Medicare comprises 12 percent of the federal budget and is the third largest federal program after defense and Social Security. For fiscal year 2011, HHS reported an estimate of almost $29 billion in Medicare FFS improper payments. Our Standards for Internal Control in the Federal Government suggests that agencies should continually perform monitoring activities to reduce the incidence of improper payments. However, our prior reports found weaknesses in CMS’s monitoring of Medicare provider and supplier enrollment and claims payment contractors. Partly in response to our work, CMS took steps to implement new DMEPOS supplier quality standards in an accreditation rule issued in August 2006 and proposed additional DMEPOS supplier enrollment standards in January 2008. To further address these concerns and create a focal point for all Medicare program integrity activities, in CPI, in 2010, CMS established a Center for Program Integrity (CPI).collaboration with other components within CMS, develops and implements the agency’s Medicare program integrity mission and goals. Among these goals is a reduction in instances of fraud, waste, and abuse, as well as strategies to ensure program vulnerabilities are identified and resolved. According to CMS, the agency is pursuing an aggressive program integrity strategy to prevent payment of potentially fraudulent claims, rather than to recover funds from providers and suppliers after payment has already been made. Because identifying and prosecuting providers and suppliers engaged in potentially fraudulent activity is time consuming, resource intensive, and costly, CMS has designed measures intended to prevent enrollment by entities that might attempt to defraud or abuse the Medicare program. For example, the agency requires that applicants use a unique 10 digit National Provider Identifier (NPI) number and affirm that they are not excluded from participating in another federal health program. DMEPOS suppliers must also undergo pre-enrollment site visits. In addition, the agency requires enrollment information to be entered into PECOS, a single, centralized, provider and supplier enrollment database that assists with data sharing across the contractors’ different geographic coverage areas. In addition, CMS has historically required the A/B MACs and the NSC to conduct activities, such as monthly reviews of state licensing board actions, to determine if individual providers continue to meet state licensing requirements and to conduct periodic checks to determine if entities continue to meet federal and state requirements for their respective provider or supplier type. With the implementation of the automated screening contract, these checks will be automated and conducted on a continuous basis, according to CMS. Since the Medicare program was created in 1965, it has been administered through a network of private contractors. CMS uses these contractors to conduct claims administration activities, to implement provider outreach and education, and to answer beneficiary inquiries through the 1-800-Medicare help line. Contractors also perform program integrity activities such as auditing providers and suppliers, reviewing claims for medical necessity, and conducting investigations of potential fraud, waste, and abuse. Central to program operations are the A/B MACs that manage Medicare provider and supplier enrollment, except for DMEPOS suppliers, and pay and review the claims submitted in their jurisdictions. In 2011, A/B MACs managed more than 1.5 million Medicare providers and suppliers. The previous year, A/B and DME MACs paid approximately 4.5 million claims each work day on behalf of CMS. Additionally, CMS contracts with the NSC to centralize the enrollment process and site visits for DMEPOS suppliers. In 2010, Medicare spent about $8.1 billion on DMEPOS supplies. In 2011, CMS added two new Medicare contractors to centralize and standardize the provider and supplier enrollment screening process. To become eligible to bill for services or supplies provided to Medicare beneficiaries, providers and suppliers must apply to the program. Entities applying to the Medicare program may complete an online enrollment form using PECOS or submit a paper application that is manually entered into PECOS by the A/B MACs or the NSC. Enrolling providers and suppliers submit identifying information such as their name, address, specialty area, and information about applicable licensure and accreditation. After the enrollment data are entered into PECOS, the A/B MACs and the NSC handle different aspects of the application process. The A/B MACs process all provider and supplier applications except for those for DMEPOS suppliers and the NSC processes all enrollment applications from DMEPOS suppliers nationally. Provider and supplier applications in PECOS are confirmed by the A/B MAC overseeing the jurisdiction where the services will be provided and by the NSC for DMEPOS suppliers. Contracts awarded in 2011 to new automated screening and site visit contractors altered this structure. CMS’s new provider screening contractor will automate many of the required enrollment checks that the A/B MACs and the NSC have done manually and will allow CMS to monitor all providers and suppliers on a continuous basis to help ensure they continue to meet Medicare enrollment requirements. These contractors assumed some functions from the A/B MACS and the NSC in early 2012. Prior to CMS’s automated screening contractor assuming these responsibilities, the A/B MACs and the NSC confirmed the provider and supplier enrollment information by checking various data sources such as the Social Security Administration (SSA) to verify an individual’s Social Security number, the National Plan and Provider Enumeration System to verify the provider’s NPI, and state licensing boards to determine if the provider is appropriately licensed to furnish medical services within a given state. CMS also required the A/B MACs and the NSC to check additional data sources including the HHS OIG’s List of Excluded Individuals/Entities (LEIE) and the General Service Administration’s Excluded Parties List System (EPLS). Starting March 25, 2011, CMS required the A/B MACs to conduct site visits for categories of providers and suppliers designated as moderate and high risk. The NSC will continue to conduct site visits related to enrollment of DMEPOS suppliers. In addition, due to long-standing concerns about high rates of fraud, waste, and abuse by DMEPOS suppliers, they have been subject to additional enrollment requirements. For example, DMEPOS suppliers must meet additional quality standards before they can be enrolled in Medicare, including proper accreditation, the successful completion of a site visit inspection, and posting of a $50,000 surety bond. CMS oversees contractors that manage the three major computer systems used to process Medicare Part A, Part B, and DMEPOS claims. Together, these computer systems are referred to as the “shared systems,” because claims from all the A/B MACs and DME MACs are processed by these systems. CMS refers to the contractors that manage these systems as the “shared systems maintainers.” Provider and supplier enrollment information in PECOS is downloaded to the shared systems in provider files that are used in claims processing. Information in the provider files is intended to ensure that providers and suppliers are eligible to receive payment for the services for which they have submitted claims. Although multiple contractors are involved in the claims payment process, the A/B and DME MACs are ultimately responsible for timely and accurate processing and payment of provider and supplier claims. For the relationship between the various contractors prior to January 2012 see figure 1. Providers and suppliers submit most claims to Medicare electronically. Upon electronic submission, claims first pass through an Electronic Data Interchange (EDI) process that makes sure the claims are formatted using the nationally established standards to exchange electronic information between business entities. In the EDI process, the claim is subject to automated prepayment controls called “edits.” Here, front end edits screen the claim for formatting errors or missing data. For example, a front end edit checks the claim to ensure that it contains the required 10 digit NPI but would not check the validity of the NPI. Medicare contractors reported that Medicare Parts A and B and DMEPOS claims that do not pass front end edits are considered unprocessable and are returned by the contractors to the appropriate provider or supplier, which may then correct the error(s) and resubmit the claim. If a Medicare claim is in the correct electronic format and passes the front end edits, it is then sent for further processing in the shared systems. There, the claim is subject to a series of prepayment edits that can prevent payment of an incomplete or incorrect claim and may reduce improper payments and help minimize the extent to which the program is vulnerable to fraud, waste, and abuse. Prepayment edits include provider enrollment-related edits and subsequent edits that screen Medicare claims against other criteria, such as medical necessity. Enrollment-related prepayment edits can be implemented on either the national or local level. The national enrollment-related prepayment edits are CMS-directed edits that are “hard coded” into the shared systems by the systems maintainers. National edits are updated quarterly and are standard across all A/B or DME MACs. In contrast, local prepayment edits are created and managed by the individual A/B or DME MACs. They may develop local enrollment-related prepayment edits based on differences in state law that determine the scope of a provider’s or supplier’s practice. CMS may also direct the A/B and DME MACs to develop local edits because they can be implemented on a more flexible schedule than CMS’s quarterly updates to national edits. Medicare claims are screened during the payment process by a series of enrollment-related prepayment edits that check claims against provider and supplier information maintained in PECOS. Such edits are designed to prevent payments to providers and suppliers that the data indicate are ineligible to receive Medicare payment. While prepayment edits are in place to prevent improper payments, factors such as frequency of information updates and the limitations of the data used to update information in PECOS may affect the timeliness and accuracy of provider and supplier information. In turn, this may limit the extent to which enrollment-related edits prevent payments to ineligible providers and suppliers. Enrollment-related prepayment edits are designed to prevent payments to ineligible providers and suppliers—such as those that are no longer active in the Medicare program or that are not properly credentialed or licensed to provide the services for which they have submitted claims. Ineligible providers and suppliers may be enrolled in Medicare despite CMS’s and its contractors’ enrollment screening efforts. Officials with the A/B and DME MACs we interviewed described the application of prepayment edits to claims as a cascading series of checks that occurs progressively as the claim moves through the process according to the edits’ “if/then” logic. For example, a certain edit will compare the NPI contained in a provider’s file with the date of service contained in the claim, and if the NPI was active on the date of service, then the claim would move to the next stage of processing. The two types of enrollment-related prepayment edits are provider and supplier verification edits and specialty edits. Provider and supplier verification prepayment edits: Medicare claims are subject to edits that verify basic provider and supplier enrollment information. These enrollment-related verification edits screen the claim’s data to ensure that the provider or supplier is eligible for payment. For example, such edits verify the validity of the entity’s NPI, which indicates whether the claim was submitted by an active provider or supplier. Verification edits at this stage of claims processing also screen claims to ensure that the provider’s or supplier’s enrollment date is before the claim’s date of service, thus indicating that they were an active provider or supplier on that date and therefore generally eligible for payment. A/B and DME MAC officials reported that claims failing these enrollment verification prepayment edits are not paid. Information on a denied claim due to provider or supplier ineligibility, including reason codes that explain the reason(s) for which the claim was not paid, is sent to the provider or supplier. These codes include reasons such as “the provider must update license information with the payer” and “invalid provider identifier.” One DME MAC estimated that the number of claims denied due to the claim’s date of service occurring outside of a DMEPOS supplier’s “effective dates” for billing eligibility was only about 36,000 claims out of a total of about 50 million claims per year. Specialty prepayment edits: Enrollment-related specialty prepayment edits screen for provider- or item-specific information about providers or suppliers, such as their eligibility to bill for certain services that can only be provided by a certain provider type or specialty. For example, limited license providers such as chiropractors can only be paid for a limited number of allowable billing codes determined by CMS. Specialty edits screen claims to ensure that the claim contains these allowable codes. DME MAC officials told us that edits at this stage would also ensure, for example, that a podiatrist is only paid for podiatry services and not ophthalmology services. Verification and specialty enrollment-related prepayment edits may be implemented as either national or local edits. According to one A/B MAC we spoke with, because there is little differentiation among Part A providers most enrollment-related prepayment edits for these providers are implemented as national edits, which are programmed into the shared systems. A/B MAC officials reported that additional enrollment-related local edits are more likely to be implemented for Part B provider claims due to differences among states regarding reimbursement for certain services and provider types. These Part B specialty edits are implemented as local edits by the A/B MAC responsible for that state. Regarding DME claims, one contractor we spoke with reported that CMS more frequently standardizes the DME claims payment process. This assures uniform coverage decisions across all DME MACs. DME MAC officials reported that DME specialty edits include those applied to oxygen, pharmacy, prosthetics, and orthotics claims. For example, DME MAC officials told us that the edits applied to oxygen claims ensure that only suppliers who have the required valid license to provide oxygen services receive payment. All three types of claims—Part A, Part B, and DME—that fail prepayment edits, whether at the national or local level, are denied and returned to the provider or supplier with a reason code that explains why the claim was not paid. For example, it may indicate “this provider type/provider specialty may not bill this service.” While prepayment edits are implemented to reduce the likelihood of improper payments due to provider or supplier ineligibility, the effectiveness of specific enrollment-related edits is not assessed by the A/B or DME MACs or CMS. A/B MAC officials reported that they generally do not need to analyze data on claims that are not paid because a prepayment edit indicates the provider or supplier is ineligible to bill for services. Thus, these contractors do not report on which of the prepayment edits prevented the improper payment. A/B MAC officials explained that each enrollment-related prepayment edit is developed to perform a specific function and therefore they do not rank edits in order of their effectiveness in preventing improper payments. Additionally, they told us that they do not submit reports to CMS that identify which enrollment-related prepayment edits are most effective. CMS requires A/B MACs to submit quarterly supplements to monthly workload reports that provide the agency with information on the number of denied claims and reasons for denials, but this information is used to identify problem areas for resolution, measure trends in denial rates, and monitor fraud and abuse workloads. Although officials from one A/B and two DME MACs told us that they may generate reports on claim activity, these data generally are used for internal workload planning purposes or as the basis for provider education on proper coding, not to determine the effectiveness of certain categories of edits. The ability of enrollment-related edits to prevent improper payments depends on the timeliness and accuracy of provider and supplier enrollment information contained in PECOS. In turn, the timeliness and accuracy of information in PECOS—which is downloaded as provider files into the shared systems each night—is affected by factors such as the frequency with which contractors update this information and limitations of the sources of the information used. A/B MACs and the NSC are responsible for updating PECOS when conducting initial and revalidation enrollment for providers and suppliers.NSC were not able to confirm the status, such as licensure, of every provider or supplier in PECOS on a daily basis. Instead, certain aspects of provider and supplier status have been checked less frequently. For example, A/B MACs were required to conduct monthly reviews of provider licensure status and an A/B MAC official told us that they searched individual state websites for this information. A/B MACs and NSC also have relied on a variety of data sources such as state licensure boards, the HHS OIG’s exclusions list, and SSA’s Death Master File (DMF) to update provider and supplier information in PECOS. These sources vary in the ease with which A/B MACs and the NSC have been able to access their data and the frequency with which they are updated. For example, CMS officials reported that the A/B MACs had to manually access state data sources to update licensure status. In addition, contractors we spoke with said SSA releases updates to its DMF monthly and therefore there is an interval between a provider’s death and when that information can be updated in PECOS. As a result, payments may still be made for claims submitted under a deceased provider’s NPI for medical services allegedly provided after the provider’s death. One A/B MAC official said that PECOS must first be updated to reflect the provider’s status and this information in turn must be downloaded into the shared systems in a timely manner to prevent an improper payment from being made. This is because, while enrollment-related prepayment edits can identify and deny invalid claims, the edits use the existing provider and supplier information to do so. Thus, if the PECOS provider and supplier information is not current or is inaccurate, the edits will be ineffective in preventing improper payments. However, A/B MACs and the We have previously reported concerns about the accuracy of the provider and supplier enrollment information in PECOS and CMS’s oversight of A/B MACs’ provider and supplier enrollment activities. CMS has acknowledged these concerns and indicated that the agency is working to address these issues. For example, we recently reported that incomplete or conflicting provider contact information in PECOS limited CMS from using its own data to operate its Physician Feedback Program. Furthermore, in 2010 we reported that A/B MACs had difficulty recognizing when nursing home provider information in PECOS was incomplete or inaccurate and CMS oversight of A/B MACs in this regard was limited. In that same report, we found that although CMS conducted desk reviews and onsite audits from years 2000 through 2009 to review contractors’ management of nursing home providers’ enrollment functions, these audits were limited. In addition, beyond these audits, CMS did not conduct checks on the PECOS database for internal consistency. According to a CMS official, this limited oversight was due to a lack of resources and competing priorities within the agency. As a result of these findings, we recommended that CMS more closely monitor the activities of A/B MACs’ provider and supplier enrollment activities to help ensure the accuracy and completeness of PECOS data. CMS concurred with this recommendation and recently reported that the agency is evaluating the criteria it uses to assess A/B MACs’ performance as it relates to the timeliness and accuracy of processing Medicare enrollment Further, the agency reported that it plans to evaluate the applications.completeness and accuracy of provider and supplier enrollment data as part of reviews of the contractors’ enrollment operations. Given that these activities have not been implemented, we could not determine their effect on the completeness and accuracy of PECOS data used to process claims or whether improper payments result from inaccurate information in the provider files. Since the enactment of PPACA, CMS has implemented new provider and supplier enrollment screening procedures and has also implemented other measures intended to strengthen existing procedures. However, the implementation of some additional enrollment screening procedures by CMS is still in progress. Since the enactment of PPACA, CMS has implemented some new provider and supplier enrollment screening procedures, and put in place other measures intended to strengthen existing procedures. New screening procedures that define conditions for provider and supplier enrollment in Medicare include CMS’s determination of different levels of screening according to the risk of fraud, waste, and abuse with respect to categories of providers or suppliers, and a new application fee for some types of providers. CMS also published a regulation consistent with its existing practice, requiring providers and suppliers to include their NPI on all enrollment applications and claims, and added two new Medicare contractors—an automated screening contractor and a site visit contractor—that are intended to conduct enhanced enrollment screening and site visits. To strengthen the screening activities already conducted by CMS’s contractors, PPACA required that the level of screening applied to each category of provider and supplier be based on their assessed risk of fraud, waste, and abuse and that screening procedures for Medicare providers and suppliers be explicitly established. On February 2, 2011, CMS published a Final Rule to implement these new screening procedures. The Final Rule requires, among other things, that the A/B MACs and the NSC conduct enrollment screening based on categories of providers and suppliers and levels of risk.levels—limited, moderate, and high—to categories of providers and suppliers based on determinations of which categories were at a greater risk for fraud, waste, and abuse. (See table 1.) A/B MACs and the NSC designate the appropriate screening level in PECOS for each enrolling provider and supplier upon submission of an application. Screening levels are designated based upon CMS guidance. As of October 2011, A/B MACs and the NSC had entered the screening level information in PECOS for all providers and suppliers that submitted an application. CMS assigned these new risk CMS stated that it assigned these categories of provider and supplier risk levels based on the agency’s experience with claims data used to identify potentially fraudulent billing practices, as well as on the expertise of its contractors charged with investigating and identifying instances of Medicare fraud across providers and suppliers. The agency also based these risk levels on prior findings in reports by GAO and HHS OIG. In addition, CMS will adjust the screening level of an individual provider or supplier from ‘‘limited’’ or ‘‘moderate’’ to ‘‘high’’ based on other factors, such as whether the provider or supplier has had its Medicare billing privileges revoked, has been terminated or is otherwise precluded from billing Medicaid, or has been subject to any final adverse action within the past 10 years such as license revocation or suspension, or certain felony convictions. Based on these new risk levels, providers and suppliers are subject to different screening procedures, with those in the high-risk level subject to the most rigorous screening. While PPACA requires that all categories of providers and suppliers be subject to licensure checks, it gave CMS discretion to establish a risk-based application of other screening procedures. CMS determined that providers and suppliers in all categories also must continue to undergo existing enrollment checks using various data sources to verify certain information such as Social Security number, NPI, HHS OIG exclusion, and taxpayer identification number. According to CMS’s new risk-based screening, moderate- and high-risk providers and suppliers additionally must undergo unscheduled or unannounced site visits, while high-risk providers and suppliers also will be subject to fingerprint-based criminal background checks. PPACA required HHS, for the first time, to impose an application fee on each institutional provider and on suppliers. In response, effective March 25, 2011, CMS, in its Final Rule, required all institutional providers and suppliers enrolling in Medicare, adding a practice location, or revalidating their enrollment to pay a $505 application fee. PPACA specifies that amounts collected as the result of the application fee shall be used for program integrity efforts, including to cover the cost of enrollment screening and to carry out other screening. However, PPACA permits CMS to grant a hardship exception for institutional providers and suppliers on a case-by-case basis if the agency determines that the imposition of the application fee would cause a hardship. According to CMS officials, an institutional provider or supplier working with underserved populations or engaged in extensive charity work would be a possible candidate for a hardship exception. CMS has instructed its contractors in guidance on March 23, 2011, not to process any Medicare enrollment applications without the proper application fee having been paid or a hardship exception approved.about application fee payments by institutional providers and suppliers— CMS transmits information which are made through an electronic payment system—to the A/B MACS or the NSC via PECOS. PPACA required HHS to promulgate a regulation for the inclusion of an NPI on all Medicare applications and claims by all providers and suppliers that qualify for an NPI—a practice that was already in effect. regulation was published as an interim Final Rule on May 5, 2010, and was effective July 6, 2010. Prior to the PPACA requirement for a specific regulation, CMS had required contractors to confirm that providers and suppliers included their NPI on Medicare enrollment applications and claims. Since 2006, the agency has required that enrollment applications include an NPI and since 2008 providers and suppliers have been required to report their NPI on Medicare claims. PPACA, § 6402, 124 Stat. 119, 753-763 (codified at 42 U.S.C. § 1320a-7k). provider or supplier meets Medicare eligibility criteria such as valid licensure, accreditation, and a valid NPI, and is not on exclusion lists, such as the HHS OIG list of providers and suppliers excluded from participating in federally funded health care programs. This screening process results in a report to the A/B MACs and NSC that indicates the screening components that the applicant passed and also screening components flagged for additional review. The A/B MACs and NSC, which remain responsible for enrollment and revalidation, obtain documentation from the provider or supplier on any flagged information that requires additional review to determine if the applicant meets Medicare enrollment or revalidation requirements. In addition to conducting screening at enrollment and revalidation, the automated screening contractor conducts checks of certain screening information on an ongoing basis. For example, the automated screening contractor is responsible for validating licensure status at least weekly. Previously, A/B MACs and the NSC were responsible for manually reviewing state- provided licensure information monthly to determine if any enrolled Medicare providers’ or suppliers’ licenses had been revoked, suspended, or otherwise inactivated in the last 60 days. CMS officials said that the automated screening contractor is developing an individual risk score for each provider or supplier. This individual risk score is similar to a credit risk score. The contractor’s risk scores may be used eventually as additional risk criteria that determine screening activities for providers and suppliers. CMS officials said the new automated screening contractor provides a centralized point for Medicare enrollment screening and allows for a national view of provider and supplier information, rather than the more limited regional view that the A/B MACs provided previously. For example, the automated screening contractor has been able to access information about providers and suppliers who operate across geographic regions. In addition, CMS officials said that the agency has taken a centralized approach to automated screening of enrollment data because of weaknesses observed in enrollment screening efforts, which were due generally to the large number of providers and suppliers for which the A/B MACs and the NSC had to manually screen applications and the lack of efficient access to data sources containing enrollment information. According to CMS officials, they expect the new automated screening contractor to improve the integrity of the enrollment and revalidation processes by automating the data checks and integrating new data sources. For example, CMS has directed the automated screening contractor to identify additional data sources for screening checks, such as financial, tax and business, and geospatial data sources. Additionally, in December 2011, CMS contracted with a site visit contractor to perform nationwide physical site visits for all providers and suppliers, except DMEPOS suppliers, in the moderate- and high-risk screening categories in all states and six U.S. territories. The site visit contractor began conducting site visits and making site visit reports available electronically through a portal accessible to CMS and its other contractors in February 2012. These site visits previously were performed by the A/B MACs. The A/B MACs will order any required on-site visits through the site visit contractor, which will schedule and conduct them and provide the results to the appropriate A/B MAC. However, the NSC will continue to conduct site visits related to provider enrollment of DMEPOS suppliers. CMS requires two types of site visits: routine and rapid response. According to CMS, routine site visits involve a physical location verification and collection of required data elements using predefined checklists. Rapid response site visits are triggered by an alert of possible fraudulent activity, and may require the same elements as a routine site visit but with rapid reporting and response due to the alert. Except for DMEPOS suppliers, the national site visit contractor collects site visit information at the physical provider or supplier site using defined questionnaires and gathers photographic evidence for transmission to CMS. The data elements required during routine and rapid response site visits include validation of the physical location of the provider or supplier, including capturing global positioning system coordinates of the site, photographs of the door of the provider or supplier office, and signage of the office. The contractor is required to conduct site visits and deliver completed site visit reports within a specified time period. Depending on the request from CMS or an A/B MAC, the contractor will make site visits within 30, 15, or 7 days, for routine visits, or within 36 hours for rapid response visits. CMS estimated that in the first year of the contract, the site visit contractor would conduct nearly 60,000 site visits within 30 days, almost 5,000 site visits within 15 days, almost 1,000 site visits within 7 days, and about 30 rapid response site visits. CMS officials said the national site visit contractor is expected to provide consistency of site visits across the country and, similar to the automated screening contractor, reduce the A/B MACs’ workloads. CMS’s implementation of some enrollment screening procedures authorized by PPACA remains in progress, including efforts to (1) extend surety bond requirements to additional providers and suppliers, (2) conduct fingerprint-based criminal background checks of high-risk providers and suppliers, (3) require enrolling providers and suppliers to disclose additional types of information, and (4) require compliance and ethics programs for providers and suppliers. CMS is in the process of drafting a proposed rule to extend the surety bond requirement to certain providers and other suppliers. Previously, surety bonds generally had been required only for DMEPOS suppliers. Specifically, CMS officials said that they are seeking comments on extending surety bonds to home health agencies and independent diagnostic testing facilities (and, potentially, outpatient rehabilitation facilities) and that they expected to issue a proposed rule to require surety bonds as conditions of enrollment for certain other types of providers in the fall of 2012. PPACA extended CMS’s authority to impose surety bonds on certain additional providers and suppliers, based on a determination about their level of risk. The surety bond would be in an amount commensurate with the provider’s or supplier’s billing volume, but not less than $50,000. CMS officials also said they are considering giving a new supplier provisional enrollment and then setting the amount of the surety bond after a review of billing activities. While CMS is considering extending surety bonds to additional providers and suppliers, a 2011 HHS OIG report stated that CMS did not have finalized procedures for recovering DMEPOS overpayments through surety bonds, and therefore, as of July 2011, no overpayments had been recovered through surety bonds since October 2, 2009, the date the surety bond requirement became effective. However, in January 2012, CMS released guidance on claims against surety bonds for DMEPOS suppliers. The guidance states that the surety—a company that provides the surety bond —is liable for any overpayments incurred during the term of the surety bond and that the surety must pay CMS within 30 days of receiving written notice of an overpayment. CMS’s guidance also advises DME MACs on how to collect overpayments incurred during the term of a surety bond. CMS officials said that they expect that many of the requirements for obtaining and maintaining DMEPOS surety bonds can be easily applied to home health agencies and independent diagnostic testing facilities. CMS officials said the agency was working with the Federal Bureau of Investigation (FBI) to gain access to its criminal background information for use in conducting fingerprint-based criminal background checks of high-risk providers and suppliers. PPACA authorized, but did not require, the use of criminal background checks in its risk-based provider and supplier screening. In order to conduct criminal background checks, CMS officials said they will contract with FBI channelers, whose contracts were recently recompeted by the FBI; CMS officials said that as of December 2011, 20 contracts were approved and 13 had been awarded by the FBI. CMS plans to contract with two channelers, one to conduct background checks and one to handle provider and supplier fingerprinting. CMS officials said they are developing a scope of work to solicit among the FBI-approved channelers and expect to have contracts in place before the end of 2012. CMS officials also said that they plan to develop guidance to further define A/B MAC and NSC responsibilities and work flow of these checks. CMS officials said the agency was developing and reviewing regulations to address the requirement for increased disclosures for enrolling or revalidating Medicare providers and suppliers. PPACA requires providers and suppliers to disclose any current or previous affiliation with another provider or supplier that has uncollected debt; has been or is subject to a payment suspension under a federal health care program; has been excluded from participation under Medicare, Medicaid, or CHIP; or has had its billing privileges denied or revoked at the time of initial enrollment or revalidation of enrollment. CMS officials noted that the development of these regulations is complicated by many issues that need to be addressed, such as provider and supplier concern about what information will be collected, what CMS will do with information once it is collected, and how to address concerns about maintaining the privacy and security of the information. CMS officials said the agency did not meet its own time frame for publishing a regulation to address this PPACA provision by November 2011 and they are not certain when the regulation will be published. CMS officials said that the agency was studying criteria found in HHS OIG model plans as it worked to address the PPACA requirement that the agency establish the core elements of compliance and ethics programs for providers and suppliers. PPACA required that Medicare providers establish compliance programs that contain the core elements established by CMS in consultation with the HHS OIG. In general, a compliance program is the internal set of policies, processes, and procedures that a provider organization implements to help it act ethically and lawfully. In this context, a compliance program is intended to help provider and supplier organizations prevent and detect violations of Medicare laws and regulations. CMS does not have a projected target date for implementation. Timely and accurate Medicare provider and supplier enrollment information maintained in the PECOS database are essential to reducing fraud, waste, and abuse and the likelihood of making improper payments. Although PECOS information has been routinely updated by CMS’s A/B MACs and the NSC using multiple national and state data sources, limitations in these data sources and in the frequency with which updates are made may lead to delays in, or failures to, accurately update information in PECOS, resulting in payments to ineligible providers or suppliers. As a result of the provisions in PPACA, CMS has begun to supplement its previous provider enrollment activities with new procedures and contracts that have the potential to improve the accuracy and timeliness of information stored in PECOS. In particular, CMS’s new enrollment screening and site visit contracts shift some provider enrollment activities from the A/B MACs and NSC to centralized national contractors. CMS anticipates that the new screening contractor will improve the accuracy and timeliness of updates to the provider enrollment information in PECOS by automating the process and using additional data sources for enrollment screening. In addition, CMS expects that the new site visit contractor will enable the agency to conduct routine and targeted site visits of certain providers and suppliers in categories considered at greater risk for submitting improper or potentially fraudulent Medicare claims. Our previous work has found, and we recommended, that contractor monitoring is needed to ensure that CMS and its contractors identify and address the causes of improper payments. However, it is too early to determine whether these new contractors—and the agency’s pending action on other PPACA provisions intended to strengthen provider enrollment standards—will improve the integrity of the Medicare provider enrollment and claims payment processes and reduce the likelihood of improper payments. HHS reviewed a draft of this report and in its written comments highlighted continuing steps that CMS is taking to improve the accuracy and timeliness of data used to screen providers and suppliers and to further strengthen contractor oversight and PECOS data integrity. In its general comments, HHS noted that, since we conducted our work, CMS has increased the frequency with which it receives the SSA’s DMF and now populates PECOS with this information weekly, rather than monthly. In addition, CMS will use its new automated screening contractor to routinely monitor changes that can affect enrollment status, such as death or loss of required licenses for providers and suppliers. HHS also commented that CMS is taking action to further strengthen quality control by performing follow-up analysis to ensure actions reported during the enrollment and revalidation processes are properly updated in PECOS. HHS noted that CMS is taking steps to improve the QASP process used to evaluate specific contractor functions by improving the depth at which these studies are performed and concentrating on areas that affect the quality of PECOS data. HHS’s comments are printed in appendix I. HHS also provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of CMS and other interested parties. The report also will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff members have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Other major contributors to this report are listed in appendix II. In addition to the contact named above, Karen Doran, Assistant Director; April Brantley; Jennel Harvey; Anne Hopewell; Laurie Pachter; Monica Perez-Nelson; and Jessica Colbert Smith made key contributions to this report.

Summary: According to the Centers for Medicare & Medicaid Services (CMS)the agency within the Department of Health and Human Services (HHS) that administers the Medicare programmore than 1.5 million health providers and suppliers of medical equipment were enrolled in the Medicare program in 2011, and 30,000 more enroll each month. CMS has established Medicare enrollment standards and procedures intended to ensure that only qualified providers and suppliers can enroll. While most providers and suppliers pose a limited risk to the Medicare program, our previous work found persistent weaknesses in CMSs Medicare enrollment standards and procedures that increased the risk of enrolling entities intent on defrauding the program. In 2010, the Patient Protection and Affordable Care Act (PPACA) authorized CMS to implement procedures to strengthen the Medicare enrollment process. GAO was asked to review CMSs Medicare provider enrollment procedures. In this report, GAO describes (1) how CMS and its contractors use provider and supplier enrollment information to prevent improper payments and factors that may affect the usefulness of this information, and (2) the extent to which CMS has implemented new provider and supplier enrollment screening procedures since the enactment of PPACA. To do so, GAO reviewed relevant regulations and documents, and interviewed officials from CMS and a sample of four of the agencys contractors based on the volume of claims they processed and the status of their contracts with CMS. Medicare claims are screened against enrollment information, using automated enrollment-related prepayment edits, in an effort to prevent improper payments to ineligible providers and supplierssuch as those that are no longer active in the Medicare program or are not properly licensed to provide the services for which they have submitted claims. Officials with the contractors we interviewed described the use of several types of prepayment edits to ensure that claims data are valid. For example, verification edits are intended to check the providers National Provider Identifier (NPI), which indicates whether the claim was submitted by an active provider or supplier. However, factors such as the frequency with which contractors have updated provider and supplier enrollment information and limitations of the data used may affect the timeliness and accuracy of data used to screen claimsin turn limiting the ability of the edits to prevent improper payments from occurring. For example, to update information maintained in the Provider Enrollment, Chain and Ownership System (PECOS)CMSs centralized database for Medicare enrollment informationthe contractors have relied on a variety of data sources that vary in the frequency with which they are updated and the ease with which the data can be accessed. We have previously reported concerns about the accuracy of the enrollment information in PECOS and recommended CMS increase its oversight of its contractors provider and supplier enrollment activities. CMS acknowledged these concerns and indicated that the agency is working to address these issues. Since the enactment of PPACA, CMS has implemented some new provider and supplier enrollment screening procedures and other measures intended to strengthen the existing Medicare enrollment process. New screening procedures include the designation of three different levels of risk of fraud, waste, and abuse, with categories of providers and suppliers assigned to limited, moderate, and high-risk levelsand those in the highest level subject to the most rigorous screening. For example, providers and suppliers in all three risk levels must undergo licensure checks, while those in moderate- and high-risk levels are subject to unannounced site visits. In addition, CMS implemented new application fees for some providers and suppliers. CMS also added two new Medicare contractors, an automated screening contractor and a site visit contractor, to conduct enhanced enrollment screening and site visits. CMS officials said that they expect the new automated screening contractor to identify additional data sources against which to screen, such as financial, tax, and business data sources. CMSs implementation of some additional enrollment screening procedures is still in progress. For example, by the end of 2012, CMS plans to contract with two Federal Bureau of Investigation-approved contractors to conduct fingerprint-based criminal background checks of high-risk providers and suppliers. In addition, the agency plans to extend the requirement for surety bonds to high-risk providers and suppliers beyond those already required of suppliers of durable medical equipment, orthotics and supplies. A surety bond guarantees that if a provider or supplier does not fulfill its obligation to Medicare, CMS can recover its losses via the surety bond. HHS reviewed a draft of this report and in its written comments noted CMSs ongoing efforts to improve provider and supplier enrollment procedures. HHS also provided technical comments, which were incorporated as appropriate.