Contractors have a long-standing and essential role in the Medicare program. Program integrity activities—particularly postpayment claims reviews—have been a core component of contractors’ roles. When conducting postpayment claims reviews, contractors apply the same criteria—Medicare regulations, and coverage and coding policies— to determine whether or not a claim was paid properly. CMS outlines the general process and contractor requirements for conducting claims review in its manuals and contractor statements of work. Postpayment claims reviews may be automated, semiautomated, or complex. Automated reviews use computer programming logic to check claims Contractors can for evidence of improper coding or other mistakes. use automated postpayment reviews to analyze paid claims and identify those that can be determined to be improper without examining any additional documentation, such as when a durable medical equipment (DME) supplier bills for items that should have been included as part of a bundled payment for a skilled nursing facility stay. Semiautomated reviews use computer programming logic to check for possible improper payments, but allow providers to send in information to rebut the claim denial before it is implemented. Only the RAs conduct such reviews. If providers send in information, RA staff review it before making a final determination. Complex reviews are conducted if additional documentation is needed to determine whether a payment was made in error. Complex reviews involve manual examinations of each claim and any related documentation requested and received from the provider, including paper files, to determine whether the service was billed properly, and was covered, reasonable, and necessary. Licensed clinical professionals, such as licensed practical nurses, and certified coders typically perform the reviews. Contractors have physician medical directors on staff who provide guidance about making payment determinations on the basis of medical records and other documentation and who may discuss such determinations with providers. The postpayment claims review process involves selection of the claims to be reviewed, the review itself, communicating with providers during and about the review, and a process for assuring quality of the contractor’s reviews and decisions. Each contractor establishes its own claims selection criteria. A contractor may use data analyses, knowledge of Medicare billing requirements, and clinical expertise to develop its claims selection criteria to focus on claims with a high likelihood of being improper. As a part of the review, the contractor may notify the provider that a claim is under review, or ask for medical records or other documentation to substantiate the claim. The latter is called an additional documentation request (ADR). If the contractor requires additional documentation, the provider must submit the requested documents within a specified time frame. If the review has determined that the Medicare payment amount was improper, either the contractor or the MAC for that jurisdiction will notify the provider that an overpayment was made and will need to be recouped, or an underpayment was made and the remainder of the remittance will be paid to the provider. Providers may appeal any of the contractors’ decisions. The contractors’ quality assurance (QA) processes may include various steps to assure consistency, reliability, and quality in claims reviews. The QA process may include some type of examination of the work that has been done and may be performed internally, by the contractors themselves, or externally, by CMS or an independent third party. A contractor’s QA process may include comparing multiple reviewers’ decisions about the same claim to determine the extent of their agreement (known as interrater reliability testing) or reviews to validate the claims review decisions by others who are either internal or external to the reviewer’s organization. The QA process may also include staff training, to ensure that the reviewers understand Medicare program and payment rules so that their determinations can be consistent. The QA processes followed may also be outlined in a QA plan. The Medicare Prescription Drug, Improvement, and Modernization Act of 2003 (MMA) directed CMS to establish a demonstration program to test the use of RAs on a contingency fee basis in the Medicare program. Other contractors that review claims are given a set amount of funding to conduct reviews. In the demonstration project, RAs were paid contingency fees on claims that were identified as improper, including on claims for which the RA determinations were overturned on appeal at the second through fifth levels of review. Subsequently, the Tax Relief and Health Care Act of 2006 required CMS to implement a permanent and national Medicare recovery audit contractor program to increase efforts to identify and recoup improper payments. During the course of the RA demonstration program, providers reported several specific problems. In providers’ views, the RA’s contingency fee payment structure created an incentive for these contractors to be too aggressive in determining that claims were improper. Providers also faulted CMS for not penalizing RAs for inaccurate claim determinations, noting that contractor determinations resulted in thousands of provider appeals that were expensive and burdensome for providers. In addition, providers stated that during the demonstration project RAs did not have the necessary medical expertise to make their determinations, because they were not required to have a physician medical director on staff or coding experts conducting the claims reviews. We indicated in a previous report that CMS took a number of steps to address issues raised by providers about the RA demonstration program when it implemented the RA national program. For example, CMS put in place more rigorous staffing requirements and eliminated contingency fee payments when RAs’ claims determinations are overturned on appeal. In addition, CMS took steps to improve oversight of the accuracy of RAs’ claims review determinations and the quality of RA service to providers in the national program. CMS added processes to review the accuracy of RA determinations and established performance metrics to monitor RA accuracy and service to providers. Internal control is the component of an organization’s management that provides reasonable assurance that the organization achieves effective and efficient operations, reliable financial reporting, and compliance with applicable laws and regulations.postpayment claims reviews, should provide reasonable assurance that the Medicare program is appropriately reimbursing for services provided to beneficiaries, thereby protecting the integrity of the Medicare program. Ineffective or inefficient claims reviews present the risk of generating false findings of improper payments and an unnecessary administrative and financial burden related to provider appeals for Medicare-participating providers and the Medicare program. CMS requirements for contractors performing postpayment claims reviews help establish the control environment and control activities, such as monitoring. The manner in which the agency delegates authority and responsibility through these requirements establishes part of the control environment. Contractor requirements also establish the mechanisms that contractors use to communicate and interact with providers. Internal controls, in this case In addition, Executive Order 13571—Streamlining Service Delivery and Improving Customer Services—was issued in April 2011 to improve government services to individuals and entities by requiring agencies to develop customer service plans in consultation with OMB. Subsequently, OMB issued implementation guidance for agencies for those services that the agencies plan to focus on improving. The guidance calls for improving the customer service experience through practices such as developing a process for ensuring consistency and coordinating with others to identify opportunities to use common processes. Among other things, the guidance also suggests analyzing customer preferences and redirecting resources from less preferred and more costly channels—like printed materials—to preferred, less costly and more widely accessible channels (such as internet communications) where appropriate. Over time, Congress provided for CMS to use contractors to carry out functions in connection with the FFS program, which has resulted in the use of more types of contractors to conduct postpayment claims reviews. These contractors also have different primary functions and characteristics, which affect their use of postpayment claims reviews. Although contractors have been used for Medicare since the beginning of the program, several statutory changes since the 1990’s increased CMS’s resources and authority to use new types of contractors—MACs, RAs, ZPICs, and CERT contractors—to conduct postpayment claims reviews in order to help detect and recoup overpayments or repay underpayments, and to investigate potential fraud. In 1965 when Medicare was established, Congress provided for two types of contractors that could be used to administer the program. From then until 1996, responsibility for processing and paying Medicare claims, as well as for the program integrity tasks of developing potential cases and coordinating with law enforcement regarding any investigations of suspected Medicare fraud, resided with contractors called fiscal intermediaries and carriers. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established the Medicare Integrity Program (MIP), which authorized CMS to contract separately for program safeguard contractors (PSC)—the precursor to the ZPICs—to conduct activities, such as identifying and investigating potential fraud, that had previously been conducted by fiscal intermediaries and carriers and provided funding for MIP. In 2003, the MMA required CMS to replace the fiscal intermediaries and carriers with the MACs. (See table 1.) During the implementation of the MACs, CMS consolidated the number of contractors that process and pay Medicare FFS claims, enlarged their geographic jurisdictions compared to the previous contractors, and combined Part A and Part B claims processing within each jurisdiction. As part of changes made while implementing MACs, CMS also transitioned fraud investigation from PSCs to ZPICs in all but one zone. The MMA also directed CMS to establish a demonstration project to test the use of recovery audit contractors in the Medicare program. Subsequently, the Tax Relief and Health Care Act of 2006 required CMS to implement a permanent and national Medicare recovery audit contractor program to increase efforts to identify and recoup improper payments. Although HHS had begun estimating the extent of improper payments in Medicare FFS claims in 1996, the Improper Payments Information Act of 2002 (IPIA) requires executive-branch federal agencies to annually review all programs and activities to identify those that are susceptible to significant improper payments, estimate the annual amount of improper payments for these programs and activities, and report these estimates along with actions taken to reduce improper payments for programs with estimates that exceed $10 million. In fiscal year 2003 as part of its IPIA compliance efforts, CMS established the CERT program to measure improper payment rates for Medicare FFS claims, including one CERT contractor that is responsible for reviewing a random sample of claims nationwide, with their related medical records and other documentation to determine if they are proper. CMS has established responsibility for overseeing these four types of contractors in different parts of its matrixed organization (see fig.1). Three different organizational components within CMS—Center for Medicare (CM), Office of Financial Management (OFM), and Center for Program Integrity (CPI)—oversee these four different types of contractors. CM oversees the MACs, which conduct several program integrity activities, including postpayment claims review. CMS’s Provider Compliance Group within OFM oversees the RAs and CERT contractors. The Provider Compliance Group has overall responsibility for the oversight of the claims review activity conducted by MACs, RAs, and CERT contractors and for measurement of the FFS improper payment rate. CPI oversees the ZPICs and has direct responsibility for program activities involved in investigating potential fraud. Four types of CMS contractors conducting postpayment reviews have different primary functions and characteristics (see table 2.) Postpayment claims reviews are the main focus of the RA and CERT contractors’ functions, but that is not the case for MACs and ZPICs. The contractors also vary in the number of states and size of their geographic jurisdictions and the volume of claims they review. MACs. Our analysis of MACs’ statement of work indicates that MACs have primary responsibility for processing and paying Medicare FFS claims in their geographic jurisdictions. In addition, MACs conduct several program integrity activities, including prepayment and postpayment claims review, audits of hospitals and other institutional providers to ensure the accuracy of payments paid based on institutions’ reported costs and recoupment of overpayments. They also implement local coverage determinations (LCD) in their jurisdictions, as long as such determinations do not conflict with national coverage policy or other Medicare payment requirements. As of June 2013, there are 12 MACs that process part A and part B claims (A/B MAC), one for each of 12 jurisdictions, and 4 MACs that process DME claims (DME MAC), one for each of 4 jurisdictions. Jurisdictions of other contractors, such as ZPICs and RAs, were designed to align with MAC jurisdictions. MACs conduct postpayment reviews to help ensure accurate payment and specifically to identify payment errors. This includes identifying ways to address future payment errors—for example, through automated controls that can be added on a prepayment basis and educating providers with a history of a sustained or high level of billing errors to ensure that they comply with Medicare billing requirements. In 2012, MACs performed about 84,000 complex postpayment claims reviews. Because each jurisdiction has a MAC responsible for claims administration, if another contractor identifies an improper payment, the MAC for that jurisdiction is responsible for correcting any underpayments and recouping any overpayments, and, in some cases, for corresponding with providers whose claims are under review. ZPICs. The ZPICs’ primary function is to identify and investigate potentially fraudulent FFS claims and providers in each of seven geographic jurisdictions, which are called zones. CMS established ZPICs in 2008 to investigate potential fraud through a jurisdiction-based approach similar to that of the MACs. CMS officials indicated that this approach consolidated responsibility with the ZPICs for investigating potential fraud for all types of claims and for all parts of Medicare in each geographic jurisdiction. The Fraud Prevention System is intended to analyze Medicare claims, provider, and beneficiary data before claims are paid to identify those that are potentially fraudulent. See GAO, Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness, GAO-13-104 (Washington, D.C.: Oct. 15, 2012). reviews generally focus on providers whose billing patterns are unusual or aberrant in relation to similar providers in order to identify potential fraud or abuse. When ZPICs identify improper payments, they refer these to the MACs to be recouped or repaid. ZPICs performed about 108,000 complex postpayment claims reviews in 2012. CERT contractor. Our analysis of its statement of work indicates that the primary function of the CERT review contractor is to conduct postpayment claims reviews used as a basis to estimate the annual FFS Medicare improper payment rate—the percentage of claims paid improperly. HHS began to estimate the rate of improper payments in Medicare FFS in fiscal year 1996. CMS began estimating the FFS Medicare improper payment rate in fiscal year 2003. Since then, the CERT review contractor has had the responsibility of reviewing a sample of claims for the entire nation for this estimate.central part of the CERT review contractor function. CERT reviews also help identify program integrity vulnerabilities by measuring the payment accuracy of each MAC, and the Medicare FFS improper payment rate by type of claim and service. The CERT claims review sample is pulled semimonthly from MAC processed claims and encompass those that have been paid, denied, or selected for a MAC claims review. This report will refer to the CERT claims reviews as “postpayment;” because all of the claims were processed prior to CERT claims review even though not all were paid. not make recoupments or repayments. If the CERT contractor determines that an improper payment has been made, the CERT contractor is required to refer the claim to the appropriate MAC for recoupment of overpayments or repayment of underpayments. In fiscal year 2012, the CERT review contractor reviewed just over 41,000 postpayment claims. RAs. Our analysis of the RA statement of work indicates that conducting postpayment claims reviews is the RAs’ primary function. Use of RAs was designed to be an addition to MACs’ existing claims review processes, since the number of postpayment reviews conducted by the MACs and other contractors was small relative to the number of claims paid and amount of improper payments. To implement the national recovery audit program, CMS contracted with four RAs to conduct postpayment reviews of Medicare FFS claims to identify overpayments and underpayments within four geographic jurisdictions. In part because of issues that were raised during the RA demonstration program, CMS made changes in the RA’s requirements to provide more oversight over their activities. As in the demonstration, under the national program the RAs are paid on a contingency fee basis, but CMS officials indicated that the percentage is smaller. For the national program, the fee ranges from 9 to 12.5 percent of the overpayments and underpayments collected. In contrast to the MACs, ZPICs, and CERT contractor, which are paid on the basis of the contractually negotiated costs for the tasks performed, RAs are compensated from the funds that are recouped. However, if an RA’s overpayment determination is overturned on appeal, the RA is not paid for that claim. The RAs conducted nearly five times as many complex reviews in fiscal year 2012 as the other three contractors combined—over 1.1 million complex postpayment claims reviews and nearly 1 million automated review denials. With an increased focus on measuring and reducing Medicare improper payments and the implementation of RAs, there has been a significant increase in the number of claims being reviewed postpayment (see table 3). Our analysis of data from CMS indicates that from 2011 to 2012, the RA’s complex postpayment reviews increased 77 percent. Except for the CERT contractor, which reviews a randomly selected sample of claims each year to estimate the error rates, all contractors increased their postpayment claims reviews by 16 percent or more. However, the 2.3 million reviews performed by these contractors accounted for less than 1 percent of the over 1 billion FFS claims paid annually, and about 1.4 million were complex reviews. CMS has different requirements for postpayment claims reviews across different contractor types, and some of these differences can sometimes impede effectiveness and efficiency by increasing administrative burden on providers. Due in part to CMS’s experience with the RA demonstration and issues raised by providers during the demonstration, CMS sets more limits through claims review requirements on RAs than on other contractors. CMS officials generally described some other differences as developing when different requirements were set by different groups within the agency at different times. CMS has begun an effort to examine whether its claims reviews activities add administrative burden for providers. As a result of lessons learned during the RA demonstration project and to establish tighter controls on RAs, CMS imposed certain postpayment requirements unique to the RAs when it implemented the national program (see table 4). For example, RAs are required to limit the number of ADRs made to a single provider during a given period, while the other contractors do not have such limits. Similarly, unlike the other contractors, RAs cannot make claim denials for lapses in documentation standards unrelated to reasonableness or medical necessity, such as illegible physician signatures or dates. Other requirements unique to the RAs include submitting to CMS for review and approval descriptions of the billing issues that they propose to review and the basis for assessing whether the claims for those services are proper prior to widespread use, posting notice of billing issues targeted for postpayment review on reimbursing certain providers for the expense entailed in providing requested medical records, making claims reviewers’ credentials available upon provider request, providing access to RA staff physicians for discussion of claim denials upon provider request, and giving providers 40 days to request an opportunity to provide additional documentation to the contractor and informally discuss any revision prior to having to file an appeal. If the contractor sent the provider an ADR, and the claim is found to be proper, RAs are the only type of postpayment review contractor required to notify the provider. This means that providers who have sent in documentation do not routinely get a definitive answer that a MAC, ZPIC, or CERT contractor claim review has been concluded—unless an improper payment has been detected. Representatives of three provider associations indicated that it was important for financial management purposes for providers to be informed when a review was concluded and whether or not funds would be recouped. Representatives of three provider associations indicated if certain RA requirements were applied to the other contractors, this could reduce administrative burden and improve claims reviews efficiency. For example, representatives from one provider association indicated that it is valuable to discuss informally any revision to the contractor’s initial claims determination prior to providers filing an appeal. When such discussion results in providers being able to properly explain their billing, it can lessen administrative burden by reducing the number of appeals filed. However, according to preliminary CMS data, nearly 20 percent of the 1.4 million RA claim overpayment determinations were appealed to the first level in 2012. Among the appealed overpayment determinations about 28 percent were overturned at the first level of appeal by MACs, which suggests that providers may not be having such discussions or the discussions are not succeeding in resolving issues prior to appeal. Three provider associations also indicated that having a limit on the number of medical records that could be requested in a given time period helped manage the burden of responding to the requests. However, adding such limits to contractors other than RAs might limit the number of claims reviews these other contractors could conduct. Many of the other requirements CMS developed for postpayment review activities, including documentation submission, staffing, and quality assurance, vary across the four contractor types. Some of the differences in the contractors’ postpayment claims review requirements can impede effectiveness and efficiency of the claims reviews by complicating providers’ responses to ADRs or their understanding of claims review decisions, according to representatives from three provider associations with whom we spoke. According to CMS officials, differences in requirements generally developed because the contracts or requirements were written at different times by staff within different parts of CMS, or the contractors’ functions and activities have changed over time. However, some differences were due to other factors, such as cost. Additional Documentation Requests. Differences in contractors’ requirements for sending ADRs and timelines for providers’ responses to the contractors are illustrated in table 5. In some cases, in addition to reviewing documentation from the provider whose claim is under review, the contractor will also need to review documentation from a third party— such as the provider who referred the beneficiary for the service or item to the service provider whose claim is being reviewed. For example, while reviewing a claim for an X-ray, the contractor might want to review additional documentation from the referring physician, in order to determine the medical necessity of the X-ray service. The MACs, ZPICs, and RAs have the discretion to send a separate ADR to a third-party provider (in the example above, the referring physician) for additional documentation to support the medical necessity of the service or supply. If the service provider cannot obtain the necessary third-party documentation or if the contractor decides that the documentation is insufficient to support the claim, the claim will be denied, but not the third- party’s claim. The CERT contractor is the only one that is required to directly contact the third party for an ADR if the provider being reviewed requests it and the claim exceeds $40. Four provider associations we interviewed indicated that it can sometimes be difficult for the providers whose claims were being reviewed to obtain the needed documentation from third parties in a timely manner. There is no financial incentive for the third parties to forward requested documentation to the service providers because the third parties’ claims are not denied as improper if the documents are not submitted to the contractor. In the view of four provider associations, requiring providers to obtain documentation not directly under their own control can hinder their compliance with the ADR, because they are sometimes unable to provide the documentation. Providers have 30 days to respond to an ADR sent by a ZPIC, 45 days to respond to an ADR sent by a MAC or RA, and 75 days to respond to an ADR sent by the CERT contractor. If the provider does not respond within the required time frame, the contractor may find the payment improper and refer the claim for recovery. MACs, ZPICs, and the CERT contractor also have discretion in setting the number of extensions, if any, whereas All of the CMS requires RAs to give providers one extension. contractors have discretion on setting the length of extensions. Representatives from two provider associations stated that having different timeframes makes responding to ADRs more challenging. In addition, ensuring consistency in common processes is consistent with OMB guidance on streamlining service delivery and a strong control environment. CMS officials told us that, in practice, RAs give providers as much time as they need and the CERT contractor may also extend the time period so as not to unnecessarily deny the claim for lack of documentation. However, the CERT contractor is constrained by its schedule to estimate the annual Medicare improper payment rate. Submission Requirements. Different types of contractors are subject to different requirements regarding the formats in which they will accept providers’ documentation, whether paper, fax, or electronic submission (see table 6). While RAs and the CERT contractor are required to accept submission of files stored electronically on compact discs or digital video discs (DVD), the other contractors are not. CMS has developed a system called electronic submission of medical documentation (esMD) for providers to transmit medical documentation electronically, which began to be adopted by contractors in 2011. Though its use is discretionary, most of the MACs, all of the RAs, the CERT contractor, and about one- third of ZPICs accept electronic submissions through esMD.provider association indicated that having all contractors accept electronic submissions, such as submissions of e-documents on compact discs and DVDs could reduce the administrative burden on providers. Further, making electronic submission acceptable across all contractors would be consistent with OMB guidance on streamlining service delivery. Staffing requirements. CMS requirements for staffing, including claims reviewers’ qualifications, vary depending on the type of contractor (see table 7). CMS specifies the minimum number of physicians serving as medical directors that each contractor must have on staff. The minimum number of medical directors and their responsibilities vary for each of the four types of contractors. CMS requires that medical directors serve as a readily available source of medical expertise to provide guidance on claims reviews for all of the contactors, but their scopes of responsibility vary across contractors. This could lead to differences in the number of medical directors needed. For example, the MAC medical directors are also responsible for oversight of prepayment review, providing provider outreach and education, developing local coverage policy, and representing the contractor in appeals. In contrast, while the RA medical directors do not have some of the other responsibilities of the MAC medical directors, they have much larger geographic jurisdictions than MACs. Requirements for the minimum number of medical directors include the following: A/B MACs must have at least three full-time equivalent (FTE) medical RAs are required to have one FTE medical director on staff, ZPICs are required to have at least one part-time medical director, the CERT contractor is required to have two FTE medical directors. Given the variability of the medical directors’ responsibilities and the differing sizes of their jurisdictions, direct comparisons cannot be made across the contractors to determine the number of medical directors needed. CMS officials acknowledged differences in staffing requirements across contractor types, and differences in expectations for the roles of medical directors. CMS officials also indicated that they have not required similar numbers of medical directors or required a certain number of medical directors to be responsible for oversight of a specific number of claims reviews because of cost issues.differences, CMS officials indicated that they do not want to incur additional costs that could be involved in establishing consistent minimum staffing requirements for conducting claims reviews, if that would increase the number of medical directors that contractors would have to hire. Requirements for other staff conducting claims reviews also differ across contractors. Specifically, CMS requires RAs to use registered nurses or therapists in making determinations of medical necessity, but the others may use licensed practical nurses. CMS also requires RAs and the CERT contractor to employ certified coders to determine compliance with Medicare coding requirements, but does not require MACs or ZPICs to do so. CMS has a requirement for ZPICs, that when Medicare policy for a given service is not clearly articulated, the ZPICs must involve a medical specialist trained and experienced in providing the type of service being reviewed. There is no similar requirement for the other contractors. CMS officials indicated that making claims reviewers’ staffing requirements more consistent could increase the cost of claims reviews— for example that requiring A/B MACs and ZPICs to hire RNs instead of LPNs to conduct claims reviews would likely increase the contract costs. Representatives from six provider associations indicated that on the basis of some of the claims review results, their members had questioned whether some reviewers were qualified to review claims, and several associations indicated that erroneous claims reviews led to appeals that would not have been needed had the determination been correct. Quality assurance requirements. While CMS requires QA processes to ensure the quality of claims reviews, the requirements differ by contractor type (see table 8). GAO’s Internal Control Management and Evaluation Tool states that monitoring (such as the monitoring carried out with QA processes) should be conducted to assess performance and determine whether controls (such as claims reviews) continue to be effective. Providers have questioned the quality of contractors’ decision making— specifically that the contractors are not consistently making proper determinations that appropriately apply Medicare coverage, coding, and payment rules in evaluating the claims. Having effective QA processes can help ensure that claims determinations are made properly and consistently—which is part of having strong internal controls. When asked about the reason for differences among specific requirements for QA processes for different contractors, CMS officials responded that different offices in CMS were responsible for the contract specifications and contractor management and the contracts were written at different times and therefore vary. With regard to internal QA processes, CMS requires that the MACs, ZPICs, and CERT contractor conduct interrater reliability testing and participate in annual clinical judgment training in support of postpayment claims review determinations. CMS also requires that the CERT contractor’s QA process include internal secondary reviews of any claim that was determined improper and internal interrater reliability testing. CMS does not require the RAs to conduct interrater reliability testing or participate in clinical judgment training. Each contractor type is also required to have an internal QA plan, but CMS does not require any specific QA steps regarding consistency and quality of postpayment claims reviews’ determinations in any of the contractors’ plans. The different types of contractors also have different requirements for external QA review processes. While the RAs are not required to have some of the internal QA processes, CMS has established an external validation process conducted by a different contractor for the RAs’ postpayment claims reviews. To validate the claims review determinations for each RA on a monthly basis, the RA validation contractor reviews a random sample of 400 claims proportional to the provider types that each RA determined had been paid improperly. Unlike the RAs, the MACs, ZPICs, and CERT contractor are not subject to external validation reviews of their postpayment claims reviews. In 2011, CMS established an internal work group known as the Provider Burden Reduction Work Group to inventory CMS and contractor activities that may create administrative burden for providers, to assess providers’ complaints, and identify areas for improving efficiency of processes. As part of this effort, CMS officials indicated that they found differences in contractor requirements related to claims reviews. As an example, they indicated that contractors’ form letters were not standardized; instead different types of contractors were required to include different information in their form letters. Representatives of two provider associations had indicated that having different contractors send out different versions of the same type of form letters seemed to be confusing to providers. As of November 2012, CMS officials told us that the work group had briefed CMS senior management about its work, but this effort was still in progress. CMS has not publicly announced the results of the work group’s efforts, whether it would make any requirements more consistent, or a time frame for any changes. Having less variation in requirements for providers would be consistent with OMB guidance on streamlining service delivery. Further, internal control standards indicate the importance of deciding on corrective actions when needed and setting time frames for completing them. CMS officials told us that they have taken steps to increase provider awareness and reduce confusion about the different review contractors and their review processes to help providers in complying with review efforts. These steps include the following: In July 2012, CMS published a 15-page booklet about Medicare claim review programs, including claims reviews by MACs, ZPICs, RAs, and the CERT review contractor on CMS’s website, and the booklet was announced in an e-newsletter that providers can sign up to receive. In August 2012, CMS published an interactive map on its website that allows the public and providers to identify the MACs, ZPICs, and RAs that perform claims reviews in each state. In September 2012, CMS published an update to a chart, the original of which was first published in July 2011, to educate providers about the definitions and responsibilities of contractors and other entities involved in various aspects of Medicare and Medicaid claims determinations. The chart explains why providers may need to communicate with multiple entities as well as why multiple entities may contact the same provider. In January 2013, CMS published a three-page description about the Medicare FFS Recovery Audit Program process that includes references to other information, such as appeals. In addition, CMS officials reported that they are developing web-based training about the audits done by its contractors. Differences in CMS’s postpayment claims review requirements for the four types of contractors may reduce the efficiency and effectiveness of claims reviews by complicating providers’ compliance with the requirements. Some of these differences may be appropriate given the different functions and responsibilities of the contractors. However, CMS officials explained that differences in some requirements came about because the contractors’ requirements were developed at different times or the contractors’ activities have changed over time. In addition, some of these differences could have come about because different types of contractors and associated requirements are managed by different parts of CMS. Greater consistency in the claims review requirements across contractors may improve the efficiency of postpayment reviews by strengthening the control environment, lessening providers’ confusion, and reducing administrative burdens. In addition, improving consistency across the contractors would be consistent with the Executive Order 13571 on Streamlining Service Delivery and Improving Customer Services and OMB guidelines for implementing it. Greater consistency could make it easier for providers to comply with ADR requests and claims requirements. It could also help reduce claims payment error determinations based on providers’ inability or failure to provide documentation in a timely manner. It might also reduce any inconsistencies in making determinations, which can lead to unneeded appeals, and might increase providers’ confidence that reviews will also be consistent and correct. In order to improve the efficiency and effectiveness of Medicare program integrity efforts and simplify compliance for providers, we are making three recommendations. We recommend that the Administrator of CMS: 1. examine all postpayment review requirements for contractors to determine those that could be made more consistent without negative effects on program integrity, 2. communicate publicly CMS’s findings and its time frame for taking 3. reduce differences in postpayment review requirements where it can be done without impeding the efficiency of its efforts to reduce improper payments. We provided a draft of this report to HHS for comment, and received written comments, which are reprinted in appendix II. In its comments, HHS concurred with our three recommendations and agreed to take steps to reduce differences in postpayment review requirements where appropriate. HHS noted that CMS had begun to examine its requirements for postpayment claims reviews as discussed in our report.HHS stated that it is currently examining requirements related to ADRs to see if the requirements could be standardized across contractor types. HHS indicated that standardizing the minimum number of days a contractor must give a provider to respond to an ADR before the contractor has the authority to deny the claim could help minimize provider confusion. HHS also agreed to publicly communicate its findings from the review of the requirements on CMS’s website and include a timeframe for implementing agreed-upon changes in procedures. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Acting Administrator of CMS, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff has any questions about this report, please contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report were: Sheila K. Avruch, Assistant Director; Carrie Davidson; Leslie V. Gordon; and Laurie Pachter. GAO’s 2013 High-Risk Update: Medicare and Medicaid. GAO-13-433T. Washington, D.C.: February 27, 2013. Medicare Program Integrity: Greater Prepayment Control Efforts Could Increase Savings and Better Ensure Proper Payment. GAO-13-102. Washington, D.C.: November 13, 2012. Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012. Program Integrity: Further Action Needed to Address Vulnerabilities in Medicaid and Medicare Programs. GAO-12-803T. Washington, D.C.: June 7, 2012. Medicare Integrity Program: CMS Used Increased Funding for New Activities but Could Improve Measurement of Program Effectiveness. GAO-11-592. Washington, D.C.: July 29, 2011. Improper Payments: Reported Medicare Estimates and Key Remediation Strategies. GAO-11-842T. Washington, D.C.: July 28, 2011. Fraud Detection Systems: Centers for Medicare and Medicaid Services Needs to Ensure More Widespread Use. GAO-11-475. Washington, D.C.: June 30, 2011. Improper Payments: Recent Efforts to Address Improper Payments and Remaining Challenges. GAO-11-575T. Washington, D.C.: April 15, 2011. Status of Fiscal Year 2010 Federal Improper Payments Reporting. GAO-11-443R. Washington, D.C.: March 25, 2011. Medicare and Medicaid Fraud, Waste, and Abuse: Effective Implementation of Recent Laws and Agency Actions Could Help Reduce Improper Payments. GAO-11-409T. Washington, D.C.: March 9, 2011. Medicare: Program Remains at High Risk Because of Continuing Management Challenges. GAO-11-430T. Washington, D.C.: March 2, 2011. Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010. Medicare Contracting Reform: Agency Has Made Progress with Implementation, but Contractors Have Not Met All Performance Standards. GAO-10-71. Washington, D.C.: March 25, 2010.

Summary: In fiscal year 2012, CMS estimated that $32.4 billion in Medicare FFS payments were improper. CMS uses several types of contractors to conduct postpayment claims reviews to identify improper payments. Recently, questions have been raised about the efficiency and effectiveness of these contractors' efforts and the administrative burden on providers. This report (1) describes these contractors and (2) assesses the extent to which requirements for postpayment claims reviews differ across the contractors and whether differences, if any, could impede effective and efficient claims reviews. GAO reviewed CMS's requirements for claims reviews in manuals and contracts, interviewed CMS officials and selected provider associations, and assessed the requirements against internal control standards and executive-agency guidance on streamlining service delivery. GAO also obtained data on numbers of claims reviewed, and appealed. The Centers for Medicare & Medicaid Services' (CMS) contractors that conduct postpayment reviews on Medicare fee-for-service (FFS) claims were established by different legislative actions; are managed by different offices within CMS; and serve different functions in the program. These contractors include (1) Medicare Administrative Contractors that process and pay claims and are responsible for taking actions to reduce payment errors in their jurisdictions; (2) Zone Program Integrity Contractors (ZPIC) that investigate potential fraud, which can result in referrals to law enforcement or administrative actions; (3) Recovery Auditors (RA) tasked to identify improper payments on a postpayment basis; and (4) the Comprehensive Error Rate Testing (CERT) contractor that reviews a sample of claims nationwide and related documentation to determine a national Medicare FFS improper payment rate. All four types of contractors conduct complex reviews, in which the contractor examines medical records and other documentation sent by providers to determine if the claims meet Medicare coverage and payment requirements. RAs are paid fees contingent on the amount of the claims that are found improper and recouped or adjusted, whereas the other contractors' reimbursement is not dependent on the amount of their claims reviews. The RAs conducted almost five times as many reviews as the other three contractors combined. Overall, compared to over one 1 billion claims processed in 2012, all four types of contractors combined reviewed less than one 1 percent of claims, about 1.4 million reviews, for which providers might be contacted to send in medical records or other documentation. Although postpayment claims reviews involve the same general process regardless of which type of contractor conducts them, CMS has different requirements for many aspects of the process across these four contractor types. Some of these differences may impede efficiency and effectiveness of claims reviews by increasing administrative burden for providers. There are differences in oversight of claims selection, time frames for providers to send in documentation, communications to providers about the reviews, reviewer staffing, and processes to ensure the quality of claims reviews. For example, while the CERT contractor must give a provider 75 days to respond to a request for documentation before it can find the claim improper due to lack of documentation, the ZPIC is only required to give the provider 30 days. CMS places more limits on the RAs in its requirements for reviews conducted by them than by other contractors. For example, RAs must submit the criteria that they will use to determine if a service is paid improperly to CMS for approval. The additional requirements for RAs are due in part to CMS's experience during an initial demonstration testing the use of RAs. CMS officials indicated that other requirement differences across contractors generally developed due to setting requirements at different times by staff in different parts of the agency. Providers indicated that some differences hindered their understanding of and compliance with the claims review process. Having inefficient processes that complicate compliance can reduce effectiveness of claims reviews, and is inconsistent with executive-agency guidelines to streamline service delivery and with having a strong internal control environment. CMS has begun to examine differences in requirements across contractors, but did not provide information on any specific changes being considered or a time frame for action. GAO recommends that CMS (1) examine all contractor postpayment review requirements to determine those that could be made more consistent, (2) communicate its findings and time frame for taking action, and (3) reduce differences where it can be done without impeding efforts to reduce improper payments. In its comments, the Department of Health and Human Services concurred with these recommendations, agreed to reduce differences in postpayment review requirements where appropriate, and noted that CMS had begun examining these requirements.