In 1990, we designated Medicare as a high-risk program,and it continues to be one today. Many of Medicare’s vulnerabilities are inherent due to its size and administrative structure, which make the largest health care program in the nation a perpetually attractive target for exploitation. Wrongdoers continue to find ways to dodge program safeguards. The dynamic nature of fraud and abuse requires constant vigilance and the development of increasingly sophisticated measures to detect fraudulent schemes and protect the program. With total benefit payments of $201 billion in fiscal year 1999, Medicare enrollment has doubled since 1967 to nearly 40 million beneficiaries today. Beneficiaries can elect to receive Medicare benefits through the program’s fee-for-service or managed care options. With benefit payments of $164 billion in fiscal year 1999 and about 85 percent of participating beneficiaries, the fee-for-service option represents the most significant part of the program. The managed care option accounts for the remaining $37 billion and 15 percent of participating beneficiaries. The program is comprised of two components. Hospital Insurance or Medicare Part A covers hospital, skilled nursing facility, home health, and hospice care. Supplementary Medical Insurance, also known as Part B, covers physician, outpatient hospital, home health, laboratory tests, durable medical equipment (DME), designated therapy services, and some other services not covered by Part A. HCFA’s administration of the Medicare fee-for-service program is decentralized. Each year, about 1 million providers enrolled in the program submit about 900 million claims to about 56 Medicare contractors for payment. The bulk of the claims are submitted electronically and never touch human hands during the entire computer processing and payment cycle. Ensuring the integrity of the Medicare fee-for-service program is a significant challenge for HCFA and its Medicare claims processing contractors and Peer Review Organizations (PROs). They are HCFA’s front line defense against inappropriate payments including fraud and abuse and should ensure that the right amount is paid to a legitimate provider for covered and necessary services provided to eligible beneficiaries. Except for inpatient hospital claims, which are reviewed by the PROs, Medicare contractors perform both automated and manual prepayment and postpayment medical reviews of Medicare claims. Various types of pre- and postpayment reviews are available to contractors to assess whether claims are for covered services that are medically necessary and reasonable. These include automated reviews of submitted claims based on computerized edits within contractors’ claims processing systems, routine manual reviews of claims submitted, and more complex manual reviews of submitted claims based on medical records obtained from providers. Reliance on postpayment utilization and medical record reviews to detect potential fraud and abuse has created opportunities for unscrupulous providers and suppliers to defraud the program with little fear of prompt detection. For example, a few providers—subjects of past health care fraud investigations in which they have pled guilty to or have been indicted for criminal charges—had set up store-front operations and fraudulently obtained millions of dollars from Medicare before their billing schemes were detected through postpayment reviews. HCFA is moving toward more extensive use of prepayment reviews, but contractors’ efforts to prevent and detect improper payments are challenged due to the sheer volume of claims they are required to process and the need to pay providers timely. The program’s vulnerabilities have been compounded by the emergence of some organized groups of criminals who specialize in defrauding and abusing Medicare, which has led to an array of fraudulent schemes that are diverse and vary in complexity. For example, based on our recent review of seven investigations of fraud or alleged fraud, we reported that the criminal groups involved had created as many as 160 sham medical entities—such as medical clinics, physician groups, diagnostic laboratories, and durable medical equipment companies—or used the names of legitimate providers to bill for services not provided. Medicare contractors and PROs are identifying thousands of improper payments each year due to mistakes, errors, and outright fraud and abuse. They refer the most flagrant cases of potential fraud and abuse to the OIG and Department of Justice (DOJ) so they can investigate further, and if appropriate, pursue criminal and civil sanctions. HCFA tracks the cases referred by Medicare contractors and PROs to the OIG and DOJ in its Fraud Investigation Database (FID).Figure 1 shows the six most common types of potential fraud and abuse cases in the FID and the relative frequency of these cases. Definitions of these common types of fraud and abuse and examples are provided in appendix 2 to this testimony. We were unable to assess the level of actual or potential program losses for the different types of potential fraud or abuse due to the limited financial data in the FID. However, HCFA officials told us that while more complex types of fraud or abuse, such as fraudulent cost reporting and kickback arrangements may be less frequent than other types, such cases often involve significantly greater losses. Given the broad nature of health care fraud and abuse, efforts to measure its potential extent should incorporate carefully selected detection techniques into the overall measurement methodology. With billions of dollars at stake, health care fraud and abuse detection has become an emerging field of study among academics, private insurers, and HCFA officials charged with managing health care programs. A variety of methods and techniques are being utilized or suggested to improve efforts to uncover suspected health care fraud and abuse. Such variety is needed because one technique alone may not uncover all types of improper payments. Although the vast majority of health care providers and suppliers are honest, unscrupulous persons and companies can be found in every health care profession and industry. Further, fraudulent schemes targeting health care patients and providers have occurred in every part of the country and involve a wide variety of medical services and products. Individual physicians, laboratories, hospitals, nursing homes, home health care agencies, and medical equipment suppliers have been found to perpetrate fraud and abuse. Fraud and abuse detection is not an exact science. No matter how sophisticated the techniques or the fraud and abuse audit protocols, not all fraud and abuse can be expected to be identified. However, using a variety of techniques holds more promise for estimating the extent of potentially fraudulent and abusive activity and also provides a deterrent to such illegal activity. Health care fraud experts and investigators have identified techniques that can be used to detect fraudulent and abusive activity. According to OIG officials, these techniques are performed by Medicare contractor fraud unitsto detect potential fraud and abuse. Table 1 summarizes the most promising techniques they identified along with some of their limitations. Consequently, health care experts and investigators also told us that effective detection of potential fraud and abuse necessarily involves the application of several of these techniques and considerable analysis, especially for the more sophisticated types of billing schemes and kickback arrangements. In addition, data on fraud referrals contained in the FID indicate that information necessary for identifying potential Medicare fraud and abuse comes from a variety of sources, as shown in figure 2. In particular, these data and the fraud experts we spoke with suggest that Medicare beneficiaries represent a valuable source for detecting certain types of potential fraud and abuse, especially services not rendered. HCFA officials told us that beneficiary complaints stem largely from the beneficiaries’ review of their explanation of Medicare benefit (EOMB) statements received after health services and supplies are provided. These findings suggest that potential fraud and abuse can only be comprehensively measured by effectively applying a variety of investigation techniques using a variety of sources. The inherent vulnerabilities of the Medicare fee-for-service program have fueled debate over how extensively the measurement of potential fraud and abuse should be pursued to provide information that policymakers and HCFA managers need to effectively target program integrity efforts. Implementing the current methodology to estimate improper payments is a major undertaking and represents an attempt to give HCFA a national estimate of payment accuracy in the Medicare program. The current methodology focuses on estimating Medicare payments that do not comply with payment policies as spelled out in Medicare laws and regulations, but does not specifically attempt to identify potential fraud and abuse. In addition to the current methodology, HCFA has three projects in various stages of development that could somewhat enhance the capability to uncover potential fraud and abuse and help HCFA better target program safeguard efforts over the next few years. The primary purpose of the current methodology is to provide an estimate of improper payments that HCFA can use for financial statement reporting purposes, and it has served as a performance measure. The OIG is responsible for overseeing the annual audit of HCFA’s financial statements, as required by the Chief Financial Officers Act of 1990 as expanded by the Government Management Reform Act of 1994. The current methodology has identified improper payments ranging from inadvertent mistakes to outright fraud and abuse. However, specifically identifying potentially fraudulent and abusive activity and quantifying the portion of the error rate attributable to such activity has been beyond the scope of the current methodology. The focus of the current methodology is on procedures that verify that the claim payments made by Medicare contractors were in accordance with Medicare laws and regulations. The primary procedures used are medical record reviews and third party verifications. Medical professionals working for Medicare contractors and PROs review medical records submitted by providers and assess whether the medical services paid for were allowable, medically necessary, accurately coded, and sufficiently documented. OIG staff perform various procedures including third party verifications to ensure that health care providers are in “good standing” with state licensing and regulatory authorities and are properly enrolled in the Medicare program. They also verify with the Social Security Administration (SSA) that the beneficiaries receiving the services were eligible for them. The OIG reported that the medical reviews conducted in the current methodology have been the most productive technique for identifying improper payments—detecting the overwhelming majority of the improper payments identified.According to OIG officials, medical reviews have led to some major prosecutions. In addition, some of the health care fraud experts we talked with stated that such medical reviews are most effective in detecting unintentional errors. However, they also told us that medical reviews are less effective in identifying potentially fraudulent and abusive activity because clever providers can easily falsify supporting information in the medical records to avoid detection. With respect to identifying potentially fraudulent or abusive activities, OIG officials indicated that medical reviews performed during the current methodology have resulted in referrals to its Investigations Office. However, they acknowledge that the current methodology generally assumes that all medical records received for review are valid and thus represent actual services provided. In addition, they agree that additional improper payments may have been detected had additional verification procedures been performed, such as (1) confirming with the beneficiary whether the services or supplies billed were received and needed and (2) confirming the nature of services or supplies provided through on-site visits and direct contact with current or former provider employees. Recognizing the potential for abuse based on past investigations—such as falsified certificates of medical necessity or where beneficiaries are not “homebound”, a requirement for receiving home health benefits—the OIG has included face-to-face contact with beneficiaries and providers when reviewing sampled claims associated with home health agency services. Further, during the course of our review, OIG officials stated that they will conduct beneficiary interviews when reviewing DME claims selected in its fiscal year 2000 study. However, according to OIG officials, they have not extended this or certain other techniques to the other numerous types of claims included in its annual review because they consider them costly and time-consuming. Accordingly, the OIG recognizes that the current methodology does not estimate the full extent of Medicare fee-for-service improper payments, especially those resulting from potentially fraudulent and abusive activity for which documentation, at least on the surface, appears to be valid and complete. In fact, the OIG testifiedthat its estimate of improper payments did not take into consideration numerous kinds of outright fraud such as phony records or kickback schemes. To identify potential fraud, the OIG also relies on tips received from informants and other investigative techniques. A secondary benefit that has been derived from the current methodology is that it has prompted HCFA into developing additional strategies, as we discuss later, for reducing the types of improper payments identified. However, HCFA is limited in developing specific corrective actions to prevent such payments because the current methodology only produces an overall national estimate of improper payments. Having the ability to pinpoint problem areas by geographic areas below a national level (referred to as subnational), Medicare contractors, provider types, and services would make improper payment measures a more useful management tool. HCFA has two projects that center on providing it with the capability of producing improper payment rates on a subnational and provider type basis—the Comprehensive Error Rate Testing (CERT) project and the surveillance portion of the Payment Error Prevention Program (PEPP). These projects are designed to improve the precision of future improper payment estimates and provide additional information to help develop corrective actions. However, since the methodologies associated with the CERT and PEPP projects incorporate techniques for identifying improper payments that are similar to those used in the current methodology, the extent to which these two projects will enhance HCFA’s potential fraud and abuse measurement efforts is limited. HCFA has a third project in the concept phase that will test the viability of using a variety of investigative techniques to develop a potential fraud rate for a specific geographic area or for a specific benefit type. This project, called the Model Fraud Rate Project (MFRP), provides HCFA the opportunity to pilot test more extensive detection techniques that, if effective, could be incorporated into the other measurement methodologies to improve the measurement and, ultimately, prevention of potential fraudulent and abusive activity. Table 2 compares the scope and potential fraud and abuse detection capabilities of the current methodology to the HCFA projects. The CERT project focuses on reviewing a random sample of all Part A and B claims processed by Medicare contractors each year except inpatient Prospective Payment System (PPS) hospital claims. It involves the review of a significantly larger random sample of claims and thus, according to HCFA officials, allowing HCFA to project subnational improper payment rates for each Medicare contractor and provider type. It is the largest of the projects and is undergoing a phased implementation with a scheduled completion date of October 2001. In addition to developing subnational error rates, HCFA officials stated that the CERT project will also be used to develop performance measures that will assist HCFA in monitoring contractor operations and provider compliance. For example, CERT is designed to produce a claim processing error rate for each contractor that will reflect the percentage of claims paid incorrectly and denied incorrectly, and a provider compliance rate that indicates the percentage of claims submitted correctly. The PEPP project is similar to the CERT project and is designed to develop payment error rates for the Part A inpatient PPS hospital claims not covered by CERT. PEPP is designed to produce subnational error rates for each state and for each PRO area of responsibility. Claim reviews under PEPP are designed to be continuous in nature with results reported quarterly. HCFA officials stated that the project is the furthest along in implementation, with the first quarterly reports expected in September 2000. The contractors and PROs implementing the project are expected to identify the nature and extent of payment errors for these inpatient claims and implement appropriate interventions aimed at reducing them. After their full implementation, HCFA intends to develop a national improper payment rate by combining the results of the CERT and PEPP projects. This rate will be compared to the rate produced by the current methodology to identify, and research reasons for, any significant variances among results. While the national estimate will continue to provide valuable information concerning the extent of improper payments, HCFA officials state that the availability of reliable estimates at the subnational levels contemplated by these efforts will greatly enhance the usefulness of these estimates as management tools. While enhancing the precision of improper payment estimates will offer a richer basis for analyzing causes and designing corrective actions, conceptually, the MFRP holds the most promise for improving the measurement of potential fraud and abuse. However, the Medicare contractor assisting HCFA in developing this project is dropping out of the Medicare program in September 2000 and has ceased work on the project. Efforts to date have focused on developing a potential fraud rate for a specific locality and specific benefit type; however, HCFA intends to eventually expand the scope of the project to provide a national potential fraud rate. As currently conceived, the project involves studying the pros and cons of using various investigative techniques, such as beneficiary contact, to estimate the occurrence of potential fraud. HCFA officials informed us that before the contractor ceased work on this project, it conducted a small pilot test using beneficiary contact as a potential fraud detection technique that identified some of the challenges HCFA will face in implementing this technique. The results of the test are discussed later. HCFA is seeking another contractor to take over implementation of the project. The contractor eventually selected will be expected to produce a report that identifies the specific potential fraud and abuse identification techniques used, the effectiveness of the techniques in identifying potential fraud and abuse, and recommendations for implementing the techniques nationally. The contractor will also be expected to develop a “how to manual” that Medicare contractors and other HCFA program safeguard contractors (PSC) can use to implement promising techniques. HCFA officials stated that promising techniques identified through MFRP could also be exported to the CERT and PEPP projects and the current methodology to enhance national and subnational estimates of potential fraud and abuse over time. Collectively, HCFA’s projects do not comprehensively attempt to measure potential fraud and abuse or evaluate the specific vulnerabilities in the claims processing process that may be allowing fraud and abuse to be perpetrated. Table 3 shows the limited use of selected identification elements among the current methodology and the HCFA projects. The MFRP project’s scope, for example, does not include studying the viability of making provider and supplier contact or using third party confirmations to detect potential fraud and abuse. Contacting beneficiaries and checking providers are valuable investigative techniques used to develop potential fraud and abuse cases. For example, California officials recently visited all MedicaidDurable Medical Equipment (DME) suppliers as part of a statewide Medicaid provider enrollment effort and found that 40 percent of the dollars paid to the suppliers was potentially fraudulent. The on-site visits not only helped to identify the fraudulent activity, but also to obtain sufficient evidence to support criminal prosecutions for fraud. Including an assessment of the likely causes of specific payment errors could help HCFA better develop effective strategies to mitigate them. The current methodology classifies errors by type, such as lack of documentation or medically unnecessary services, which is used to show the relative magnitude of the problems. Knowing the relative magnitude of a problem offers perspective on what issues need to be addressed. For example, based on its review of errors identified in the current methodology, HCFA recently issued a letter to physicians emphasizing the need to pay close attention when assigning Current Procedural Terminology (CPT) codesand billing Medicare for two closely related, yet differing, types of evaluation and management services. Further analysis of identified improper payments that provide additional insights into possible root causes for their occurrence is essential for developing effective corrective actions. For example, if errors are resulting from intentionally abusive activity, specific circumstances or reasons that permit the abuse to be perpetrated can be analyzed to develop and implement additional prepayment edits to detect and prevent their occurrence. In this regard, GAO has long advocated enhancing automated claims auditing systems to more effectively detect inappropriate payments due to inadvertent mistakes or deliberate abuse of Medicare billing systems.Also, developing or strengthening specific enforcement sanctions offer an additional tool to deter providers or suppliers from submitting inappropriate claims. Likewise, numerous individuals and entities are involved throughout the entire Medicare claims payment process, including providers, suppliers, employees (caregivers, clerical, and management), Medicare claims processing contractors, HCFA, beneficiaries (and their relatives), and others. Interestingly, in its review of Illinois Medicaid payments,the Illinois Department of Public Aid (IDPA) determined that over 45 percent of the errors it identified were inadvertent or caused by the IDPA itself during the process of approving services or adjudicating claims, and that 55 percent appeared to be caused by questionable billing practices. IDPA officials told us that having a clear understanding of the root causes for these errors has been instrumental in developing effective corrective actions. Similarly, attributing the causes of Medicare fee-for-service improper payments to those responsible for them could provide HCFA with useful information for developing specific corrective actions. Certain third party validation techniques are included and have been successfully implemented in the current methodology. For example, OIG staff confirm a provider’s eligibility to bill the Medicare program by contacting state licensing boards to ensure that the doctors billing Medicare have active licenses. They also verify that beneficiaries are eligible to receive medical services under the Medicare program with the SSA. However, as currently conceived, none of the HCFA projects include third party contact as a potential fraud detection technique. The experiences of recent efforts to apply more aggressive fraud detection techniques coupled with our discussions with patient and provider advocacy groups indicate that finding successful protocols for implementing some detection techniques may require careful study. Our review of three studies that have attempted to use beneficiary contact as a measurement device—the MFRP and two Medicaid studies in Texas and Illinois—indicate that, while useful, it is a challenging technique to implement. The initial contractor for the MFRP conducted a small pilot test using beneficiary contact to verify Medicare billed services and found that making contact was more difficult than anticipated. Telephone contact was the most cost-effective approach for contacting beneficiaries, but the contractor could only reach 46 percent of them due to difficulty in obtaining valid phone numbers and difficulty in actually talking to the beneficiary or his or her representative once a valid number was located. Using more costly and time-consuming approaches, such as mailing written surveys and conducting face-to-face interviews only increased the success rate to 64 percent. To maximize the effectiveness of these alternative approaches, the contractor noted that it was important to obtain valid addresses and ensure that the written survey instrument was concise, easy to understand, and complete for beneficiaries to take the time to respond. The state of Texas experienced similar difficulties contacting Medicaid recipients in a recent statewide fraud study.Telephone numbers for more than half of the 700 recipients that the state attempted to contact were not available or were incorrect. The state attempted to make face-to- face contact if telephone contact was not possible, and by the study’s end, over 85 percent of the recipients were contacted. The state concluded that contacting a recipient by telephone is the only cost-effective way to verify that services had been delivered. It also found that delays in making contact could impact the results since recipients’ ability to accurately recall events appeared to diminish over time. For the Illinois Medicaid study, the IDPA found other problems in using beneficiary contact as a detection technique in the payment accuracy study of its program.Department investigators met with almost 600 recipients or their representatives to verify that selected medical services had been received. The investigators found that while recipient interviews were an overall useful step in the study’s methodology, they did not always produce the desired results. For example, investigators found cases where caretaker relatives could not verify the receipt of services. They also found other cases where recipients were unaware of the services received, such as lab tests, or could not reliably verify the receipt of services because they were mentally challenged. Illinois officials involved with implementing the Medicaid study told us that direct provider contact is also challenging. For example, an important consideration is whether or not to make unannounced visits. According to the Illinois officials, unannounced visits can be disruptive to medical practices and inappropriately harm the reputations of honest providers by giving patients and staff the impression that suspicious activities are taking place. Announced visits, on the other hand, can give the provider time to falsify medical records, especially if they know which medical records are going to be reviewed. The Illinois officials resolved this dilemma by announcing visits two days in advance and requesting records for 50 recipients so it would be difficult for the provider to falsify all the records on such short notice. Data on fraud referrals included in HCFA’s FID indicates that health care providers and beneficiaries represent important sources for identifying improper payments, particularly for certain types of potential fraud and abuse. Moreover, the application of more extensive fraud detection techniques into efforts to measure improper payments will require their cooperation. Our discussions with patient and health care provider advocacy groups indicated they may oppose the application of more extensive detection techniques due to concerns with violating doctor- patient confidentiality, protecting the privacy of sensitive medical information, and added administrative burdens. For example, officials from the Administration on Aging, an HHS operating division, told us that they discourage elders from responding to telephone requests for medical and other sensitive information. Similarly, the American Medical Association and American Hospital Association emphasize the adverse impact that meeting what they consider to be complex regulations and responding to regulatory inquiries has on health care providers’ ability to focus on meeting patient needs. They also voiced concerns with the added cost that would have to be absorbed by providers to comply with even more requests for medical information in an era of declining Medicare reimbursements. Further, some of the health care experts we talked with cautioned that there are practical limits to the amount of potentially fraudulent and abusive activity that can be measured. These experts emphasize that no set of techniques, no matter how extensive, can be expected to identify and measure all potential fraud and abuse. In addition to beneficiary and provider contact, the health and fraud experts we spoke with told us that validating the information that Medicare contractors are relying on to pay claims, including provider and supplier assertions concerning the appropriateness of those claims, with third parties could also help to identify potential fraudulent or abusive activity. The current methodology incorporates such procedures to confirm providers’ current standing with state licensing authorities and beneficiaries’ eligibility status with SSA. Other sources—such as beneficiary employers, beneficiary relatives or personal caregivers, State Medicaid agencies, and employees of providers and suppliers—could also offer useful information for assessing the appropriateness of claims. However, determining the appropriate nature and extent of third party verification procedures to incorporate into efforts to measure improper payments should be considered carefully. Excluding third party verification efforts, and therefore placing greater reliance on the accuracy of data developed internally or provided independently, should be based on risks determined through analysis of reliable indicators. The Comptroller General’s StandardsforInternalControlintheFederal Governmentstresses the importance of performing comprehensive risk assessments and implementing control activities, including efforts to monitor the effectiveness of corrective actions to help managers consistently achieve their goals. While the annual cost of the current methodology and the HCFA projects involve several million dollars, these efforts represent a needed investment toward avoiding significant future losses through better understanding the nature and extent of improper payments—including potential fraud and abuse. As shown in table 2, the current methodology costs $4.7 million, not counting the cost of medical review staff time at contractors. PEPP is estimated to cost $7.5 million annually, and CERT costs are expected to be over $4 million annually once fully implemented. While these may seem to be expensive efforts, when considered in relation to the size and vulnerability of the Medicare program and the known improper payments that are occurring, they represent prudent, needed outlays to help ensure program integrity. In our recent report on improper payments across the federal government,we discussed the importance of ascertaining the full extent of improper payments and understanding their causes to establish more effective preventive measures and to help curb improper use of federal resources. However, as we recently testified,HCFA’s ability to protect against fraud and abuse depends on adequate administrative funding. Therefore, in developing effective strategies for measuring improper payments, consideration of the most effective techniques to apply in the most efficient manner is essential to maximize the value of administrative resources. While HCFA faces significant challenges for ensuring the integrity of the Medicare fee-for-service program, importantly, HCFA can use the results of these efforts to more effectively assess corrective actions, target high-risk areas, and better meet its role as steward of Medicare dollars. HCFA plans to expand its efforts to measure Medicare improper payments by assessing the usefulness of performing additional fraud detection techniques with the MFRP. Meanwhile, since the current methodology and the CERT and PEPP projects do not incorporate the use of some techniques considered effective in identifying potential fraud and abuse, HCFA’s ability to fully measure the success of its efforts to reduce fraud and abuse remains limited. Health care fraud experts told us that the ability of these projects to measure potential fraud and abuse are somewhat dependent on the nature, extent, and level of fraud sophistication that may be involved. For example, the introduction of beneficiary contact, in conjunction with other techniques, should improve the ability to determine whether services were actually rendered. However, if the beneficiary is a willing participant in the potential fraud and abuse scheme, these additional techniques may not lead to an accurate determination. The size and administrative complexity of the Medicare fee-for-service program make it vulnerable to inadvertent error and exploitation by unscrupulous providers and suppliers. Given the billions of dollars that are at risk, it is imperative that HCFA continue its efforts to develop timely and comprehensive payment error rate estimates that can be used to develop effective program integrity strategies for reducing errors and combating fraud and abuse. The current methodology represented a significant first step in obtaining such information, but the lack of key fraud and abuse detection techniques limit its effective use as a management tool to estimate potential fraud and abuse and ultimately achieve important program integrity goals. HCFA’s projects could collectively address some of the limitations of the current methodology if properly executed, but do not appear to go far enough. Expanding the scope of the Model Fraud Rate Project to include studying provider visits and a more extensive assessment of the cause of improper payments and other promising techniques could help HCFA pinpoint additional high-risk areas and develop more effective corrective actions. The implementation of more extensive detection techniques is bound to be challenging and expensive, so using rigorous study methods and consulting with the people affected, such as beneficiary and provider advocacy groups, are essential steps to ensure success, as well as considering the tangible and intangible benefits of using particular techniques. Given the delays and potential challenges associated with implementing the Model Fraud Rate Project, substantial improvements in the measurement of improper payments, especially those stemming from potential fraudulent and abusive activity, will probably not be realized for a few years. To improve the usefulness of measuring Medicare fee-for-service improper payments, including those attributable to potential fraud and abuse, we recommend that the HCFA Administrator take the following actions: Experiment with incorporating additional techniques for detecting potential fraud and abuse into methodologies used to identify and measure improper payments and then evaluate their effectiveness. In determining the nature and extent of additional specific procedures to perform, the overall measurement approach should (1) recognize the types of fraud and abuse perpetrated against the Medicare program, (2) consider the relative risks of potential fraud or abuse that stem from the various types of claims, (3) identify the advantages and limitations of common fraud detection techniques and use an effective combination of these techniques to detect improper payments, and (4) consider, in consultation with advocacy groups, concerns of those potentially affected by their use, including beneficiaries and health care providers. Include in the methodologies’ design, sufficient scope and evaluation to more effectively identify underlying causes of improper payments, including potential fraud and abuse, to develop appropriate corrective actions. Mr. Chairman this concludes my statement. I would be happy to answer any questions you or other Members of the Task Force may have. For information about this statement, please contact Gloria Jarmon at (202) 512-4476 or at jarmong.aimd@gao.gov.Individuals making key contributions to this statement included Shawn Ahmed, Aditi Archer, Kay Daly, Bill Hamel, Don Hunts, Jim Kernen, and Meg Mills. Our objective was to identify additional improvements to the Medicare improper payments measurement projects that were recently designed by HCFA to further estimate improper payments including potential fraud and abuse. Through interviews with HCFA Program Integrity Group officials and reviews of HCFA documentation including program integrity plans, project descriptions, statements of work, and requests for proposals, we identified HCFA projects that could improve the measurement of Medicare fee-for- service improper payments. Through interviews with health care fraud and investigation experts, we gained an understanding of the vulnerabilities in the Medicare fee-for- service program that create opportunities for improper payments, especially those stemming from fraudulent and abusive activity, and the most promising detection techniques to identify these payments. Specifically, we talked with officials from the Department of Health and Human Service’s Office of the Inspector General (OIG) and Office of Investigations (OI), Department of Justice (DOJ), Federal Bureau of Investigation (FBI), HCFA’s program integrity group, HCFA’s Atlanta Regional Office unit specializing in fraud detection efforts, a Medicare claims processing contractor, Association of Certified Fraud Examiners, three private health insurance organizations, National Health Care Anti- Fraud Association (NHCAA), Health Insurance Association of America (HIAA), three states in connection with their Medicaid program, and two academicians with notable fraud investigation experience. We also reviewed various documents including HCFA and OIG Fraud Alerts, prior GAO, OIG, and other studies on health care fraud and abuse, particularly those related to the Medicare fee-for-service program. We analyzed HCFA’s Fraud Investigation Database (FID) to identify the most common types of potential fraud referred to the OI and DOJ for further investigation and possible criminal and civil sanctions. We also analyzed the FID to determine the most frequent sources for identifying potential fraud. The FID was created in 1995, but has data on fraud referral going back to 1993. We did not attempt to validate the database. To assess the potential effectiveness of the techniques planned for the HCFA projects for identifying improper payments attributable to potential fraud and abuse, we (1) performed a comparative analysis of common types and sources of referrals of fraud and abuse occurring in the Medicare program, the types of techniques identified by investigative experts as most effective for identifying them, and the extent to which identified techniques are incorporated in the respective methodologies and (2) discussed the results of our analysis with officials in HCFA’s Program Integrity Group and OIG. To gain an understanding of how the implementation of additional procedures to identify and measure improper payments attributable to potential fraud and abuse could affect providers, suppliers, and recipients of health care services and supplies, we interviewed officials from patient and health care provider advocacy groups, including the American Medical Association, American Hospital Association, HHS Administration on Aging (AOA), American Association of Retired Persons (AARP), and the Health Care Compliance Association (HCCA). We performed our work from November 1999 through June 2000 in accordance with generally accepted government auditing standards. As the category indicates, cases involving billing for services not rendered occur when health care providers bill Medicare for services they never provided. Potential fraud and abuse is usually detected by statements received from the provider’s patients or their custodians and the lack of supporting documents in the medical records. For example, a provider routinely submitted claims to Medicare and CHAMPUSfor cancer care operations for services not rendered or not ordered; upcoded procedures, as defined below, to gain improper high reimbursement; and double billed Medicare for certain procedures. As a result of the fraudulent submissions, the provider allegedly obtained millions of dollars to which they were not entitled. Cases involving medically unnecessary services, supplies, or overutilization occur when providers or suppliers bill Medicare for items and services that are not reasonable and necessary for the diagnosis and treatment of illness or injury or to improve the functioning of a body part. They include incidents or practices of provider, physicians, or suppliers of services that are inconsistent with accepted sound medical practices, directly or indirectly resulting in unnecessary costs to Medicare, improper payments, or payments for services that fail to meet professionally recognized standards of care or are medically unnecessary. For example, a provider ordered magnetic resonance imaging tests (MRIs) and neurological tests which investigators questioned whether the tests were medically necessary, and whether the neurological tests were actually performed. Most of the tests were performed on patients who responded to the provider’s advertisements in the yellow pages. After a 5 to 10 minute consultation, the provider would diagnose almost every patient with the same disorder – radiculopathy, a disease involving compression of, or injury to the roots of spinal nerves. Medicare publishes coverage rules on what goods and services the program will pay for and under what circumstances it will pay or not pay for certain goods and services. Providers sometimes bill Medicare, showing a billing code for a covered item or service when, in fact, a noncovered item or service was provided. Further, providers sometimes intentionally falsify statements or other required documentation when asked to support payments for claimed services or supplies. In particular, investigators have determined that falsification of CMNs—documents evidencing appropriately authorized health care professionals’ assertions regarding the beneficiaries’ needs for certain types of care or supplies, such as home health and hospice services or certain durable medical equipment—occur, providing unscrupulous providers and suppliers additional opportunities to abuse Medicare. For example, a provider billed for an orthotic knee brace, when in fact the provider was providing Medicare beneficiaries with nonelastic compression garments and leggings. Although knee orthotics are reimbursed by Medicare and Medi-Calfor a total of over $650 per brace, the nonelastic compression garment is not reimbursed by Medicare. The total billings totaled approximately $332,055. One type of incorrect coding is called “upcoding.” Upcoding cases result from health care providers changing codes on claim forms submitted to Medicare, causing reimbursements to be paid at higher rates than are warranted by the service actually provided. Upcoding can also result from providers billing for services actually provided by nonphysicians, which would be paid at a lower reimbursement rate. For example, a provider allegedly submitted false claims for services provided by physicians in training and inflated (upcoded) claims in connection with patient admissions services. The provider paid the U.S. Government $825,000 primarily to settle allegations resulting from an audit performed by the HHS OIG. The audit was triggered by a lawsuit filed by private citizens as authorized by the False Claims Act (31 U.S.C. sections 3729 –3733). Falsifying any portion of the annual report submitted by all institutional providers participating in the Medicare program. The report is submitted on prescribed forms, depending on the type of provider (e.g., hospital, skilled nursing facility, etc.). The cost information and statistical data reported must be current, accurate and in sufficient detail to support an accurate determination of payments made for the services rendered. For example, a provider billed Medicare for hundreds of thousands of dollars for personal expenses disguised as legitimate healthcare expenses. The personal expenses billed included an addition to a private home, vacations, and beauty pageant gowns. The provider was fined over $500,000 for the fraudulent billings. Section 1128B of the Social Security Act, 42 U.S.C. § 1320a-7b(b), makes it a felony to solicit, receive, offer, or pay a kickback, bribe, or rebate in connection with the provision of goods, facilities, or services under a federal health care program, including Medicare. For example, a provider agreed to plead guilty to conspiracy, mail fraud, and violating the anti-kickback provision and to pay $10.8 million in criminal fines in connection with its scheme to defraud Medicare. The pleas relate to kickbacks and false Medicare billings made in connection with the provider’s receipt of fees from another company for the provider’s management of certain home health agencies. (916363)

Summary: Pursuant to a congressional request, GAO discussed the Health Care Financing Administration's (HCFA) efforts to improve the measurement of improper payments in the Medicare fee-for-service program. GAO noted that: (1) because it was not intended to include procedures designed specifically to identify all types of potential fraudulent and abusive activity, the current methodology does not provide an estimate of the full extent of improper Medicare fee-for-service payments; (2) HCFA has initiated three projects designed to further its measurement efforts which offer some promise for determining the extent of improper payments attributable to potential fraud and abuse; (3) based on careful evaluation of their effectiveness, performing additional potential fraud identification techniques as part of its efforts to measure improper payments could assist HCFA in arriving at a more comprehensive measurement and, ultimately, develop cost-effective internal controls to combat improper payments; and (4) however, no set of techniques, no matter how extensive, can be expected to measure all potential fraud and abuse.