SSA administers two main programs under the Social Security Act that provide benefits to individuals with disabilities—Disability Insurance (DI) and Supplemental Security Income (SSI). Individuals are generally considered disabled if they are unable to do their previous work, and considering age, education and work experience, engage in any other kind of substantial gainful work and their disability has lasted or is See expected to last at least 1 year or is expected to result in death.table 1 for additional key features and requirements of the DI and SSI programs. SSA’s process for determining medical eligibility for disability benefits is complex and can involve several state and federal offices. The determination process—which is the same for both DI and SSI claimants—involves an initial determination at a DDS office. SSA funds the 54 DDSs, which are operated by state agencies, to process disability claims in accordance with SSA policies and procedures. If a claim is denied, claimants have several opportunities for appeal within SSA, starting with a reconsideration at the state level; then a hearing before an administrative law judge (ALJ); and finally at the Appeals Council, which is SSA’s final administrative appeals level. Claimants can generally submit new medical evidence throughout the disability determination process. Claimants must file any further action in federal court. Claims at all levels for which the claimant is determined to be eligible for DI or SSI, also called favorable claims, are forwarded to other SSA offices for payment. (See fig. 1.) Generally, DDSs are required to develop a complete medical history for each claimant for at least a 12-month period prior to the application. SSA guidance directs DDSs to request medical evidence records from all providers who treated or evaluated the individual for the alleged or documented impairment during this time period. For example, a DDS may request laboratory reports; X-rays; doctor’s notes; and other information used in assessing the claimant’s health and functioning from many types of providers, including physicians or psychologists, hospitals, or community health centers. According to SSA, DDSs generally pay providers for these records in accordance with required state fee schedules. In claims where the evidence gathered is insufficient to make a determination or where no evidence is present, the DDS may order its own tests or evaluations—called consultative examinations—from medical providers. SSA regulations specify the types of providers who can perform consultative exams and require DDSs to recruit, train, and oversee these providers in their states. State DDSs pay providers to conduct exams and set the rates of payments for these exams. SSA’s regulations prohibit DDSs from purchasing consultative exams from medical providers who are excluded, suspended, or otherwise barred from participation in the Medicare or Medicaid programs, or any other federal or federally-assisted program, which includes providers on the List of Excluded Individuals and Entities maintained by the Department of Health and Human Services (HHS) Office of Inspector General (OIG). SSA regulations also prohibit the agency from purchasing exams from certain providers whose license to practice has been revoked by any state licensing authority. HHS is legally required to exclude from participating in federal health care programs individuals and entities convicted of certain criminal offenses, such as defrauding Medicare, Medicaid, or other federal or state health programs; patient abuse or neglect; and felony convictions related to controlled substances. This function is performed by the HHS OIG. The OIG also has discretion to exclude individuals and entities based on a number of other grounds— SSA instructs DDSs both related and unrelated to programmatic fraud.to review the HHS list and verify medical licenses and credentials before using the services of any consultative exam provider. DDSs are also required to review the list for each existing exam provider at least annually. DDSs are not required to check the status of the claimant’s treating physician or other medical providers that submit evidence since they are obtaining existing medical records and not paying for medical services. SSA has guidance on how examiners should document and report suspected fraud. According to SSA’s policy, fraud generally occurs when an individual makes or causes to be made false statements of material facts or conceals such facts for use in determining rights to benefits, with the intent to defraud. SSA employees should gather enough information to either remove suspicion or determine that there is potential fraud. They are also expected to develop the referral with as much information as possible, including who allegedly committed fraud, how, when, and why. If they determine that potential fraud exists, they should refer it to the SSA OIG. For states with a CDI unit, cases can be referred directly to the CDI. SSA and the OIG jointly established the CDI Program, in conjunction with DDSs and state or local law enforcement agencies, to effectively pool resources and expertise and prevent fraud in SSA’s disability programs. The Units investigate disability claims under DI and SSI programs that state disability examiners believe are suspicious. Referral processes can vary by DDS. For example, some DDSs may require management approval before referring a case to the SSA OIG. Once a case is referred to the SSA OIG, that office determines whether it will investigate the case.with other federal, state, and local agencies. See figure 2 for an overview of SSA’s fraud referral process. SSA relies heavily on front-line staff in DDS offices—those who are responsible for reviewing medical evidence—to detect and prevent The employees in the five DDS potential physician-assisted fraud.offices we visited, however, said that they are not well-positioned to identify signs of potential fraud, such as similar medical evidence across multiple claims. Further, the performance measures used by the agency and the DDSs may serve as a disincentive for front-line staff to spend additional time documenting and reporting fraud allegations, and limited training also reduces front-line staff’s ability to identify such fraud. Although SSA relies on front-line staff as their first line of defense to detect potential fraud, it can be difficult for them to identify potential fraud in claims. Instead of systematically using data systems or analytics to detect patterns of potential fraud, SSA’s guidance instructs front-line staff to identify suspicious patterns of medical evidence—such as boilerplate or similar language from the same physician across multiple claims—as well as other factors that may indicate potential fraud. However, SSA regional officials, DDS management, and front-line staff said that it is difficult to detect these patterns because staff may review claims originating anywhere in the state or across a large geographic area, leaving it in part to chance that staff would see evidence from a single physician on more than one claim. As a result, DDS staff stated that they must rely on coincidence—such as the receipt of consecutive claims with evidence from the same physician—to be able to identify a suspicious pattern. Additionally, single applications are generally seen by multiple staff in the course of development and determinations. DDS and SSA regional officials stated that, irrespective of how claims are distributed amongst staff, the volume of claims and associated medical evidence they review makes it difficult to detect patterns of potential fraud. Front- line staff are expected to review multiple claims every day, each of which may be supported by medical evidence from multiple physicians. One DDS director stated that the sheer number of physicians who submit medical evidence make it challenging to identify suspicious patterns from any one physician. SSA and DDS performance measures incentivize processing claims quickly and may pose a barrier to front-line staff’s willingness to develop referrals and report potential fraud. SSA assesses DDS performance, in part, based on the length of time it takes to process claims. In turn, all five DDSs we visited assess front-line staff on the speed by which they process claims. According to SSA, disability applicants file at vulnerable times in their lives and the agency and DDS offices focus on making timely and fully considered objective decisions on applications and develop performance measures in support of this objective. Our previous work has found that there are positive aspects of aligning individual performance expectations with organizational goals.noted the importance of balancing quality and timeliness goals, with the We have also potential for unintended perverse incentives.suspected, SSA policy states that staff should develop evidence to support their suspicions and prepare referral forms that explain the basis for their concern. During our site visits, some front-line staff stated that they do not report suspicious physicians or potential fraud because developing the evidence to report the allegation adversely affects their ability to process claims promptly. Only one DDS we visited lessened the potential disincentives to reporting suspected fraud by not counting the time spent developing allegations of fraud against the employees’ claims processing time. This DDS also provided recognition to staff when their fraud allegation resulted in conviction or a denial of benefits. Front-line staff we met with at this DDS stated that this recognition incentivized them to be more vigilant about identifying and reporting suspicious claims. SSA’s focus on timeliness may also create a disincentive for front-line staff to report sources of questionable information in claims that they have denied. SSA guidance directs DDS staff to report all suspicious claims, even if the claim is denied. However, staff in three of the five DDSs we visited said they may not always report potentially fraudulent information to the OIG if there is already sufficient evidence to make a denial because of the additional time required to process the fraud referral. One DDS director stated that denied claims are typically not reported to the OIG because an investigation would be redundant and wasteful considering that it would produce the same result—a denied claim. Nevertheless, there is merit in reporting these denied claims with suspicious evidence because they could either be appealed or the claimant could reapply at a later date and there may not be any indication to the subsequent reviewer that suspicious evidence exists. Moreover, without these referrals of suspicious claims, SSA is missing key information that could help them identify patterns of potential physician-assisted fraud. DDS staff in some of the offices we visited also told us that they were reluctant to report potential fraud because of a perceived lack of communication from the OIG regarding the status or outcome of their fraud referrals. According to the OIG, the office communicates the status of investigations to DDS management approximately 1 month after the fraud referral is received. However, staff in four of the five DDSs we visited stated that the communication they receive from the OIG is inadequate. For example, some staff reported that when cases were denied for investigation, the OIG did not sufficiently explain the reason for the denial. In some instances, staff never received a response about the status of their referral. Some front-line staff we spoke to said that they would report more cases of potential fraud if they received better feedback on the outcome of their referrals. Staff from four of the five DDSs we visited stated that the anti-fraud training they received was infrequent, insufficient, and that additional training was needed. As part of their new employee training, front-line staff receive a short segment of anti-fraud instruction. This training defines fraud and provides an overview of SSA’s anti-fraud policies and procedures. However, subsequent anti-fraud training is not mandatory and varies by state. Federal internal control standards state that management needs to identify appropriate knowledge and skills needed for various jobs, such as identifying and preventing potential fraud, and provide appropriate training. SSA does not require DDS employees to receive training on fraud identification or reporting beyond their initial training courses and SSA officials stated that DDSs are primarily responsible for determining the training needs of their staff. We found that additional anti-fraud training at the five DDSs we visited often occurred infrequently or not at all. Without additional training, front-line staff may not have the skills and knowledge to identify and report potential fraud. For example, front-line staff at one DDS had not received any anti-fraud training since their initial basic training and stated that they did not know how to identify or report potential fraud. At another DDS, some staff indicated they had not received training in several years. Data we reviewed suggests that DDSs in states with CDI units are likely to receive more training on how to identify and report potential fraud, contributing to more referrals from these DDSs. According to OIG data, 28 of the 32 states and territories without a CDI unit did not refer any suspicious claims to the OIG in 2013 compared to an average of 216 referrals from DDSs in states with a CDI unit, including the Commonwealth of Puerto Rico (see fig. 3 for CDI unit and fraud referral information). Front-line staff in the two states we visited with CDI units— California and Illinois—also noted the benefits of additional anti-fraud training, including a better understanding of the fraud referral process. Further, Illinois officials said that the number of suspicious claims referred by staff increased after receiving training from the CDI unit. Nonetheless, DDS staff in both states said that training was not provided regularly and that they would like to receive additional training that includes examples of fraud investigations—such as cases in which medical providers and others may have colluded to help claimants obtain benefits—and strategies to prevent similar events from occurring in the future. OIG officials stated that they are reluctant to provide additional training to states without established CDI units because they do not have the resources to investigate the expected increase in fraud referrals from those states. Potential vulnerabilities exist in how DDSs screen and use medical evidence from sanctioned physicians. SSA regulations prohibit DDSs from purchasing consultative exams from medical providers who are currently barred from participation in federal or federally-assisted programs. To comply with these regulations, SSA instructs DDSs to screen medical providers who conduct consultative exams against a list of sanctioned providers maintained by the Department of Health and Human Services Office of Inspector General. Regarding medical records, federal law generally requires SSA to review all available evidence and make every reasonable effort to obtain medical evidence from the claimant’s treating physician and other treating health care providers. However, under the Social Security Act, the agency is required to disregard any evidence reviewed when there is reason to believe that fraud or “similar fault” is involved with the determination. The agency is also required to exclude from participation in SSA programs, representatives and health care providers convicted of violations of specific criminal offenses related to SSA programs. Such offenses include making false statements related to DI or SSI applications. SSA regulations set forth factors for how medical evidence should be considered and weighted by DDS staff when making a DDSs that we visited do not, however, screen disability determination.physicians who submit medical evidence on behalf of a claimant against the sanctioned list and therefore front-line staff do not know whether the medical evidence they are basing their disability determination on came from a sanctioned physician. While being on the sanctioned list does not mean that a physician submitted fraudulent evidence to SSA, it could be an indicator that the claim includes questionable evidence. After matching vendor files from California and Illinois against the sanctioned list, we found that neither state purchased consultative exams from sanctioned physicians since 2010. In the same time period, however, at least 37 sanctioned physicians in these states provided medical evidence to the agency on behalf of claimants and 22 of these physicians provided such evidence after they had been sanctioned, potentially affecting the validity of those claims (see table 2). Our results demonstrate that, in some instances, SSA is accepting medical evidence from potentially questionable and unreliable physicians. We identified sanctioned physicians who were convicted of health care fraud or other program-related crimes who submitted medical evidence on behalf of claimants. For example, one physician, who was placed on the sanctioned list in 2011 for smuggling over $1 million in foreign misbranded and unapproved drugs into the United States and administering them to his patients, submitted evidence for at least 33 disability claimants in the past 2 years. Such information could be useful to front-line workers in that they would be able to better determine whether more scrutiny of the medical evidence may be warranted, potentially resulting in a reduced risk of fraud. Further, front-line staff said it would be helpful to have a list of suspicious physicians available when reviewing claims. One DDS created such a list that includes physicians who DDS staff identified as providing suspect evidence—such as a pattern of exaggerated medical findings—in the past. However, frontline staff who we spoke with said they were unaware of this list. SSA faces barriers to identifying and addressing the potential risks associated with medical evidence submitted by sanctioned physicians. According to SSA officials, the agency has explored whether it would be beneficial to consider physicians’ licensing status when making a disability determination. The agency identified several logistical barriers to checking licensure status for all physicians who submit medical evidence, and also cited complex policy implications that they believe could result in increased appeals and potentially disadvantage claimants, among other challenges. For example, SSA would have to determine when and what evidence from a physician to exclude and the type of sanctions to consider, among other things. The SSA OIG also reported in 2013 on hurdles regarding screening evidence against the sanctioned list.According to SSA’s OIG, SSA and the DDSs request more than 15 million health records from over 500,000 physicians every year. Further, the SSA OIG also reported that because the sanctioned list generally contains the names of individual physicians, a sanctioned physician who provides medical evidence on behalf of a claimant may not be detected by the DDS if they work for a hospital or clinic. We found similar limitations with the data that DDSs currently collect. For instance, SSA does not require DDSs to routinely and uniformly record the names and addresses of physicians who submit medical evidence on behalf of claimants. As a result, DDSs collect inconsistent and incomplete data on medical providers, which limits SSA’s ability to identify sanctioned physicians. For example, hospitals or similar institutions that employ hundreds of individuals may have only one source recorded in DDS vendor files. Despite these barriers, as SSA moves forward on key information technology initiatives, the agency has an opportunity to assess several risk factors, including whether sanctioned physicians are providing medical evidence, and the likelihood that such evidence could be fraudulent. Federal internal control standards state that agencies should identify and analyze the relevant risks from external sources, such as potentially questionable evidence from sanctioned physicians. the process of transferring state vendor information from 54 distinct DDS data systems into a National Vendor File that will include information on all medical providers whom the agency pays for medical evidence. Such a consolidation may present an opportunity for the agency to better assess the threat of sanctioned physicians submitting medical evidence on behalf of claimants and reduce the administrative cost of identifying such physicians on a DDS by DDS basis. Having national-level data could help SSA better determine risk factors for potential fraud as well as what medical evidence should be subject to additional scrutiny. Additionally, consolidating vendor data gives the agency an opportunity to gain a better understanding of the inconsistencies in the information collected at the DDS level and determine whether it should implement more uniform data collection and policy requirements. GAO/AIMD-00-21.3.1. Recognizing that it must do more to systematically detect potential fraud, SSA is in the early stages of exploring the use of computerized tools to enhance its efforts. Known as predictive analytics, these are automated systems and tools that can help identify patterns of potentially fraudulent claims—such as patterns of suspicious behavior involving physicians and claimants—before claims are paid. A system such as this would give SSA the ability to systematically check large numbers of claims for potential fraud in addition to using front-line staff to spot suspicious patterns in claims. Staff from SSA’s Office of Information Security began this analytics effort in February 2014 and piloted these capabilities in two stages. In the first stage, SSA developed its initial computer model and identified existing sources of data within the agency. SSA tested and refined its model by using recent cases of alleged fraud in Puerto Rico, New York, and West Virginia to determine whether it would have detected characteristics of potential fraud in those cases. SSA reported that it completed this stage in May 2014 and that its efforts were successful. In the second stage, SSA will explore purchasing a tool from a vendor and using analytics to spot suspicious claims in other locations. SSA will also explore purchasing data—such as arrest records—from an external vendor to integrate into its system that could help SSA to identify links between disability claims, physicians, and attorney representatives through social network analysis that may not be apparent from existing SSA data. For example, SSA staff said these data could identify individuals who are seemingly unconnected but who shared an address in the past. External data also proved to be helpful in the recent case of suspected fraud in New York, where investigators made use of local government data to determine that beneficiaries made false statements when applying for benefits. SSA told us that while it completed its second phase of testing, which consisted of a preliminary risk-scoring model for disability claims, significant work remains to be done before it has a working analytics system in place. See figure 4 for an illustration of how a predictive model would differ from SSA’s current approach. SSA’s analytics efforts have potential, but we have concerns regarding the agency’s ability and capacity to implement such a system on a large scale going forward. For example, SSA does not consistently collect some data that may aid in its analytics effort. As part of its analytics efforts, SSA plans to look for relationships between physicians who provide medical evidence and potentially fraudulent claims. However, as we noted earlier, SSA and DDS officials told us that existing data systems often do not identify individual physicians. Instead, the systems may capture the hospital or clinic that provided medical records, or in some cases, a third-party company that manages medical records or payments on behalf of physicians. An SSA official working on analysis efforts noted that SSA currently lacks the ability to distinguish between individual physicians and clinics or hospitals. Without the ability to consistently identify individual physicians, SSA’s ability to detect potential physician- assisted fraud may be hampered. SSA must also contend with obtaining physician data from a number of case management systems. For example, the agency is in the process of transitioning DDSs from five different legacy case management systems to a unified Disability Case Processing System that will be used by all DDSs. SSA officials stated that the National Vendor File that will be linked to this system has the ability to capture individual physician license numbers. This vendor file currently only collects the same information as the DDS’s existing legacy systems, which may or may not include this information because SSA does not require DDSs to collect unique identifiers for physicians. Further, while SSA is also pursuing external data sources to perform social network analysis, its ability to fully make use of this information could be limited by its inability to readily identify the physicians involved in disability claims. Alleged Puerto Rico Disability Fraud Scheme In August 2013, 75 individuals in Puerto Rico were indicted for disability fraud. This included a claimant representative (and former Social Security employee), three physicians, and 71 claimants. The representative allegedly conspired with three doctors to fabricate and submit false medical evidence to support unwarranted disability claims for his clients. According to the Department of Justice (DOJ), these physicians received kickbacks of between $150 and $500 to submit false medical evidence to SSA, and the representative received a lump-sum payment. Although the investigation continues, 34 of the 75 individuals charged have pled guilty as of March 2014. Moreover, SSA has yet to detail how it will first operationalize any analytics efforts into its ongoing business practices and then investigate potential leads generated. Officials we spoke with at the Centers for Medicare & Medicaid Services (CMS)—who implemented their own fraud analytics program in 2011—and several private disability insurers told us that analytics are helpful for determining which claims are at risk for potential fraud and where to focus investigative resources. However, they noted that organizations cannot rely on analytics alone to determine whether fraud is occurring and that considerable staff resources are often needed to develop leads that result from the initial analysis. For instance, officials at one private disability insurer said that analysts may spend half a day examining a claim before deciding whether additional investigation is warranted. This sentiment was shared by participants at a 2013 GAO forum on data analytics who noted that having knowledgeable staff was critical for interpreting the results of analytics and identifying investigative leads.challenges facing SSA, including declining staff levels at DDSs and However, we and the SSA OIG have previously reported on difficulty in meeting SSA performance goals. We also recommended that SSA develop a long-term plan to address service delivery challenges, including those related to human capital and information technology initiatives. The agency has noted the benefit of using data analytics to prevent fraud and has mentioned data analytics in its Strategic Plan, 2015 budget request, and Information Resource Management Strategic Plan. However, these agency documents do not provide concrete steps or identify the needed resources to make this undertaking successful. Additionally, staff working on the analytics pilot told us that SSA has yet to determine which component of SSA will ultimately have responsibility for following up on leads. One analytics firm cautioned that analytics cannot just be a software tool, but must fit into a larger cultural change regarding fraud and how business is conducted. It added that an organization that jumps into analytics without a clear plan and goals risks failure. Alleged West Virginia Disability Fraud Scheme SSA is investigating claims stemming from West Virginia. According to a staff report from the Senate Committee on Homeland Security and Government Affairs, an attorney conspired with an SSA administrative law judge (ALJ) to allow disability benefits for undeserving claimants. As part of this alleged scheme, the ALJ’s office would schedule exams with doctors favored by the attorney. The attorney is said to have provided pre-filled medical forms to these doctors, which often contained similar language. The ALJ was placed on administrative leave and later retired, and the attorney continues to practice disability law. Additionally, without more details on its plans, it is unclear whether SSA can adhere to key practices that organizations must use to successfully implement fraud analytics. We identified these practices in past work and by interviewing other organizations that have implemented analytics (see table 3). In its early efforts, SSA has so far followed some key practices. For example, SSA has publicized its efforts, including announcing its plans during a congressional hearing. SSA has also consulted with other organizations, such as CMS, which already have analytics in place. Agency officials identified other steps they have taken that align with these key practices, but when we requested additional details on how it will carry out these efforts, SSA did not yet have any concrete plans. In addition to predictive analytics, other SSA components are implementing several efforts that may have the potential to detect and prevent potential physician-assisted fraud. SSA OIG Disability Fraud Pilot: The SSA OIG is piloting an effort to augment its CDI units and target organized fraud schemes, such as those that allegedly occurred in New York and Puerto Rico. OIG officials told us that this effort will differ from existing CDI efforts, which generally investigate potential fraud before SSA makes a disability determination and are focused on claimants. The fraud pilot will instead focus on third-party facilitators—including physicians and attorneys—and their involvement in systematic efforts to defraud SSA’s disability programs. OIG officials noted that the pilot incorporates new performance measures that allow for prolonged investigations as opposed to the quicker investigations normally conducted by CDI units. The OIG began the pilot in the summer of 2013 in four locations and will consider expanding the effort in fiscal year 2015 after evaluating the success of the pilot and the effect it has had on SSA disability programs. Disability Fraud Prevention Units: SSA established a centralized fraud prevention unit based in New York City to identify instances of potential fraud and look for trends nationwide. Initially, this unit will utilize 20 disability examiners with experience in investigating claims associated with the New York City and Puerto Rico fraud cases. SSA recently established additional units in Kansas City and San Francisco. SSA expects that these units will provide ongoing investigative support to the OIG as well as analytical and programmatic support to federal and local prosecutors pursuing cases of potential fraud. Office of Disability Adjudication Review (ODAR) data analysis efforts: ODAR—which is responsible for overseeing the claims appeals process—has an ongoing effort analyzing data from claims decided at the appeals level. ODAR officials told us that this effort was intended to provide better oversight of administrative law judges, as well as to identify errors in decisions to be better able to target training resources. ODAR is also using these data to look for irregularities— such as repeated instances of similar language from a physician—and identify potential fraud, referring those cases to the OIG. Additionally, ODAR is working with the OIG disability fraud pilot to provide data in support of their efforts. Although SSA officials indicated that several of these efforts will be under the purview of the recently reinstituted National Anti-Fraud Committee, the agency lacks detailed plans describing how these various efforts will be implemented or how they will relate to each other. In prior work, we have reported that clearly delineating activities and timelines, and defining problems and goals, are key elements of sound planning. Specifically, agencies should identify activities needed to complete projects and be able to describe how these activities are related to each other. However, SSA has yet to articulate how these efforts will relate to each other. For example, while the fraud analytics pilot, the OIG disability fraud pilot, the disability fraud prevention units, and ODAR’s efforts all involve some analysis of disability claims data, SSA’s plans do not address how these efforts will support each other or how it will avoid duplication across efforts. Additionally, SSA was unable to provide us with detailed information regarding the development of these initiatives or describe how they differed from each other. Competing priorities may compromise SSA’s ability to follow through on plans to enhance fraud detection and maintain this focus. As stated earlier, SSA has not sufficiently balanced the need to quickly process claims and pay benefits with the need to ensure program integrity. Moreover, SSA officials told us that the role of the agency and DDSs is to help claimants navigate a complex application process and that searching out fraud—while a concern—does not align with SSA’s core mission. In addition, employees at two of the DDSs we visited told us that SSA only began to emphasize the need to look for potential fraud after the announcement of alleged schemes; and they were concerned about the agency’s ability to maintain a sustained focus in this area. One DDS director added that SSA needs to build fraud detection into its regular business operations in order to sustain it. The director added that SSA currently budgets only enough resources to its DDSs to maintain their current business practices. While the full extent and nature of physician-assisted fraud is difficult to measure, any occurrence has the potential to undermine confidence in SSA’s ability to award benefits only to deserving individuals. The agency relies on front-line workers, including those who collect and assess claimants’ medical records at DDS offices, to be the first line of defense against potential fraud. They are also expected to make timely and accurate disability determinations. In some instances, the agency’s focus on making determinations quickly has been a disincentive to reporting suspicious physicians or potential fraud. Unless SSA and the DDSs work to remedy performance measures that primarily focus on and reward timeliness, possibly at the expense of delving into potentially problematic claims, the agency will remain vulnerable to potential fraud. Further, absent enhanced and consistent training, front-line staff may lack the expertise to identify and report potential fraud. SSA has some controls in place to help ensure that sanctioned physicians do not perform exams on behalf of the agency. However, the agency could be exposing itself to risk by using medical evidence from physicians who are sanctioned by either federal or state governments. While there are numerous reasons a physician can be sanctioned, without knowing whether such physicians have provided medical evidence and why they were sanctioned, SSA could be missing information needed to identify and flag for additional scrutiny potentially falsified medical evidence. Lastly, as the agency begins to shift its focus to better detection and prevention of potential fraud through analytics, it will be important to balance these new efforts with the existing workload demands on front- line staff. Furthermore, even though substantial resources and collaboration will be needed to fully implement a successful analytics system and follow up on resulting leads, SSA has not systematically identified the data and actions needed to implement and make them successful. Given the lack of details that the agency was able to provide on its plans, we have concerns about their potential success. Absent a coordinated and cohesive effort, SSA could undermine the success of its new initiatives and remain vulnerable to physician-assisted fraud in the future. We recommend that the Commissioner of the Social Security Administration take the following actions to improve the ability of the agency to detect and prevent potential physician-assisted fraud: 1. To address potential disincentives for staff to detect and prevent physician-assisted fraud, SSA should review the standards used to assess DDS performance; and develop and distribute promising practices to incentivize staff to better balance the goal of processing claims promptly with the equally important goal of identifying and reporting evidence of potential fraud. 2. To ensure that the agency captures complete information on suspicious claims, SSA should issue guidance to remind DDSs of its existing policy to report all claims with potentially fraudulent medical evidence to the SSA OIG, even if sufficient evidence exists to deny a claim. 3. To help front-line staff identify potentially fraudulent activity, SSA should enhance its training efforts by ensuring it provides fraud- related refresher training to all DDS employees on a regular basis. Such training should include the identification of suspicious medical evidence and providers, as well as the processes and procedures for reporting such information. To facilitate its efforts, the agency could coordinate with the SSA OIG and draw on the type of training provided by CDI units. 4. To address the potential risks associated with medical evidence submitted by sanctioned physicians, SSA should evaluate the threat posed by this information and, if warranted, consider changes to its policies and procedures. 5. To help ensure new initiatives that use analytics to identify potential fraud schemes are successful, SSA should develop an implementation plan that identifies both short- and long-term actions, including: data requirements, e.g., the collection of unique medical provider timeframes for implementation; resources and staffing needs; how technology improvement will be integrated into existing technology improvements such as the Disability Case Processing System and National Vendor File; and how different initiatives will interact and support each other. We provided a draft of this product to the Social Security Administration for comment. In its written comments, reproduced in appendix II, SSA agreed with 4 of our 5 recommendations and partially agreed with one of them. SSA partially agreed with our recommendation to review its standards used to assess DDS performance; and develop and distribute promising practices to incentivize staff to better balance the goal of processing claims promptly with the equally important goal of identifying and reporting evidence of potential fraud. SSA did not specify why it did not agree fully, but did outline the critical role that field and DDS office staff play in identifying and detecting potential fraud. In our report, we acknowledge that these employees are the first line of defense against fraud. We also noted that based on our interviews, and review of agency and DDS performance standards, that there is a potential disincentive to report suspicious claims. If properly designed and managed, performance standards that include identifying and reporting suspicious claims could provide incentives to encourage staff to devote more time to program integrity issues while maintaining their ability to process claims in a timely manner. Such standards would also further demonstrate to DDS staff SSA management’s commitment to preventing potential physician- assisted fraud in its disability programs. SSA agreed with the remainder of our recommendations and provided additional information about the actions it has taken in the past year to enhance its fraud detection and prevention efforts and steps they will take going forward. SSA also provided technical comments on our report, which we incorporated as appropriate. In these comments, the agency noted that our report implies that fraud schemes are more commonplace than they actually are. Our report states that the full extent and nature of physician- assisted fraud is difficult to measure and that even one instance of this type of fraud could result in a large number of beneficiaries improperly receiving benefits, as well as substantial costs to the government. SSA also commented that our report overemphasized the potential utility of the List of Excluded Individuals and Entities for identifying potential physician- assisted fraud. In our report, we noted key limitations and challenges to using this list. Nonetheless, we maintain that some physicians—an important component of the disability determination process—have been at least suspected of fraudulent activities by others and this is important information for SSA to consider. We believe SSA can improve staffs’ ability to identify cases that deserve closer scrutiny by more fully assessing the potential threat posed by sanctioned physicians. Such an assessment would also help the agency identify actions that DDS offices could take to better track and screen for evidence from these providers. In the long-term it could also assist with the agency’s new fraud analytics efforts. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Commissioner of Social Security and other interested parties. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7215 or bertonid@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix III. In conducting our review of potential physician-assisted fraud in the Social Security Administration’s (SSA) disability programs, our objectives were to examine (1) SSA’s policies and procedures for detecting and deterring physician assisted fraud, and (2) the steps SSA is taking to improve its ability to detect physician-assisted fraud. We reviewed relevant federal laws and regulations, as well as SSA program documentation including policies, procedures, training manuals, and performance plans, as well as reports and testimonies from SSA and the Office of the Inspector General (OIG) on fraud detection and prevention efforts. We evaluated SSA’s efforts against its own policies and procedures, federal internal control standards, and other key fraud analytics practices to detect and prevent potential fraud. We also interviewed key officials in SSA and conducted site visits to five states where we interviewed Disability Determination Services (DDS) and SSA regional office staff. Additionally, we interviewed organizations that represent DDS management and front-line SSA employees, in addition to meeting with private disability insurers and other organizations involved in preventing fraud. We compared the medical provider vendor lists in two states to a list of federally sanctioned doctors. To understand SSA’s policies and efforts to improve fraud detection, we interviewed officials in a number of SSA components. These included: The Office of the Deputy Commissioner, Operations, which is responsible for overseeing the initial disability determination process and state DDS offices; The Office of Disability Adjudication and Review (ODAR), which is responsible for overseeing the disability appeals process; The Office of the Chief Strategic Officer; The Office of Information Security; and The Office of the Inspector General (OIG). To gain additional perspectives on how SSA policies are implemented and challenges regarding detecting physician-assisted fraud, we conducted site visits to a non-generalizable sample of five states. We chose these states in order to provide diversity in terms of their geographic location, whether the state had a single or multiple DDS locations, the presence of an OIG Cooperative Disability Investigations (CDI) unit, and the data system used by a state. During our site visits, we interviewed DDS management, medical relations professionals, disability examiners and supervisors, and medical consultants. When possible, we randomly selected examiners and consultants, who worked with the DDS for at least 1 year, to interview based on rosters provided by DDS management. In three of the states, we met with examiners individually. In the other two states, we met with examiners in a group setting because of challenges with scheduling individual interviews. In addition to providing information on SSA’s policies and procedures, DDS officials and staff provided insights on SSA’s newer fraud detection initiatives. Additionally, we spoke with regional SSA officials in each of the regions that correspond with our site selection. We also spoke with OIG CDI staff in each location where they were present. The information we obtained at our site visits is illustrative and not intended to reflect the experiences of DDSs in other states. See table 4 for key characteristics of our site visit locations. We also interviewed officials from SSA’s New York regional office to better understand how recent alleged fraud cases in New York and Puerto Rico—both within that SSA region—were uncovered, as well as changes made in response to these incidents. In addition, we interviewed officials at the Michigan DDS because it has a dedicated fraud unit. To supplement our site visits, we interviewed national organizations that represent DDS examiners, managers, and Administrative Law Judges, including: Association of Administrative Law Judges National Council of Social Security Management Associations National Association of Disability Examiners National Council of Disability Determination Directors To provide additional context, we interviewed a number of other federal agencies, private insurers, and other organizations that are familiar with the disability determination process, detecting fraud, or with implementing predictive analytics. These organizations included: American Academy of Disability Evaluating Physicians (a professional organization serving physicians involved in disability management and evaluations) Coalition Against Insurance Fraud (an anti-fraud alliance that includes public and private insurers) Centers for Medicare and Medicaid Services Department of Health and Human Services, Office of Inspector Elder Research Inc. (a consulting company focused on predictive analytics and data mining) The Recovery Accountability and Transparency Board Unum (a private insurer that uses predictive analytics to identify potential fraud) We conducted data matching using information from California and Illinois to help determine the extent to which sanctioned medical providers submitted evidence in disability decisions. We attempted to find providers who appeared in both of these two data sources: 1. The List of Excluded Individuals and Entities (LEIE): The list is maintained by the Department of Health and Human Services OIG, and lists individuals who are excluded from federal health care programs for a number of reasons, including health care fraud. 2. State Vendor Files: Vendor files are maintained by each DDS and list medical providers who were reimbursed for providing medical evidence in support of disability claims. These vendors include claimants’ treating physicians who are reimbursed for providing copies of medical records, and consultative exam providers, who conduct medical exams for the DDS under contract, among others. We conducted matching between each state vendor file and the LEIE on the basis of tax identification numbers—Social Security Numbers or Employee Identification Numbers. In instances when we found a match between both sources, we gave the DDSs (through SSA) summary information on the providers and obtained information on when they last submitted evidence or conducted exams in support of claims. The Illinois DDS provided us with additional information on our matches in June 2014 and the California DDS in August 2014. Providers can be sanctioned for a number of reasons not related to health care fraud; therefore, the results of our matching do not indicate that fraud occurred in either federal health care or disability programs. Additionally, the results of our data matching are not generalizable to other states or to the wider population of disability claims. There were several limitations in both the state vendor files and the HHS LEIE that could have affected the results of our matching, including: DDS vendor data did not include all physicians who submitted medical evidence on behalf of claimants or individual physicians who performed consultative examinations on behalf of SSA. Since these files are used for payment purposes, DDSs only maintain tax identification numbers for vendors (e.g., physicians, clinics, or third- parties managing records on behalf of physicians) who they pay for records or services; not necessarily the individual physicians who see claimants. According to the HHS OIG, the LEIE may not reflect all sanctioned medical providers, given limitations on OIG’s authorities, appeals of exclusions, and occasional delays in referrals to the OIG. The SSA OIG also noted that sanctioned physicians may move on and off the list depending on the outcome of appeals and reinstatements. Therefore, a doctor providing medical evidence to SSA on behalf of a disability claimant may be on the exclusions list one quarter and off the next. As a result of these limitations, any results in matching are likely to be a lower bound. We conducted data reliability assessments on both states’ vendor data and found these data sets to be sufficiently reliable for our analysis. We restricted these assessments to the specific variables and records that were pertinent to our analyses. We conducted interviews with SSA staff familiar with the data and requested additional information from the DDSs. We also assessed the completeness of the data, including frequency analysis of relevant fields, testing for population of variables, out of range values, and duplicate records. In both states, the data’s unique identifiers that we used for matching were not populated for all records. We followed up with SSA and the DDSs to gain an understanding of why some fields were not populated. Because the vendor files are used for payment purposes, the DDSs only collect tax identification numbers for entities they pay for medical records or consultative examinations. We restricted our matching to vendor data that we determined had a legitimate tax identification number and eliminated duplicates in the data. We then asked the DDSs to verify the last date of payment for providers whom we matched to assess whether they were receiving payment while they were sanctioned. We conducted similar data reliability steps for the HHS LEIE, including electronic testing and interviews with the HHS OIG officials responsible for maintaining the list. We found these data to be sufficiently reliable for our analysis. We identified a number of key practices that organizations should consider when implementing analytics to uncover potential fraud in disability claims. These practices are based on our past work that examined the use of analytics to detect Medicare fraud. To validate these practices and determine their relevance for disability programs, we shared the list of practices with private sector entities that have experience implementing analytics for disability programs. We also asked these entities whether there were additional practices that should be added to our list. These entities generally agreed with the practices from our prior work and suggested that we add mining text data to our list because this capability is critical to identifying similar medical language across claims. We conducted this performance audit from July 2013 to November 2014 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings based on our audit objectives. In addition to the contact named above, Gretta L. Goodwin (Assistant Director), Nyree Ryder Tee (Analyst-in-Charge), Daniel Concepcion, Brian Schwartz, and Melinda Cordero made key contributions to this report. Additional contributors include: James Bennett, Sarah Cornetto, David Chrisinger, Alex Galuten, Sheila McCoy, Zachary Sivo, Almeta Spencer, Vanessa Taylor, and Walter Vance. Highlights of a Forum: Data Analytics for Oversight and Law Enforcement. GAO-13-680SP. Washington, D.C.: July 15, 2013. Social Security Administration: Long-Term Strategy Needed to Address Key Management Challenges. GAO-13-459. Washington, D.C.: May 29, 2013. Medicare Fraud Prevention: CMS Has Implemented a Predictive Analytics System, but Needs to Define Measures to Determine Its Effectiveness. GAO-13-104. Washington, D.C.: October 15, 2012. Social Security Disability: Collection of Medical Evidence Could Be Improved with Evaluations to Identify Promising Collection Practices. GAO-09-149. Washington, D.C.: December 17, 2008. Results-Oriented Cultures: Insights for U.S. Agencies from Other Countries’ Performance Management Initiatives. GAO-02-862. Washington, D.C.: August 2, 2002. Supplemental Security Income: Additional Actions Needed to Reduce Program Vulnerability to Fraud and Abuse. GAO/HEHS-99-151. Washington, D.C.: September 15, 1999. Supplemental Security Income: Action Needed on Long-Standing Problems Affecting Program Integrity. GAO/HEHS-98-158. Washington, D.C.: September 14, 1998.

Summary: SSA relies on medical evidence to determine whether the millions of new claimants each year qualify for disability benefits. This evidence—and those who provide it—have been the subject of intense scrutiny as questions have been raised about the potential for fraud schemes that include falsified medical evaluations. GAO was asked to study physician-assisted fraud in SSA's disability programs. GAO reviewed (1) how well SSA's policies and procedures are designed and implemented to detect and prevent physician-assisted fraud, and (2) the steps SSA is taking to improve its ability to prevent physician-assisted fraud. GAO reviewed relevant federal laws and regulations, visited 5 of the 54 DDS offices that were selected to obtain geographic and office structure variation, and analyzed DDS data to identify whether federally sanctioned physicians (as of the end of January 2014) may have submitted evidence on behalf of claimants. GAO also interviewed SSA officials, as well as private disability insurers and others knowledgeable about SSA's programs to identify key practices for fraud prevention. The Social Security Administration (SSA) has policies and procedures in place for detecting and preventing fraud with regard to disability benefit claims. However, GAO identified a number of areas that could leave the agency vulnerable to physician-assisted fraud and other fraudulent claims: SSA relies heavily on front-line staff in the offices of its disability determination services (DDS)—which have responsibility for reviewing medical evidence—to detect and prevent potential fraud. However, staff said it is difficult to detect suspicious patterns across claims, as directed by SSA policy, given the large number of claims and volume of medical information they review. Moreover, DDS offices generally assign claims randomly, so staff said it would only be by chance that they would review evidence from the same physician. SSA and, in turn, DDS performance measures that focus on prompt processing can create a disincentive for front-line staff to report potential fraud because of the time it requires to develop a fraud referral. Four of the five DDS offices GAO visited count time that staff spend on documenting potential fraud and developing fraud referrals against their processing time. Some staff at these DDS offices said this creates a reluctance to report potential fraud. The extent of anti-fraud training for staff varied among the five offices GAO visited and was often limited. SSA requires all DDSs to provide training to newly hired staff that includes general information on how to identify potential fraud, but does not require additional training. The five DDS offices GAO visited varied in whether staff received refresher training and its content—such as how to spot suspicious medical evidence from physicians—and staff at all levels said they needed more training on these issues. SSA has not fully evaluated the risk associated with accepting medical evidence from physicians who are barred from participating in federal health programs. Although information from these physicians is not necessarily fraudulent, it could be associated with questionable disability determinations. SSA has launched several initiatives to detect and prevent potential fraud, but their success is hampered by a lack of planning, data, and coordination. For instance, SSA is developing computer models that can draw from recent fraud cases to anticipate potentially fraudulent claims going forward. This effort has the potential to address vulnerabilities with existing fraud detection practices by, for example, helping to identify suspicious patterns of medical evidence. However, SSA has not yet articulated a plan for implementation, assigned responsibility for this initiative within the agency, or identified how the agency will obtain key pieces of data to identify physicians who are currently not tracked in existing claims' management systems. Furthermore, SSA is developing other initiatives, such as a centralized fraud prevention unit and analysis to detect patterns in disability appeals cases that could indicate fraud. However, these initiatives are still in the early stages of development and it is not clear how they will be coordinated or work with existing detection activities. GAO recommends SSA identify ways to remove potential disincentives for detecting and referring potential fraud, enhance its training efforts, evaluate the threat of physician-assisted fraud, and ensure that new and existing fraud efforts are coordinated. SSA agreed with four of our five recommendations, partially agreed with one, and noted plans to address all of them.