The Medicare Part D program was designed to be administered by private organizations—referred to as plan sponsors—that CMS contracts with to provide outpatient prescription drug benefit plans to Medicare beneficiaries. These sponsors may contract with other entities—called First Tier, Downstream or Related Entities (FDR)—to help provide these benefits. (See fig. 1.) FDRs include pharmacy benefit managers— companies that provide services such as contracting with a network of pharmacies, managing formularies, and performing drug utilization reviews on behalf of the sponsors—and pharmacies. CMS holds plan sponsors responsible for oversight of their FDRs. Program integrity responsibilities in Medicare Part D are shared by plan sponsors, CMS’s Center for Program Integrity (CPI) and Center for Medicare, and CMS’s program integrity contractors. Plan sponsors are required to have comprehensive compliance programs that include elements intended to safeguard the Part D program from fraud, waste, and abuse. CMS issued requirements for these programs based on input from various sources, including plan sponsors and industry representatives. CMS requires plan sponsors to monitor and audit their FDRs; analyze data to detect and prevent potential fraud, waste, and abuse; have a unit, such as a Special Investigation Unit (SIU), specifically tasked with identifying and addressing fraud, waste, and abuse, or ensure that the responsibilities generally conducted by an SIU are conducted by a plan sponsor’s compliance department. CMS’s CPI oversees Part D program integrity and coordinates with other groups within CMS’s Center for Medicare that monitor plan sponsor compliance with the Part D program. (See fig. 2.) Within the Center for Medicare, one such group is the Medicare Parts C and D Oversight and Enforcement Group, which ensures contractual compliance through audits of plan sponsors. If those audits identify noncompliance with the terms of the Part D contract, CMS may take a variety of actions that include requiring corrective action plans, sending warning letters, assessing civil money penalties, and terminating or not renewing a contract. The other group, the Medicare Drug Benefit and C & D Data Group, analyzes data to identify potential patient safety concerns, such as overutilization of opioid drugs, that may also indicate potential fraud or abuse. CPI has primary responsibility for overseeing the two MEDICs tasked with promoting program integrity in Medicare Part D: The National Benefit Integrity (NBI) MEDIC is responsible for preventing, detecting, and deterring Part D fraud, waste, and abuse. This includes intake and handling of complaints from beneficiaries and others as well as requests for information from law enforcement; investigating providers and others and referring them to law enforcement; and analyzing Part D program prescription drug event records and other data to identify patterns indicative of potential fraud, waste, or abuse. The Outreach & Education (O&E) MEDIC provides Part D fraud, waste, and abuse education to plan sponsors and other stakeholders by working in concert with CMS to develop educational and training tools, and by facilitating information-sharing opportunities, such as fraud alerts, conferences, and other meetings. CPI also oversees the Part D Recovery Audit Contractor (RAC) program, which is tasked with reviewing paid Medicare claims—or, for Part D, prescription drug event data—from plan sponsors and their pharmacies to determine overpayments and underpayments; providing information to CPI to help prevent future improper payments; and referring any potential fraud identified during the auditing process to the NBI MEDIC to investigate. While the Part D RAC may conduct work similar to the NBI MEDIC, the focus of the RAC is improper payments—such as overpayments—while the MEDIC’s focus is potential fraud, waste, and abuse. We identified a total of 23 practices for addressing prescription drug fraud, waste, and abuse that fall within one or more of the three categories based on the Fraud Prevention Framework: (1) prevention, (2) detection and monitoring, and (3) investigation and prosecution. Counting only once the practices that fall within more than one category, we identified 16 unique practices. We identified eight practices related to the prevention of prescription drug fraud, waste, and abuse that can include multiple activities, as shown in table 1. For example, one prevention practice, limiting the supply of abused drugs, can help prevent abuse by restricting the amount of potentially abused drugs that are available. This is done by conducting the following activities: offering “take-back” programs where patients can safely dispose of any unused medications, preventing use or abuse by others; securing information and materials, such as Drug Enforcement Administration (DEA) registration numbers and prescription pads,that could prevent bad actors from illegally obtaining prescription drugs; and developing abuse-resistant drugs that could hamper efforts to abuse them. We identified nine practices related to the detection and monitoring of prescription drug fraud, waste, and abuse, as shown in table 2. For example, the collaboration practice includes sharing information about specific fraud schemes and potentially fraudulent providers that can help other interested parties—such as other insurers—find those schemes and providers within their own systems. These practices also help monitor individuals who have been identified as potentially abusing drugs or health care benefits. For example, one practice we identified is recipient restriction programs—called “lock-ins”—that typically require certain patients to use one prescribing physician and one dispensing pharmacy— to better track their prescription drug use. We identified six practices related to the investigation and prosecution of prescription drug fraud, waste, and abuse, as shown in table 3. Practices include having investigative staff knowledgeable of prescription drug schemes and experienced in investigating them, as well as having the ability to take actions to enforce prescription drug rules. CMS pursues many of the practices we identified that can be used to prevent, detect, and investigate prescription drug fraud, waste, and abuse. In addition, CMS plans to add new and strengthen certain existing practices, but will not adopt certain other practices for a variety of reasons. CMS activities to address prescription drug fraud, waste, and abuse reflect 14 of the 23 total practices we identified, based on interviews with officials and review of agency documents. Most of the practices CMS pursues—10 of its 14 practices—relate to the detection and monitoring, and investigation and prosecution categories. CMS implements its prescription drug program integrity practices by assigning activities to and working with plan sponsors, the MEDICs, and others. For example, for prevention, CMS works with the O&E MEDIC to develop educational materials that plan sponsors can download from the O&E MEDIC’s website and customize for their beneficiaries; for detection and monitoring, CMS requires plan sponsors to have compliance programs, which incorporate multiple practices we identified, such as data analysis, collaboration, and education; the NBI MEDIC also analyzes data and shares the results with plan sponsors; and for investigations and prosecutions, plan sponsors and the NBI MEDIC are expected to have staff who can identify and investigate potential fraud, waste, and abuse. The NBI and O&E MEDICs reported completing work for a variety of practices, and CMS rated elements of the MEDICs’ work from satisfactory to exceptional on their most recent performance assessments. CMS paid approximately $17 million in 2013 to the NBI MEDIC to analyze data, process and review complaints, and develop investigations to promote Part D program integrity. In the most recently completed contract year, the NBI MEDIC reported the following: processing almost 7,000 complaints to determine whether they identified potential fraud, for which CMS most recently rated the contractor “exceptional”; completing 7 data analysis projects and initiating 41 new projects, for which CMS most recently rated the contractor “exceptional”; and referring almost 400 cases that represented approximately $5.1 billion in potential fraud to law enforcement, for which CMS most recently rated the contractor “satisfactory” for its investigations and “exceptional” for its law enforcement referrals. CMS paid approximately $1.7 million in 2013 to the O&E MEDIC to provide outreach and education that assists CMS in communicating program integrity efforts as well as supporting fraud, waste, and abuse oversight audits. In the most recently completed contract year, the O&E MEDIC reported the following: developing 59 outreach and education materials, such as fraud awareness flyers and frequently asked questions; developing 33 training products, such as webinars and job aids; and executing 8 conferences, including with stakeholders we interviewed, and providing 22 presentations at other conferences and meetings. CMS rated each element of the O&E MEDIC’s work as “satisfactory.” Table 4 identifies the practices implemented by CMS and its contractors. CMS is planning to implement another 3 of the 23 total practices and to strengthen 4 that it has already implemented, but officials stated that the agency is not pursuing 6 practices for a number of reasons. The three additional practices CMS plans to implement are the following: Detection and Monitoring: Prescription Drug Monitoring Program (PDMP). CMS officials said the agency is seeking access to PDMP data through several avenues. For example, CMS and the NBI MEDIC are working with the PDMP Center of Excellence to obtain de- identified PDMP data to assist the MEDIC in detecting potential patterns of prescription drug fraud, waste, and abuse. Investigation and Prosecution: PDMPs. CMS officials said CMS and the NBI MEDIC are also working with four states—Idaho, Indiana, Massachusetts, and New York—to obtain PDMP data as another data source to help investigate potential prescription drug diversion. Idaho currently is the only state that allows Medicare access to its PDMP, while the other states have expressed interest in providing information to CMS. Investigation and Prosecution: Enforcement. Under the recently issued rule, which established a Medicare enrollment requirement for prescribers of drugs covered by Part D, CMS can revoke a physician’s or eligible professional’s Medicare enrollment if the DEA or a state agency has suspended or revoked the individual’s prescriber privileges. CMS may also revoke enrollment where it determines the individual has prescribing patterns or conducts practices that are abusive or represent a threat to the health and safety of Medicare beneficiaries, or both. Prior to this new requirement, CMS could not directly take administrative actions against a Part D provider. CMS officials also reported that they are working with OIG on how best to pursue other enforcement options, such as “permissive exclusions,” which allow OIG to exclude providers from federal health programs for certain other actions, such as misdemeanor convictions for certain offenses. CMS is planning to strengthen four practices that it has already implemented, which correspond to all three categories. Prevention: Screening. CMS issued a final rule in May 2014 that is intended to strengthen Part D prescriber and beneficiary screening. The rule establishes a Medicare enrollment requirement for prescribers of drugs covered by Part D, effective June 2015. As a result, CMS is to screen these prescribers during the Medicare enrollment process to verify that they meet specific requirements, such as having current licenses or accreditation and valid Social Security numbers. Additionally, this final rule authorizes CMS to revoke a physician’s or eligible professional’s Medicare enrollment for certain abuses of the program, or based upon a suspension or revocation of the prescriber’s DEA certificate or state authority to prescribe drugs. As with fee-for-service providers, CMS will revalidate enrollment information when changes or updates are submitted and during a 5-year revalidation process. CMS is still considering whether to require pharmacies that dispense covered Part D drugs to enroll into the Medicare program. The rule is also intended to strengthen screening of Part D beneficiaries. Currently, plan sponsors are to verify beneficiaries’ Part D eligibility. While incarcerated or confined beneficiaries are generally ineligible for Part D coverage, recent OIG reports found that CMS paid for prescription drugs for such beneficiaries.implements the exclusion of beneficiaries incarcerated for 30 days or more from receiving Part D benefits starting January 1, 2015, by removing the facilities where individuals are incarcerated from the definition of a plan’s service area. Detection and Monitoring: Collaboration. CMS is seeking to strengthen collaboration through a new voluntary web-based system created by the NBI MEDIC—PLATO—that is intended to allow CMS and plan sponsors to more easily share information on fraud schemes and potential bad actors. For example, plan sponsors may use the system to share information on specific suspect providers so that other plan sponsors can determine whether they should also investigate or take actions against those providers. CMS officials said that they anticipate that PLATO will be accessible to plan sponsors by the end of 2014. In addition, according to agency officials, CMS is working with the NBI MEDIC to develop and implement predictive models in PLATO to help identify potential fraud schemes that can be shared with plan sponsors, such as a model for identifying prescribers who provide certain controlled substances to patients without a valid medical need. Detection and Monitoring: Compliance Program. CMS is pursuing options for improving its oversight of plan sponsors’ compliance programs. In 2013, among the plan sponsors that it audited, CMS found weaknesses in the majority of plan sponsors’ compliance programs for addressing fraud, waste, and abuse. During that year, CMS audited 29 plan sponsors, representing 14 percent of all plan sponsors and, of those, nearly all (94 percent) had findings related to fraud, waste, and abuse activities, according to officials. These officials also reported that almost all weaknesses were addressed through a corrective action plan. In January 2014, CMS proposed a rule that would require, among other things, that plan sponsors hire an independent auditor to verify that any required corrective action plans addressed deficiencies found during a program audit. CMS did not finalize this requirement in the final rule issued in May 2014, and as of October 2014, CMS officials did not provide a proposed completion date. In addition, CMS officials reported that the agency has an initiative under way to gather information that could help improve oversight of plan sponsors’ practices to address fraud, waste, and abuse. As part of this initiative, CMS interviewed five plan sponsors about how they use the information CMS provided to them on new fraud schemes and potentially fraudulent providers. Based on this information, CMS officials reported that they could change how the agency audits plan sponsors’ fraud, waste, and abuse activities, or increase the requirements for sponsors’ activities, in order to improve oversight.However, CMS officials noted that any changes will be based on the agency’s final assessment of lessons learned from the initiative, which was still in progress as of August 2014. Investigation and Prosecution: Collaboration. CMS is working to develop a more formal way to share information about fraudulent providers with relevant state medical boards, CMS officials said, so that the medical boards can conduct additional investigations to determine whether the board should impose sanctions on those providers, such as revoking a provider’s medical license. CMS is not pursuing six practices that appear in two categories, prevention and detection and monitoring, because the agency considers the practices to be outside the scope of its program integrity activities, is concerned about limiting beneficiaries’ access to services, or for other reasons. Prevention, and Detection and Monitoring: Clinical Guidelines. While CMS uses clinical guidelines to review plan sponsors’ formularies to ensure access to certain drugs, CMS does not require plan sponsors to carry out activities within these program integrity practices, such as filling only the prescriptions for the lowest effective dose, promoting alternatives to opioids, or screening their patients for potential drug abuse. However, CMS provides training materials to providers on such topics to promote patient safety, and other parts of Medicare cover screening for drug abuse under certain conditions. Prevention: Health Information Technology. CMS does not use health information technology for program integrity purposes, but encourages its use by, for example, providing information to Medicare beneficiaries on the benefits of electronic health records. Prevention: PDMPs. CMS guidance to physicians has encouraged prescribers to check their states’ PDMP prior to prescribing certain drugs; however, variations in state practices regarding access to PDMPs means that not all prescribers may be able to conduct checks, according to CMS officials. Prevention: Limit the Supply of Abused Drugs. CMS officials told us that the agency does not conduct activities to limit the supply of abused drugs because this practice is beyond the scope of Part D program integrity efforts. For example, CMS does not operate “take back” days where beneficiaries can dispose of any unneeded prescription drugs, since, until recently, DEA required a law enforcement presence at such events, which CMS cannot provide.CMS also does not address the supply of abuse-resistant drugs, officials said, since that is the responsibility of the Food and Drug Administration and pharmaceutical manufacturers. Detection and Monitoring: Lock-ins. CMS does not monitor Medicare beneficiaries through a “lock-in” or restricted recipient program. We previously recommended that CMS consider a restricted recipient program for Medicare Part D that would limit certain beneficiaries to one prescriber, one pharmacy, or both for receiving prescriptions, and that the agency should seek congressional authority, as appropriate, to do so. CMS, in responding to our recommendation, stated that it did not agree that a restricted recipient program was necessarily the appropriate control for the Part D program, and raised concerns about restricting beneficiaries’ access to services.2014, OIG recommended that CMS restrict certain beneficiaries to a limited number of pharmacies and prescribers, and CMS concurred However, in August with the recommendation, but stated the agency needs—and is receptive to—legislative authority to “lock in” beneficiaries in Part D. Currently, the agency requires plan sponsors to review data to identify beneficiaries potentially at risk for overutilization of certain drugs, including opioids, and to monitor those beneficiaries. Monitoring may include notifying their prescribers of the overutilization, case management, and point-of-sale edits, which are beneficiary-specific edits that can vary based on the situation. For example, the edits may prevent a beneficiary from receiving certain types of prescription drugs or an excessive amount of a particular drug. See appendix I for the status of all 23 program integrity practices we identified and whether CMS and its contractors have implemented, planned to implement, or are not pursuing them. We provided a draft of this report to the Department of Health and Human Services (HHS) for comment and HHS provided written comments, which are reprinted in appendix II. In its comments, HHS generally agreed with our findings, and provided more information regarding our finding that CMS is not pursuing 6 of the 23 practices we identified for prescription drug fraud, waste, and abuse. Generally, the agency provided additional information for why CMS is not pursuing certain practices as part of its program integrity efforts, such as the use of clinical guidelines, PDMPs, and lock-in programs. Regarding the practice of health information technology, while HHS noted that CMS requires the development by Part D sponsors of electronic prescription drug programs and the use of e-prescribing is encouraged, these activities were not identified by CMS officials as specific program integrity efforts. Regarding the practice of limiting the supply of abused drugs, HHS described CMS activities that we considered under a different practice—the use of prepayment edits. Our descriptions and examples of these practices, as well as the other 17 practices, are included in tables 1, 2, and 3 in this report. HHS also provided a recent example of its program integrity efforts to address fraud, waste, and abuse in the Part D program, in which HHS sent letters to providers identified as very high prescribers of certain controlled substances to give information to these providers to help them evaluate whether their high prescribing level of these drugs is appropriate for their patient population, and to identify areas where their prescribing could be modified. HHS also provided technical comments, which we incorporated as appropriate. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, appropriate congressional committees, and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. Table 5 shows the 23 prevention, detection and monitoring, and investigation and prosecution practices we identified, their CMS status (implemented, planned, or not pursuing), and examples of the activities. We determined that CMS had implemented a practice if the agency required or documented at least one activity within that practice, that CMS planned a practice if documentation or officials described activities as pilots or in the process of development, and that CMS was not pursuing practices based on reviews of documentation and interviews with officials. Kathleen M. King, (202) 512-7114 or kingk@gao.gov. In addition to the contact named above, Karen Doran, Assistant Director; Elizabeth Morrison; Lisa Rogers; Eden Savino; and Jennifer Whitworth made key contributions to this report.

Summary: Recent media reports and law enforcement actions have highlighted the problem of prescription drug fraud, waste, and abuse in the United States. Medicare, and the Part D prescription drug benefit, are susceptible to such fraud—a risk made greater by Medicare's size, scope, and complexity. GAO and others have raised questions about CMS's oversight of its activities to address fraud, waste, and abuse in Part D, as well as oversight of the contractors tasked with this work. GAO examined (1) practices for promoting prescription drug program integrity, and (2) the extent that CMS's oversight of Medicare Part D program integrity, including the program integrity contractors, reflects these practices. To develop a list of practices, GAO interviewed 14 stakeholder groups involved in various aspects of prescription drug program integrity, including provider, beneficiary, and anti-fraud groups; identified and reviewed related documents; and conducted a search of eight bibliographic databases that included peer-reviewed articles and government documents. GAO organized the practices based on the three categories of GAO's Fraud Prevention Framework. To determine how CMS's oversight reflects these practices, GAO analyzed agency documents, such as contracts, manuals, work products, and CMS audits of contractors; and interviewed agency officials. GAO identified 23 practices for addressing prescription drug fraud, waste, and abuse that fall within three categories based on GAO's Fraud Prevention Framework—prevention, detection and monitoring, and investigation and prosecution. The Department of Health and Human Services' (HHS) Centers for Medicare & Medicaid Services' (CMS) activities to address prescription drug fraud, waste, and abuse in the Medicare Part D prescription drug program reflect 14 of these 23 identified practices, some of which are in multiple categories, and the agency plans to implement 3 additional practices. a practice if documentation or officials described activities as pilots or in the process of development, and that CMS was not pursuing a practice based on reviews of documentation and interviews with officials. HHS generally agreed with our findings.