GAO has identified key strategies to help CMS address challenges it faces in preventing fraud, waste, and abuse, and ultimately to reducing improper payments. These strategies are: (1) strengthening provider enrollment processes and standards, (2) improving pre-payment review of claims, (3) focusing post-payment claims review on most vulnerable areas, (4) improving oversight of contractors, and (5) developing a robust process for addressing identified vulnerabilities. In the course of our work, we have found that CMS has made progress in some of these areas, and recent legislation may provide it with enhanced authority. However, CMS has not implemented some of our recommendations and other challenges remain. Given the large number of providers filing claims with Medicare and the volume of payments the agency and its contractors handle, ensuring that providers are legitimate businesses before allowing them to bill Medicare is important. Checking the background of providers at the time they apply to become Medicare providers is a crucial step to reduce the risk of enrolling providers intent on defrauding or abusing the program. In particular, we have recommended stricter scrutiny of enrollment processes for two types of providers whose services and items CMS has identified as especially vulnerable to improper payments—home health agencies (HHA) and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS). CMS contractors are responsible for screening enrollment applications from prospective HHAs. We found that the screening process was not thorough. This may have contributed to a rapid increase in the number of HHAs that billed Medicare in certain states with unusually high rates of billing patterns indicative of fraud and abuse. For example, the contractors were not required to verify the criminal history of persons named on the application. We recommended that CMS assess the feasibility of such a criminal history verification of all key officials’ names on an HHA enrollment application; to date, CMS has not implemented this recommendation. Regarding DMEPOS suppliers, we also found that CMS had not taken sufficient steps to prevent entities intent on defrauding Medicare from enrolling in the program. In 2005, we reported that more effective screening and stronger enrollment standards were needed. CMS implemented new supplier enrollment standards in January 2008, partly in response to our recommendation. However, in that same year, we exposed persistent weaknesses when we created two fictitious medical equipment companies that were enrolled by CMS’s contractor and given permission to begin billing Medicare. As an enrollment requirement, suppliers are required to show that they have contracts for obtaining inventory—but the contracts provided with the applications of our fictitious companies would have been shown to be fabricated if they had been reviewed properly. Since January 2008, CMS has taken two additional steps to ensure that only legitimate DMEPOS suppliers can bill Medicare. First, it implemented a requirement for DMEPOS suppliers to post a surety bond to help ensure that the Medicare program recoups erroneous payments that result from fraudulent or abusive billing practices. Second, CMS required that all DMEPOS suppliers be accredited by a CMS-approved accrediting organization to ensure that they meet minimum standards. CMS told us that thousands of DMEPOS suppliers were removed as result of these requirements. In addition, Congress has directed CMS to implement a competitive bidding program for DME, which could also help reduce fraud, waste, and abuse because it authorizes CMS to select suppliers based in part on new scrutiny of their financial documents and other application materials. However, the program will not take effect until January 2011 and it will initially be implemented in only nine metropolitan areas. Implementation of additional authorities in PPACA and HCERA also may help the agency strengthen provider enrollment, including addressing vulnerabilities our work has identified. In particular, among other provisions, the legislation allows HHS to (1) add criminal and background checks to its enrollment screening processes, depending on the risks presented by the provider; and (2) impose a temporary moratorium on enrollment of providers, if the agency deems it necessary to prevent fraud and abuse. In addition, there are specific requirements for providers to disclose any current or previous affiliation with a provider or supplier that has uncollected debt, has been or is subject to a payment suspension under a federal health care program, has been excluded from participation under Medicare, Medicaid or the State Children’s Health Insurance Program (CHIP) or has had its billing privileges denied or revoked. HHS may deny enrollment to any such provider whose previous affiliations pose an undue risk. However, the effectiveness of these authorities is unknown and will depend on CMS’s implementation. CMS told us that the agency is in the process of implementing these authorities, including drafting regulations on criminal and background checks. Pre-payment reviews of claims are essential to helping ensure that Medicare pays correctly the first time; however, these reviews are challenging due to the volume of claims. Overall, less than 1 percent of Medicare’s claims are subject to a medical record review by trained personnel—so having robust automated payment controls called edits in place that can deny inappropriate claims or flag them for further review is critical. However, we have found weaknesses in these pre-payment controls. For example, in 2007, we found that contractors responsible for reviewing DMEPOS suppliers’ claims did not have automated pre-payment controls in place to identify questionable claims that might connote fraud, such as those associated with atypically rapid increases in billing or for items unlikely to be prescribed in the course of routine quality medical care. As a result, we recommended in 2007 that CMS require its contractors to develop thresholds for unexplained increases in billing and use them to develop automated pre-payment controls. Although CMS has not implemented that recommendation specifically, it has added edits to flag claims for services that were unlikely to be provided in the normal course of medical care. This is a valuable addition to the program’s safeguards, but additional pre-payment controls, such as using thresholds for unexplained increases in billing, could further enhance CMS’s ability to identify improper claims before they are paid. Post-payment reviews are critical to identifying payment errors to recoup overpayments. CMS’s contractors have conducted limited post-payment reviews—for example, we reported in 2009 that two contractors paying home health claims conducted post-payment reviews on fewer than 700 of the 8.7 million claims that they paid in fiscal year 2007. Further, we found that they were not using evidence, such as findings from pre-payment reviews, to target their post-payment review resources on providers with a demonstrated high risk of improper payments. We recommended that post-payment reviews be conducted on claims submitted by HHAs with high rates of improper billing identified through pre-payment review. In response, CMS commented that other types of post-payment review may already include claims from these HHAs. We continue to believe including this targeted post-payment review should be a priority. Cross-checking claims for home health services with the physicians who prescribed them can be a further safeguard against fraud, waste, and abuse, but we have found that this is not always done. For example, CMS does not routinely provide physicians responsible for authorizing home health care with information that would enable them to determine whether an HHA was billing for unauthorized care. In one instance, a CMS contractor identified overpayments in excess of $9 million after interviewing physicians who had referred beneficiaries with high home health costs. The physicians indicated that their signatures had been forged or that they had not realized the amount of care they had authorized. We recommended that CMS require that physicians receive a statement of services beneficiaries received based on the physicians’ certification, but to date, the agency has not taken action. CMS’s new national recovery audit contracting program, begun in March 2009, was intended to address post-payment efforts; however, we continue to have concerns about post-payment reviews of HHAs and DMEPOS. Congress authorized the national program after completion of a three-year recovery audit contracting demonstration program in 2008. The national program is designed to help the agency supplement the pre- and post- payment reviews of other contractors. Recovery audit contractors (RAC) review claims after payment, with reimbursement to them contingent on finding improper overpayments and underpayments. Because RACs are paid on a contingent fee based on the dollar value of the improper payments identified, during the demonstration RACs focused on claims from inpatient hospital stays, which are generally more costly services. Therefore, other contractors’ post-payment review activities could be more valuable if CMS directed these contractors to focus on items and services where RACs are not expected to focus their reviews, and where improper payments are known to be high, specifically home health and durable medical equipment. Because Medicare is administered by contractors, such as drug plan sponsors, overseeing their activities to address fraud, waste, and abuse and prevent improper payment is critical. All drug plan sponsors are required to have programs to safeguard the Medicare prescription drug program from fraud, waste, and abuse. CMS’s oversight of these programs has been limited but is expanding. In March 2010, we testified that CMS had completed desk audits of selected sponsors’ compliance plans. At that time, CMS was beginning to implement an expanded oversight strategy, including revising its audit protocol and piloting on-site audits, to assess the effectiveness of these programs more thoroughly. As of June 2010, the agency has conducted 5 on-site audits and plans to conduct a total of 30 on-site audits by the end of the fiscal year. These audits are in response to a recommendation we made in our 2008 study that found that the five sponsors we reviewed (covering more than one-third of total Medicare prescription drug plan enrollees) had not completely implemented all seven of CMS’s required compliance plan elements and selected recommended measures for a Medicare prescription drug fraud, waste, and abuse program. In addition, CMS published a final rule in April 2010 to increase its oversight efforts and ensure that sponsors have effective compliance programs in place. In issuing the proposed rule, CMS noted that we requested that the agency take actions to evaluate and oversee fraud and abuse programs to ensure sponsors have effective programs in place. Having mechanisms in place to resolve vulnerabilities that lead to improper payment is critical to program management, but CMS has not developed a robust process to specifically address identified vulnerabilities that lead to improper payment. Our Standards for Internal Control in the Federal Government indicate that part of an agency’s controls should include policies and procedures to ensure that (1) the findings of all audits and reviews are promptly evaluated, (2) decisions are made about the appropriate response to these findings, and (3) actions are taken to correct or otherwise resolve the issues promptly. Further, our Internal Control Management and Evaluation Tool affirms that in order to establish an effective internal control environment, the agency has to appropriately assign authority, including holding individuals accountable for achieving agency objectives. As we reported in March 2010, CMS did not establish an adequate process during its initial recovery audit contracting demonstration or in planning for the national program to ensure prompt resolution of identified improper payment vulnerabilities. During the demonstration, CMS did not assign responsibility for taking corrective action on these vulnerabilities to either agency officials, contractors, or a combination of both. According to CMS officials, the agency only takes corrective action for vulnerabilities with national implications, and leaves it up to the contractors that process and pay claims to decide whether to take action for vulnerabilities that may only be occurring in certain geographic areas. Additionally, during the demonstration CMS did not specify in a plan what type of corrective action was required or establish a timeframe for corrective action. The documented lack of assigned responsibilities impeded CMS’s efforts to promptly resolve the vulnerabilities that had been identified during the demonstration. For the recovery audit contracting national program, CMS established a corrective action team that will compile, review, and categorize identified vulnerabilities and discuss corrective action recommendations. CMS has also appointed the Director of the Office of Financial Management as responsible for the day-to-day operations of the program, and the CMS Administrator as the responsible official for vulnerabilities that span agency components. However, the corrective action process still does not include any steps to either assess the effectiveness of the corrective actions taken or adjust them as necessary based on the results of the assessments. Further, the agency has not developed time frames for implementing corrective actions. We recommended that CMS develop and implement a process that includes policies and procedures to ensure that the agency promptly (1) evaluates findings of RAC audits, (2) decides on the appropriate response and a time frame for taking action based on established criteria, and (3) acts to correct the vulnerabilities identified. CMS concurred with this recommendation. Agency officials indicated that they intended to review vulnerabilities on a case-by-case basis and were considering assigning them to risk categories that would help them prioritize action. However, this recommendation has not been implemented. Mr. Chairman, this concludes my prepared statement. I would be happy to answer any questions you or other members of the subcommittees may have. For further information about this statement, please contact Kathleen M. King at (202) 512-7114 or kingk@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this statement. Sheila Avruch, Christine Brudevold, and Martin T. Gahart, Assistant Directors; Lori Achman; Jennie F. Apter; Thomas Han; Jennel Harvey; Amanda Pusey; and James R. Walker were key contributors to this statement. Medicare Recovery Audit Contracting: Weaknesses Remain in Addressing Vulnerabilities to Improper Payments, Although Improvements Made to Contractor Oversight. GAO-10-143. Washington, D.C.: March 31, 2010. Medicare Part D: CMS Oversight of Part D Sponsors’ Fraud and Abuse Programs Has Been Limited, but CMS Plans Oversight Expansion. GAO-10-481T. Washington, D.C.: March 3, 2010. Medicare: CMS Working to Address Problems from Round 1 of the Durable Medical Equipment Competitive Bidding Program. GAO-10-27. Washington, D.C.: November 6, 2009. Medicare: Improvements Needed to Address Improper Payments in Home Health. GAO-09-185. Washington, D.C.: February 27, 2009. Medicare Part D: Some Plan Sponsors Have Not Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has Been Limited. GAO-08-760. Washington, D.C.: July 21, 2008. Medicare: Covert Testing Exposes Weaknesses In The Durable Medical Equipment Supplier Screening Process. GAO-08-955. Washington, D.C.: July 3, 2008. Medicare: Competitive Bidding For Medical Equipment and Supplies Could Reduce Program Payments, but Adequate Oversight is Critical. GAO-08-767T. Washington, D.C.: May 6, 2008. Medicare: Improvements Needed to Address Improper Payments for Medical Equipment and Supplies. GAO-07-59. Washington, D.C.: January 31, 2007. Medicare: More Effective Screening and Stronger Enrollment Standards Needed for Medical Equipment Suppliers. GAO-05-656. Washington, D.C.: September 22, 2005. This is a work of the U.S. government and is not subject to copyright protection in the United States. The published product may be reproduced and distributed in its entirety without further permission from GAO. However, because this work may contain copyrighted images or other material, permission from the copyright holder may be necessary if you wish to reproduce this material separately.

Summary: GAO has designated Medicare as a high-risk program since 1990, in part because the program's size and complexity make it vulnerable to fraud, waste, and abuse. Fraud represents intentional acts of deception with knowledge that the action or representation could result in an inappropriate gain, while abuse represents actions inconsistent with acceptable business or medical practices. Waste, which includes inaccurate payments for services, also occurs in the Medicare program. Fraud, waste, and abuse all can lead to improper payments, overpayments and underpayments that should not have been made or that were made in an incorrect amount. In 2009, the Centers for Medicare & Medicaid Services (CMS)--the agency that administers Medicare--estimated billions of dollars in improper payments in the Medicare program. This statement, will focus on challenges facing CMS and selected key strategies that are particularly important to helping prevent fraud, waste, and abuse, and ultimately to reducing improper payments, including challenges that CMS continues to face. It is based on nine GAO products issued from September 2005 through March 2010 using a variety of methodologies, including analysis of claims, review of relevant policies and procedures, stakeholder interviews, and site visits. GAO received updated information from CMS in June 2010. GAO has identified challenges and strategies in five key areas important in preventing fraud, waste, and abuse, and ultimately to reducing improper payments. GAO has made recommendations in these areas. CMS has made progress in some of these areas, and recent legislation may provide the agency with enhanced authority. However, CMS faces continuing challenges. 1. Strengthening provider enrollment process and standards. Checking the background of providers at the time they apply to become Medicare providers is a crucial step to reduce the risk of enrolling providers intent on defrauding or abusing the program. In particular, GAO has recommended stricter scrutiny of providers identified as particularly vulnerable to improper payments to ensure they are legitimate businesses. 2. Improving pre-payment review of claims. Pre-payment reviews of claims are essential to helping ensure that Medicare pays correctly the first time. GAO has recommended that CMS further enhance its ability to identify improper claims through additional automated pre-payment claim review before they are paid. 3. Focusing post-payment claims review on most vulnerable areas. Post- payment reviews are critical to identifying payment errors and recouping overpayments. GAO has recommended that CMS better target claims for post payment review on the most vulnerable areas. 4. Improving oversight of contractors. Because Medicare is administered by contractors, overseeing their activities to address fraud, waste, and abuse is critical. GAO found that CMS's oversight of prescription drug plan sponsors' compliance programs has been limited. However, partly in response to GAO's recommendation, CMS oversight of these programs is expanding. 5. Developing a robust process for addressing identified vulnerabilities. Having mechanisms in place to resolve vulnerabilities that lead to improper payment is vital to program management, but CMS has not developed a robust process to specifically address these. GAO has recommended that CMS establish an adequate process to ensure prompt resolution of identified improper payment vulnerabilities.