State Medicaid programs do not directly purchase prescription drugs but instead reimburse pharmacies for covered prescription drugs dispensed to Medicaid beneficiaries. States operate their Medicaid programs by paying qualified health-care providers (including prescribers and pharmacies) for a range of covered services provided to eligible beneficiaries and then seeking reimbursement for the federal share of those payments. States may directly pay health-care providers for services rendered using a FFS delivery system or may delegate these responsibilities to managed-care organizations (MCO). Under managed- care arrangements, states contract with MCOs to deliver care through networks. States typically pay the MCOs a fixed amount each month, called a capitation payment. All four of the states included in our review— Arizona, Florida, Michigan, and New Jersey—had MCO arrangements in place. Although the federal government establishes broad requirements, each state has flexibility in managing its Medicaid program. Guidelines established by federal statutes, regulations, and policies allow each state to (1) broaden its eligibility standards; (2) determine the type, amount, duration, and scope of services; (3) set the rate of payment for services; and (4) administer its own program, including enrollment of providers and beneficiaries, processing and monitoring of medical claims, payment of claims, and maintenance of fraud-prevention programs. CMS is responsible for administering legislation and regulations affecting the Medicaid program. CMS also provides guidelines, technical assistance, and periodic assessments of state Medicaid programs. The federal government requires coverage for certain mandatory services under Medicaid, but states may decide to include other optional services as well. Some of the largest and most commonly included services include nursing facilities, home and community-based care, and hospital inpatient care. Although pharmacy coverage is an optional service under federal Medicaid law, all 50 states currently provide coverage for prescription drugs. States may pay for drugs dispensed through MCOs using either the “carve-in” or the “carve-out” approach. To use the carve- in approach, states include payment for the drugs dispensed to beneficiaries in the MCOs’ fixed monthly payment amounts. In the carve- out approach, states exclude payment for the drugs dispensed to beneficiaries from the MCOs’ fixed monthly payment amounts and instead pay for these drugs using the traditional FFS system. States may also use a combination of carve-out and carve-in approaches. The Medicaid prescription-drug programs, such as the Drug Utilization Reviews (DUR), include the management, development, and administration of systems and the data collection necessary to operate them. As part of data-collection efforts, states are mandated to report FFS claims and individual encounter data for managed-care enrollees to CMS. MSIS is the mechanism by which CMS requires states to report these data on a quarterly basis, although delays in reporting data occur. The database is used for analytical research, program integrity, planning, budgeting, and policy analyses associated with Medicaid. Federal law prohibits Medicaid providers and beneficiaries from taking certain actions related to billing for or receiving Medicaid services. For example, the Federal False Claims Act makes it illegal to submit false claims to Medicare, Medicaid, and other government health-care programs for payment.regulations may constitute fraud. We and other federal oversight entities have recently issued a number of reports related to fraud and other types Violation of these or other relevant laws and of improper payments in CMS’s health-care programs, including Medicaid. For example, in May 2014 we reported that neither state nor federal Medicaid entities were well positioned to identify improper payments made to MCOs due to a gap in state and federal efforts to ensure Medicaid managed-care program integrity. A report released by the HHS OIG in August 2014 found over 1,500 Medicare beneficiaries who had questionable utilization patterns for HIV drugs, including beneficiaries who had no indication of HIV in their Medicare histories, received an excessive dose or supply of HIV drugs, or received HIV drugs from a high number of pharmacies or prescribers. In October 2014, we reported on 23 practices for addressing prescription-drug fraud, waste, and abuse in Medicare developed from a detailed literature review as well as interviews with relevant stakeholders. According to CMS guidance to state Medicaid directors, programs with the size and scope of Medicaid require robust, timely, and accurate data to identify potential fraud or waste. However, CMS’s MSIS data continue to have limited usefulness for identifying fraud, waste, and abuse due to issues with accuracy, completeness, and timeliness. We analyzed 11 states to possibly include in our study, but had to exclude data from four states—California, Maryland, Ohio, and Pennsylvania—due to fiscal year 2011 data-availability and quality issues. In California, officials expressed concerns regarding the reliability of their data due to issues of reporting from the health plans and data conversions to other systems. Officials also had concerns about the ability to identify prescribing providers in the MCO data. The January 2013 Mathematica Policy Research report noted that for Maryland fiscal year 2011 MSIS data, National Provider Identifier (a unique identifier for Medicaid providers) and physician-specialty information were missing on managed-care prescription transactions. Similarly, the January 2013 Mathematica Policy Research report identified that Ohio MSIS data were missing provider-identifying information and prescription-drug and pharmacy information. The January 2013 Mathematica Policy Research report identified that Pennsylvania had not reported any data related to managed-care encounters through at least the fourth quarter of fiscal year 2011, even though the majority of the state’s Medicaid-eligible population was enrolled in comprehensive managed care. Although the MSIS data from Arizona, Florida, Michigan, and New Jersey were sufficiently reliable for the purpose of identifying indicators of potential fraud or abuse, we identified issues with their timeliness and completeness. For example, the most-recent validated data available from CMS for Arizona, Florida, Michigan, and New Jersey were more than 3 years past the date when they should have been validated. The fiscal year 2011 claim files were the most-current claim files contained in the MSIS system. In addition, about 20 million (26 percent) of the records included filler data (e.g., 01-01-0001) in the prescribed date fields. While the data help identify potential vulnerabilities to Medicaid prescription-drug fraud, waste, and abuse, they are not sufficiently timely to enable investigation of specific transactions. These problems with the MSIS data used for this review are consistent with concerns raised in previous GAO and HHS OIG reports. In October 2012, we reported that MSIS data were not timely because of late state submissions and the time it takes CMS to review and validate data. In that report we found that 37 states were late with their quarterly data by six quarters in July 2012. We further reported that even though CMS requires states to submit MSIS data within 45 days, states’ reporting of MSIS data and the subsequent validation process can be up to 3 years late. In interviews for this review, both CMS and state Medicaid officials agreed that this validation process can be lengthy. For example, CMS officials may identify a data-quality issue during the validation process in which they analyze the data and ensure that errors do not exceed a predetermined threshold. If the threshold is exceeded, CMS will then request the state to resubmit corrected data, which can take several additional months, according to both CMS and state Medicaid officials. In addition, we reported in June 2012 that MSIS-based audits were hampered by deficiencies in the data, and noted that CMS had initiatives to transition into a new system called the Transformed Medicaid Statistical Information System (T-MSIS).CMS guidance to state Medicaid directors, T-MSIS is intended to modernize and enhance the way states will submit operational data about beneficiaries, providers, claims, and encounters and will be the foundation of a robust state and national analytic data infrastructure. Additionally, in the August 2013 CMS guidance to state Medicaid directors, CMS stated that this change will enhance the agency’s ability to observe trends or patterns indicating potential fraud, waste, and abuse in the state Medicaid programs to prevent or mitigate the effect of these activities. States may also have enhanced capabilities to counter fraud, waste, and abuse capabilities. The guidance also indicates CMS and the states will be able to analyze the data submitted by the states along with other information in the CMS data repositories, including Medicare data, enhancing abilities to better identify potential anomalies for further investigation. CMS officials stated that they will not begin to analyze the benefits derived from T-MSIS until the transition reaches the point where data for at least half of the Medicaid population in the United States are included in T-MSIS. Department of Health and Human Service, Office of Inspector General, Early Outcomes Show Limited Progress for the Transformed Medicaid Statistical Information System, OEI- 05-12-00610 (Washington, D.C.: September 2013). and timely information to T-MSIS to support effective oversight. According to the Fiscal Year 2016 HHS OIG Justification of Estimates for Appropriations Committees, this recommendation remains a priority unimplemented recommendation. CMS began implementing T-MSIS with states on a rolling basis in July 2014 and is working towards full implementation in 2015. Specifically, CMS officials stated that the T-MSIS project is in the midst of implementation with all states. Moreover, all states are working towards completion of the T-MSIS implementation in 2015, according to CMS. CMS went live with its federal T-MSIS platform in May 2015, and estimates that at least half the Medicaid population in the United States will be available through submitted T-MSIS files by the end of 2015. However, officials from the four states included in our review told us that they are experiencing challenges with implementing T-MSIS requirements. Specifically, officials from three of the states explained that CMS continues to change data-field requirements for the data submissions. Our analysis of fiscal year 2011 Medicaid prescription claims data from four selected states identified several indicators of potential fraud. Specifically, we found indicators of potential fraud among beneficiaries, prescribers, and pharmacies (1) with questionable patterns related to received, prescribed, and dispensed drugs; (2) who received drugs for certain conditions for which the beneficiaries had no other indicators in their fiscal year 2011 Medicaid outpatient claims; and (3) with concerns identified using data matching—such as prescribers who appeared to be deceased by the prescribed date. Because of the age of the data, we did not independently investigate individual transactions to confirm whether a particular beneficiary, prescriber, or pharmacy actually engaged in fraud, waste, or abuse. Beneficiaries who receive large numbers of drugs, especially of the same drug, can indicate possible overutilization and, in more-egregious cases, drug diversion. Additionally, beneficiaries obtaining services from many different prescribers can raise questions. In our analysis of potentially excessive prescription claims, we found the following: Beneficiaries with high quantities of the same drug. About 700 of the 5.4 million beneficiaries we reviewed received more than a 1-year supply (a 480-day supply) of the same drug in 2011 at a cost to About 50 of these beneficiaries Medicaid of at least $1.6 million.received more than 2 years’ worth (a 730-day supply) of the same drug. One beneficiary appeared to receive more than 3-1/2 years’ worth of the same respiratory medication at a cost to Medicaid of at least $10,000. Another beneficiary received more than 1 year’s worth of seven different drugs at a cost to Medicaid of at least $30,000. Beneficiaries visiting five or more prescribers. Doctor shopping is a beneficiary fraud scheme in which Medicaid beneficiaries visit multiple prescribers to obtain more prescriptions for the same or similar drugs than a single physician would prescribe. Specifically, when a beneficiary obtains drugs from many prescribers or pharmacies, it could mean the beneficiary is seeking drugs to divert for profit or that the beneficiary’s identification number was stolen. Another concern is that the beneficiary is getting excessive doses or supplies. According to CMS data, more than 16,000 beneficiaries out of the 5.4 million we reviewed visited five or more prescribers to receive prescriptions for antipsychotics or respiratory medications valued at about $33 million.15 prescribers and 10 pharmacies to obtain various antipsychotics at a cost to Medicaid of about $23,000 in 1 year. Another beneficiary For example, a single beneficiary visited received prescriptions for respiratory medications at 11 pharmacies written by 21 prescribers at a cost to Medicaid of at least $4,800 in 1 year. Table 1 shows the number of potential doctor shoppers and the costs associated with the purchased drugs for these therapeutic classes, by prescribers visited. Beneficiaries may have a justifiable reason for receiving prescriptions from multiple medical practitioners. For example, a beneficiary may legitimately receive prescriptions from different prescribers within the same practice. Also if a beneficiary moves multiple times over the course of the year, he or she may still require the same prescriptions, which will necessitate visits to additional prescribers. There may be other legitimate medical reasons for receiving prescriptions for the same drug from multiple prescribers, such as visiting multiple specialists. Analysis of prescribing and dispensing patterns can also help identify indicators of potential fraud, waste, and abuse. Excessive patterns of prescribing or dispensing, relative to peers, can indicate potential fraud. For example, we examined and identified prescribers and pharmacies with an unusually high proportion of activity for brand-name drugs.addition, analysis of pharmacy adjustments on claims can indicate whether pharmacies are properly billing Medicaid. In our analysis of prescription claims for questionable prescribing and dispensing patterns, we found the following: Prescribers and pharmacies associated with high numbers of brand-name drugs. In our discussions with officials that had investigated or researched prescription-drug fraud, we found that brand-name drugs can be at greater risk of diversion due to their relatively high expense. In more egregious examples, an unusually high proportion of brand-name drugs could represent a kickback scheme benefitting the prescriber or indicate a substitution of generic drugs scheme where the pharmacy dispenses generics but bills for more-expensive brand-name drugs. Our analysis identified 119 out of about 28,000 prescribers associated with at least 500 claims for which at least 75 percent of the prescriptions were written for brand- name drugs. Among the 8,800 pharmacies we reviewed with at least 500 claims, we found about 300 pharmacies for which over half of the prescriptions filled were for brand-name drugs. We also found 37 pharmacies with at least 500 claims that only dispensed brand-name drugs. Pharmacies without adjustments. When a change to a prescription is made or when a beneficiary fails to pick up the prescribed drugs, the pharmacy must adjust the claim transaction. According to officials in New Jersey, instances of pharmacies with too many or too few adjustments may be red flags for concern. We identified about 70 out of approximately 4,000 pharmacies that filed over 5,000 claims without a single adjustment. These pharmacies received at least $23 million from Medicaid during fiscal year 2011. In contrast, among pharmacies that filled over 5,000 claims, the median pharmacy adjusted about 2 percent of its claims and the mean pharmacy adjusted about 5 percent of its claims. As we stated previously, adjustments may reflect changes to claims for medications that are not picked up by beneficiaries. While there may be legitimate reasons for a pharmacy to have low percentages of adjustments to claims, such pharmacies may warrant follow-up review by state oversight officials. For example, Michigan officials stated that there are some long-term nursing care facilities that only bill for the medications consumed by patients at the end of the month. These facilities would not have adjustments in their claims because the bill at the end of the month reflects the accurate amount of medication used by the patient. We identified beneficiaries in our four selected states who received prescription drugs only used to treat HIV and medications primarily used to treat diabetes but who had no additional (beyond receiving the HIV or diabetes medications) indicators of HIV or diabetes in their outpatient Medicaid activity from fiscal year 2011. The absence of such evidence does not prove that the beneficiary did not have HIV or diabetes or that there was inappropriate off-label use: the claims files we used were for a limited period and did not reflect the beneficiary’s entire medical history, and our search may not have included every possible diagnosis or service code related to HIV and diabetes. The HHS OIG reported in August 2014 that antiretroviral drugs that treat HIV are a target for fraud, waste, and abuse because they can be very expensive and can have psychoactive effects. Our analysis showed that the majority (94 percent) of the approximately 13,000 beneficiaries who received prescriptions for one of five HIV drug treatments had an HIV- related diagnosis indicator documented in their fiscal year 2011 Medicaid outpatient claims. In contrast, more than 750 of the 13,000 beneficiaries received HIV medications despite having no apparent indicator of having HIV in their fiscal year 2011 Medicaid outpatient claims. These beneficiaries received the HIV medications Atripla, Combivir, Norvir, Reyataz, and Truvada, which according to Food and Drug Administration indications and usage labeling are used to treat HIV-positive patients. Medicaid paid about $3.7 million in claims for HIV medications for beneficiaries with no other indications in their fiscal year 2011 outpatient claims of having HIV. For example, 60 beneficiaries each received Truvada at least 12 times despite not having a HIV diagnosis code or other indicator for HIV, costing Medicaid at least $523,000. About 30 beneficiaries with no HIV indicators each received the HIV medication Atripla at least 12 times at a cost to Medicaid of at least $418,000. One such beneficiary had 52 claims for multiple different HIV medications at a cost to Medicaid of over $50,000. Our analysis found that about 20 pharmacies dispensed HIV medications to at least 10 different beneficiaries who had no HIV indicators according to their fiscal year 2011 Medicaid claims. Table 2 summarizes the costs associated with each drug under review received by beneficiaries who did not have a Medicaid HIV indicator in the fiscal year 2011 outpatient claims file, broken out by beneficiaries with 1 to 11 claims and beneficiaries with 12 or more claims. We cannot determine from data analysis alone which cases represent inappropriate prescriptions and which permissible prescribing patterns are. Such determinations would require additional review of the facts and circumstances of each individual case by state oversight officials. Our analysis showed that the majority (96 percent) of the approximately 57,000 beneficiaries who received prescriptions for one of four diabetes treatments had diabetes-related indicators elsewhere in their fiscal year 2011 Medicaid outpatient claims. However, we identified about 2,300 beneficiaries who received diabetes medications, including Actos, Humalog, Lantus, and Novolog, without other indicators for the disease in their Medicaid outpatient claims. The costs for providing these medications amounted to at least $680,000. For example, about 100 beneficiaries each received 12 or more prescriptions for Actos at a total cost to Medicaid of at least $96,000. Another 72 beneficiaries each received 12 or more prescriptions for Lantus costing Medicaid at least $46,000. Table 3 summarizes the costs associated with each drug under review received by beneficiaries who did not have a diabetes-related indicator in the fiscal year 2011 outpatient claims file, broken out by beneficiaries with 1 to 11 claims and beneficiaries with 12 or more claims. We cannot determine from data analysis alone which cases represent inappropriate prescriptions and which represent permissible prescribing patterns or anomalies within the data. Again, such determinations would require additional review of the facts and circumstances of each individual case by oversight officials. Of the 5.4 million beneficiaries in the four states we examined, we found hundreds of cases from the fiscal year 2011 data that showed potential indicators of improper payments, which may include fraudulent activity (e.g., prescriptions written by apparently deceased prescribers), due to concerns about the beneficiary, prescriber, or pharmacy. Figure 1 summarizes the results of our matching data to external sources to identify indicators of potential improper payments or fraud. Additional investigation would be required to definitively determine whether improper payment or fraud occurred. Deceased prescribers. The identities of 290 deceased prescribers in the four states we examined were used to prescribe drugs to individuals who received Medicaid benefits. The cost of the drugs totaled at least $77,000 for fiscal year 2011. Deceased beneficiaries. The identities of about 170 deceased beneficiaries in the four states we examined were used to obtain prescriptions that were subsequently filled and paid for by Medicaid. The cost of the drugs totaled at least $32,000 for fiscal year 2011. Identity theft is stealing identifying information from providers and patients and using it for nefarious purposes. Phantom billing is billing for prescription drugs (or other services) that were not provided to the beneficiary. which Medicaid officials must check before paying for a prescription claim: the List of Excluded Individuals and Entities, managed by HHS, and the System for Award Management, managed by GSA. The primary effect of these exclusions is that no payment will be provided for any items or services furnished, ordered, or prescribed by an excluded individual or entity. This includes Medicare, Medicaid, and all other federal plans and programs that provide health benefits funded directly or indirectly by the United States. We found about 200 excluded prescribers who wrote prescriptions that were then used to obtain prescription drugs that were paid for by Medicaid. The selected states approved and paid the claims at a cost of over $1 million. Beneficiaries concurrently receiving benefits in two or more states. Beneficiaries are entitled to Medicaid prescription-drug benefits in the states in which they currently reside but are not eligible to receive Medicaid benefits in more than one state concurrently.We identified about 618 beneficiaries that received prescription drugs from Medicaid in two or more of our selected states concurrently. The costs associated with these drugs were at least $186,000. CMS monitors state Medicaid programs’ efforts to prevent and detect instances of prescription-drug fraud in Medicaid, but we identified areas that may require additional guidance for oversight. Required by federal law, the Medicaid Drug Utilization Review (DUR) program is one process states use to promote patient safety and monitor prescription-drug activity for fraud, waste, and abuse. In the first phase (prospective DUR) the states use tools such as point-of-sale edits, preferred-drug lists, and eligibility screening to promote patient safety and avoid abuse. The second phase (retrospective DUR) involves ongoing and periodic examination of claims data to identify patterns of fraud, abuse, gross overuse, or medically unnecessary care and implements corrective action when needed. For example, these measures can include postpayment reviews, lock-in programs, and pharmacy automatic refill restrictions. An effective DUR can reduce states’ exposure to potential fraud schemes, such as those described earlier in this report. Federal statute and regulation require that states report on their DUR activities as well as cost savings generated from their DUR programs. CMS also collects information from states about DUR program operations, cost savings from DUR programs, and innovative DUR practices by means of the Medicaid Drug Utilization Review Annual Report Survey. CMS compiles this information into an annual summary report that is publicly available, and may be used to highlight innovative practices that state Medicaid programs have implemented. According to the fiscal year 2013 Medicaid Drug Utilization Review State Comparison Annual Report (2013 CMS DUR Summary), DUR activities saved an average of about 18 percent on drug costs, adding up to about $3.9 billion in savings. CMS does not collect information about lock-in programs for noncontrolled substances or automatic refill prohibitions, despite the concerns detailed below. Prospective DUR screens prescription-drug claims to identify possible safety and overuse indicators before the drugs are dispensed. Key prospective DUR controls include the following: Point-of-sale edits. Point-of-sale edits are alerts that occur at the pharmacy point of sale and promote patient safety and program integrity by sending alerts to pharmacies during the process of filling the prescription to determine whether certain criteria are met. Effective point-of-sale edits can address issues such as the potentially excessive and unnecessary prescriptions described earlier in this report. Alerts, such as drug–drug interactions or therapeutic duplication, appear when there is a drug interaction risk or when a patient is to be dispensed a drug that is in the same therapeutic class as another recently dispensed drug, respectively. These alerts also work to promote patient safety as well as program integrity. A DUR can also include alerts such as a gender-specific alert that occurs when a drug is dispensed that is not recommended for use by the gender indicated on the recipient’s eligibility file. Other alerts such as early-refill warnings are routine edits that may signal that the patient is not taking the drug according to the directions or may be misusing the medication. Early-refill alerts also help to prevent Medicaid from paying for excessive amounts of medication above and beyond what is necessary. According to the 2013 CMS DUR Summary, all states set early-refill thresholds as a way of preventing prescriptions from being refilled too soon, which is categorized as a point-of-sale edit. Preferred-drug list. DUR often include a preferred-drug list, which is designed to help keep health-care costs down by encouraging use of preferred, generic and over-the-counter drugs. The preferred-drug list drives a market shift to generic drugs when the generic drug pricing is less than the brand-name drug pricing (net of CMS and supplemental rebates), although prescribers can override the preferred-drug list using a prior-authorization request. Use of the preferred-drug list may limit or prevent wasteful spending. Eligibility screening. As described earlier in this report, states are to screen for the eligibility of beneficiaries, prescribers, pharmacies, and other entities to ensure that they have coverage under or participate in a health-insurance program. States are to use federal death sources such as SSA’s Death Master File as well as local sources such as the state’s vital statistics office and prisoner files to check for the death and incarcerations of beneficiaries. Per CMS regulations, states are also required to use tools such as the List of Excluded Individuals and Entities, managed by HHS, and the System for Award Management, managed by GSA, to screen prescribing providers or pharmacies for federal exclusions and debarments. Retrospective DUR involves ongoing and periodic examination of claims data to identify potentially problematic patterns. Key retrospective DUR fraud controls include postpayment reviews, lock-in programs, and automatic refill prohibitions. Postpayment reviews. Postpayment reviews involve reviewing claims and other documents after payment to ensure compliance with payment rules, and to determine whether the prescription was medically necessary. These reviews permit states to suspend payments and obtain and review medical records. Specific tactics states may choose to employ to find fraud in these payments include examining claims by amount paid, average costs, number of claims, adjustment rates, or percentage of claims for brand-name or Drug Enforcement Administration Schedule II drugs. States can vary the period of review depending on available data and may monitor overall activity as well as activity within subsections of the population. For example, states can look for top beneficiary recipients of a certain drug or therapeutic class, prescribers who most frequently prescribe controlled substances, or pharmacies that dispense certain drugs at an average cost that is significantly higher than that of their peers. There are numerous ways the data can be analyzed and checks can be combined to strengthen detection of indicators of potential fraud. Effective strategies can then be repeated. While it is likely not possible to determine from data analysis alone whether any given prescription was appropriate, such analysis can detect anomalies that might warrant additional audit and investigation outside the DUR process. For example, as we discussed previously in this report, a pharmacy may dispense an unusually high proportion of brand-name medications. States can use pharmacy audits to ensure dispensary compliance with program rules and regulations while looking for fraud and abuse. Lock-In Programs (also known as Restricted Recipient Programs). As noted earlier in this report, we identified about 16,000 individuals whose visits to multiple prescribers for antipsychotics and respiratory medications raise questions.DUR tool that can address doctor shopping by locking beneficiaries who have abused the Medicaid program in to one prescriber, one pharmacy, or both for receiving prescriptions. Lock-in allows both prescribers and pharmacies to develop a more-complete picture of the beneficiary’s drug-utilization history. Lock-in programs historically have applied to those beneficiaries in an FFS arrangement, although MCOs may employ similar measures to “lock-in” enrollees when such actions are warranted. Lock-ins are typically triggered by abuse of controlled substances. Officials in Arizona and New Jersey stated that their lock-in program has historically focused on lock-in for controlled substances, although lock-ins for other drugs were permitted. Officials in Florida stated that their program does not use lock-in for noncontrolled substances and has trended towards using point-of-sale edits to restrict doctor- shopping activities related to controlled substances. Michigan officials stated that the state Medicaid program has two categories of lock-ins: beneficiaries may be locked in to a specific prescriber for controlled substances, or beneficiaries may be locked in to specific prescribers and pharmacies for all medications. Michigan officials indicated that they apply specific criteria to determine the lock-in category a beneficiary is assigned. According to CMS officials, CMS does not have specific guidance for the state Medicaid programs on lock-ins. They said that states decide the requirement for placing a beneficiary in a lock-in program. Given that we found more than 16,000 beneficiaries who received prescriptions for relatively high-value medications from at least five prescribers in 1 fiscal year, there is a risk that Medicaid is wasting funds on prescriptions that are medically not necessary, and potentially fraudulently diverted. Although there is no federal requirement for states to implement a lock-in program, according to the 2013 CMS DUR Summary all but one of the states has a lock-in program for controlled substances. However, the report does not contain information on lock-in programs for noncontrolled substances. Pharmacy Automatic Refill. Pharmacies may automatically refill prescriptions for certain medications without any customer action. Automatic refill services can be employed at both retail and mail- service pharmacies. In retail settings, medications that are not picked up by the patient within a finite period must be returned to stock. However, mail-service pharmacies are unable to return the medication to stock once the prescription is delivered. Concerns with pharmacy automatic refill include the potential for stockpiling, continued fill of discontinued medications, and an increase in the cost and waste of prescription medications. In 2013, CMS banned pharmacy automatic refills in the Medicare Part D program because these practices were potentially generating significant waste and unnecessary additional costs for the Medicare Part D program overall. Unlike Medicare Part D, CMS currently does not have specific guidance on pharmacy automatic refills for the Medicaid program. CMS officials stated that policy on pharmacy automatic refills is a state-specific decision and states may have information in their billing instructions to pharmacies on their policy regarding automatic refills. In addition, CMS officials said that each state’s Board of Pharmacy may have a policy on this subject and that these boards may audit pharmacies regarding their compliance with state regulations. Currently, Florida and Arizona are the states in our review that do not allow automatic refills. When asked why such prohibitions were in place, officials in Arizona noted that its Medicaid population was transient, and automatic refills could lead to prescriptions mailed to old addresses where the beneficiary no longer lived, at the state’s expense. Officials in Florida cited concerns about beneficiaries stockpiling medications and not wanting to pay for prescriptions that were no longer needed. Federal regulations define abuse as provider practices that are inconsistent with sound fiscal, business, or medical practices, and result in an unnecessary cost to the Medicaid program, or in reimbursement for services that are not medically necessary. Automatic refill programs may result in Medicaid beneficiaries obtaining medications far in excess of what was utilized or needed, resulting in wasted Medicaid resources. In fact, officials in New Jersey stated that automatic refills pose a problem for both fraud and waste of government funds, but at the time of our review did not have a policy preventing this practice. According to the Standards for Internal Control in the Federal Government, internal controls should generally be designed to ensure that ongoing monitoring occurs in the course of normal operations, and that it is performed continually and ingrained in the agency’s operations.Our review of CMS monitoring activities found that CMS surveys states on a variety of different measures for fraud and waste prevention as well as cost-savings measures. Our discussions with officials in the selected states and CMS indicated that lock-in programs for noncontrolled substances and automatic refill prohibitions may warrant additional review. As discussed previously, state Medicaid programs varied in the type of medications that are included in lock-in programs. Additionally, we found more than 16,000 beneficiaries who received prescriptions for relatively high-value medications from at least five prescribers in 1 fiscal year, indicating that there is a risk that Medicaid is wasting funds on prescriptions that are medically not necessary, and potentially fraudulently diverted. The Medicare Part D program, as well as Florida and Arizona Medicaid programs, prohibit automatic refills, citing both patient safety and unnecessary costs as concerns for implementing these practices. However, CMS does not collect this information in the DUR survey or other collection methods. As a result, CMS does not know the number of state Medicaid programs that prohibit automatic refills or have lock-in programs for noncontrolled substances. Additional information would allow CMS to determine whether additional guidance for locking in recipients of noncontrolled substances and prohibiting automatic refills in Medicaid could prevent some of the problems we identified in our analysis and lead to cost savings. Our review of fiscal year 2011 prescription-drug claims data from four states uncovered indicators of potential fraud, waste, and abuse throughout the Medicaid prescription-drug program in those states, including potential doctor shopping of noncontrolled substances. In addition, interviews with officials from these four states highlighted Medicaid practices that were prone to waste and abuse, such as pharmacy automatic refills. Ensuring that cost-effective controls are in place and working properly requires additional improvements from the MCOs, states, and CMS responsible for administering Medicaid. While CMS oversees the administration of state Medicaid programs, CMS does not currently identify whether states have implemented lock-in programs for noncontrolled substances or automatic refill prohibitions. Lock-in programs are an important tool that can be used to address doctor shopping by locking beneficiaries who have abused the Medicaid program in to one prescriber, one pharmacy, or both for receiving prescriptions. Automatic refill prohibitions may help limit waste and unnecessary program expenditures. Expanding monitoring efforts to examine these matters in greater depth would provide CMS with more- complete information to help determine whether there is a need to issue guidance to address these potential problems more consistently to help ensure greater program integrity and additional cost savings. To enhance monitoring of potentially wasteful or abusive practices in the Medicaid program, we recommend that the Acting Administrator of CMS require states to report to CMS whether their state has lock-in programs for abusers of noncontrolled substances and prohibitions on pharmacy automatic refills, and examine the results to determine whether additional guidance is appropriate. We provided a draft copy of this report to HHS, SSA, and state Medicaid program offices for Arizona, Florida, Michigan, and New Jersey. Written comments from HHS; SSA; the Arizona Health Care Cost Containment System (AHCCCS); the Florida Agency for Health Care Administration (AHCA); and the State of New Jersey, Department of Human Services, Division of Medical Assistance and Health Services (DMAHS) are summarized below and reprinted in appendixes II–VI. HHS concurred with our recommendation. The letter from SSA stated the agency had no comments on our report. AHCCCS disagreed with our methodology and provided detailed comments on our findings, as described below. AHCA did not comment on the report’s findings but stated that the state Medicaid program already prohibits pharmacy automatic refills and will work with CMS to implement a lock-in program for noncontrolled substance abusers. DMAHS did not comment on the report’s findings but outlined several steps the state has taken that could address the types of issues raised in our report, which are summarized below. In an e-mail received on May 28, 2015, officials from the Michigan Department of Community Health did not comment on the report’s findings but provided technical comments, which we incorporated as appropriate. In addition, we provided excerpts of this draft report related to the reliability issues of Medicaid data to state Medicaid program offices for California, Illinois, Maryland, New York, Ohio, Pennsylvania, and Texas for technical comment. In an e-mail received on May 19, 2015, the Deputy Director, Division of Program Development and Management of the New York Department of Health, provided suggestions regarding CMS’s implementation of T-MSIS, which was outside the scope of our review, so we did not incorporate these comments in our draft report. Officials from California, Illinois, Maryland, New York, Ohio, Pennsylvania, and Texas did not provide technical comments. In its written comments, HHS concurred with our recommendation and stated that it will consider requiring states to report on lock-in programs for abusers of noncontrolled substances and pharmacy automatic refill policies. HHS also outlined the steps the agency has taken to improve data collection in Medicaid and address prescription-medication fraud since the fiscal year 2011 data used in our study. We incorporated these comments in our report as appropriate. In its written comments, AHCCCS said that it takes exception to being included in a series of findings that offer no state-specific detail. As we noted in our meetings with all state agencies included in our study, we did not provide state-level detail for two primary reasons. First, because CMS was the audited agency for our work, conducting analysis at the state- level would be outside the scope of our work and would put the focus on a comparison between the states, rather than on CMS oversight. In addition, due to the age and limitations of the data, as noted in the report, we would not be referring specific cases for follow-up. Moreover, AHCCCS noted that the findings of our study represent less than one- tenth of Medicaid spending for the four states used in our study. As we stated previously in this report, all of the states in our study had MCO arrangements in place during our study period. As a result, the Medicaid paid amounts associated with managed care may not be reflected in the state claims that were submitted to CMS for medical services, and hence our estimate is likely understated. AHCCCS also commented on specific sections of our analysis. First, AHCCCS stated that our report did not identify state practices that are able to leverage more-accurate data sources on a real-time basis. As mentioned above, the focus of our work was CMS oversight of the Medicaid program rather than an in-depth discussion of current, specific practices employed by the states. Second, AHCCCS incorrectly stated that we used the federal incarceration file in our analysis. As we note in appendix I, we used each state’s department of corrections prisoner databases for individuals incarcerated for any period during fiscal year 2011. Specifically, for our work, we used the same Arizona Department of Corrections file to perform matches that AHCCCS outlined in its response letter. Third, AHCCCS provided an overview of the additional checks the state performs to identify incarcerated beneficiaries, as well as deceased providers and beneficiaries. This overview does not refute the findings in our report, and we did not incorporate these details in the report. Regarding our analysis of prescription-drug medication claims data, AHCCCS stated that our report should have used more than a single year of claims data to identify diagnosis information. We acknowledge this limitation, and updated our report with the appropriate caveats. Specifically, we state that we identified beneficiaries who did not have indicators of HIV or diabetes in their outpatient Medicaid activity from fiscal 2011, and that the absence of such evidence does not prove that the beneficiary does not have HIV or diabetes or that there was inappropriate off-label use. Further we stated that the results of this analysis may also be caused by off-label use, record-keeping, or data- coding issues. In addition, we noted that timing differences in the prior- authorization process could explain some of these observations. We also note that we cannot determine from data analysis alone which cases represent inappropriate prescriptions and which are permissible prescribing patterns. Regarding our analysis of brand-name medications, AHCCCS stated that our findings represent 0.425 percent of prescribing clinicians. In the draft report provided to AHCCCS, we provided the number of individuals we found and the total study population to provide the appropriate context. AHCCCS also noted that our report did not take into consideration that states may continue to require brand-name coverage because it may be more costly to the state to purchase the generic product. As a result, we incorporated discussion of this limitation in our report. Similarly, AHCCCS stated that our report does not differentiate between retail pharmacies and specialty pharmacies, and that some specific specialty pharmacies are expected to have a high percentage of branded medications. We noted that we did not control for medications where there was not a generic version available. However, to address the specific concern of AHCCCS, we incorporated this caveat into our report. Again, as noted several times in our report, the results of our analysis are indicators of potential fraudulent or improper payments. AHCCCS further stated that Arizona protocols already apply the recommendations in our report. In our report, we note that Arizona has a lock-in program that can incorporate noncontrolled medications and prohibits automatic refills in the Medicaid program. As noted in our report, the recommendation is addressed to CMS, and not the states used in our study. Specifically, we recommended that CMS collect information on what other states’ practices are related to lock-ins of noncontrolled medications and prohibitions of automatic refills, and examine the results to determine whether additional guidance is appropriate. Finally, AHCCCS stated that our report reaches sweeping conclusions without validating findings based on state-specific data. Again, as mentioned earlier, the focus of our report is CMS oversight of the Medicaid program. Our report provides the appropriate context for our findings, including limitations of our analysis to ensure that the results of our analysis were not taken in an inappropriate context. In response to our draft report, the Florida Agency for Health Care Administration (AHCA) stated that the Florida Medicaid program currently does not allow pharmacy automatic refills. Further AHCA stated that it will work with CMS’s guidance and recommendations for the implementation of a lock-in program for abusers of noncontrolled substances In its response to our draft report, the New Jersey Department of Human Services, Division of Medical Assistance and Health Services (DMAHS), stated that automatic prescription refills are a major concern for the State of New Jersey. According to DMAHS, although characterized by retail pharmacies as a “patient-friendly” service designed to improve the quality of prescription services, automatic prescription refills pose several concerns, such as the potential for stockpiling medications; continued filling of discontinued medications; unrecognized changes in drug therapies; and increases in fraud, waste, and abuse of prescription drugs. DMAHS stated that it looked forward to better understanding the audit practices used by CMS and certain states to audit this practice. In addition, DMAHS outlined steps the New Jersey Medicaid program has taken to strengthen prescription-drug internal controls, including requiring MCO programs to implement a pharmacy lock-in program. DMAHS also provided comments to address additional actions the state has taken that would address the findings we outlined in our report, including a quality- management and utilization-review program that focuses on medical encounters and a quarterly doctor-shopper report that identifies recipients who may be engaged in fraudulent activities. While we did not make any specific recommendations to the states, we believe that such actions should enhance their oversight of prescription-drug controls. Additionally, DMAHS provided comments on timely submission of MSIS data and stated that timely submission of MSIS data is related to the time required for CMS to validate New Jersey claims file submissions. We incorporated its comments in our report, as appropriate. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Secretary of Health and Human Services, the Commissioner of Social Security, relevant state agencies, and interested congressional committees. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-6722 or bagdoyans@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff that made key contributions to this report are listed in appendix VII. In this report, we (1) evaluated the reliability of Medicaid data from the Centers for Medicare & Medicaid (CMS) and selected states for the purpose of identifying indicators of potential fraud or abuse; (2) identified and analyzed indicators, if any, of potentially fraudulent or abusive activities related to prescription drugs in Medicaid; and (3) examined the extent to which federal and selected state oversight policies, controls, and processes are designed to prevent and detect indicators of prescription- drug fraud in Medicaid. To evaluate the reliability of Medicaid data from CMS for our selected states that could be used to identify indicators of potential fraud or abuse, we took several steps. We vetted 11 states for possible inclusion in our study. We selected states based on high Medicaid beneficiary enrollment, geographic diversity, and availability of data. In the selection process, we also considered whether drugs were paid under fee-for- service (FFS) or managed care, by including states that included these program types in our review. We performed electronic testing to determine the validity of specific data elements in the federal and selected state databases that we used to perform our work. We also reviewed related documentation, including data layouts and agency reports. Specifically, we used a January 2013 Mathematica Policy Research report that details Medicaid Statistical Information System (MSIS) state data characteristics and anomalies to further vet states selected for our audit work. We also used published GAO and Department of Health and Human Services (HHS) Office of the Inspector General (OIG) reports that detailed the limitations of the MSIS data we Additionally, we interviewed officials responsible for used for our study.their respective databases to discuss data-reliability considerations, and reviewed prior work related to the quality of the MSIS data used for our study.testing, we concluded that the data elements from the four states— Arizona, Florida, Michigan and New Jersey—used for this report were sufficiently reliable for the purpose of identifying indicators of potential fraud or abuse. However, in assessing the reliability of the data, we observed reportable shortcomings such as issues with timeliness, completeness, and accuracy in the data that may affect Medicaid administrators’ ability to effectively oversee their program. We discuss these shortcomings in greater detail earlier in this report. On the basis of our discussions with agency officials and our own To identify indicators of potentially fraudulent or abusive activities related to prescription drugs in Medicaid, we obtained and analyzed Medicaid claims paid in fiscal year 2011, the most-recent period from which we could draw reliable data, for four states: Arizona, Florida, Michigan and New Jersey. These states accounted for about 13 percent of the federal share of fiscal year 2011 Medicaid expenditures. These states were selected primarily because they had consistently comparable and reliable data and were among the states with the highest Medicaid expenditures. The results of our analysis of these states are not generalizable to other states. We obtained CMS MSIS beneficiary, provider, prescription-drug, and other services claims data, as well as state Medicaid Management Information Systems (MMIS) crosswalk data (with personal identifiers) to perform our work. The crosswalk data we used contained specific identifying information on prescribers, pharmacies, and beneficiaries that were not collected in the MSIS data, such as name and address. Additionally, managed-care organizations (MCO) receive a monthly capitated payment.with managed care may not be reflected in the state claims that were submitted to CMS for medical services, and hence our estimate is likely understated. All of the states included in our review—Arizona, Florida, Michigan, and New Jersey—had MCO arrangements in place. As a result, the Medicaid paid amounts associated We reviewed literature related to health-care fraud, including reports discussing fraud, waste, and abuse related to prescription drugs. We interviewed federal, state, and private-sector auditors, program administrators, and other relevant officials who had published work that investigated or researched prescription-drug fraud. On the basis of this research, we identified areas at greater risk of fraud and abuse such as drugs at high risk for diversion and types of prescribing patterns that warranted additional review. We used this information to develop our analytic approach to identify indicators of potential fraud and abuse related to prescription drugs in Medicaid. To identify potential overuse, we reviewed beneficiaries who received more than a 480-day supply of the same medication in a single year based on the national drug code. To identify potential doctor-shopping activities, we examined beneficiaries who received prescriptions for drugs within one of two therapeutic classes of drugs from five or more prescribers. We focused on beneficiaries who received prescriptions for antipsychotics or respiratory medications from five or more different prescribers over the course of 1 year. We selected medications in these therapeutic classes because they had a large number of individuals who received drugs from five or more prescribers relative to other classes of noncontrolled substances we considered, have a known diversion risk, and are relatively expensive. We selected the five-or-more prescribers threshold based on our review of drug-diversion literature and prior GAO work. Since we did not focus on all noncontrolled substances, our analysis understates the number of instances and dollar amounts related to potential doctor-shopping activities. We also looked for prescribers and pharmacies with a high proportion of prescribing or dispensing activities for brand-name drugs (versus generics) compared to the average activity of other prescribers and pharmacies and pharmacies without any adjusted or voided claims. Our review did not include all drugs that may be used to treat HIV or diabetes. population. We restricted our review to only include beneficiaries who received at least one prescription written during fiscal year 2011. We also matched the Medicaid data to other external sources to identify potential fraud and improper payments. We compared the beneficiary and prescriber identity information shown in the Medicaid claims data to the Social Security Administration’s (SSA) complete file of death information from October 2012 to determine whether any individuals were reportedly deceased before or when they purportedly prescribed, dispensed, or received prescription drugs covered by Medicaid. To identify prescription- drug claims that might have been improperly processed and paid by the Medicaid program because either the prescribers or beneficiaries were incarcerated, we matched our selected states’ MMIS data to the states’ departments of corrections prisoner databases. Prisoner data included individuals incarcerated for any period during fiscal year 2011. For Arizona, Florida, and New Jersey, we identified provider and beneficiary records for which the Medicaid Social Security number (SSN) and names matched that of a person who was incarcerated in fiscal year 2011 in any of the four states. Michigan did not provide SSNs in its incarceration data. For Michigan, we identified provider and beneficiary records for which the Medicaid name and birth day exactly matched that of a person who was incarcerated in fiscal year 2011 in any of the four states. We then identified Medicaid claims associated with the identified individuals by matching to the MSIS data. We compared the beginning service date of the claims to the individual’s admittance and release date to identify all claims that occurred while the associated beneficiary or provider identity was incarcerated. Additionally, we reviewed these claims’ type of service to determine that none qualified for federal matching funds. It is not possible to determine from data matching alone whether these matches definitively identify recipients who were deceased or incarcerated without reviewing the facts and circumstances of each case. For example, it is possible that individuals can be erroneously listed in the full Death Master File. Similarly, a provider or beneficiary may have an SSN, name, and date of birth similar to an individual in state prison records. Alternatively, our matches may also understate the number of deceased or incarcerated individuals receiving assistance because matching would not detect applicants whose identifying information in the Medicaid data differed slightly from their identifying information in other databases. To identify Medicaid beneficiaries who received benefits in two or more states concurrently, we identified all beneficiary SSNs that appeared in two or more states’ MMIS data in fiscal year 2011. We then found all claims associated with the beneficiary identities. We conducted further analysis to determine the states in which each beneficiary identity appeared and the service ranges—first and last prescribed date—for those states. We defined a concurrent claim as a claim that occurred within the service range of a second state for the same beneficiary identity. For each claim, we compared its prescription date to the service ranges for the beneficiary identity to determine whether it was a concurrent claim. It is not possible to definitely say through data matching alone that a beneficiary was improperly receiving Medicaid benefits in two or more states concurrently without looking into further information for each claim and beneficiary. For example, a beneficiary could have been a resident in one state and received services, then changed residency to a second state and received benefits for a brief period, before finally relocating again back to the original state and receiving additional services. In this case, the claims could have been identified as a concurrent claim even if the beneficiary did not receive any services from the original state during his or her relocation period in the second state. To identify claims that might have been improperly processed and paid by the Medicaid program because the federal government had excluded these providers from providing services to Medicaid beneficiaries, we compared the Medicaid claims to the exclusion and debarment files from the Department of Health and Human Services’ (HHS) Office of Inspector General (OIG) and the General Services Administration (GSA). Specifically, we used the HHS List of Excluded Individuals and Entities file from September 2012 and the GSA Excluded Parties List System database extract from October 2011 to perform our match. We matched MMIS and MSIS Medicaid data using SSN and individual name with both the List of Excluded Individuals and Entities and the Excluded Parties List System data extracts. We then identified unique individuals who had Medicaid claims processed where the date of exclusion occurred before the prescribed date in the Medicaid claims file. To determine the extent to which federal and state oversight policies, controls, and processes are designed to prevent and detect instances of prescription-drug fraud in Medicaid, we reviewed CMS and state Medicaid policies pertinent to program integrity over pharmaceuticals, met with CMS officials, and visited state Medicaid offices that perform oversight functions for the four states we selected. We used federal standards for internal control, GAO’s Fraud Prevention Framework,statutes and regulations addressing the administration of pharmacy benefits to evaluate these functions. To determine the reliability of the data used in our analysis, we performed electronic testing to determine the validity of specific data elements in the federal and selected state databases that we used to perform our work. We also interviewed officials responsible for their respective databases, and reviewed documentation related to the databases and literature related to the quality of the data. On the basis of our discussions with agency officials and our own testing, we concluded that the data elements used for this report were sufficiently reliable for our purposes. We identified criteria for Medicaid fraud controls by examining federal and state policies, laws, and guidance, including policy memos and manuals. We interviewed officials from CMS and the state governments of Arizona, Florida, Michigan, and New Jersey involved in Medicaid program administration, auditing, and Medicaid fraud response. We conducted this performance audit from March 2014 to July 2015 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our audit findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. In addition to the contact named above, Matthew Valenta (Assistant Director), John Ahern, Mariana Calderón, Melinda Cordero, Julia DiPonio, Lorraine Ettaro, Colin Fallon, Katherine Iritani, Barbara Lewis, Maria McMullen, Kevin Metcalfe, Rubén Montes de Oca, James Murphy, Christine San, and Paola Tena made key contributions to this report.

Summary: Medicaid is a significant expenditure for the federal government and the states, with total federal outlays of $310 billion in fiscal year 2014. CMS reported an estimated $17.5 billion in potentially improper payments for the Medicaid program in 2014. GAO was asked to review pharmacy-related program-integrity efforts at selected states. Among other reporting objectives, this report (1) identifies and analyzes indicators of potentially fraudulent or abusive prescribing activities in fiscal year 2011, and (2) examines the extent to which federal and state oversight policies, controls, and processes are in place to prevent and detect instances of prescription-drug fraud and abuse. GAO analyzed Medicaid claims paid in fiscal year 2011, the most-recent reliable data available, for four states: Arizona, Florida, Michigan, and New Jersey. These states were chosen, in part, because they were among those with the highest Medicaid expenditures; the results are not generalizable to all states. GAO performed data matching with various databases to identify indicators of potential fraud, reviewed CMS and state Medicaid program-integrity policies, and interviewed CMS and state officials performing oversight functions. GAO found indicators of potential prescription-medication fraud and abuse among thousands of Medicaid beneficiaries and hundreds of prescribers during fiscal year 2011—the most-recent year for which reliable data were available in four selected states: Arizona, Florida, Michigan, and New Jersey. These states accounted for about 13 percent of all fiscal year 2011 Medicaid payments. Specifically, in these four states, GAO found the following: More than 16,000 of the 5.4 million beneficiaries potentially engaged in “doctor shopping,” by visiting five or more doctors to receive prescriptions for antipsychotics or respiratory medications valued at about $33 million. About 700 beneficiaries received more than a 1-year supply of the same drug in 2011 at a cost to Medicaid of at least $1.6 million. This is an indicator of diversion, which is the redirection of prescription drugs for illegitimate purposes. As required by federal law, the Medicaid Drug Utilization Review program is a two-phase review process states use to promote safety while also monitoring prescription-drug activity for fraud. Federal law requires each state to report on the operation of its review program, a key monitoring tool that the Centers for Medicare & Medicaid Services (CMS) uses to oversee the review process in states, but GAO identified additional actions that could improve oversight. In the first phase, states use tools and eligibility screening to promote patient safety and avoid abuse before the drugs are dispensed. The second phase involves ongoing and periodic examination of claims data to identify patterns of fraud, abuse, gross overuse, or medically unnecessary care, and implement corrective action when needed. However, GAO identified two potential controls that are not included in CMS's current reporting requirements: Lock-in programs for noncontrolled substances. Lock-in programs address doctor shopping by restricting beneficiaries who have abused the Medicaid program to one health-care provider, one pharmacy, or both, for receiving prescriptions. Lock-in programs have typically been used on controlled substances. Expanding lock-in programs that currently focus on controlled substances to restrict abusers of noncontrolled substances, such as the human immunodeficiency virus medications Atripla and Truvada, to a single prescriber or pharmacy may help address potential fraud and abuse. Prohibition of automatic refills. Pharmacies permitting automatic refills automatically refill prescriptions for certain medications without any customer action. Concerns with pharmacy automatic refill include the potential for stockpiling, continued fill of discontinued medications, and increased cost and waste of prescription medications. Two states GAO reviewed—Florida and Arizona—have prohibited the practice. CMS does not collect information about lock-in programs for noncontrolled substances or automatic refill prohibitions, but doing so would help the agency determine whether additional guidance is needed. GAO recommends that CMS require states to report information about specific drug-utilization review controls to determine whether additional guidance is needed. The agency concurred with the recommendation and stated that it will consider requiring states to report on these areas.