FFS Medicare generally pays providers directly for the services they perform—such as paying physicians for office visits—based on predetermined payment formulas. FFS payments are based on claims data received directly from providers. CMS relies primarily on prepayment automated checks and postpayment medical reviews to identify and recover FFS improper payments. Under the Improper Payments Information Act of 2002 (IPIA), as amended, CMS reported that the FFS improper payment rate was 11 percent for fiscal year 2016. Two-thirds of the FFS improper payment rate, according to CMS, was a result of insufficient documentation. CMS and its contractors engage in a number of activities to prevent, identify, and recover improper payments in FFS. The Patient Protection and Affordable Care Act of 2010 included provisions designed to strengthen Medicare’s provider enrollment and screening requirements. Subsequently, CMS implemented a revised screening process for new and existing providers and suppliers based on the potential risk of fraud, waste, and abuse. In November 2016, we evaluated this revised screening process and found that CMS used the new process to screen and revalidate over 2.4 million unique applications and existing enrollment records. As a result of this process, over 23,000 new applications were denied or rejected, and over 703,000 existing enrollment records were deactivated or revoked. CMS estimates that this process saved $2.4 billion in Medicare payments to ineligible providers and suppliers from March 2011 to May 2015. Also in FFS, CMS uses different types of contractors to conduct prepayment and postpayment reviews of Medicare claims at high risk for improper payments. We examined the review activities of these contractors and in April 2016 reported that using prepayment reviews to deny improper claims and prevent overpayments is consistent with CMS’s goal to pay claims correctly the first time. In addition, prepayment reviews can better protect Medicare funds because not all overpayments can be collected. We recommended that CMS seek legislation to allow Recovery Auditors, who are currently paid on a postpayment contingency basis from recovered payments, to conduct prepayment reviews. Although CMS did not concur with this recommendation, we continue to believe CMS should seek legislative authority to allow Recovery Auditors to conduct these reviews. Medicare Administrative Contractors (MACs) process Medicare claims, identify areas vulnerable to improper billing, and develop general education efforts focused on these areas. In March 2017, we evaluated MACs’ provider education efforts to help reduce improper billing. We found that CMS collects limited information about how the efforts focus on the areas MACs identify as vulnerable to improper billing, and recommended that CMS require MACs to report in sufficient detail to determine the extent to which their provider education efforts focus on vulnerable areas. According to CMS, the agency has updated its reporting guidance and MACs will begin reporting more detailed information beginning in July 2017. Whereas Medicare pays FFS providers for services provided, Medicare pays MAOs a fixed monthly amount per enrollee regardless of the services enrollees use. To identify and recover MA improper payments resulting from unsupported data submitted by MAOs for risk adjustment purposes, CMS conducts two types of RADV audits: national RADV activities and contract-level RADV audits. Both types determine whether the diagnosis codes submitted by MAOs are supported by a beneficiary’s medical record. CMS conducts national RADV activities annually to estimate the national IPIA improper payment rate for MA. For 2016, CMS estimated that 71 percent of the improper payments resulted from the insufficient medical record documentation MAOs submitted to CMS that did not support diagnoses they had previously submitted to CMS. The second type of RADV audit, contract-level audits, seeks to identify and recover improper payments from MAOs, and thus deter MAOs from submitting inaccurate diagnosis information. CMS conducted contract- level audits of 2007 payments for a sample of enrollees in 32 MA contracts. CMS’s goal is to conduct contract-level audits annually to recover improper payments efficiently, among other things. It plans to recoup overpayments by calculating a payment error rate for a sample of enrollees in each audited contract and extrapolating the error rate to estimate the total amount of improper payments made under the contract. CMS has RADV audits underway for three payment years—2011, 2012, and 2013. In general, CMS audits about 5 percent of contracts for each year, or roughly 30 contracts. CMS calculates a beneficiary’s risk score—a relative measure of projected Medicare spending—based on both demographic characteristics and health status (diagnoses). The agency uses Medicare data to determine a beneficiary’s demographic characteristics; however, it must rely on data submitted by MAOs for health status information. CMS requires MAOs to submit diagnosis codes for each beneficiary in a contract in order to calculate risk scores. Since 2004, CMS has used the Risk Adjustment Processing System (RAPS) to collect diagnosis information from MAOs. In 2012, CMS began requiring MAOs to submit encounter data. Such data include diagnosis and treatment information for all medical services and items provided to an enrollee, with a level of detail similar to FFS claims. Since 2015, CMS has used both RAPS and encounter data submitted by MAOs to risk adjust MA payments. When CMS proposed collecting encounter data in 2008, the agency stated it would use the data for risk adjustment and may also use them for specified additional payment and oversight purposes. CMS has recognized the importance of ensuring that the data collected are complete—representing all encounters for all enrollees—and accurate— representing a correct record of all encounters that occurred—given the important functions for which the data will be applied. In our 2016 report, we found several factors that hamper CMS’s recovery activities, including its failure to select contracts for audit that have the greatest potential for payment recovery, delays in conducting CMS’s first two RADV payment audits, and its lack of specific plans or a timetable for incorporating Recovery Audit Contractors (RACs) into the MA program to identify improper payments and help with their recovery. Our 2016 report found that the results from the RADV audits of 2007 payments indicated that the scores CMS calculates to identify contracts that are candidates for audit, called coding intensity scores, were not strongly correlated with the percentage of unsupported diagnoses. CMS defines coding intensity as the average change in the risk score component specifically associated with the reported diagnoses for the beneficiaries in each contract. Increases in coding intensity measure the extent to which the estimated medical needs of the beneficiaries in a contract increase from year to year; thus, contracts whose beneficiaries appear to be getting “sicker” at a relatively rapid rate, based on the information submitted to CMS, will have relatively high coding intensity scores. Figure 1 shows, for example, that CMS reported that the percentage of unsupported diagnoses among the high coding intensity contracts it audited (36 percent) was nearly identical to the percentage among the medium coding intensity contracts (35.7 percent). Our report also found that the RADV audits were not targeted to contracts with the highest potential for improper payments. We identified two reasons that the RADV audits were not targeted on the contracts with the greatest potential for recoveries. The first reason is that the coding intensity scores have shortcomings. For example, our report found that CMS’s calculation may be based on scores that are not comparable across contracts, because the years of data used for each contract may differ, and there are known year-to-year differences in coding intensity scores. In addition, CMS’s calculation does not distinguish between diagnoses likely coded by providers and diagnoses subsequently coded by MAOs. Medical records that providers create from diagnoses are apt to support the diagnoses better than diagnoses subsequently coded by the MAO through medical record review. CMS has a method available to it—the Encounter Data System—that will distinguish between the two diagnoses. Although using encounter data would help target the submitted diagnoses that may be most likely related to improper payments, CMS has not outlined plans for using it. Furthermore, CMS follows contracts that are renewed or consolidated under a different existing contract within the same MAO, but CMS’s coding intensity calculation does not incorporate prior risk scores from an earlier contract into the MAO’s renewed contract. This could result in an improper payment risk if MAOs move beneficiaries with higher risk scores, such as those with special needs, into one consolidated contract. The second reason audits are not targeted to the contracts with the greatest potential for recovery is that CMS does not always use the information available to it to select audit contracts with the highest potential for improper payments. CMS did not always target the contracts with the highest coding intensity scores, use results from prior contract- level RADV audits, account for contract consolidation, or account for contracts with high enrollment. For example, only four of the contracts selected for the 2011 RADV audit had coding intensity scores at the 90th percentile or above. Even though we found that coding intensity scores are not strongly correlated with diagnostic discrepancies, they are still somewhat correlated. Also, CMS’s 2011 contract selection methodology did not consider results from the agency’s prior RADV audits, potentially overlooking information indicating contracts with known improper payment risk. Finally, even though the potential dollar amount of improper payments to MAOs with high rates of unsupported diagnoses is likely greater when contract enrollment is large, CMS officials stated that the 2011 contract-level RADV audit contract selection did not account for contracts with high enrollment. We made two recommendations to address these issues: We recommended that (1) CMS improve the accuracy of coding intensity calculations, and (2) modify its processes for selecting contracts for RADV audit to focus on those most likely to have improper payments. In July 2017, CMS officials told us that the agency is working to implement these recommendations regarding the selection of contracts for audit. These officials said that CMS is reevaluating the design of the RADV audits to ensure its rigor in the context of all the payment error data acquired since the original design of the RADV audits, including an examination of whether coding intensity is the best criterion to use to select contracts for audit. Our 2016 report found that prior contract-level RADV audits have been ongoing for years, and CMS lacks an annual timetable to conduct and complete audits. CMS officials reported at that time that the current and previous contract-level RADV audits had been ongoing for several years. CMS has audits for payment years 2011, 2012, and 2013 underway. We concluded that this slow progress in completing audits conflicted with CMS’s goal of conducting contract-level RADV audits annually, and slowed recovery of improper payments. CMS lacked a timetable that would help the agency complete these contract-level audits annually. In this regard, CMS had not followed established project management principles, which call for developing an overall plan to meet strategic goals and to complete projects in a timely manner. In addition to the lack of a timetable, we found other factors that lengthened the time frame of the contract-level audit process. The sequential notification of MAOs that identify contracts selected for audit and then, sometimes months later, identify the beneficiaries under these contracts creates a time gap that hinders the agency from conducting annual audits. Technology problems with CMS’s system for receiving medical records are the main cause of the delay in completing CMS’s contract-level audits of 2011 payments. Additional technical issues with other systems led CMS to more than triple the medical record submission time frame for the 2011 audits. Our report found that disputes and appeals of contract-level RADV audits have also continued for years, and CMS has not incorporated measures to expedite the process. Nearly all of the MAOs whose contracts were included in the 2007 contract-level RADV audit cycle disputed at least one diagnosis finding following medical record review. CMS stated that MAOs disputed a total of 624 (4.3 percent) of the 14,388 audited diagnoses, and that the determinations on these disputes, which were submitted from March through May 2013, were not complete until July 2014. In addition, because the dispute process took a year and a half to complete, CMS officials stated that it did not receive all 2007 appeal requests for hearing officer review until August 2014. The hearing officer adjudicated or received a withdrawal request for 377 of the 624 appeals from August 2014 through September 2015. For the 2011 audit cycle, CMS officials stated that the medical record dispute process will be incorporated into the appeal process. Thus, MAOs can request reconsideration of medical record review determinations concurrent with the appeal of payment error calculations, rather than sequentially, as was the case for the 2007 cycle. While this change may help, the new process does not set time limits for when reconsideration decisions must be issued. Lack of explicit time frames for appeal decisions at reconsideration hinders CMS’s collection of improper payments because the agency cannot recover extrapolated overpayments until the MAO exhausts all levels of appeal, and the lack of time frames is inconsistent with established project management principles. We made two recommendations to address these issues: We recommended that CMS take steps to improve the timeliness of the RADV audit process. In July 2017, CMS officials told us that, as part of the agency’s efforts to consolidate program integrity initiatives into one center, the decision was made to transition RADV contract- level audits to the CMS Center for Program Integrity (CPI) at the end of 2016. With the transition, CMS is implementing a formal project management structure to facilitate the timeliness of the audit process. We also recommended that CMS require that reconsideration decisions be rendered within a specified number of days, similar to other time frames in the Medicare program. In July 2017, CMS officials told us that the agency is actively considering options for expediting the appeals process. Our 2016 report found that CMS had not expanded the RAC program to MA, as it was required to do by the end of 2010 by the Patient Protection and Affordable Care Act. Implementing an MA RAC would help CMS address the resource requirements of conducting contract-level audits. In 2014, CMS issued a request for proposals for an MA RAC, which would audit improper payments in three areas of MA, but CMS officials told us that CMS did not receive any proposals to do the work in those audit areas, and that its goal was to reissue the MA RAC solicitation in 2015. CMS reconsidered the audit work in the request for the MA RAC. In December 2015, CMS issued a request for information seeking industry comment on how an MA RAC could be incorporated into CMS’s existing contract-level RADV audit framework. In the request, CMS stated that it was seeking an MA RAC to help the agency expand the number of MA contracts subject to audit each year, and stated that its ultimate goal is to have all MA contracts subject to either a contract-level RADV audit or another audit that would focus on specific diagnoses determined to have a high probability of being erroneous. Officials from three Medicare FFS RACs all told us their organizations had the capacity and willingness to conduct contract-level RADV audits. We recommended that CMS develop specific plans for incorporating a RAC into the RADV program. In July 2016, CMS described to us its initial steps to meet this goal. In July 2017, CMS officials told us that the agency is evaluating its strategy for the MA RAC with CMS leadership. In July 2014, we recommended that CMS complete all the steps necessary to validate encounter data, including performing statistical analyses, reviewing medical records, and providing MAOs with summary reports on CMS’s findings, before using the data to risk adjust payments or for other intended purposes. In our 2017 report, we found that CMS had made limited progress toward validating encounter data. (See fig. 2.) As of January 2017, CMS had begun compiling basic statistics on the volume and consistency of data submissions and preparing automated summary reports for MAOs indicating the diagnosis information used for risk adjustment; however CMS had not yet taken other important steps identified in its Medicaid protocol, which we used for comparison. The steps CMS had not yet taken as of our January 2017 report are: Establish benchmarks for completeness and accuracy. This step would establish requirements for collecting and submitting MA encounter data. Without benchmarks, CMS does not have objective standards against which to hold MAOs accountable for complete and accurate data reporting. Conduct analyses to compare with established benchmarks. This would help ensure accuracy and completeness. Without such analyses, CMS has limited ability to detect potentially inaccurate or unreliable data. Determine sampling methodology for medical record review and obtain medical records. Medical record review would help ensure the accuracy of encounter data. Without these reviews, CMS cannot substantiate the information in MAO encounter data submissions and lacks evidence for determining the accuracy of encounter data. Summarize analyses to highlight individual MAO issues. This step would provide recommendations to MAOs for improving the completeness and accuracy of encounter data. Without actionable and specific recommendations from CMS, MAOs might not know how to improve their submissions. In July 2014, we also recommended that CMS establish specific plans and time frames for using the data for all intended purposes in addition to risk adjusting payments to MAOs. We found in our 2017 report that CMS had made progress in defining its objectives for using MA encounter data for risk adjustment and in communicating its plans and time frames to MAOs. CMS reported it plans to fully transition to using MA encounter data for risk adjustment purposes by 2020. However, even though CMS had formed general ideas of how it would use MA encounter data for purposes other than risk adjustment, as of January 2017 it had not specified plans and time frames for most of the additional purposes for which the data may be used. These other purposes include activities to support program integrity. In July 2017, CMS officials told us that the agency had not taken any further actions in response to our July 2014 recommendations. Because CMS is making payments that are based on data that have not been fully validated for completeness and accuracy, the soundness of billions of dollars in Medicare expenditures remains unsubstantiated. In addition, without planning for all of the authorized uses, the agency cannot be assured that the amount and types of data being collected are necessary and sufficient for specific purposes. Given CMS’s limited progress in planning and time frames for all authorized uses of the data, we continue to believe CMS should implement our July 2014 recommendations that CMS should establish specific plans for using MA encounter data and thoroughly assess data completeness and accuracy before using the data to risk adjust payments or for other purposes. In response to our 2014 recommendations, the Department of Health and Human Services did not specify a date by which CMS would develop plans for all authorized uses of the data and did not commit to completing data validation before using the data for risk adjustment in 2015. CMS began using encounter data for risk adjustment in 2015, although it had not completed activities to validate the data. In conclusion, Medicare remains inherently complex and susceptible to improper payments. Therefore, actions CMS takes to ensure the integrity of the MA program by identifying, reducing, and recovering improper payments would be critical to safeguarding federal funds. Chairman Buchanan, Ranking Member Lewis, and Members of the Subcommittee, this concludes my prepared statement. I would be pleased to respond to any questions that you may have. For questions about this statement, please contact James Cosgrove at (202) 512-7114 or cosgrovej@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Individuals who made key contributions to this testimony include Martin T. Gahart (Assistant Director), Aubrey Naffis (Analyst-in-Charge), Manuel Buentello, Elizabeth T. Morrison, Jennifer Rudisill, and Jennifer Whitworth. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: GAO has designated Medicare as a high-risk program because of its size, complexity, and susceptibility to mismanagement and improper payments, which reached an estimated $60 billion in fiscal year 2016. CMS contracts with MAOs to provide services to about one-third of all Medicare beneficiaries, and paid MAOs about $200 billion for their care in 2016. CMS's payments to the MAOs vary based on the health status of beneficiaries. For example, an MAO receives a higher risk-adjusted payment for an enrollee with a diagnosis of diabetes than for an otherwise identical enrollee without this diagnosis. Improper payments in MA arise primarily from diagnosis information unsupported by medical records that leads CMS to increase its payments. This testimony is based on GAO's 2016 and 2017 reports addressing MA improper payments and highlights (1) factors that have hindered CMS's efforts to identify and recover improper payments through payment audits and (2) CMS's progress in validating encounter data for use in risk adjusting payments to MAOs. For these reports, GAO reviewed research and agency documents, analyzed data from ongoing RADV audits, and compared CMS's activities with the agency's protocol for validating Medicaid encounter data and federal internal control standards. GAO interviewed CMS officials for both reports, and also asked for updates on the status of GAO's prior recommendations for this statement. The Centers for Medicare & Medicaid Services (CMS) estimated that about $16 billion—nearly 10 percent—of Medicare Advantage (MA) payments in fiscal year 2016 were improper. To identify and recover MA improper payments, CMS conducts risk adjustment data validation (RADV) audits of prior payments. These audits determine whether the diagnosis data submitted by Medicare Advantage organizations (MAOs), which offer private plan alternatives to fee-for-service (FFS) Medicare, are supported by a beneficiary's medical record. CMS pays MAOs a predetermined monthly amount for each enrollee. CMS uses a process called risk adjustment to project each enrollee's health care costs using diagnosis data from MAOs and demographic data from Medicare. In its 2016 report, GAO found several factors impeded CMS's efforts to identify and recover improper payments, including: RADV audits were not targeted to contracts with the highest potential for improper payments. The agency's method of calculating improper payment risk for each contract, based on the diagnoses reported for the contract's beneficiaries, had shortcomings, and CMS did not use other available data to select the contracts with the greatest potential for improper payment recovery. Substantial delays in RADV audits in progress jeopardize CMS's goal of eventually conducting annual RADV audits. CMS had RADV audits underway for payment years 2011, 2012, and 2013. CMS had not expanded the use of Recovery Audit Contractors (RAC) to the MA program as required by law in 2010. RACs have been used in other Medicare programs to recover improper payments for a contingency fee. GAO recommended that CMS improve the accuracy of its methodology for identifying contracts with the greatest potential for improper payment recovery, modify the processes for selecting contracts to focus on those most likely to have improper payments, and improve the timeliness of the RADV audit process. CMS reported in July 2017 that it had taken initial actions to address these recommendations, but none had been fully implemented. GAO also recommended that CMS develop specific plans for incorporating a RAC into the RADV program. In July 2017, CMS reported that the agency is evaluating its strategy for the MA RAC with CMS leadership. CMS has begun to use encounter data, which are similar to FFS claims data, along with diagnosis data from MAOs to help ensure the proper use of federal funds by improving risk adjustment in the MA program. Encounter data include more information about the care and health status of MA beneficiaries than the data CMS uses now to risk adjust payments. In its January 2017 report, GAO found CMS had made progress in developing plans to use encounter data for risk adjustment. However, CMS had made limited progress in validating the completeness and accuracy of MA encounter data, as GAO recommended in 2014. GAO continues to believe that CMS should establish plans for using encounter data and thoroughly assess the data for completeness and accuracy before using it to risk adjust payments.