Since 2006, CMS has contracted with private companies, referred to as plan sponsors, to provide outpatient prescription drug plans for Medicare beneficiaries. In 2014, there were 3,455 prescription drug plans offered nationwide. Every time a Medicare beneficiary fills a prescription covered under Part D, the sponsor must submit a prescription drug event (PDE) record to CMS. These records include drug cost and payment information that enables CMS to administer and monitor the Part D benefit. Plan sponsors are required to have comprehensive compliance programs that include a plan to safeguard the program from fraud, waste, and abuse. Plan sponsors are required to offer plans that provide a minimum set of benefits to beneficiaries—the standard benefit—or an actuarially equivalent benefit. Beneficiaries pay monthly premiums and cost sharing—such as coinsurance—for drug purchases. The amount of cost sharing varies over the course of the year as beneficiaries move through the phases of the benefit. As shown in figure 1, the standard benefit in 2014 featured a $310 deductible and an initial coverage period during which beneficiaries pay coinsurance of 25 percent of the cost for prescription drugs until they reach the initial coverage limit of $2,850. After the initial coverage period, beneficiaries enter a coverage gap, during which beneficiaries pay a large share of drug costs. After reaching the catastrophic threshold, beneficiaries pay a small share of total drug costs. Under Part D, certain individuals are also entitled to a low-income subsidy, through which they pay reduced premiums and generally have zero or nominal cost sharing. In addition to the subsidy for certain low-income individuals, Medicare also provides Part D plans with direct subsidy payments and reinsurance payments. The direct subsidy is a monthly prospective capitated payment to plans adjusted for the health status of beneficiaries expected to enroll, among other things. Reinsurance payments are monthly subsidies Medicare pays to plans that cover 80 percent of plans’ estimates for beneficiaries that incur costs above the catastrophic threshold. CMS has a goal to reduce improper payments in the Medicare Part D program and conducts a number of activities to protect the integrity of the program—that is, to ensure that payments are made correctly the first time and to identify, investigate, and recoup payments made in error. CMS’s Center for Program Integrity oversees Part D program integrity. Within the Center for Program Integrity, the Division of Plan Oversight and Accountability is responsible for administering the Part D RAC program. The Division of Plan Oversight and Accountability coordinates its efforts with components in CMS’s Center for Medicare and the Office of Acquisition and Grants Management. The Part D RAC is required under PPACA to conduct post-payment reviews to identify improper payments in the Part D program. In addition, the RAC is required to conduct three additional activities: ensure that each Part D prescription drug plan has an antifraud plan in effect and review the effectiveness of each plan; examine Part D prescription drug plans’ claims for reinsurance payments to determine whether costs were incurred in excess of the costs allowed; and review Part D prescription drug plans’ estimates for the enrollment of high-cost beneficiaries and compare to the numbers of high-cost beneficiaries actually enrolled. The RAC uses a CMS-approved audit methodology to identify potential improper payments, takes steps to have its work validated by another contractor, and provides plan sponsors with an opportunity to appeal its findings, prior to CMS collecting any confirmed improper payments. The RAC may use data from CMS and the HHS Office of Inspector General, such as CMS’s Medicare Exclusion Database or the Office of Inspector General’s List of Excluded Individuals/ Entities, among other sources, and compare those data to Medicare Part D claims data that plan sponsors submit in PDE records to identify potential improper payments. The RAC reviews all contracts that fall within a particular year for a particular plan sponsor unless directed to do otherwise by CMS, and may identify potential improper payments on PDE records within 4 years of the plan sponsor’s current plan year. After the RAC has identified potential improper payments in PDE records, a data validation contractor confirms the results and works with the RAC to resolve any discrepancies, for example in the amount of improper payments identified or the number of PDE records containing potential improper payments. Once the RAC’s results are finalized, the results are sent to the plan sponsor to give it an opportunity to appeal the RAC’s results, that is, to request a reconsideration of the identified potential improper payments and provide additional documentation to support its request. After all appeals are considered and final decisions are made, CMS collects improper payments from plan sponsors. The RAC is paid on a contingency fee basis from amounts recovered, as required by law. This payment is a percentage of the improper payments that CMS collects after the appeals process has been completed. CMS implemented the Part D RAC program in January 2011 by undertaking various activities, including establishing a statement of objectives and conducting a solicitation process to select a RAC to identify improper payments. CMS officials told us the agency addresses additional PPACA requirements for the Part D RAC program through other activities it conducts. However, unclear expectations about the work the Part D RAC would conduct and unrealistic timelines regarding project milestones hampered Part D RAC program implementation. CMS implemented the Part D RAC program in January 2011 by undertaking various activities, such as establishing a statement of objectives, conducting a solicitation process to select a contractor, and awarding a Part D RAC contract. CMS’s statement of objectives described the outcomes that CMS required a Part D RAC to achieve, such as developing a methodology to identify improper payments. Prospective contractors were to use this statement of objectives to design a performance work statement to describe how they would conduct their work to achieve those objectives. According to CMS officials, the majority of CMS contracts include a statement of work that describes how contractors should conduct their work. However, CMS officials decided that prospective contractors for the Part D RAC program would design their own performance work statements instead because CMS officials said they wanted to give industry the opportunity to shape the program. After CMS created the statement of objectives, it solicited contractors to serve as the Part D RAC using the General Services Administration’s Federal Supply Schedule. Although using the Federal Supply Schedule limited the number of potential contractors that could respond to CMS’s solicitation and from which CMS could choose, CMS officials said the agency chose this solicitation method because it was a streamlined approach to generate interest from contractors already approved to work for the federal government. According to CMS officials, CMS received two proposals from potential contractors, and only one of them was found to be technically acceptable. CMS officials said that they reviewed the potential contractors’ performance work statement and assessed their experience with Medicare Part D and knowledge of Medicare Part D statutes and regulations, along with other qualifications. CMS selected the only contractor whose proposal, including its performance work statement, the agency considered technically acceptable. While this contractor did not have any previous federal experience, CMS determined that its recovery audit experience in the private sector was sufficient. In January 2011, when CMS awarded a contract to the contractor selected to serve as the Part D RAC, the contractor’s performance work statement became part of the contract. As such, the performance work statement established requirements and set expectations for the work the RAC would perform and how the work would be conducted. The RAC’s initial contract period was for 1 base year with four 1-year options for extension, although CMS extended the base period of the contract eight times over a 2-year period through contract modifications. The base period was originally through January 2012; however, it was extended through December 2013. At that time, CMS and the RAC agreed in a contract modification to revise the performance period to reflect a 3-year base period, two 12-month option periods, and a separate nearly 13-month option for administrative and appeals activities. CMS and the RAC exercised the first option period of the modified contract, which ran from January through December 2014, and then the second and final option period, which ends December 31, 2015. CMS officials said they plan to obtain the RAC services on the open market using a full and open competitive solicitation and select a contractor to begin serving as the Part D RAC under new contract terms in January 2016. CMS officials also said the 2016 Part D RAC contract will include a statement of work. According to CMS officials, the RAC cannot perform activities to address the three additional PPACA requirements for the Part D RAC program, and therefore CMS conducts activities that address these requirements. CMS officials told us that the RAC cannot perform activities to address the additional requirements because the fee that CMS is statutorily required to pay the RAC is based on improper payments identified by the RAC, and there is no allowance under the statute for payment for other work done by the RAC. However, CMS conducts certain activities that, according to CMS officials, address the three PPACA requirements: Ensure that each Part D plan has an antifraud plan in effect and review the effectiveness of each plan—According to CMS officials, the agency meets this requirement by conducting program compliance audits of plan sponsors, which include a review of the sponsors’ antifraud plans. According to CMS officials, 96 percent of beneficiaries are enrolled in Part D plans that have been reviewed within a 5-year period as part of these compliance audits. In addition, CMS conducted a pilot study from September 2013 to February 2014 to review the effectiveness of five plan sponsors’ antifraud plans. CMS officials said the findings from this study will be used to inform and, if necessary, improve CMS’s reviews of sponsors’ antifraud plans as part of its compliance audits. Examine Part D plans’ claims for reinsurance payments to determine whether costs were incurred in excess of the reinsurance costs allowed—According to CMS officials, the agency meets this requirement through its reconciliation of Part D plans’ reinsurance estimates to their actual costs. As CMS has noted, Part D plans legitimately incur costs in excess of allowable reinsurance costs during the catastrophic coverage period of the Part D benefit. CMS pays prospective reinsurance payments to Part D plans, based on the plans’ estimates of reinsurance costs, and reconciles these prospective reinsurance payments to the plans’ actual reinsurance costs on an annual basis. Review Part D plans’ estimates for the enrollment of high-cost beneficiaries and compare to the numbers of high-cost beneficiaries actually enrolled—According to CMS officials, the agency meets this requirement through its reconciliation of Part D plans’ reinsurance estimates to their actual costs. These officials said that although Part D plans do not submit actual estimates for the enrollment of high-cost beneficiaries to CMS, the plans’ estimates of the number of beneficiaries who will reach the catastrophic threshold affect plans’ reinsurance estimates, which are examined as part of the reconciliation process, as noted above. CMS’s challenges in setting expectations about the work the Part D RAC would conduct and establishing the length of time required for CMS and the RAC to reach project milestones hampered Part D RAC program implementation. CMS’s expectations for the work the RAC would perform were unclear because although CMS incorporated the terms of work set out in the performance work statement into the RAC’s contract without making any changes to the performance work statement, CMS later proposed audit work for the RAC to pursue that differed from the work described in the performance work statement. For example, the initial RAC audit process outlined in the performance work statement broadly focused on reviews of all PDE records to eliminate duplicate payments, to validate the accuracy of information in required PDE data fields and edit checks, and to validate the information in direct and indirect remuneration reports and PDE records by comparing it to additional documentation received from the plan sponsors. However, CMS officials proposed that the RAC focus its initial audit work only on providers that were excluded from the Medicare program yet had written or filled prescriptions that were paid for by CMS, and this became part of a contract modification in February 2012. A senior official with the RAC said that the RAC expected to conduct the audit process described in its performance work statement and did not learn until after the first contract year that the initial audit work would be narrowly scoped and proposed by CMS. In addition, CMS required the RAC to follow processes for determining audit work and validating audit findings that differed from the processes set out in the performance work statement. For example, after CMS selected the initial audit work the RAC would conduct, CMS required the RAC to obtain CMS approval before it began work on subsequent audits. CMS also required a data validation contractor to review and validate the RAC audit findings. However, these steps were not included in the processes outlined in the performance work statement, and a senior official with the RAC said the RAC did not learn that CMS had adopted processes that required these steps until the end of the first contract year. The senior official with the RAC said the additional steps significantly lengthened the time it took to select audit topics and conduct audits, and reduced the number of audits the RAC was able to perform. CMS officials said they proposed that the RAC perform work and follow processes that were not in the performance work statement because they recognized during the first year of the contract that the RAC had less expertise in Medicare Part D regulations and the Part D benefit than was necessary. For example, CMS officials said that the RAC required significant assistance in developing its audit methodology because it lacked staff with adequate knowledge of Medicare Part D. According to these officials, in some cases it was necessary for CMS to develop audit methodology on the RAC’s behalf, and in other cases, CMS needed to revise the RAC’s methodology to eliminate numerous false positives— payments that the RAC incorrectly determined were overpayments— identified by the data validation contractor. CMS officials also said that they incorporated into the audit work CMS guidance, policies, and other internal processes in order to help ensure that the audit work was reasonable and viable. CMS officials said that once they recognized it was necessary to take a more prescriptive approach to directing the RAC’s work, they began developing a statement of work for the RAC, which was intended to replace the performance work statement. This statement of work included the processes that the RAC should follow to obtain CMS approval for new audit topics and to conduct audits. CMS sent the Part D RAC the initial draft statement of work in December 2011, but it was not finalized until 2 years later in December 2013. CMS officials said that prior to finalizing the statement of work, CMS provided guidance to the RAC about its expectations for the work the RAC was to perform through contract modifications. However, a senior official with the RAC said that throughout this period, the RAC did not have a clear understanding about CMS’s expectations regarding the work it should perform. In addition to not setting clear expectations for the work the Part D RAC would perform, the agency also did not establish realistic timelines regarding the length of time required for CMS and the RAC to reach project milestones. The Part D RAC contract and implementation timeline, which CMS reviewed, did not adequately reflect the time needed to meet certain goals. (See fig. 2 for a comparison of the projected and actual timelines of key implementation activities.) For example, the RAC was required to ensure its information technology systems comply with the agency’s information system security guidelines before CMS would grant it the authority to operate. The implementation timeline projected that the RAC would receive its authority to operate within 3 months of the contract award. However, the RAC did not receive its authority to operate until about 8 months after the contract was awarded. CMS officials told us that it typically takes up to a year for a new contractor to obtain its authority to operate. Furthermore, CMS did not begin collecting improper payments and the Part D RAC did not begin receiving contingency fees until more than a year after projected in the 2011 Part D RAC contract. The Part D RAC contract projected CMS would collect improper payments and the RAC receive contingency fees by January 2012, the end of the original base period of the contract. Instead, CMS began collecting improper payments more than 1 year later, in February 2013. The RAC did not begin receiving contingency fees until April 2013, 16 months later than projected. The RAC was required to cover its operating expenses until audits could begin, but a RAC official said that the RAC had not expected the projected implementation deadlines to be incorrect by more than a year. In response to concerns RAC officials raised about expenses the RAC incurred during perceived delays in receiving contingency fees, CMS officials said they made several modifications to the Part D RAC contract. For example, CMS waived key personnel requirements and extended the base period of the contract eight times. Since CMS faced challenges setting expectations about the work the Part D RAC would conduct and about the length of time required for CMS and the RAC to reach implementation milestones for the Part D RAC program, the RAC did not have a clear understanding about the work it should perform, and CMS did not recover improper payments for Part D until a year later than projected. Consistent with FAR requirements, agencies should clearly define requirements for services. Furthermore, well-defined requirements are critical to ensuring the government gets what it needs from service contractors, as reported in our August 2011 review of opportunities to build strong foundations for better services contracts. While requirements for a project can change at any point, officials must aggressively manage changes in requirements to avoid a negative effect on project results. Since the Part D RAC contract was executed in January 2011, CMS has not completed any annual evaluations of the RAC’s performance. CMS is currently in the process of finalizing an evaluation of the RAC’s 2014 contract year performance. CMS has conducted other oversight of the RAC by establishing quality assurance procedures, such as progress meetings, inspection of deliverables, and audit finding review and acceptance. CMS has not completed any annual evaluations of the Part D RAC’s performance since the RAC contract was signed in January 2011. A senior official with the RAC said that despite the RAC’s requesting annual evaluations, CMS had not conducted annual evaluations since the beginning of the contract and did not explain to the RAC why it did not conduct these evaluations. In March 2015, CMS officials acknowledged that they should have completed annual evaluations and said the agency has been behind in its evaluations of some of its contractors, including the RAC. CMS officials said they started an evaluation of the RAC’s contract year 2014 performance in December 2014. In May 2015, CMS officials finished the initial evaluation of the RAC’s 2014 performance and provided the evaluation to the RAC for review and comment. The RAC has 60 days to submit a rebuttal to the agency’s evaluation, prior to CMS completing the evaluation. CMS officials said that the agency would not likely evaluate the RAC’s performance prior to 2014, but did not indicate its plans for performance evaluation of the 2015 contract year. In addition to not having completed an annual evaluation of the RAC, CMS has not established performance standards with measurable targets against which to evaluate the RAC’s performance. A senior official with the RAC said that in addition to requesting evaluations, the RAC requested performance standards with targets, but has not received them. CMS officials said that the January 2014 statement of work included performance standards for the RAC, such as deadlines for submitting deliverables and error rate targets for audit work—that is, the target percentage of incorrect determinations of potential improper payments the RAC should not exceed. However, CMS did not create a target for how often the RAC must meet deadlines for submitting deliverables. Also, CMS officials acknowledged that the error rate target was a threshold used to determine how much time the data validation contractor would be given to conduct its work. Therefore, it is not a direct performance standard with targets for the RAC. While performance standards with targets do not exist for the Part D RAC, they do exist for other Medicare RACs. For example, the Medicare Parts A and B RACs have targets of 100 percent compliance in both maintaining private health information security and responding to written correspondence within 30 calendar days of receipt. Multiple federal standards and our prior work contain requirements and suggestions for conducting regular performance evaluations and developing performance measures, which would have provided CMS and the RAC with a basis for evaluating the RAC’s performance. In March 2013, the Office of Management and Budget issued a memorandum establishing targets in fiscal years 2013 through 2015 to improve compliance in conducting annual performance evaluations, with a target of 100 percent compliance in fiscal year 2015. The FAR requires federal performance-based contracts to include measurable performance standards and a method for assessing contractor performance against performance standards, as well as to clearly define requirements for services. According to federal internal control standards, federal agencies should conduct monitoring activities to assess the quality of performance over time and ensure that the findings of audits and other reviews are resolved promptly. According to our prior work, performance measurement systems should include not only the collection of data on various metrics, but also a designation of specific performance measures, with realistically achievable performance targets against which to measure progress. Since CMS had not completed annual contractor performance evaluations of the RAC using performance standards with measurable targets, CMS did not have a clear basis for assessing RAC performance in identifying improper payments and did not provide the RAC with targets against which the RAC could compare its performance. While CMS has not conducted annual contractor performance evaluations, it has conducted other oversight by establishing quality assurance procedures through contract modifications, including a statement of work. CMS first established certain quality assurance procedures in April 2012, through a contract modification, to ensure compliance with the contract. The quality assurance procedures included progress meetings, inspection of deliverables, and audit finding review and acceptance. CMS revised its quality assurance procedures in the statement of work effective January 1, 2014. The new quality assurance procedures included monitoring RAC performance using measures including, but not limited to, demonstration of ongoing dialogue or meetings with the appropriate and necessary parties; requiring the RAC to “maintain the highest degree of quality” for all activities performed throughout the period of performance of the contract; and monitoring contractor performance using measures including, but not limited to, completeness and accuracy of data analysis and all deliverables. However, these performance measures do not include targets, as called for in federal standards and our prior work. CMS took steps to oversee the RAC’s activities using these quality assurance procedures. For example, CMS officials said they conducted biweekly meetings with the RAC and held ad hoc meetings, as needed. CMS has also conducted oversight through audit finding review and acceptance. A data validation contractor reviews the RAC’s findings, and with the RAC, it resolves any discrepancies that were found between the review results and the RAC’s initial findings. CMS officials said that the data validation contractor reviews 100 percent of the RAC’s findings, in part because of concerns CMS had about the quality of the RAC’s initial audit work. In addition to this ongoing oversight, in June 2014 CMS sent the RAC a letter titled “Areas of Concern for the RAC Part D Contract” to inform the RAC of concerns CMS program staff had about the overall performance of the contract. In the letter, CMS cited the quality assurance procedures in the statement of work as the source of its performance expectations for the RAC. CMS identified the following concerns about the RAC’s audit work: Incorrect templates and materials being used by the RAC to communicate with plan sponsors; Quality issues with identifying potential improper payments and preparing documents for data validation during audit work; and Formatting errors and erroneous information in letters to be sent to plan sponsors. While the RAC acknowledged that some of the concerns were valid, the RAC also disagreed with other concerns CMS raised. The RAC acknowledged that among other things, concerns CMS raised about some of the formatting errors and erroneous information were valid. However, the RAC rebutted some of CMS’s concerns. For example, the RAC noted that there was no measurable target for evaluating the RAC’s performance for one issue CMS raised. Specifically, CMS stated in the “Areas of Concern” letter that the agency had identified about 14,000 PDE records that the RAC had incorrectly determined to be potential improper payments, but did not state what would be an appropriate error rate. Since CMS did not set a maximum acceptable error rate, the RAC did not have an established target against which it could measure its work, and CMS did not have an established target with which to compare the RAC’s performance. Without performance standards with targets, CMS is unable to adequately assess the quality of the RAC’s performance in determining improper payments. The RAC also noted in its response to CMS’s Areas of Concern letter that CMS was assessing the RAC’s performance on some of its audit work— identifying potential improper payments for excluded providers—using expectations that were not in place at the time the RAC was conducting the work. CMS stated in the second letter replying to the RAC’s response that while it understood that the performance expectations referenced in the Areas of Concern letter were not directly in effect when the RAC was conducting the audit work, CMS’s expectation was that all contractors would implement and maintain a standard of quality control at all times during their period of performance. When asked about the fact that performance expectations were established after the RAC’s audit work was conducted, CMS officials told us that these concerns stemmed from expectations originally set in contract modifications and later formalized in the statement of work. However, our analysis of the contract modifications in place at the time of the RAC’s work under question did not find contract language indicating how the RAC’s performance would be evaluated, or measurable targets establishing a standard of quality control. From January 2011 through May 2015, for five audit issues, CMS both authorized the RAC to conduct audit activities and pursued improper payment collections. Audit issues include two elements: (1) areas within the Part D program that should be considered for audits; and (2) the year or years for which PDE records are being audited. The five audit issues CMS approved addressed three types of issues: (1) excluded providers, (2) unauthorized prescribers, and (3) inappropriate refills of certain drugs regulated by the Drug Enforcement Administration under the Controlled Substances Act. CMS had collected less than $10 million in improper payments as of May 2015 for the five approved audit issues. CMS authorized the RAC to conduct audit activities that identified about $19.8 million in potential improper payments, and has collected about $9.7 million as of May 2015. Of the remaining approximately $10.1 million, $7.3 million in potential improper payments has been determined to be proper, for example, because the plan sponsor provided additional information verifying the amount of the Part D claim; $45,000 in potential improper payments has been identified as being uncollectible for various reasons, such as the plan sponsor’s contract was terminated before audit activity took place; and $2.8 million in improper payments remain that have not yet been collected, not yet determined to be proper, or not yet identified as being uncollectible. (See table 1 for each of the five approved audit issues for which CMS pursued collections, the amount CMS approved for the RAC to conduct audit activities, and the status of potential improper payments identified.) From the beginning of the contract in January 2011 until the statement of work became effective on January 1, 2014, CMS and the RAC faced challenges in determining audit issues on which to conduct work. As noted above, CMS did not initially authorize the RAC to begin conducting the audit work that the RAC had proposed and outlined in the performance work statement that became part of the contract. Instead, the first audit issue CMS approved the RAC to conduct was an audit of excluded providers for plan year 2007, which CMS suggested and which was included in a contract modification in February 2012. By the time the statement of work became effective on January 1, 2014, CMS had suggested that the RAC conduct audit work on three audit issues: excluded providers for plan year 2007, excluded providers for plan years 2008 through 2011, and unauthorized prescribers for plan years 2009 through 2011. During that same time, CMS denied four of the six audit issues the RAC proposed. Of the remaining two audit issues, CMS later denied one issue and approved the other. CMS denied issues for various reasons; for example, one audit issue was denied because the improper payments identified were outside the 4-year period prior to a plan sponsor’s current plan year, which is the time limit for identifying improper payments. After CMS and the RAC agreed to a new process for identifying, reviewing, and approving audit issues, which became effective on January 1, 2014, the RAC faced challenges in applying Part D regulations and CMS rules to develop audit methodologies. The statement of work CMS and the RAC agreed to included a new process by which the RAC would submit new audit issues for CMS’s consideration. Figure 3 outlines the process the RAC and CMS follow to submit, evaluate, and decide on new audit issues. Under this process, CMS officials said, under some circumstances the RAC can resubmit an audit issue for a particular plan year once it has been denied. For example, CMS may deny the methodology the RAC used and ask the RAC to resubmit the audit issue using a different audit methodology. Since the new process took effect, the RAC has faced challenges in applying regulations and CMS rules to audit methodologies, resulting in CMS denials. For example, CMS denied the RAC’s proposal to audit hospice care beneficiaries’ PDE records because CMS guidance published in March 2014, 3 days after the RAC made the proposal, prevents CMS from performing hospice audits associated with Medicare Part D potential improper payments prior to May 1, 2014. CMS noted in its denial that a retrospective audit would not be pursued at the time because previous CMS guidance was ambiguous and there were no objective criteria for plan sponsors to apply in determining whether the beneficiaries were eligible for Medicare Part D. CMS denied the RAC’s proposal to audit deactivated prescribers in plan years 2010 through 2012 in part because the RAC’s audit methodology included using a field in the PDE record that plan sponsors were not required to submit until January 1, 2013. CMS officials said they provide the RAC with assistance in developing audit issues; nevertheless, CMS has not approved any audit issues submitted since the new process took effect. CMS officials said they hold regular phone conversations between the RAC and program officials with subject matter expertise from several CMS program offices, and provide feedback to the RAC after an audit issue is submitted. However, since the new process took effect in January 2014, the RAC has proposed nine audit issues, and CMS has not approved any of them. (See table 2 for each of the nine denied audit issues.) Challenges faced by CMS and the RAC have resulted in few audit issues being approved and therefore a small amount of improper payments being identified and collected relative to CMS’s estimates of improper payments in Medicare Part D. In more than 4 years, initial CMS and RAC challenges in determining the audit work to conduct and later RAC challenges in determining how to apply regulations and rules to audit issues have resulted in CMS’s approving 1 of the 15 audit issues the RAC proposed, and no approvals for issues submitted since the new audit issue process took effect. The RAC can only resubmit an audit issue under some circumstances, once it has been denied, so a denial not only results in lost time and effort, but also may result in a lost opportunity to identify and collect potential improper payments. In addition, the RAC may only identify potential improper payments on PDE records within 4 years of the plan sponsor’s current plan year. Therefore, as each year passes, another prior plan year can no longer be audited by the RAC. Both CMS and the RAC are charged with reducing Medicare Part D improper payments. CMS has a goal to reduce improper payments in Medicare Part D, according to the fiscal year 2016 Annual Performance Plan and Report. The RAC’s mission is to reduce Medicare improper payments through the efficient detection and collection of improper payments, using a methodology that maximizes recoveries as well as meets all regulatory requirements, according to CMS’s statement of objectives for the RAC. In addition, federal internal control standards state that agencies should have effective and efficient processes in place that enforce management’s directives and that these processes are monitored. The $9.7 million in improper payments that CMS has collected since 2011 is a relatively small amount compared to CMS’s estimated improper payments in Medicare Part D of $1.9 billion in 2014 alone. If the process for identifying, reviewing, and approving new audit issues was more efficient in developing appropriate issues, the process would likely have resulted in more issues being approved each year of the RAC contract and more improper payments being identified and collected. Given Medicare’s vulnerability to improper payments, it is important to develop a RAC program that effectively identifies and recovers those improper payments. The effectiveness of the RAC program, which began in January 2011, has been hindered by various challenges faced by both CMS and the RAC that resulted in relatively little in improper payment collections. The first RAC contract is ending on December 31, 2015, and CMS is contemplating how to solicit contractors for the next RAC contract. Among CMS’s considerations is obtaining RAC services on the open market using a full and open competitive solicitation. As CMS considers its upcoming solicitation for the next contract period, it has an opportunity to address the challenges it and the RAC faced during the first contract. Establishing clear work statements, realistic timelines, and an improved process for identifying, reviewing, and approving audit issues would provide more assurance that audit work can be conducted more effectively and efficiently through the next RAC contract. Additionally, conducting annual performance evaluations against measurable targets would allow CMS to regularly assess the effectiveness of a RAC contractor and identify and address any areas for improvement. Setting in place these improvements would significantly increase the likelihood of identifying and collecting more improper payments in the Part D program. As CMS prepares to solicit the next RAC contract(s), we recommend that the Administrator of CMS take the following three actions to improve the agency’s RAC program operations and contractor oversight: Ensure that work statements included in solicitations for contract proposals and the executed contract(s) set clear expectations about the work CMS intends the RAC to perform and that time frames are established that reflect the time needed to reach milestones. Conduct annual evaluations of the RAC’s performance against measurable performance standards to provide a clear basis on which CMS and the RAC can assess RAC performance in identifying improper payments. Review the agency’s process for identifying, reviewing, and approving new audit issues to identify process improvements that will help ensure the efficient development of appropriate audit issues (i.e., reduce audit issue denials and increase audit issue approvals) and thereby maximize the collection of improper payments. We provided a draft of this report to HHS for comment, and its comments are reprinted in appendix I. HHS also provided technical comments, which we incorporated as appropriate. We shared portions of the draft report with the current Part D RAC; the contractor provided oral technical comments, which we incorporated as appropriate. In commenting on this report, HHS agreed with our three recommendations. HHS stated that it plans to select a contractor to serve as the Part D RAC under new contract terms in January 2016. For this Part D RAC, HHS stated that it will address our recommendations by setting clear expectations, reasonable timelines, and measurable performance standards, as well as developing improved processes for reviewing new audit topics by strengthening the collaboration between CMS’s policy experts, PDE review experts, and data analytics experts, as well as the Part D RAC’s team of analysts. In its comments, HHS also noted additional steps it has taken to strengthen Part D program integrity, such as enrolling prescribers of Part D drugs in Medicare by January 2016, and subjecting these prescribers to the screening procedures used for other Medicare providers. HHS also created a web-based tool to allow CMS, law enforcement, and plan sponsors to share information and coordinate actions against high-risk pharmacies. As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of Health and Human Services, the Administrator of the Centers for Medicare & Medicaid Services, and other interested parties. In addition, the report is available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. Major contributors to this report are listed in appendix II. Kathleen M. King, (202) 512-7114 or kingk@gao.gov. In addition to the contact named above, Karen Doran (Assistant Director), Muriel Brown, Christine Davis, Peter Mangano, Roseanne Price, Mandy Pusey, and Jennifer Whitworth made key contributions to this report.

Summary: In 2014, the federal government spent $58 billion on Medicare Part D, the voluntary, outpatient prescription drug coverage program. An estimated $1.9 billion of this total was improper payments--including overpayments or underpayments that may be due to errors, such as the submission of duplicate claims for the same service. In January 2011, CMS began a RAC program in Part D that was intended in part to identify and recoup improper payments, as required under the Patient Protection and Affordable Care Act. The RAC is paid a contingency fee from amounts recovered. GAO was asked to review CMS's Part D RAC program implementation, oversight, and results. GAO examined (1) how CMS has implemented the Part D RAC program and any challenges it faced during implementation; (2) the extent to which CMS has overseen the RAC's audit activities; and (3) the results of the RAC's work to date and any challenges CMS and the RAC faced in identifying and collecting improper payments. To do this, GAO analyzed the RAC contract and audit documents, and federal statutes and regulations on Part D and federal contracting. GAO also interviewed CMS and RAC officials. The Centers for Medicare & Medicaid Services (CMS) within the Department of Health and Human Services (HHS) implemented the Part D recovery audit contractor (RAC) program in January 2011 by undertaking various activities, including establishing a statement of objectives and conducting a solicitation process to select a RAC to identify improper payments. However, CMS's challenges in setting expectations about the work the Part D RAC would conduct and establishing the length of time required for CMS and the RAC to reach project milestones hampered Part D RAC program implementation. Consistent with federal contracting requirements, agencies should clearly define requirements for services. As a result of CMS's challenges in setting expectations and establishing realistic timelines as it implemented the RAC program, the RAC did not have a clear understanding about the work it should perform, and CMS recovered improper payments for Part D more than a year after it had projected. As of May 2015, CMS had not completed any annual evaluations of the Part D RAC, but an initial evaluation of the RAC's contract year 2014 performance was in progress, and the agency had conducted other oversight of the RAC's performance. Federal internal controls and contracting standards and GAO's prior work contain requirements and suggestions for conducting regular performance evaluations and developing performance measures. In March 2015, CMS officials acknowledged that the agency should have completed annual evaluations and noted that CMS has been behind schedule in conducting evaluations of some its contractors, including the RAC. In May 2015, CMS officials finished the initial evaluation of the RAC's 2014 performance and provided the evaluation to the RAC for review and comment. An annual performance evaluation would provide CMS with a clear basis for assessing RAC performance in identifying improper payments and provide the RAC with targets against which the RAC could compare its performance. While CMS has not completed annual evaluations, it has established quality assurance procedures to conduct oversight of the RAC. For example, CMS uses a separate contractor to review and validate 100 percent of the RAC's audit findings, in part because of concerns about the quality of the RAC's work. As of May 2015, CMS had collected less than $10 million in improper payments, and had not approved the RAC to perform new audit work since March 2014. Both CMS and the RAC are charged with reducing Medicare Part D improper payments, and federal internal control standards call for agencies to have effective and efficient processes to meet agency goals. However, as a result of CMS's and the RAC's challenges in determining audit work to conduct and the RAC's challenges in developing audit methodologies, CMS has approved 1 of the 15 audit proposals from the RAC since the beginning of the contract in 2011 and has collected a limited amount of improper payments relative to the estimated $1.9 billion in improper payments in Part D in 2014. With a more effective and efficient process for identifying, reviewing, and approving appropriate new audit work, more audit work would likely have been approved each year of the RAC contract, resulting in more improper payments being identified and collected. As CMS prepares to solicit the next RAC contract(s), CMS should set clear expectations in contract work statements, conduct annual RAC performance evaluations, and review the process for developing new audit issues. HHS concurred with GAO's recommendations.