contain reliable data about fiscal year 2010 savings attributable to automated edits versus manual edits or to edits based on national policy versus those based on local policy. Although PIMR captured both kinds of information, CMS officials said these data were unreliable because not all MACs defined and reported information about edits in the same way. However, in 2011, CMS issued new reporting instructions for contractors to standardize definitions for various types of edits. We analyzed MACs’ costs for specific tasks related to prepayment edits and medical review, based on the most recent contract periods for which we had data at the time of our analysis. These contract periods, which were almost always 1 year, ranged from a period ending July 30, 2010, to one ending March 31, 2011, depending on the time frame for each contract. Medicare Integrity Program (MIP) funds were used to pay the costs for the tasks we included in our review. MIP was established to enhance efforts to address Medicare’s vulnerabilities to fraud, waste, and abuse. Costs of various tasks in the MIP category—which also includes provider outreach and education and coordination of benefits—are paid with MIP funds. MACs are permitted to direct the MIP funds they receive among these tasks but are not permitted to use MIP funds for tasks in other categories. On average, the MIP category accounted for 30 percent of A/B MACs’ total costs and 19 percent of DME MACs’ total costs in the most recent contract period. addition, ARTS data do not include approximately $1.1 million in costs incurred for another contractor to develop NCCI edits. Our analysis of Medicare claims data, for which we selected five national Medicare policies, found cases in which Medicare paid for services that appeared to be inconsistent with its national coverage and coding policies. Specifically, we found $14.7 million in payments from fiscal year 2010 that appeared to be inconsistent with four of the selected policies and therefore improper. At least some of these payments that were improper could have been prevented by prepayment edits. (See table 3.) For each of the four policies, the steps we followed for our analysis also could have been followed on a prepayment basis using automated edits because the steps consisted of a review of only the procedure codes, diagnosis codes, and quantities provided, all of which could be determined prior to claim payment. (See app. I for a description of the analytic approach.) For the remaining policy, we found no payments that appeared to be inconsistent. We found that Medicare paid $8.6 million for claims that exceeded the MUE quantity limits for a single beneficiary under most circumstances on a single date of service. By the beginning of fiscal year 2012, CMS had established quantity limits for about 10,800 HCPCS codes for services provided by physicians and other noninstitutional outpatient service providers. Claims can have multiple lines, with a single service claimed on each line. MUEs look for excess quantities of services provided to a single beneficiary by a single provider on each individual claim line. (See app. II for an example of how excess quantities of services could be billed in a way that avoids triggering an MUE.) Therefore providers still could be paid for more than the maximum quantity specified under the policy if quantities were divided among multiple lines on the same claim or among multiple claims for the same beneficiary. When we analyzed claims using the method actually applied by MUEs—in which each claim line was analyzed independently—we found only about $400,000 in paid claims that exceeded the MUE quantity limits. However, when we analyzed claims using the quantity limits to identify payments for the same beneficiary, same provider, and same date of service—whether on the same claim line or multiple claim lines—we found $8.6 million in paid claims that exceeded quantity limits. We also found $6.1 million in payments that appeared to be inconsistent with three selected NCDs and therefore improper. For a fourth NCD, we did not find any payments that appeared to be inconsistent. Using one of the three NCDs, which prohibits use of vagus nerve stimulation to treat resistant depression, we found that Medicare paid about $5.0 million in fiscal year 2010 for vagus nerve stimulation for claims with diagnoses for depression. In addition, using two NCDs that address a treatment for age-related macular degeneration, we found $1.1 million in payments that appeared to be improper. These two related NCDs stipulate that this macular degeneration treatment must use both ocular photodynamic therapy (OPT) and the drug verteporfin together and that beneficiaries must receive a diagnostic test prior to treatment. The $1.1 million we found was for claims for the therapy without the diagnostic test, the therapy without the drug, or the drug without the therapy. We did not find any payments that appeared to be inconsistent with the remaining NCD, which establishes that Medicare does not cover lumbar artificial disc replacement for beneficiaries older than age 60. Our analysis of Medicare claims using three selected LCDs demonstrated the potential for increased savings. Variation in Medicare coverage and in the prepayment edits used to enforce coverage policy in different geographic areas results in Medicare paying for services that are covered in some parts of the country but not others. We found that MACs other than those whose LCDs we used as the basis for our analysis paid more than $100 million for claims that were inconsistent with these three LCDs. (See table 4.) These payments cannot necessarily be classified as improper because other MACs may not have had a similar LCD in place.greater or lesser use of services in some jurisdictions than in others. However, variation in coverage among MACs can result in Although greater use of services does not necessarily reflect overuse, leading health care experts have noted that overuse of services is a significant problem that has led to increased health care spending, including in the Medicare program. More widespread use of automated edits that some MACs found to be among their most effective at identifying claims for services that they do not consider reasonable and necessary could have led to more consistent coverage throughout the country and therefore to savings for the Medicare program as a whole. In our analysis, we found about $68.7 million in payments for monitored anesthesia care that were made by MACs other than the MAC whose LCD we used as the basis for this analysis. The LCD specified the diagnoses for which monitored anesthesia care would be covered by Medicare in the MAC’s jurisdiction. The MAC whose LCD we used for this analysis had implemented an automated edit to identify claims that lacked one of the required diagnoses. In addition, we found about $30.9 million in payments for claims for a test of parathyroid hormone levels that was performed more than once per day or lacked one of the diagnoses required by the MAC whose LCD we used. The LCD identified a set of diagnoses for which a parathormone test would be covered as medically necessary and generally prohibited coverage for more than one service Medicare payments in 2 of the 15 MAC jurisdictions made up per day.about half—$17.1 million—of the payments we identified as inconsistent with the parathormone LCD. Finally, we found about $4.5 million in payments in fiscal year 2010 that were inconsistent with an LCD covering tests to measure blood flow to the brain. The claims we found did not contain any of the diagnoses required by that LCD. CMS has three processes for identifying the need for, and implementing, prepayment edits based on national policies: (1) the NCCI process; (2) the Vulnerability Tracking Corrective Action Process; and (3) the NCD process. The designs of these processes have steps consistent with our internal control standards. However, they also have weaknesses that hinder their effectiveness in preventing improper payments. The NCCI process, which CMS initiated in 1996, aims to reduce inappropriate payments through the development and implementation of automated edits that deny certain types of improperly coded claims. The NCCI process develops two types of edits. Code-pair edits are designed to result in denial of claims for services to a beneficiary with pairs of codes that should not be billed together. MUEs are designed to result in denial of claims with units of service that exceed the maximum number a provider would bill under most circumstances. The first step outlined in the NCCI process—in which CMS identifies risks that can be addressed with NCCI edits—is consistent with our risk assessment internal control standard that calls for agencies to identify risks comprehensively using various methods. To identify the need for an NCCI edit, CMS’s NCCI contractor reviews information from a variety of sources, including MAC medical directors, publications of national health care organizations, new laws and regulations, and annual changes in procedure codes. In general, the NCCI contractor staff told us that they propose a code-pair edit whenever they identify a procedure or item where proper payment could be enhanced, irrespective of the size of the potential vulnerability. However, CMS guidance indicates that the magnitude of potential program vulnerability is one possible rationale for setting an MUE at a particular level. CMS has procedures for deciding whether to implement an NCCI edit, consistent with our risk assessment standard that calls for deciding on appropriate corrective actions. To help CMS determine whether an NCCI edit might be appropriate, the NCCI contractor reviews CMS policy, standards of medical and surgical practice, current coding practice, and provider billing patterns. The contractor then presents information on proposed edits in regular meetings with senior-level CMS staff assigned to NCCI workgroups, who then decide whether to implement proposed edits. CMS generally provides a review and comment period before implementing edits to allow for input from representative national organizations that may be affected by the edits. CMS considers the comments when it makes its final decision about implementing an edit, but does not necessarily decide against an edit because of adverse comments. CMS implements NCCI edits on a regular timeline, consistent with our monitoring standard that calls for taking action within established time frames. The NCCI contractor provides a file of new and revised edits to CMS on a quarterly basis. The contractors then download this file from CMS’s Data Mover to integrate it into the claims payment systems. Representatives of MACs we contacted said they receive the edit files in a timely manner. CMS has procedures in place to determine whether NCCI edits are operating as intended before applying the edits in processing claims. Prior to submitting the edit files to CMS, the NCCI contractor performs a series of quality control checks to ensure that the edits are operating correctly. Representatives of the MACs we contacted said they also test these edits to ensure they are operating correctly within the shared systems. However, the MUE edits are not working to enforce the MUE limits because of how they are structured. Thus, this monitoring step does not meet our standard that calls for agencies to assess whether internal controls are functioning properly. As noted above, MUEs are structured to identify each claim line in which units of service exceed the MUE limit, and do not identify excess units billed across multiple claim lines. As a result, we identified about $8.2 million in Medicare payments in fiscal year 2010 for quantities of services that exceeded published MUE limits but were not identified by MUEs because the excess amounts were billed across multiple claim lines. The NCCI contractor recognized this weakness in the MUEs and recently recommended to CMS that MUEs be restructured so that they are applied against all claims reported for a single date of service rather than against each line of a claim. Finally, the process for developing NCCI edits is adequately documented, consistent with our control activities standard that calls for agencies to develop written policies and procedures for their activities. CMS has documented its processes for NCCI edits in a policy manual that explains the rationale for these edits and how edit decisions are made. The document is updated annually and is available to the public on the CMS website. CMS’s Vulnerability Tracking Corrective Action Process (Vulnerability Tracking) began in November 2008 and is still evolving, according to agency officials. It was originally developed to track vulnerabilities identified by the RACs and corrective actions taken, but it has expanded to include vulnerabilities identified through other means. CMS can decide to address these vulnerabilities with prepayment edits or with other types of corrective actions. To identify risks associated with vulnerabilities to improper payments, CMS has designed a process that calls for analyzing several sources of information, an approach consistent with our risk assessment standard that calls for comprehensively identifying risks. CMS staff analyze available data—such as CERT data and data on improper payments identified by RACs and other CMS contractors—in order to identify potential vulnerabilities and determine whether they are actual vulnerabilities. CMS staff then assess the risks posed by these vulnerabilities and prioritize them for corrective action based on five criteria: (1) the associated CERT error rate; (2) whether the vulnerability has been identified by RACs as a “major finding,” meaning a vulnerability for which more than $500,000 was identified for recoupment; (3) overall financial effect; (4) geographic effect and scope; and (5) political and media sensitivity. Although the application of criteria to prioritize vulnerabilities is a strength of CMS’s process, we found a weakness in how CMS analyzes RAC data to identify vulnerabilities to prioritize for correction through edits or other actions. When setting the threshold to determine whether a RAC- identified vulnerability should be considered a major finding, CMS considers only the amount identified by each RAC and does not aggregate the amounts across all RACs that have identified similar vulnerabilities and may not consider thoroughly the potential national scope of vulnerabilities that one or two RACs are pursuing. CMS officials told us they do not routinely review information on RAC-identified vulnerabilities under the $500,000 threshold. As a result, CMS can leave vulnerabilities unaddressed, some of which could be addressed with prepayment edits. For example, as of December 2011, the four RACs had identified a total of about $503,000 in improper payments for claims for the services of clinical social workers provided during inpatient stays. Because this amount was not identified by a single RAC, this would not meet the definition of a major finding. CMS also does not take into account the period over which the RACs identified the improper payments. CMS has designed procedures for determining what actions will be taken to address vulnerabilities, including prepayment edits, which is consistent with our risk assessment standard that calls for deciding on appropriate corrective actions to address risks. The agency has assembled a Corrective Action Development Team, which meets weekly to review analyses on prioritized vulnerabilities and to propose corrective actions to leadership in the CMS Provider Compliance Group, which is responsible for vulnerability tracking. The Provider Compliance Group can develop edits or take other corrective actions such as publishing provider education articles, referring vulnerabilities to other CMS components, or referring vulnerabilities to the MACs to be addressed at the local level.CMS officials in the Provider Compliance Group told us they had developed at least three edits as part of the Vulnerability Tracking process to address identified vulnerabilities, and were in the process of developing edits to address at least 10 other vulnerabilities identified by the RACs. CMS has not specified time frames for implementing all corrective actions, contrary to our monitoring standard that calls for taking corrective action within established time frames. CMS officials explained that they have not done so because the time involved can vary from a few days to several months, depending on the work involved in determining and implementing the appropriate action. For example, CMS officials told us that staff may conduct research to determine whether local and national edits have already been implemented to address the vulnerability in question. But CMS has not established planned time frames for addressing each vulnerability once the agency has determined the type of corrective action needed. Also, as recently reported by the HHS Office of Inspector General (OIG), the Provider Compliance Group has not established procedures or time frames for following up with other CMS components to which it has referred vulnerabilities, to ensure that vulnerabilities have been resolved. CMS has not obtained information to assess whether all of its edits and other corrective actions taken through its Vulnerability Tracking Process are functioning properly, contrary to our monitoring standard. However, CMS does test edits before implementation and has assessed the effects of some edits and other corrective actions. According to CMS officials, all edits CMS develops centrally are implemented through the change management process, which includes testing prior to implementation to ensure they are working as intended. With respect to other types of corrective actions, CMS officials told us they gathered and analyzed data to assess two corrective actions to see if the actions were having the intended effects and have plans to conduct similar data analyses to assess others 18 to 24 months after implementation, when their effects will be more evident. However, CMS officials said they do not have the resources to monitor the results of all edits or other corrective actions themselves and that, depending on the risk to the program, the agency may rely on information from other entities, such as reports from RACs, the CERT contractor, or the HHS OIG. While information from these entities can be useful, our standard on monitoring calls for routine monitoring that assesses the effectiveness of control activities, which CMS managers told us they are not doing. CMS officials indicated that better data on the effects of edits will be available when the agency replaces its PIMR database. CMS has developed preliminary documentation of the Vulnerability Tracking Process, but the documentation is incomplete and therefore inconsistent with our control activities standard with respect to documentation, which calls for agencies to develop written policies and procedures for their activities. CMS’s documentation specifies roles and responsibilities for CMS teams, identifies sources of information about potential vulnerabilities, specifies criteria for prioritizing vulnerabilities for corrective action, and lists possible corrective actions. The document also lists monitoring of corrective action plans as a responsibility of CMS staff and mentions assessing billing and payment trends as a monitoring strategy. However, this documentation does not establish time frames for monitoring corrective actions, as the HHS OIG also reported. In addition, it does not outline required steps to take if the corrective action is not working as intended. According to CMS officials, there are procedures in place for agency staff to decide whether to implement an edit based on an NCD. As described by CMS officials, this process for determining whether to implement an edit based on an NCD is consistent with our risk assessment standard that calls for deciding on appropriate corrective actions. CMS develops NCDs to describe the circumstances under which Medicare covers certain services. CMS officials told us that, when feasible, CMS develops and implements edits to enforce the policy behind the NCD to ensure that claims that do not follow the policy are not paid. According to CMS officials, when the agency develops an NCD, staff in the CMS component responsible for policy development consult with staff in the component responsible for provider billing to determine whether an automated edit can be developed. However, CMS officials could not confirm that such consideration was consistently given in the past. Although agency officials told us they had separate documentation on each of the edits implemented based on an NCD, the agency has not assembled that information. Therefore, CMS could not readily provide information about all of its edits based on NCDs, or all of the NCDs for which there are associated edits. If CMS determines that an automated edit based on the NCD is not possible—for example, because certain aspects of the NCD are not specific or because the necessary procedure and diagnosis codes do not exit—CMS assigns MACs the responsibility of ensuring that they process claims in conformance with the policy. Some aspects of the agency’s approach to implementing edits based on NCDs are consistent with our standard that calls for taking action within established time frames, but other aspects have weaknesses. If CMS determines that an automated edit based on the NCD is possible, the edit is generally implemented through a change request, which calls for central implementation and follows documented procedures and specific time frames. However, for some edits, CMS has assigned responsibility to MACs to independently program and integrate the edits into the shared systems. CMS officials told us that they have sometimes assigned responsibility to MACs because there is a queue for implementing system changes at the national level, and in some cases MACs can implement edits more quickly. CMS officials acknowledged that having multiple MACs program some edits based on NCDs may have led to inconsistent implementation of national coverage policy. CMS officials also noted that this approach creates more work than necessary for MACs, particularly because each MAC must update the edits regularly to reflect coding changes, which can lead to additional inconsistencies. Our claims analysis found instances where inconsistent implementation of NCDs may have led to improper payments. As we reported earlier, we found about $6.1 million in payments in fiscal year 2010 that appeared to be inconsistent with three NCDs we selected for analysis. CMS officials told us that the agency is considering steps to address inconsistent implementation of NCD-based edits by assessing whether the agency can implement centrally all automated prepayment edits based on NCDs. CMS is working with a contractor to update coding for NCDs as part of the transition to the International Classification of Diseases 10th Edition (ICD-10).has begun to inventory the edits based on NCDs. The contractor will also consider whether automated prepayment edits could be developed and implemented centrally for NCDs that do not currently have them. CMS officials also told us that centrally coding edits based on NCDs will help ease MAC workloads. As part of this transition, the contractor CMS tests edits based on NCDs before implementation to ensure they are working as intended, but the agency does not assess the effects of these edits thereafter, contrary to our monitoring standard that calls for agencies to assess whether internal controls are functioning properly. CMS officials told us the shared systems maintainers test edits prior to implementation, and the MACs subsequently test the edits as well. However, according to CMS officials in both components responsible for NCD-based edits, neither component monitors the effects of these edits nor tracks savings information. CMS officials did not provide any written guidance outlining the decision- making process they described to us, contrary to our control activities standard that calls for agencies to develop written policies and procedures for their activities. They also did not provide documentation that the process has been followed for each NCD developed recently. CMS informs MACs about program vulnerabilities that could be addressed through local prepayment edits and about the varying coverage policies MACs have implemented in their jurisdictions, but the agency does not systematically compile and disseminate information about effective local edits. To oversee MACs’ efforts to address vulnerabilities, which include implementation of edits, CMS requires MACs to report on plans to address specific vulnerabilities and examines some of these reports as part of performance reviews. In fiscal year 2011, CMS increased the funding allocated to MACs for medical review However, the agency provided relatively small activities by 12 percent.financial incentives in the form of award fees to motivate MACs to make more effective use of prepayment edits. CMS provides information to MACs about some program vulnerabilities that could be addressed through prepayment edits. The agency also provides some information about local coverage policies, but little about effective prepayment edits and the policies on which they are based. Vulnerabilities. CMS disseminates information to MACs about program vulnerabilities through several channels. One key channel is the agency’s regular reports identifying vulnerabilities. For example, CMS publishes midyear and annual reports on improper payments identified by CERT and also makes CERT data available to MACs to conduct their own analyses. Other data CMS makes available include the Part B National Summary Data file, which MACs can use to compare the utilization rates of providers in their jurisdiction to national rates, to detect potentially aberrant billing patterns. In addition, CMS facilitates regular conference calls and meetings with MACs at which vulnerabilities are discussed. For example, CMS leads three conference calls per month, each focusing on a different type of claim, in which MACs can obtain information from RACs about vulnerabilities these other contractors have identified in their analyses of paid claims. CMS also sponsors two annual meetings for A/B MAC staff—one for medical directors and another for medical review managers—and similar meetings for DME MAC staff, at which vulnerabilities may be discussed. Local coverage policies. CMS facilitates information sharing about local coverage policies through regular conference calls and national meetings two to three times per year. CMS also maintains a public web-based Medicare Coverage Database that contains detailed information about both NCDs and LCDs. MACs considering changes to local coverage policy can search the database for information about related NCDs or LCDs. Some of the LCD descriptions contain enough information, including diagnosis and procedure codes, to give an idea of the edits that may have been implemented to enforce them. However, the LCD descriptions do not indicate whether those edits have actually been implemented or provide any measure of the effectiveness of those that have. Prepayment edits. Although CMS facilitates limited and generally informal information sharing among MACs about their prepayment edits, the agency does not systematically compile and disseminate information about effective edits. Such information would include information about the national or local coverage policies on which the edits are based and the savings they have generated. CMS requires MACs to analyze the effectiveness of each of their edits—quarterly for manual edits and annually for automated edits—but does not require MACs to report this information to the agency. Although CMS may examine MACs’ documentation of these analyses as part of broader reviews, it does not compile or analyze the data across MACs. Representatives of one of the MACs we contacted said that if a vulnerability were widespread, CMS might ask a MAC that had successfully addressed it to present information about its edit and associated savings to other MACs during a regularly scheduled conference call or national meeting. However, representatives of another MAC noted that sharing of information about edits typically occurred in informal exchanges among MACs at national meetings and did not include information about savings. CMS lacks a complete and centralized source of information on the most effective local edits that could facilitate information sharing. The PIMR database was established by CMS specifically to compile information about the edits implemented by claims administration contractors and to collect savings and cost data to assess the edits’ effectiveness. However, CMS officials reported that the database has not served that purpose since MACs began processing claims, in part because MACs’ cost data are collected in a system that does not link to PIMR. In addition, PIMR lacks descriptions of many edits, which MACs must enter manually, and, according to CMS officials, it has other flaws that significantly limit its usefulness as a tool for identifying effective edits. CMS contracted with a consultant to evaluate the system and make recommendations for an upgrade or replacement. CMS received these recommendations in January 2012, but agency officials we interviewed could not say if or when HHS would approve the funding for a new system. CMS officials said the agency will stop using the PIMR database in July 2012. Until a new database is in place, the agency will continue using a manual data collection process initiated in September 2011, in which staff compile in a spreadsheet information from MACs about the number of claims denied and dollars saved each month by different types of edits, including automated and manual prepayment edits. CMS provides oversight of MACs’ use of prepayment edits primarily through its review of certain MAC reports, through annual QASP reviews, and, most recently, through directives requiring the MACs to explain whether and how they have addressed certain vulnerabilities specified by CMS. CMS review of MAC reports. CMS requires MACs to submit several types of reports that include partial information about their use of prepayment edits. These reports include annual medical review strategies and monthly status reports: Medical review strategies each MAC’s annual medical review strategy is a prioritized list of the specific vulnerabilities the MAC has deemed most critical to address . As directed by CMS, the central element of and a description of plans to address them, which may include implementation of prepayments edits or other efforts, such as provider education. The strategy must also indicate the data analyses the MAC conducted, describe methods for assessing the effectiveness of planned interventions, and explain how the work will be managed, staffed, and budgeted. CMS assigns two staff members—one with expertise in medical review and another, generally from a CMS regional office, with broader responsibility for monitoring a MAC’s performance—to review each MAC’s medical review strategy. In addition, according to CMS officials, the CMS group responsible for medical review began in 2011 to conduct what they intend to be annual conference calls with each MAC to discuss its medical review strategy. Representatives of two MACs we contacted said that CMS has sometimes requested revisions to their medical review strategies—for example, to provide more detail about certain aspects of their plans. Monthly status reports. CMS requires MACs to submit monthly status reports to inform the agency of problems and risks encountered during the review period and actions taken to address them, which may include implementation of new local coverage policies or prepayment edits. These reports are reviewed by multiple CMS staff members with expertise in the different functional areas covered by the reports and discussed in monthly conference calls with each MAC. These reports are designed to provide CMS with information about prepayment edits MACs have implemented to address or explore specific vulnerabilities or potential vulnerabilities, but not to provide a comprehensive overview of MACs’ use of prepayment edits. For example, in their medical review strategies, MACs commonly described plans to conduct probe reviews—reviews of a representative sample of claims that have been flagged by manual edits—which are designed to determine the nature and extent of vulnerabilities in order to develop appropriate interventions. Although the protocols for some of these reports call for MACs to describe their active manual edits, they do not call for MACs to describe or document the effectiveness of all the edits they have implemented or to identify their most effective edits. QASP reviews. CMS also oversees MACs’ use of prepayment edits through QASP reviews, but these reviews include a greater number of standards related to other aspects of MACs’ performance, such as financial management. CMS selects the standards to include in each MAC’s review based in part on areas of concern in each MAC’s performance. The number of QASP standards focused on a particular performance area is significant because MACs’ eligibility for award fees depends partly on the percentage of QASP metrics passed. Specifically, for a MAC to be eligible for award fees, it must have a rating of satisfactory or better in all categories in which it was rated that year in the Contractor Performance Assessment Reporting System. Recent QASP reviews have included relatively few performance standards related to medical review—the one performance area that focuses on prepayment edits and associated review of claims—compared with the number related to other aspects of MACs’ performance. (See fig. 1.) QASP reviews of A/B MACs typically included two standards related to medical review— one focused on MACs’ strategies for this review and the other on their handling of skilled nursing facility demand bills.MACs typically included only one standard focused on medical review strategies. Although the agency developed a third medical review QASP standard, focused on CERT rates, CMS officials told us the agency has rarely used it because of recent revisions to the CERT methodology. The application of prepayment edits is an important strategy to help ensure that Medicare claims are paid properly the first time. As CMS data show, this strategy prevented at least $1.76 billion in improper payments in fiscal year 2010 alone. But CMS has opportunities to further reduce improper payments by promoting more widespread use of effective prepayment edits. CMS has processes in place to identify the need for and to develop edits based on national policies—such as NCDs and MUEs—but these processes could be improved. CMS could do more to ensure that edits based on NCDs are implemented consistently, such as centralizing the process within the agency rather than leaving it up to MACs. Greater attention to developing centralized NCD edits whenever possible could reduce improper payments. CMS could also do more to ensure that its edits are structured to enforce the national policies on which they are based. Our findings show that CMS has paid for quantities of service in excess of its policies for what would ordinarily be provided to a beneficiary on a single day, because MUEs allow payment for excessive quantities of services if those quantities are spread over multiple claim lines or multiple claims, even if explanatory modifiers are not included. Although CMS has made progress in cataloging and assessing vulnerabilities in a structured way, it could do more to improve some of its analysis and documentation. Specifically, the agency could improve how it prioritizes vulnerabilities identified by RACs in their postpayment reviews by compiling the information on these vulnerabilities differently— for example, by aggregating the overpayments identified by all the RACs for a given vulnerability, rather than considering each RAC’s findings in isolation. CMS could further strengthen its Vulnerability Tracking process and edits based on NCDs by developing written procedures for steps where such documentation is currently lacking. This would include specifying time frames for taking corrective actions, methods for assessing the effects of corrective actions, and procedures to ensure that CMS considers and ultimately implements edits for all applicable NCDs, including older NCDs that were not previously considered for automated edits. CMS could take several actions to encourage MACs to implement effective prepayment edits at the local level by collecting and providing information about the underlying coverage policies and savings associated with edits that have proved particularly effective in some jurisdictions, and, if feasible, by increasing the incentives for edit implementation. Currently, CMS lacks the information needed to assess how effectively MACs are employing prepayment edits, even in comparison with other MACs. The agency has taken steps to improve the information it collects about edits by setting new reporting standards and pursuing a possible replacement for the PIMR database. Until a new database is in place, CMS could facilitate an information exchange about edits among MACs through some of its usual channels. Each MAC would need to consider local circumstances in deciding whether to implement LCDs and related edits similar to those used by another MAC. Nevertheless, systematic exchanges of information about policies and edits that have proved particularly effective in some jurisdictions would highlight for MACs additional ways to help ensure that Medicare pays only for reasonable and necessary services. CMS has recently begun encouraging MACs to address certain vulnerabilities by requiring them to report on what actions, if any, they have taken. This has led to MACs reporting on or implementing edits. CMS could also consider encouraging MACs to implement prepayment edits by increasing the financial incentives for them to do so. Award fees offer a mechanism to provide such an incentive, but the share of award fees CMS allocated to the one metric most directly related to prepayment edits and medical review in 2011 was relatively small. In order to promote greater use of effective prepayment edits and better ensure proper payment, we recommend that the CMS Administrator take the following seven actions. To promote implementation of effective edits based on national policies, we recommend that the CMS Administrator: centralize within CMS the development and implementation of automated edits based on NCDs to ensure greater consistency; implement MUEs that assess all quantities provided to the same beneficiary by the same provider on the same day, so providers cannot avoid claim denials by billing for services on multiple claim lines or multiple claims without including modifiers that reflect a declaration that quantities above the normal limit are reasonable and necessary; revise the method for compiling information about RAC-identified vulnerabilities to identify their full extent and prioritize them accordingly; and develop written procedures to provide guidance to agency staff on all steps in the processes for developing and implementing edits based on national policies, including (1) time frames for taking corrective actions, (2) methods for assessing the effects of corrective actions, and (3) procedures for ensuring consideration of automated edits whenever possible, including for all existing NCDs and other national policies. To encourage more widespread use of effective local edits by MACs, we recommend that the CMS Administrator: improve the data collected about local prepayment edits to enable CMS to identify the most effective edits and the local coverage policies on which they are based and disseminate this information to MACs for their consideration; until CMS has a new database in place to collect information about edits, require MACs to share information about the underlying policies and savings related to their most effective edits; and assess the feasibility of providing increased incentives to MACs to implement effective prepayment edits. We provided a draft of this report to HHS for comment and received written comments, which are reprinted in appendix III. In its written comments, HHS generally concurred with our seven recommendations and cited actions that CMS plans to take to address them. In addition, we had obtained the views of third parties—CMS’s contractors—on specific sections of an earlier draft. Both HHS and the contractors provided technical comments, which we addressed as appropriate. HHS generally agreed with our four recommendations to promote implementation of effective edits based on national policies. HHS agreed with our recommendation to centralize the development and implementation of automated edits. In response to our recommendation to implement MUEs that assess all quantities provided to the same beneficiary by the same provider on the same date of service, HHS agreed to further investigate how to address this recommendation but noted that there are numerous clinical situations in which MUEs can reasonably be exceeded. The agency commented that our report did not identify which services would benefit from improved MUEs without causing unreasonable claim denials. However, we believe all claims payments we identified could reasonably have been denied because we identified only payments for claims without modifier codes, and—as HHS noted in its comments—providers should include modifier codes when billing above the MUE limits. If CMS implemented MUEs as we recommended, it could continue to allow providers to use modifiers as indicators of medical necessity for exceeding the MUE limits. HHS also agreed with our recommendation to revise the method for compiling information about vulnerabilities identified by Recovery Audit Contractors. Finally, the agency agreed with our recommendation to create written procedures for developing and implementing edits based on national policies and said CMS would take steps to address this recommendation by December 31, 2012. HHS also agreed with our three recommendations to encourage more widespread use of effective local edits by MACs. In response to our recommendation that CMS improve the data collected about local edits, the agency acknowledged that the data-collection process needed improvement and said that CMS would explore ways to collect data about local edits from MACs. In addition, to address our recommendation that CMS require MACs to share information about the local policies and savings related to their most effective local edits, the agency said CMS would issue a Technical Direction Letter to MACs about collaborating on the most effective edits. Finally, HHS agreed with our recommendation to assess the feasibility of providing increased incentives to MACs to implement effective prepayment edits and said the units within CMS that are responsible for overseeing MAC contracts—which CMS calls “business owners”—would assess the feasibility and benefits of increasing performance incentives. However, the agency noted that any changes to a MAC’s award fee plan proposed by CMS during an existing evaluation period would need to be agreed to by the MAC. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staffs have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix IV. We used several methods to assess the extent to which (1) the Centers for Medicare & Medicaid Services (CMS) and its contractors employed prepayment edits, (2) CMS has designed adequate processes to determine the need for prepayment edits and to implement edits based on national policies, and (3) CMS provides information, oversight, and incentives to Medicare administrative contractors (MAC) to promote use of effective prepayment edits. To address these objectives, we reviewed data from CMS databases, interviewed CMS officials and MAC representatives, conducted an analysis of Medicare claims data, reviewed CMS documentation on processes to develop and implement edits to assess consistency with our internal control standards, and reviewed relevant CMS and MAC documents, such as those that described MAC’s medical review activities and CMS’s oversight of those activities. To assess the extent to which CMS and its contractors employed prepayment edits, we reviewed data from two CMS data systems—the Program Integrity Management Reports (PIMR) system and the Automated Reporting and Tracking System (ARTS)—that contain information about the savings and costs associated with prepayment edits. We obtained PIMR data reports from CMS for fiscal year 2010 that contained information about the savings associated with prepayment edits for each claims administration contractor. We also obtained ARTS data reports from CMS showing MACs’ task budgets and costs. In the ARTS reports, we identified the specific tasks most closely associated with prepayment edits and related medical review, including the development of underlying local coverage determinations (LCD), and confirmed our identification of these tasks with CMS officials. We then calculated MACs’ prepayment-edit-related costs for the most recently completed contract period—in almost all cases, one year—as of August 4, 2011, the date on which CMS provided the data to us. Depending on the MAC, these data represented a contract period ending in fiscal year 2010 or fiscal year 2011. To assess whether CMS and its contractors applied prepayment edits to the extent possible, we selected a sample of five national and three local policies that could be implemented using automated edits and analyzed paid Part B claims from fiscal year 2010 to identify payments that appeared to be inconsistent with those policies. We selected components of policies that could be implemented using automated edits because automated edits are less costly for MACs to use than manual edits. For national policies, we identified paid claims that appeared to be inconsistent with the policy in all MAC jurisdictions. For local policies, we identified paid claims that were inconsistent with the policy in all MAC jurisdictions except the jurisdiction that implemented the coverage policy and associated edit that we selected for analysis. We excluded MACs in jurisdictions where the contract was up for recompetition to avoid including in our sample MACs that might lose their contracts before we completed data collection. 2009 and 2010 that generated the most savings to the Medicare program, and to provide information about the savings generated by each of those edits and about the LCDs or other local policies on which these edits were based. We chose to analyze LCDs for monitored anesthesia care, parathormone, and noninvasive cerebrovascular studies because (1) they were feasible to analyze using data elements in the Carrier and Outpatient SAFs, (2) fewer than half of the other A/B MACs operating at the start of fiscal year 2010 had implemented a similar LCD, and (3) the edits based on these LCDs had generated a relatively high amount of overall savings. Our analysis of this selected sample of policies and associated edits was intended to allow us to illustrate whether greater savings to the Medicare program could be achieved if effective prepayment edits—and, in some cases, the underlying LCDs—were implemented more widely. Our sample is not an exhaustive list of every policy that could be implemented more fully through additional edits. We took steps to confirm that we understood the policies and that our analytic approach was appropriate. To confirm our understanding of Medically Unlikely Edits (MUE), we discussed our analytic approach with the contractor that creates MUEs and reviewed CMS documentation about MUEs. To confirm our understanding of other national policies, we discussed them with CMS. We discussed the selected LCDs with the MACs that issued them to ensure that our interpretation of the LCDs was accurate. To further test the validity of our analyses based on LCDs, we compared the payments in the jurisdiction of the MAC that had implemented the LCD to payments in other MAC jurisdictions. For each of our analyses based on LCDs, we found the lowest amount of payments in the jurisdiction of the MAC whose LCD we used as the basis for analysis, which was consistent with our expectation. Because providers may appeal claims denials based on an LCD, some payments inconsistent with the LCD could occur. MAC jurisdiction, and at the national level. We extrapolated our results from the 5 percent sample of claims from the Carrier SAF and Outpatient SAF to estimate results for the entire fee-for-service Medicare population. For our analysis of MUEs, we excluded claims that contained modifiers, which are used by providers to indicate potentially legitimate reasons why certain procedures were performed. For the MUE analysis, we also excluded claims data that appeared multiple times in the SAF. We identified these multiple entries by identifying claim lines that matched on certain key variables—including the same beneficiary identification number, procedure, date of service, and provider. For each set of matching entries, we kept the claim line with the latest processing date and excluded all matching claim lines. We reviewed several CMS documents that describe processes used to determine the need for prepayment edits and to implement edits based on national policies. We also interviewed CMS officials to obtain additional detail where needed about these processes. In some cases, the processes were not documented or not fully documented, and in those cases we relied on the officials’ oral descriptions of the processes. We compared these process descriptions to our internal control standards to assess whether CMS has designed adequate processes. We focused our assessment primarily on the design of these processes and did not attempt to fully assess whether the processes were operating as intended. We identified three internal control standards as relevant to our assessment of the design of CMS’s processes: (1) risk assessment, (2) monitoring, and (3) appropriate documentation of transactions and internal control. Table 6 describes the specific elements of these standards that were applicable to our assessment. To assess the information CMS provides to MACs to promote use of effective local prepayment edits, including information about program vulnerabilities and local coverage policies on which effective prepayment edits have been based, we examined the web-based Medicare Coverage Database and reviewed relevant documents, including documentation for the PIMR database. We also interviewed CMS officials and representatives of the MACs in our sample to understand how CMS facilitates information sharing. To assess CMS’s oversight of MACs’ use of prepayment edits, we reviewed agency documents that specify relevant requirements for MACs, including the MAC statement of work, the Program Integrity Manual, the Quality Assurance Surveillance Program (QASP) review protocols, and the quarterly Technical Direction Letters that required MACs to report how they had addressed or planned to address certain vulnerabilities. We also examined samples of reports submitted by MACs, including medical review strategies and responses to the quarterly Technical Direction Letters. In addition, we analyzed data on the most recent QASP reviews conducted as of August 3, 2011, the date on which CMS provided the data to us. Depending on the MAC, these data represented a review period ending in fiscal year 2010 or fiscal year 2011. We also interviewed CMS officials and representatives of MACs in our sample about CMS’s oversight. To assess the financial incentives CMS provides to MACs to promote use of effective local prepayment edits, we examined relevant documents, including descriptions of award fee metrics and review protocols. We also analyzed CMS data on the distribution of award fees for review periods ending in fiscal year 2011, as well as ARTS data on the award fees and base fees budgeted for MACs in the most recent contract year for which we had data—which, as noted above, was either fiscal year 2010 or fiscal year 2011, depending on the MAC. In addition, we examined data on Medicare Integrity Program funding from fiscal year 2008 through fiscal year 2011. We also interviewed CMS officials about how metrics are selected for inclusion in award fee plans, how MACs’ fees are divided between award fees and base fees, and the RAC prepayment review demonstration. To ensure that the data from PIMR, ARTS, and the Medicare claims database used in this report were reliable enough for the purposes used, we performed appropriate electronic data checks, examined relevant documentation, and interviewed agency officials who were knowledgeable about the data. We found the data were sufficiently reliable for the purpose of our analyses. We conducted this performance audit from July 2011 through November 2012 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Appendix II: Hypothetical Example of How Medicare Claims Can Avoid Triggering Medically Unlikely Edits (MUE) In addition to the contact named above, Sheila K. Avruch, Assistant Director; Zhi Boon; Elizabeth Conklin; Nancy Fasciano; Matthew Gever; Richard Lipinski; Roseanne Price; and Steve Robblee made key contributions to this report.

Summary: CMS reported an improper payment rate of 8.6 percent ($28.8 billion) in the Medicare fee-for-service program for fiscal year 2011. To help ensure that payments are made properly, CMS uses controls called edits that are programmed into claims processing systems to compare claims data to Medicare requirements in order to approve or deny claims or flag them for further review. GAO was asked to assess the use of prepayment edits in the Medicare program and CMS's oversight of MACs, which process claims and implement some edits. This report examines the extent to which (1) CMS and its contractors employed prepayment edits, (2) CMS has designed adequate processes to determine the need for and to implement edits based on national policies, and (3) CMS provides information, oversight, and incentives to MACs to promote use of effective edits. GAO analyzed Medicare claims for consistency with selected coverage policies, reviewed CMS and contractor documents, and interviewed officials from CMS and selected contractors. Use of prepayment edits saved Medicare at least $1.76 billion in fiscal year 2010, but GAO found that savings could have been greater had prepayment edits been more widely used. GAO illustrated this point using analysis of a limited number of national policies and local coverage determinations (LCD), which are established by each Medicare administrative contractor (MAC) to specify coverage rules in its jurisdiction. GAO identified $14.7 million in payments in fiscal year 2010 that appeared to be inconsistent with four national policies and therefore improper. These payments could have been prevented through automated prepayment edits. GAO also found more than $100 million in payments that were inconsistent with three selected LCDs and that could have been identified using automated edits. The Centers for Medicare & Medicaid Services (CMS) has three processes with some appropriately designed steps to identify the need for, and to implement, edits based on national policies, but each of these processes has at least one weakness. The weaknesses include incomplete analysis of vulnerabilities to improper payment that could be addressed by edits; lack of specific time frames for implementing edits and other corrective actions; flaws in the structure of some edits; lack of centralization in the implementation of some edits, which leads to inconsistencies; incomplete assessment of whether edits are working as intended; and lack of full documentation of the processes. For example, GAO found that Medicare paid $8.6 million in fiscal year 2010 for claims that exceeded CMS's limits on the quantity of certain services that can be provided to a beneficiary by the same provider on a single date of service. Although edits had been implemented to limit service quantities, a weakness in their structure caused them to miss instances in which quantity limits were exceeded. CMS informs MACs about vulnerabilities that could be addressed through prepayment edits, but the agency does not systematically compile and disseminate information about effective local edits to address such vulnerabilities. CMS oversees MACs' use of edits partly through its review of certain MAC reports, but these reports are not intended to provide a comprehensive overview of their edits. In January 2011, CMS expanded its oversight activities and began requiring MACs to report on how they had addressed certain vulnerabilities to improper payment, some of which could be addressed through edits. While CMS increased the funding in fiscal year 2011 for contractors' medical review activities, including edit development, the agency provided relatively small incentives--3 percent or less of all contract award fees--to promote use of effective prepayment edits by MACs. GAO recommends that CMS take seven actions to strengthen its use of prepayment edits, such as restructuring some edits, centralizing implementation of others, fully documenting processes, encouraging more information sharing about effective edits, and assessing the feasibility of increasing incentives for edit use. The Department of Health and Human Services generally agreed with GAO's recommendations and noted CMS's plans to address them.