HHS annually reports on improper payments in its AFR. For fiscal year 2010, HHS reported improper payment estimates for several programs, including Medicare. Collectively, HHS reported an estimate of almost $48 billion in improper payments in Medicare. The $48 billion in estimated improper payments reported for fiscal year 2010 is attributable to Medicare fee-for-service and Medicare Advantage. As shown in figure 1, the Medicare program represents about 38 percent of the $125.4 billion improper payment estimated amount reported by 20 federal agencies covering 70 programs. Further, Medicare’s estimated improper payment amount is the highest among all federal programs that reported an estimated amount. HHS’s estimated amount of improper payments for Medicare is incomplete because it has yet to report a comprehensive improper payment estimate for the Medicare prescription drug benefit program, which had reported outlays of about $59 billion in fiscal year 2010. However, HHS has taken some steps to develop a comprehensive improper payment error rate. Specifically, for fiscal year 2010, HHS calculated error rates for the four components of the Medicare prescription drug benefit program, with the estimates ranging from $45 million to $5.4 billion for each component. However, HHS reported that the four estimates overlap and consequently cannot be totaled. HHS reported that it expects to report a comprehensive estimate for the prescription drug benefit program in fiscal year 2011. It is important to recognize that the $48 billion in estimated improper payments reported by HHS in fiscal year 2010 is not an estimate of fraud in Medicare. Reported improper payment estimates include many types of overpayments, underpayments, and payments that were not adequately documented. In addition, because the improper payment estimation process is not designed to detect or measure the amount of fraud in Medicare, there may be fraud that exists in the Medicare program that is not included in the reported improper payment estimate. In addition to inadequate documentation, HHS cited a number of other causes for the estimated $48 billion in reported improper payments, including the provision of services that were found not to be medically necessary, coding errors, incorrect interpretation of data, and payment calculation errors. HHS reported that its analysis showed most Medicare fee-for-service improper payments were for medically unnecessary durable medical equipment and inpatient hospital services. For Medicare Advantage, HHS reported that the majority of the improper payment estimate resulted from insufficient documentation to support the diagnoses submitted by private health plans for payment. CMS’s methodology for estimating improper payments has evolved. Beginning in 1996, HHS’s Office of Inspector General (OIG) estimated improper payments in the Medicare fee-for-service program as part of its annual financial statement audit. In fiscal year 2003, CMS assumed responsibility for estimating Medicare fee-for-service improper payments and modified the methodology to improve error detection and provide more detailed information on the errors. During fiscal year 2009, HHS revised its methodology for calculating the Medicare fee-for-service improper payment error rate based on HHS OIG audit reports and input from CMS advisory medical staff. According to HHS, the revised methodology is more stringent. Using this revised methodology for a limited number of claims reviewed in fiscal year 2009, HHS reported estimated Medicare fee-for-service improper payments of $24.1 billion in its fiscal year 2009 AFR, representing an error rate of 7.8 percent. However, HHS subsequently restated the fiscal year 2009 improper payment estimate for Medicare fee-for-service by applying the results of the revised methodology to the entire year and reported a revised estimate of $35.4 billion and an error rate of 12.4 percent. CMS set key performance measures to reduce improper payments for Medicare fee-for-service and Medicare Advantage. For fiscal year 2010, HHS reported error rates of 10.5 percent and 14.1 percent for Medicare fee-for-service and Medicare Advantage, respectively. HHS reported that it met its improper payment error rate target for Medicare Advantage in fiscal year 2010 by achieving a 14.1 percent error rate, which was better than its goal of 14.3 percent. However, CMS was not able to demonstrate sustained progress in reducing its Medicare fee-for-service improper payment rate. As discussed previously, HHS reported that it made changes to improve the estimation methodology, which meant that previous estimates were not comparable to those HHS made in fiscal year 2010. For fiscal year 2012, CMS reported that it set improper payment reduction targets as part of the strategic plan prepared under the Government Performance and Results Act of 1993. The 2012 target error rates are 6.2 percent for Medicare fee-for-service and 13.2 percent for Medicare Advantage. Further, in response to Executive Order 13520, HHS designated the Assistant Secretary for Financial Resources and Deputy Administrator for Program Integrity at CMS as the accountable officials responsible for efforts to reduce improper payments and establish improper payment reduction targets for Medicare fee-for-service and Medicare Advantage as shown in figure 2. In 2010, CMS created the Center for Program Integrity (CPI) to serve as its focal point for all national Medicare program integrity issues. CPI is responsible for addressing program vulnerabilities leading to improper payments, including collaborating with other CMS components to develop and implement a comprehensive strategic plan, objectives, and measures to carry out the agency’s program integrity mission and goals. According to CMS documentation describing the program, CPI was designed to promote Medicare integrity through the following activities:    providing support and assistance to states;  conducting provider and contractor audits and policy reviews; identifying and monitoring program vulnerabilities; collaborating on the development and advancement of new legislative initiatives and improvements to deter, reduce, and eliminate fraud, waste, and abuse;  overseeing all CMS interactions and collaboration with key stakeholders related to program integrity (e.g., the Department of Justice, HHS OIG, and state law enforcement agencies) for the purposes of detecting, deterring, monitoring, and combating fraud and abuse; and taking action against those who commit or participate in fraudulent or other unlawful activities. CMS has begun a number of initiatives related to the five strategies identified in our previous reporting that are key to reducing Medicare improper payments. However, CMS still faces significant challenges in designing and implementing internal controls to effectively prevent or detect and recoup improper payments and to prevent fraud, waste, and abuse. In March 2011, we testified that effective implementation of GAO recommendations, provisions in recently enacted laws, and recent guidance related to five key strategies could help remediate fraud, waste, abuse, and improper payments in the Medicare program. Figure 3 provides an overview of those key strategies. We testified in March 2011 that PPACA had a number of provisions that, if effectively addressed, could aid CMS in its efforts to minimize improper payments. Specifically, PPACA included provisions related to strengthening provider enrollment and improving contractor oversight. CMS had issued final rules implementing some of these provisions. In addition, in June 2011, we reported on challenges CMS has faced in implementing information technology systems to help it identify potentially fraudulent or abusive claims that had been paid. The following sections provide an overview of CMS reported actions related to each of the five strategies we identified in our prior reporting as key to helping reduce Medicare improper payments. GAO has made recommendations to strengthen CMS’s actions to address these strategies, some of which have not been implemented. Strengthening provider enrollment standards and procedures. As discussed in our March 2011 testimony, strengthening the standards and procedures for provider enrollment could help reduce the risk of enrolling providers intent on defrauding or abusing the program. CMS has previously identified two types of providers whose services and items are especially vulnerable to improper payments—home health agencies (HHA) and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS). In our 2009 report on HHAs, we found problems with the enrollment procedures—for example, CMS’s contractors were not requiring HHAs to resubmit enrollment information (including information about key officials, operating capital, and practice location) for reverification every 5 years as required by CMS. CMS implemented one of the recommendations from that report but did not implement a recommendation to revoke billing privileges from HHAs engaged in pattern of improper billing practices. In a 2005 report on DMEPOS suppliers, we found that CMS had not taken sufficient steps to prevent entities intent on defrauding Medicare from enrolling, and we reported that more effective screening and stronger enrollment standards were Partl needed to ensure that new suppliers were legitimate businesses. in response to our recommendation to improve the provider enrollment process, CMS took steps to implement new supplier quality standards a part of an accreditation rule issued in August 2006 and proposed new supplier enrollment standards in January 2008. It proposed that supplie would be required to meet these new accreditation standards in 2009. However, the new supplier enrollment standards were not finalized until August 2010. Several requirements in PPACA focus on strengthening provider enrollment procedures, which could help prevent Medicare from making improper payments and address some of our previous concerns and recommendations. For example, PPACA requires the Secretary of HHS, in consultation with the HHS OIG, to establish procedures for screenin providers enrolling in Medicare, including assessing the risk levels o fraud, waste, and abuse by categories of providers. At a minimum, PPACA requires all providers to be subject to licensure checks, which may include checks across state lines. Further, PPACA provides for enhanced oversight of new providers for specific periods of time and of the initial claims of DMEPOS suppliers. On February 2, 2011, CMS and HHS OIG published a final rule to implement these new screening procedures. In addition, PPACA imposes specific requirements for providers to disclose any current or previous affiliation with a provider th has uncollected debt; has been or is subject to a payment susp under a federal health care program; has been excluded from participation under Medicare, Medicaid, or the Children’s Health Insurance Program or has had its billing privileges denied or revoked. The law allows CMS to deny enrollment to any such provider whose previou affiliations pose an undue risk. In February 2011, CMS officials told us s that they were drafting a proposed rule to implement this authority. Further, providers that order home health services must have a face-to- face encounter with the beneficiary before the services can be ordered. CMS issued a final rule regarding this requirement in November 2010. To reduce spending for durable medical equipment and related supplies, the Medicare Prescription Drug, Improvement, and Modernization Act of 2 (MMA) required that CMS phase in, with several rounds of bidding, a CMS large scale competitive bidding program for certain DMEPOS. began to implement a Medicare competitive bidding program for durable medical equipment and supplies with prices that took effect in January 2011 from the first round of bidding. This program has the potential to help reduce fraud, waste, and abuse because it requires CMS to se DMEPOS suppliers based in part on new scrutiny of their financial documents and other application materials, among other things. PPA required CMS to expedite implementation of the competitive bidding program for durable medical equipment, expanding the number of areas to be included in the second round of bidding from 70 to 91 by the end of 2011. CMS told us that it was working on round 2 of the competitive bidding program, which is anticipated to be operational in summer 2013. Improving prepayment review of claims. Our prior reporting on Medicare found that prepayment reviews of claims are essential to he ensure that Medicare pays correctly the first time. Conducting these reviews is challenging due to the volume of claims. Overall, less than 1 by percent of Medicare’s claims are subject to a medical record review trained contractor personnel. Therefore, having robust automated payment controls—called edits—in place to deny inappropriate claims o flag them for further review is critical. However, in our 2007 report, we r identified weaknesses in these prepayment controls. For example, we found that contractors responsible for reviewing DMEPOS claims did not have automated prepayment controls in place to identify questionable claims, such as those associated with atypically rapid increases in billing or for items unlikely to be prescribed in the normal course of medical care. Since then, CMS has added computer edits to flag claims for services unlikely to be provided in the normal course of medical care, but has not implemented our recommendation to have edits in place based on thresholds for unexplained increases in billing. If implemented, several recent legislative requirements and administrative directives could help CMS with its prepayment review to prevent improper payments. First, the Small Business Jobs Act of 2010 requires CMS to use predictive modeling and other analytic techniques—known as predictive analytic technologies—both to identify and to prevent improper payments under the Medicare fee-for-service program. These predictive analytic technologies will be used to analyze and identify Medicare provider networks, billing patterns, and beneficiary utilization patterns and detect those that represent a high risk of fraudulent activity. Through such analysis, unusual or suspicious patterns or abnormalities could be identified that could be used to prioritize additional review of suspicious transactions before payment is made. CMS published a solicitation in December 2010 for these technologies and a case management system to track findings. The legislation provides that the solicitation require contractors that are selected to begin using these technologies on July 1, 2011, in the 10 states identified by CMS as having the highest risk of fraud, waste, or abuse in Medicare fee-for-service payments. After the initial year, based on the results of the predictive analytic technologies, CMS reported that it plans to expand their use to other states beyond the 10 states identified as having the highest risk for fraud, waste, and abuse. According to CMS, as of July 1, 2011, initial predictive modeling has been used on claims prior to payment to identify their level of risk for being improper and to focus investigative efforts. Second, a June 2010 presidential memorandum directed agencies to check certain databases—known as the “Do Not Pay List”—before making payments, to ensure that payments do not go to individuals who were deceased or excluded from receiving federal payments or to entities that had been excluded from receiving federal payments. As of July 2011, this governmentwide database was still under development. However, CMS officials stated that, in response to the presidential memorandum, the agency reviewed selected databases that it and its Medicare contractors were using to determine payment eligibility for providers and took action to ensure that the agency’s method of ensuring payment eligibility was consistent with the intent of the “Do Not Pay List.” Focusing postpayment claims review on most vulnerable areas. We previously reported that postpayment reviews are critical to identifying payment errors to recoup overpayments in Medicare. CMS’s claims administration contractors conduct limited postpayment reviews. Therefore, it is important that they target their postpayment review resources on providers with a demonstrated high risk of improper payments. Further, we previously reported that CMS could strengthen postpayment home health claims review by focusing postpayment claims review on the most vulnerable areas and increasing the amount of postpayment review by using recovery audit contractors (RAC) for the Medicare program. CMS has not acted to implement our recommendation about focusing postpayment home health claims review based on high rates of improper billing identified through prepayment reviews. CMS has had efforts focusing on postpayment review of claims, most recently its national RAC program, begun in March 2009, after completion of a 3-year demonstration program in 2008. The national program was designed to help the agency supplement the postpayment reviews conducted by contractors other than RACs. The RACs review fee-for-service claims after payment, but because RACs are paid a contingent fee based on the dollar value of the improper payments identified, they have focused on claims from inpatient hospital stays, which are generally more costly services. PPACA expanded Medicare’s RAC program to Medicare Advantage and the prescription drug benefit program. CMS published a request for comments on the development of RACs for those programs in December 2010. CMS awarded a Medicare prescription drug benefit RAC task order for a 1-year base period that began January 2011 and included 4 option years. In June 2011, we reported that CMS has also developed information technology to help it better identify claims paid in error, but the systems are not being used to the extent originally planned, and CMS has not measured whether they have helped in reducing payment errors. To integrate claims information and improve its ability to identify fraud, waste, and abuse, CMS initiated two information technology system programs in 2006: the Integrated Data Repository (IDR) and One Program Integrity (One PI) to centralize and make more accessible the data needed to conduct these analyses. The IDR was intended to provide a central source of data related to Medicare and Medicaid claims, and the One PI system is a web-based portal and suite of analytical software tools to be used to extract data from IDR and enable complex analyses of these data. As we reported in June 2011, although CMS has developed and implemented IDR and One PI for use by its program integrity analysts, IDR did not include all the data the agency planned to have incorporated by the end of 2010. For example, IDR includes most types of Medicare claims data, but did not include data from other CMS systems that are needed to help analysts identify improper payments. According to IDR program officials, these data were not incorporated into IDR because funding for the development of the software and acquisition of the hardware needed to meet this requirement was not approved until the summer of 2010. Since then, IDR program officials have developed project plans and identified users’ requirements, and plan to incorporate these additional data by November 2011. In addition, CMS has developed and deployed One PI, but the system has been used by a limited number of analysts—less than 7 percent of the intended user community—and did not yet provide as many tools as planned. According to agency officials, plans to train and deploy the system to a broad community of users were disrupted when resources dedicated to these activities were redirected to address a need to improve the user training program. Further, as of June 2011, plans and schedules for completing the remaining work had not been finalized, and CMS had not identified risks and obstacles to project schedules that may affect its ability to ensure broad use and full implementation of the systems. Consequently, the agency may miss an opportunity to effectively use these information technology solutions to enhance its ability to detect fraud, waste, and abuse in the Medicare program. In our June 2011 report, we made seven recommendations to help ensure that the development and implementation of IDR and One PI help CMS meet its program integrity goals and objectives. CMS concurred with GAO’s recommendations and agreed to act upon them. Improving oversight of contractors. As called for in our Standards for Internal Control in the Federal Government, monitoring the activities used by an organization to address improper payments should be performed continually and should be ingrained in the entity’s operations. Over the years, we have found areas where CMS’s oversight of contractor activities that provide services to Medicare beneficiaries had been insufficient to ensure that required program control activities were conducted and working well. For example, all Part D drug-plan sponsors are required to have programs to prevent, detect, and correct fraud, waste, and abuse—also referred to as fraud and abuse programs. CMS is responsible for ensuring that sponsors are in compliance with this requirement. However, in 2008 we found that CMS’s oversight of these programs was limited. We recommended that CMS conduct timely audits of sponsors’ fraud and abuse programs. CMS agreed with this recommendation. In March 2010, we reported that CMS had completed desk audits of selected sponsors’ programs and was beginning to implement an expanded oversight strategy, including on-site audits to assess the effectiveness of these programs more thoroughly. In November 2010, CMS officials reported that the agency had conducted on-site audits of 33 of the 290 sponsors in 2010 covering 62 percent of the enrolled beneficiaries in 2010, which addresses our recommendation. As a result of the on-site audits, CMS had taken formal enforcement actions against several sponsors. In addition, CMS published a final rule in April 2010 to increase its oversight efforts and ensure that sponsors have effective programs in place. PPACA included provisions for CMS to evaluate contractors receiving Medicare Integrity Program and Medicaid Integrity Program funding every 3 years. In addition, PPACA requires these contractors to provide performance statistics to HHS and its OIG upon request. In February 2011, CMS officials told us that they were taking action to implement these requirements for Medicare. At that time, officials told us that CMS was tracking performance statistics and adding to and refining these statistics and was also developing the specific performance statistics for its Part D integrity contractors and expected to finalize these statistics this year. Developing a robust process for addressing identified vulnerabilities. Having mechanisms in place to resolve vulnerabilities that lead to improper payments is key to effective program management. But our work has shown that CMS has not developed a robust process to specifically address identified vulnerabilities that lead to improper payments in Medicare. We have reported that an agency should have policies and procedures to ensure that (1) the findings of all audits and reviews are promptly evaluated, (2) decisions are made about the appropriate response to these findings, and (3) actions are taken to correct or resolve the issues promptly. We have also stressed the importance of holding individuals accountable for achieving agency objectives. However, as we reported in March 2010, CMS had not established an adequate process during its recovery audit contracting demonstration or in planning for the subsequent recovery audit national program to ensure prompt resolution of identified improper payment vulnerabilities in Medicare. During the demonstration, CMS did not assign responsibility to agency officials or contractors for taking corrective action. According to CMS officials, the agency took corrective action only for vulnerabilities with national implications, and let the contractors that processed and paid claims decide whether to take action for vulnerabilities that might occur only in certain geographic areas. Additionally, we reported that during the demonstration CMS did not specify in a plan what type of corrective action was required or establish a time frame for corrective action. We also found that the lack of documented responsibility assignments impeded CMS’s efforts to promptly resolve the vulnerabilities identified during the demonstration. For the national Medicare RAC program, although CMS established a corrective action team to compile, review, and categorize identified vulnerabilities and discuss corrective action recommendations, the corrective action process was still incomplete. CMS appointed the Director of the Office of Financial Management to be responsible for the day-to-day operations of the program, and the CMS Administrator to be responsible for vulnerabilities that span agency components. However, the corrective action process did not include any steps to either assess the effectiveness of the corrective actions taken or adjust them as necessary based on the results of the assessments. Further, the agency had not developed time frames for implementing corrective actions. Because of these weaknesses, we recommended that CMS develop and implement a corrective action process that includes policies and procedures to ensure that the agency promptly (1) evaluates findings of RAC audits, (2) decides on the appropriate response and a time frame for taking action based on established criteria, and (3) acts to correct the vulnerabilities identified. CMS concurred with this recommendation. Agency officials said they intended to review vulnerabilities on a case-by- case basis and were considering assigning them to risk categories to help prioritize their actions. In February 2011, CMS reported that the agency was still working to address the vulnerabilities identified during the demonstration program. Specific to corrective actions, CMS officials told us that its contractors were required to consider and evaluate vulnerabilities identified by various entities, including the RACs. However, as of March 2011, CMS had not yet implemented this recommendation. We will continue to follow up with CMS on its progress in this area. With the amount of estimated improper payments and the unknown amounts of potential fraud, waste, and abuse in the Medicare program, it is critical for CMS to act quickly and decisively to reduce them. As it implements PPACA provisions concerning Medicare, CMS has an opportunity to use new tools to help address fraud, waste, abuse, and improper payments in the program. CMS has taken a number of actions related to rule making and issuing guidance to implement recent legislative and regulatory provisions, but because many efforts are in process, it is too early to gauge their effectiveness. These requirements will be critical in helping ensure integrity in Medicare operations, as will additional evaluation and oversight to determine whether they are implemented as intended and have the desired effect on ensuring that payments are made for intended and proper purposes. Notably, we are beginning new work to assess CMS’s efforts to strengthen the standards and procedures for Medicare provider enrollment to reduce the risk of enrolling providers that are intent on defrauding or abusing the program. We are also examining the effectiveness of different types of prepayment edits in Medicare systems and of CMS’s oversight of its contractors in implementing those edits to help ensure that Medicare pays claims correctly the first time. The level of importance CMS places on effectively implementing our recommendations and the requirements established by recent laws and guidance will be a key factor in reducing improper payments and potential fraud, waste, and abuse in the Medicare program and ensuring that federal funds are used efficiently and for their intended purposes. In this regard, we plan to continue monitoring these issues. Chairman Platts, Ranking Member Towns, this completes my prepared statement. I would be happy to respond to any questions you or other members of the subcommittee may have at this time. For more information regarding this testimony, please contact, Kay L. Daly, Director, Financial Management and Assurance, at (202) 512-9312 or by e-mail at DalyKL@gao.gov or Kathleen M. King, Director, Health Care, at (202) 512-7114 or by e-mail at KingK@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this testimony. Individuals making key contributions to this testimony included Valerie Melvin, Director; Carla Lewis, Assistant Director; Sheila K. Avruch, Assistant Director; Teresa Tucker, Assistant Director; Jacquelyn Hamilton; Jim Healy; Jason S. Kirwan; Crystal Lazcano; and Chelsea Lounsbury. Over the past couple of years, Congress and the executive branch have taken a number of actions intended to heighten the attention given to the issue of improper payments and to promote corrective actions. The Centers for Medicare & Medicaid Services’ (CMS) efforts to identify and remediate Medicare improper payments will be affected by these new initiatives. Table 1 summarizes the recent legislative and executive branch efforts intended to improve oversight and accountability over improper payments governmentwide, as well as key actions specific to Medicare. In November 2009, Executive Order 13520, Reducing Improper Payments, was intended to focus on increasing transparency and accountability for reducing improper payments and creating incentives for reducing improper payments. Under the Executive Order, the Office of Management and Budget (OMB) designated 14 programs as high-priority programs to focus attention on the programs that significantly contribute to the federal government’s improper payments. Medicare fee-for-service, Medicare Advantage, and Medicare prescription drug programs have been designated as high-priority programs as part of the Executive Order. Additionally, OMB established a Web site (www.PaymentAccuracy.gov) on the 14 high-priority programs that provides information on (1) the programs’ senior accountable officials responsible for efforts to reduce improper payments; (2) current, targeted, and historical estimated rates of improper payments; (3) why improper payments occur in the programs; and (4) what federal agencies are doing to reduce improper payments and recover overpayments. To supplement program integrity efforts, the Medicare Prescription Drug, Improvement, and Modernization Act of 2003 directed CMS to conduct a 3-year demonstration project on the use of a new type of contractors— recovery audit contractors (RAC)—in identifying underpayments and overpayments, and recouping overpayments in the Medicare program. The RAC demonstration program began in 2005. Subsequently, the Tax Relief and Health Care Act of 2006 required CMS to implement a national RAC program by January 1, 2010. CMS began implementing it in March 2009. In March 2010, the President issued a memorandum intended to expand agency efforts to recapture improper overpayments using recapture audits. Also, the Patient Protection and Affordable Care Act (PPACA), as amended by the Health Care and Education Reconciliation Act of 2010, contains provisions intended to improve accountability over Medicare. These provisions include:  establishing procedures for screening providers enrolling in Medicare, including assessing the risk levels of fraud, waste, and abuse by categories of providers;  expanding the Medicare RAC program to Medicare Advantage and Medicare prescription drug benefit program;  adding requirements for providers to disclose any current or previous affiliation with a provider that has uncollected debt; has been or is subject to a payment suspension under a federal health care program; has been excluded from participation under Medicare, Medicaid, or the Children’s Health Insurance Program or has had its billing privileges denied or revoked;  expanding the number of areas to be included in the competitive bidding program for durable medical equipment; and strengthening the Health Care Fraud and Abuse Control Program, a joint effort of the HHS Inspector General and the Department of Justice, which is designed to coordinate law enforcement activities regarding health care fraud and abuse, including that in Medicare. In June 2010, the President announced that the Administration would reduce the error rate for the Medicare fee-for-service program by half by fiscal year 2012. Also, the President directed agencies to check certain databases—known as the “Do Not Pay List”—before making payments to ensure payments did not go to individuals who were deceased or excluded from receiving federal payments or to entities that had been excluded from receiving federal payments. In addition to amending the Improper Payments Information Act of 2002 (IPIA) improper payment estimation requirements, the Improper Payments Elimination and Recovery Act of 2010 (IPERA) established additional requirements related to (1) federal agency management accountability; (2) recovery auditing aimed at identifying and reclaiming payments made in error; (3) compliance and noncompliance determinations based on an inspector general’s assessment of an agency’s adherence to IPERA requirements, and reporting that determination; and (4) an opinion on internal controls over improper payments. OMB issued IPERA implementing guidance on April 14, 2011. The Small Business Jobs Act of 2010 also contains a provision regarding claims review to prevent improper payments. It requires CMS to use predictive modeling and other analytic techniques—known as predictive analytic technologies—both to identify and to prevent improper payments under the Medicare fee-for-service program. The law requires these predictive analytic technologies to be used to analyze and identify Medicare provider networks, billing patterns, and beneficiary utilization patterns and detect those that represent a high risk of fraudulent activity. Through such analysis, unusual or suspicious patterns or abnormalities could be identified that could be used to prioritize additional review of suspicious transactions before payment is made. Fraud Detection Systems: Additional Actions Needed to Support Program Integrity Efforts at Centers for Medicare and Medicaid Services. GAO-11-822T. Washington, D.C.: July 12, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Status of Fiscal Year 2010 Federal Improper Payments Reporting. GAO-11-443R. Washington, D.C.: March 25, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Medicare: Program Remains at High Risk Because of Continuing Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 2011. Opportunities to Reduce Potential Duplication in Government Programs, Save Tax Dollars, and Enhance Revenue. GAO-11-318SP. Washington, D.C.: March 1, 2011. High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February 2011. Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010. Medicare Part D: CMS Oversight of Part D Sponsors’ Fraud and Abuse Programs Has Been Limited, but CMS Plans Oversight Expansion. GAO-10-481T. Washington, D.C.: March 3, 2010. Improper Payments: Progress Made but Challenges Remain in Estimating and Reducing Improper Payments. GAO-09-628T. Washington, D.C.: April 22, 2009. Medicare: Improvements Needed to Address Improper Payments in Home Health. GAO-09-185. Washington, D.C.: February 27, 2009. Medicare Part D: Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited. GAO-08-760. Washington, D.C.: July 21, 2008. Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies. GAO-07-59. Washington, D.C.: January 31, 2007. Medicare: More Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment Suppliers. GAO-05-656. Washington, D.C.: September 22, 2005. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: GAO has designated Medicare as a high-risk program because of its size, complexity, and susceptibility to improper payments. In 2010, Medicare covered 47 million elderly and disabled beneficiaries and had estimated outlays of $516 billion. The Centers for Medicare & Medicaid Services (CMS) is the agency in the Department of Health and Human Services (HHS) responsible for administering the Medicare program and leading efforts to reduce Medicare improper payments. This testimony focuses on estimated improper payments in the Medicare program for fiscal year 2010 and the status of CMS's efforts to implement key strategies to help reduce improper payments. This testimony is primarily based on previous GAO reporting related to governmentwide improper payments, Medicare high-risk challenges and program integrity efforts, and CMS's information technology systems intended to identify improper payments. GAO supplemented that prior work with additional information on the nature and extent of Medicare improper payments reported by HHS in its fiscal year 2010 agency financial report. GAO also received updated information from CMS in February 2011 and, in select cases, as of July 2011, on its actions related to relevant laws, regulations, guidance, and open recommendations pertaining to key remediation strategies. For fiscal year 2010, HHS reported an estimate of almost $48 billion in Medicare improper payments, representing about 38 percent of the total $125.4 billion estimate for the federal government. However, this Medicare improper payment estimate is incomplete because HHS has yet to develop a comprehensive estimate for the Medicare prescription drug benefit. The improper payment estimate includes both overpayments and underpayments. Causes cited include inadequate documentation, medically unnecessary services, coding errors, and payment calculation errors. It is important to recognize that the $48 billion is not an estimate of fraud in Medicare. Because the improper payment estimation process is not designed to detect or measure the amount of fraud that may exist, there may be fraud that is not reflected in HHS's reported estimate. CMS faces challenges in designing and implementing internal controls to effectively prevent or detect and recoup improper payments. In 2010, CMS established the Center for Program Integrity to serve as its focal point for all national Medicare program integrity issues. Based on past work, GAO identified five key strategies to help reduce fraud, waste, and abuse and improper payments in Medicare, which CMS has reported initiating actions to address. GAO has made recommendations to strengthen CMS's implementation of these strategies, some of which the agency has not implemented. (1) Strengthen provider enrollment standards and procedures. Strong standards and procedures can help reduce the risk of enrolling providers intent on defrauding the program. CMS has taken action to implement provisions of the Patient Protection and Affordable Care Act by screening providers by levels of risk and providing more stringent review of high-risk providers, but has yet to implement certain GAO recommendations in this area. (2) Improve prepayment reviews. Prepayment reviews of claims help ensure that Medicare pays correctly the first time. According to CMS, as of July 1, 2011, CMS has begun applying predictive modeling analysis to claims and plans to expand Medicare prepayment controls. CMS has not implemented GAO's recommendation to improve prepayment reviews. (3) Focus postpayment reviews on vulnerable areas. Postpayment reviews are critical to identifying payment errors and recouping overpayments. In March 2009, CMS began instituting a national recovery audit contractor (RAC) program to help the agency supplement its postpayment reviews. CMS has also developed information technology to help it better identify claims paid in error, but GAO recently reported that the systems are not being used to the extent originally planned and made several recommendations to address the issues. (4) Improve oversight of contractors. CMS has taken action to improve oversight of prescription drug plan sponsors' fraud and abuse programs, which addresses GAO's recommendation, but is still developing specific performance statistics. (5) Develop a robust process to address identified vulnerabilities. Having mechanisms in place to resolve vulnerabilities that lead to improper payments is critical. While CMS has begun actions in this area, it has not developed a robust corrective action process for vulnerabilities identified by Medicare RACs as GAO recommended.