The Secretary of HHS has delegated to the OIG the authority, under sections 1128 and 1156 of the Social Security Act, to exclude certain health care providers from most federal health care programs. Under the law, the OIG, which acts through its Office of Investigations, must exclude, nationwide, providers that have been convicted of a criminal offense related to Medicare or any state health care program, a criminal offense related to patient abuse or neglect, or a felony related to other health care fraud or controlled substances. Under these circumstances, providers fall into the category of “mandatory exclusions.” The OIG also has authority to exclude individuals or organizations if the OIG determines that the particular facts in a case meet certain criteria. These actions are termed “permissive exclusions.” They may be based on, for example, submitting excessive claims, license suspensions and revocations, and sanctions imposed by federal or state health agencies. (See app. II for the legal bases for exclusions.) OIG field offices receive exclusion referrals from state Medicaid agencies, licensing boards, MFCUs, and others. For mandatory exclusion cases, the field offices assemble and forward to headquarters the case files containing evidence of a provider’s criminal conviction. For other referrals, which could result in permissive exclusions, the field offices receive documents on disciplinary actions taken by state Medicaid agencies, licensing boards, or others. The field offices assess the relevant facts and forward to OIG headquarters the names of providers they recommend for exclusion. OIG headquarters makes the final decision on excluding the provider from program enrollment. When the OIG excludes a provider, it sends notification letters to organizations—such as state Medicaid agencies, Medicare contractors, and state licensing boards—in the states in which the provider is known to practice or operate. When applicable, the provider’s employer is also notified. In addition, the OIG provides HCFA with periodic cumulative reports and monthly updates on excluded providers, which HCFA distributes nationally. As of October 1996, about 9,500 providers were excluded from federal health care programs nationwide. Three exclusion categories—conviction for program-related crime, conviction for a criminal offense related to patient abuse or neglect, and license suspensions and revocations—accounted for 76 percent of these nationwide exclusions. Unless the OIG maintains accountability for state exclusion referrals, providers that have committed fraud or rendered substandard care to Medicaid beneficiaries in one state can continue to provide services (1) to Medicaid beneficiaries in other states, (2) under Medicare, or (3) through other federal health programs. Likewise, long delays in processing exclusion referrals allow unacceptable providers to continue to provide services in federal health care programs. In our review of a judgmental sample of 88 state exclusion referrals to three OIG field offices, we found that almost one-half of the referrals had significant processing problems. Field offices had no record of 11 referrals. Processing time for another 30 referrals, or 34 percent, was 1 year or longer. All of the missing and delayed referrals occurred among the 66 referrals we followed up on in the Chicago and New York field offices. In these offices, long delays occurred for both mandatory referrals—which the OIG is required by law to exclude—and permissive referrals—for which the OIG has to decide whether certain exclusion criteria are met. While these referrals remained unresolved, some providers received thousands of dollars from Medicare. OIG field offices could not account for all referrals received from state agencies. While the Philadelphia field office had files for all 22 referrals we reviewed, the Chicago and New York field offices had no records for 11 of the 66 state referrals we checked. The Chicago field office could not locate 5 of 18 referrals from the Illinois Medicaid program and 1 of 14 referrals from the Illinois MFCU. Moreover, three of the state Medicaid agency referrals involved serious quality-of-care issues. For example, in April 1995, the Illinois Medicaid agency excluded a dentist from its program for providing care that placed his patients at risk. Among the charges was that the dentist had performed surgical extractions and had given patients general anesthesia without documented need. The state Medicaid agency’s case file on this dentist showed that he had been referred to the OIG in June 1995. When we inquired at the Chicago field office in March 1996, however, no record could be found of the case. After our inquiry, the office opened a case file on the dentist and he was excluded by the OIG in December 1996. During the 17-month period between state removal from Medicaid and OIG exclusion from all federal health care programs, this dentist received over $13,000 for services provided to Medicare patients. Likewise, the New York field office had no record for 5 of the 28 referrals we reviewed that the New York Medicaid officials claimed had been referred to the OIG. Specifically, the field office had no record of a physician who had been excluded from the state’s Medicaid program over a year earlier for a variety of quality-of-care problems, such as failure to evaluate patient problems and overutilization of laboratory and other tests. From the time this physician was removed from Medicaid in New York, Medicare had paid him over $108,000, as of November 1996. In another case, the field office had no record of a durable medical equipment supplier who had been removed from Medicaid 2 years earlier, after an audit determined that the supplier had overbilled the Medicaid program by more than $173,000. OIG processing of state referrals was sometimes delayed while the Chicago and New York field offices waited for states to send in documents needed by the OIG to exclude the provider nationwide. In mandatory exclusion cases, the OIG requires copies of conviction and sentencing documents; in permissive cases, the OIG requires basic information describing what the provider did to bring about the state removal. The extent to which states furnished such documentation when referring a case to the OIG varied among state agencies we contacted. This variation seemed due, in part, to an absence of clear guidance from the OIG on the documentation needed for exclusion processing. Moreover, when these documents were not provided with the referral, case files often did not show any indication of field office follow-up to obtain the missing information. Even after all the information was received, some case files showed long periods of inactivity. OIG guidance requires that after field office staff receive a permissive exclusion referral, they must decide, within 60 working days, whether to pursue exclusion. However, the guidance does not set any standards or performance goals for actually processing state referrals after the decision is made to pursue an exclusion. In contrast to the Chicago and New York field offices, the Philadelphia field office resolved all of the 22 referrals we reviewed in less than 1 year and most took 6 months or less. This situation appeared to be due, in part, to the Maryland MFCU—the state agency whose referrals we selected for follow-up in the Philadelphia field office—consistently sending the field office all the required documentation. The following examples illustrate the delays we found in Chicago and New York (additional examples can be found in app. III): A pharmacy was removed for overbilling the Illinois Medicaid program by more than $117,000. The Chicago field office took 15 months to forward this permissive exclusion case to headquarters. The case file showed no activity for extended periods of time, including a 10-month period. In a mandatory exclusion case, the Chicago field office referred a provider to headquarters for exclusion 19 months after the Illinois MFCU notified it that the provider had pled guilty and was sentenced in state court for falsely billing for Medicaid services. Two-and-one-half months after the case was forwarded to OIG headquarters, the provider was excluded nationwide. In another mandatory exclusion case, a dentist was sentenced in June 1995 for stealing more than $220,000 from New York’s Medicaid program, charging for more expensive procedures when less expensive ones were actually performed or charging for services not provided. State delays in providing documents on the sentencing initially delayed the New York field office’s processing of the case. These documents were received in November 1995, but no further action had been taken on the case until a few days before we reviewed it in November 1996. The Medicare program in New York paid a physician nearly $61,000 during the more than 2-year period from the time the state Medicaid agency in New York notified the OIG field office that it had removed a physician to the time the OIG excluded the physician from all federal health programs. The state had removed the physician from Medicaid for maintaining an unacceptable practice, keeping inadequate records, and for inappropriately sharing fees for professional services. We reviewed the New York field office case file on this permissive exclusion, and it showed inactivity for extended periods of time, including one 17-month period. In a similar permissive exclusion case, OIG headquarters decided not to pursue exclusion against a physician, who had been removed from New York’s Medicaid program for providing poor quality of care to Medicaid beneficiaries, because it considered the case too old to pursue. The field office had received the referral 18 months earlier. Since exclusion from Medicaid, Medicare in New York had paid this physician over $86,000. We identified inconsistencies in the way the OIG has handled permissive exclusions, that is, cases in which the OIG has discretion on whether to recommend nationwide exclusion. In 1987, the OIG was given expanded discretionary authority to exclude providers nationwide. The OIG, however, has not always used its expanded exclusion authority consistently. Given competing demands on the OIG’s time, permissive exclusions have sometimes had a relatively low priority, OIG officials said. In October 1992, the OIG instructed its field offices to process state Medicaid agency and licensing board disciplinary actions only when actual harm was done to patients and the provider had moved to another state. Field offices, in turn, asked state agencies to refer only these kinds of cases. About a year later, however, the OIG rescinded this guidance and state agencies were asked once again to refer all cases. We also observed inconsistencies in the way field offices process permissive exclusion cases. As a result, providers with equally serious problems could be treated differently by the OIG, depending on location. For example, the Washington, D.C., field office would not consider recommending nationwide exclusion unless a state Medicaid agency had excluded the provider or a licensing board had revoked a license for at least 1 year, a field office official said. The Chicago and New York field offices, however, use a 2-year rule of thumb. Moreover, cases that appeared to be equally serious received different treatment in the same field office. For example, the New York field office forwarded to OIG headquarters a physician’s case for nationwide exclusion after the state Medicaid agency removed the physician. The reasons for removal were providing excessive services, treating patients inappropriately with the wrong medications, and not performing sufficient testing to determine the cause of patients’ complaints. This field office, however, did not forward the case of another physician, whom the state had removed for similar reasons about a year earlier. The field office case file lacked an explanation or rationale for why this case had not been investigated. The regional inspector general, the head of the field office, said the office’s large backlog of cases and shortage of staff accounted for the situation. Section 1902 of the Social Security Act requires state Medicaid agencies to report to HHS whenever a provider of services is terminated, suspended, or otherwise sanctioned or prohibited from participating in the program. For purposes of indicating which providers the OIG may exclude, HHS regulations define the term “otherwise sanctioned” as intending to cover all actions that limit the ability of a person to participate in the program, regardless of what such an action is called, including situations in which an individual or entity voluntarily withdraws from a program to avoid a formal sanction (42 C.F.R. 1001.601). We found, however, that states were not always clear about reporting requirements and OIG field offices did not monitor state agencies to ensure that all cases that fell under the OIG’s exclusion authority were being referred. Consequently, the OIG was not informed of all providers that had committed fraud or abuse or had furnished poor quality of care in a state Medicaid program; such providers could therefore continue providing services to beneficiaries under Medicare or other state Medicaid programs. During our state visits, we found that four state Medicaid agencies did not always report removals. Two states—Illinois and New York—did not notify the OIG of certain providers effectively removed from their programs; Missouri did not report removals to the appropriate OIG field office. Further, the Medicaid agency in Washington, D.C., did not report any removals to the OIG because officials were unaware of the reporting requirements. In Illinois, the state Medicaid program sometimes negotiates a settlement agreement with a provider against whom it has initiated removal proceedings because of, for example, serious quality-of-care problems. The settlement, in effect, excludes the provider, but the state does not spend the time and resources needed to pursue a formal action. In such an agreement, the provider admits no wrongdoing, but agrees to withdraw from participation in Medicaid. The provider also forfeits the right to appeal if denied reinstatement at a later date. The provider does not, however, face the prospect of losing the license to practice because, according to state Medicaid officials, the case is not referred to the state licensing board. In addition, the state does not report such a case to the OIG. This settlement enables Illinois to remove providers from its Medicaid program relatively quickly and keep them out. But, because the state does not refer these actions to the state licensing board or the OIG, the providers may continue to provide services like those for which the state sought the provider’s removal from Medicaid. As of June 1996, about 23 percent of the physicians not allowed to participate in the Illinois Medicaid program had withdrawn rather than face an adverse action. When we checked on the Medicare status of four providers who had withdrawn from Medicaid between 1992 and 1995, we found that all four were still enrolled in Medicare and three continued to bill for services. These providers had withdrawn from Medicaid for serious quality-of-care problems. For example, Medicare paid a podiatrist over $32,000 for services provided to program beneficiaries after he had withdrawn from the Illinois Medicaid program in August 1995. The podiatrist withdrew from the program after the state alleged that he had provided grossly inferior care to Medicaid beneficiaries. Another provider, a physician, withdrew in April 1995, after the state charged him with providing poor care to Medicaid beneficiaries. The following were among the allegations made by the state: diagnoses were inconsistent with medical findings, abnormal laboratory test results were not addressed, and medications were used without clinical indications. Since this physician’s withdrawal from Medicaid, Medicare has paid him over $7,000. In commenting on this report, Illinois said that federal requirements for state reporting of negotiated settlements were unclear. Specifically, the state questioned whether a direct link existed between the statute—which requires state Medicaid agencies to report providers who are “otherwise sanctioned”—and the federal regulation—which defines the term to explain the circumstances under which the OIG may impose a permissive exclusion. Although the regulation may be somewhat unclear, the OIG interprets it as requiring states to report providers who voluntarily withdraw from the Medicaid program. We do not know how many states, other than Illinois, allow providers to avoid adverse action by withdrawing from Medicaid. In four other states we visited—Maryland, Missouri, Virginia, and Washington, D.C.—such withdrawals seldom occurred or were not allowed. In the remaining state, New York, providers are sometimes allowed to withdraw from its program, but state Medicaid officials said these cases are reported to the OIG, the state licensing board, and others. New York, however, removes certain providers it suspects of abuse, but does not report the cases to the OIG. New York program regulations permit either the provider or the state Medicaid agency to end the provider’s participation in the program “without cause,” with 30 days’ written notice. This practice has been used primarily against pharmacies that the state suspected were heavily involved in dispensing prescription drugs easily diverted to illicit use. As a result, the state agency has been able to deal quickly with pharmacies that it believed were involved in drug diversion. In the course of our work, we identified two other problems in state reporting to the OIG. In Missouri, for over 1 year, referrals from the Missouri Medicaid program did not reach the OIG’s Chicago field office because of some confusion associated with the closure of the OIG’s Kansas City field office and a realignment of responsibilities. One of the referrals that was not promptly considered involved a pediatric dentist who had been removed from the Missouri Medicaid program in May 1995, after the state licensing board had revoked his license. Among the numerous charges of poor quality of care against this dentist was that while attempting to administer a local anesthetic, he penetrated the nasal cavity of one child and pierced the jaw of another. He was also charged with being abusive to a patient by striking her and, in another case, failing to consult with a child’s parent before extracting four front teeth. A program analyst in the Chicago field office told us he first became aware of, and started working on, this case in March 1996, after receiving information on the dentist’s license revocation from the state dental board. The dentist was excluded nationwide by the OIG in August 1996—approximately 15 months after he had been excluded from the Medicaid program in Missouri. Finally, in Washington, D.C., Medicaid officials told us they did not report disciplinary actions to the OIG, and the official with overall responsibility for provider enrollment and removal did not know of the requirement to do so. Records in Washington’s Medicaid agency indicated that as of August 1996, 36 providers had been removed from its program for disciplinary reasons. In one case, the Medicaid agency had removed a provider in April 1994 for poor quality of care and patient abuse. In May 1996, the OIG began an effort, known as Project WEED, designed, in part, to determine if state MFCUs were reporting all mandatory exclusion cases. The project identified over 400 convictions resulting from MFCU investigations that, the OIG contended, had not been reported to its field offices. Although some of these cases may not have been reported to the OIG, the OIG may have been unaware of others because field offices lacked accountability over cases, as discussed earlier. One MFCU representative we contacted acknowledged his unit had not been reporting cases. However, a representative from another unit, which accounted for nearly one-third of the Project WEED cases, told us the cases had been reported to the appropriate field office. We believe that the OIG needs to provide clearer guidance to states on its reporting requirements. We also believe improved oversight by OIG field offices of key state agencies that refer cases to the OIG, such as MFCUs and state Medicaid agencies, would at least identify those agencies that are not reporting. Improved oversight would also allow the OIG to be better informed about the extent of states’ compliance with statutory reporting requirements for removed providers. The OIG and HCFA periodically provide state Medicaid agencies with lists of providers that have been excluded from federal health care programs. States are expected to use these exclusion data to ensure that OIG-excluded providers are removed from their Medicaid programs, if currently enrolled, or prevented from enrolling at a later date. Limitations in OIG’s exclusion data and inconsistencies between OIG and state tracking systems, however, can make it difficult for states to identify excluded providers. As a result, providers that have been excluded nationwide by the OIG sometimes continue to be enrolled in state Medicaid programs. The Health Insurance Portability and Accountability Act of 1996 contains provisions that could make the identification and tracking of excluded providers easier and more reliable, but these improvements are most likely years away from implementation. About twice a year, the OIG prepares a Cumulative Sanction Report, which is an alphabetical list of all individuals and organizations that have been excluded nationwide from federal health programs. For each name listed, the report shows date of birth and Social Security number (for individuals), health care specialty or type of business, and address. Also shown is the authority used to impose the exclusion and the date the exclusion took effect. The OIG provides a copy of the report, on a diskette, to HCFA. HCFA’s Issuances Unit prepares a paper copy of the report, which is then forwarded to a contractor for printing and distribution to state Medicaid agencies. The HCFA-prepared report does not identify individuals or organizations by Social Security or employer identification number.We were informed, however, that state Medicaid agencies could obtain a copy of the complete report, on a diskette, from the OIG. The OIG also provides HCFA with monthly exclusion updates on diskette, which HCFA sends to state Medicaid agencies in paper copy and via electronic mail. In contrast to the cumulative report, both the paper copy and, until recently, electronic versions of the monthly updates have included the Social Security numbers of individuals who were excluded since the previous monthly update. In the six states we visited, Medicaid officials responsible for ensuring that OIG-excluded providers were not enrolled in their programs were generally unaware of the availability of cumulative exclusion data on diskette, as well as monthly updates on electronic mail. Thus, to check on providers, Medicaid officials typically relied on paper copies of the cumulative exclusion list and monthly updates. Manually comparing the thousands of names on the OIG cumulative list and the dozens of names on the monthly updates with their enrollment files is difficult, if not impractical. Moreover, the paper copy of the cumulative exclusion list received by state Medicaid agencies lacks identifiers, such as Social Security numbers or employer identification numbers, which could facilitate checking. Although the OIG’s diskette of the cumulative exclusion list does not contain employer identification numbers for organizations, it does have Social Security numbers for individuals. Thus, states, if made aware that the diskette is available, could use it to cross-check with their provider enrollment files, to the extent state files contain Social Security numbers. When we cross-checked the automated version of OIG’s February 1996 Cumulative Sanction Report against the state Medicaid agency enrolled provider files, we found excluded providers enrolled in five state Medicaid programs. For example, we found 13 out-of-state providers who had been excluded by the OIG between 1988 and 1995, but were still enrolled in the Illinois Medicaid program. Similarly, we found 10 OIG-excluded providers enrolled in the Washington, D.C., Medicaid program, two each enrolled in Maryland and Missouri, and one enrolled in Virginia. One of the Illinois providers had received almost $25,000, while one of the Missouri providers had received over $9,000. Although none of the other providers had billed their state Medicaid programs after being excluded by the OIG, state Medicaid officials acknowledged that these providers would have been paid had they submitted claims. The states we visited tended to use the paper version of the OIG’s monthly list for a one-time cross-check against their active provider files. However, most states did not review earlier monthly lists to cross-check for an excluded provider who tried to enroll in the state’s Medicaid program in any month after exclusion. Thus, a provider could enroll in a state’s Medicaid program, after being excluded nationwide by the OIG, and not be detected. Likewise, some states we visited did not always cross-check providers that appeared on the monthly update but had out-of-state addresses. This can lead to problems because many providers can provide services in more than one state or can relocate, gaining access to Medicaid. An official in Missouri, for example, told us that although staff did cross-check the OIG monthly list against in-state and border state addresses, they did not check names from other states. New York officials also told us they only cross-checked names with addresses in their state because too much time would be required to cross-check the entire list. In our cross-checking, we found that almost all of the OIG-excluded providers enrolled in state Medicaid programs were listed with out-of-state addresses on the OIG’s excluded provider list. HCFA officials have recently updated a software program that would enable them to compress cumulative exclusion data and transmit the data to the states on the Internet. This report—unlike the cumulative report already available on the Internet and available to the public—would include Social Security numbers for individual providers. However, because of concerns about maintaining confidentiality for Social Security numbers transmitted over the Internet, HCFA decided not to electronically transmit to the states the cumulative report with Social Security numbers and stopped including Social Security numbers on the monthly updates. Thus, the OIG’s cumulative and monthly diskettes are currently the only automated means to obtain excluded providers’ Social Security numbers. After we gave several state officials an OIG diskette of excluded providers, including Social Security numbers, they told us that if they could have these data routinely, they would explore the feasibility of cross-checking the data against their enrollment files. For example, one state official told us that once he received automated listings of excluded providers, he intended to do periodic computer matches of OIG exclusion data and state provider files. Such matching, however, would still require extensive manual analysis of the results, he said, because OIG’s format cannot readily be made compatible with the state’s own files. Moreover, such computer-matching would not prevent a provider from enrolling in the program between matches. Much better, he said, would be for the state to integrate the exclusion data into its enrollment file; this integration would automatically ensure that OIG-excluded providers would be removed from the state’s Medicaid program and that OIG-excluded providers not currently enrolled could not enroll later. Consequently, he said, he had requested that the Medicaid agency’s information system staff explore the feasibility of setting up a system for capturing OIG exclusion data. Information system resources are currently focused on the state’s implementation of managed care and other priorities, however, he said, so this project most likely will not receive attention for a long time. No universal identifier for health care providers currently exists, and health care providers often have multiple identifiers for the programs and organizations with which they do business. This makes it difficult to identify and track excluded providers across health care programs. State Medicaid agencies, for instance, sometimes have difficulty determining whether OIG-excluded providers are enrolled or have attempted to enroll in their programs because identifying information about the providers on the exclusion list may be incomplete or different from the identifiers used in state data systems. Although OIG exclusion data usually include Social Security numbers for excluded individuals, the data do not include identifiers for certain excluded organizations, such as pharmacies, home health care agencies, and medical transportation companies. Almost 800 excluded organizations were listed on the OIG’s October 1996 cumulative report. Without an identifier, such as an employer identification number, it is difficult for a state Medicaid agency to determine whether a provider enrolled in its program is the same organization as one on the excluded provider list with the same or a similar name. Although OIG exclusion data usually include the addresses of excluded organizations, they frequently relocate or operate out of multiple locations. But including employer identification numbers on the OIG exclusion list would not necessarily solve the problem because organizations can use different numbers. The lack of common identifiers also hampers tracking providers in states that use identifiers other than Social Security numbers. Missouri and Virginia, for example, give individuals the option of enrolling by Social Security number or employer identification number. To the extent individuals in these states use employer identification numbers, excluded providers are unlikely to be detected through computer-matching of Social Security numbers. Alternatively, these states could attempt to match by name, but name-matching can result in many erroneous identifications, as well as the need for time-consuming research and follow-up. In some states, however, individual providers are identified solely or primarily by Social Security numbers, making it relatively easy to cross-check the OIG exclusion data with state enrollment files. In addition, certain kinds of excluded providers that do not directly bill a state Medicaid program—such as nurses, pharmacists, or physicians employed by hospitals, nursing homes, pharmacies, and health maintenance organizations—are difficult to identify. These providers, once excluded, can change employers or move to other states and continue to provide services through federal health care programs without detection. To at least partly deal with this problem, OIG exclusion data will be added to the National Practitioner Data Bank—a repository of information on practitioners (physicians, dentists, and other state-licensed health care providers) concerning malpractice payments; clinical privilege actions; and adverse actions taken by hospitals, insurance companies, licensing boards, and professional societies. The OIG believes that this action will substantially reduce the number of excluded licensed providers that continue to indirectly participate in federal health care programs in hospitals. This is because hospitals, when making appointments to their medical staff or granting clinical privileges, are required to query the database for all new practitioners and all current practitioners every 2 years. But not all excluded providers would be exposed by these queries. For one thing, not all providers are covered by the database because some are not state licensed. For example, Maryland does not license nurses’ aides. Moreover, some providers may not be affiliated with hospitals. Other organizations—such as nursing homes, pharmacies, and health maintenance organizations—are allowed, but not required, to query the database. The Health Insurance Portability and Accountability Act of 1996, enacted in August 1996, has added tools that may help the OIG and states track unacceptable providers. One of these tools is a system of unique health identifiers for all health care providers, which the act requires HHS to establish. Assigning a unique identifier to each health care provider should make it easier for state Medicaid agencies to determine if excluded providers are enrolled in their programs, reducing opportunities for excluded providers to receive inappropriate payment. However, full implementation will take several years. The act requires that within 18 months, the Secretary of HHS adopt a standard for a unique health identifier for all health care providers—both individuals and organizations. Since 1993, HCFA has been developing a unique identifier for Medicare providers, known as the National Provider Identifier (NPI). HCFA plans to adapt the NPI to meet the requirements of the act and has begun working to encourage states, private payers, and other federal agencies to adopt the NPI. A proposed regulation announcing the standard and seeking public comment is expected to be published in spring 1997, with a final regulation planned for July 1997. Although the law requires compliance with the standard within 24 months after it is adopted, according to HCFA officials we spoke with, it will most likely take much longer to assign NPIs to all health care providers. The law primarily deals with those providers who bill federal programs electronically, HCFA officials believe. Thus, HCFA will emphasize assigning identification numbers to these providers, reserving for later assigning numbers to other providers, including the estimated thousands who do not participate in federal programs at all. Implementing the provisions for a unique identifier may also be delayed because of unresolved questions on how to (1) meet the cost of implementing the new system, (2) ensure that all health care providers are identified and assigned NPIs, and (3) minimize the disruption to health plans and organizations when converting their provider enrollment files. Another tool provided for by the act—which may help the OIG, state Medicaid agencies, and other health care programs keep track of problem providers—is the Adverse Action Data Bank. Currently, no centralized database exists to track fraud and abuse in the health care system. The OIG’s excluded provider list is but one of several databases and information sources that contain information on problem health care providers. The Adverse Action Data Bank would provide a comprehensive and centralized database of “final adverse actions,” such as criminal convictions, civil judgements, exclusions from federal health care programs, administrative sanctions, and other disciplinary actions imposed against health care providers. This database is to be widely accessible to public and private health care organizations. Like assigning unique identifiers, setting up the database will take time to accomplish. The OIG, in conjunction with the Department of Justice, is responsible for overseeing the development of the database, but OIG officials we spoke with estimated implementation was at least a year away. Although start-up costs could be about $2 million, the costs to operate the database are largely unknown. Moreover, certain factors could limit the data bank’s effectiveness. For instance, the law does not contain sanctions or penalties if a government agency or health plan fails to report its adverse actions or use the database. Thus, some way must be found to (1) persuade these entities to report their adverse actions and (2) convince them, especially state agencies and health plans that will be charged for inquiries, that the database is useful. In addition, the law specifies that the database must not duplicate information already contained in the National Practitioner Data Bank. Moreover, the law exempts from reporting those settlements in which no findings of liability have been made, such as the provider withdrawals we found occurring in the Illinois Medicaid program. HCFA and OIG officials fear that if large numbers of providers attempt to enter into settlements to avoid being listed in the database, these exemptions could undermine the usefulness of the database. OIG officials attributed many of the problems we found to resource cuts over the last several years. For the audit and investigation of health care providers, the Health Insurance Portability and Accountability Act appropriates for the OIG not less than $60 million and not more than $70 million in extra funds for fiscal year 1997, with additional amounts authorized for subsequent years. Headquarters officials plan to use some of this money to hire additional field office staff to process exclusion cases, they said. In addition, under the Project WEED umbrella, the OIG has taken or planned other corrective actions: Tracking of incoming exclusion referrals: Since September 1996, the OIG field offices have maintained a database on all exclusion referrals from states. According to a headquarters official, as of December 1, 1996, more than 4,300 exclusion referrals had been logged in. Training of field office staff: In July and September 1996, field office staff who process exclusion referrals from states received training. It focused on what staff need to do to prepare a case for exclusion and reemphasized the criteria and guidance staff are expected to follow, headquarters officials said. Outreach efforts: The OIG plans to contact state Medicaid agencies, MFCUs, and licensing boards to ensure that all information needed to process provider exclusions is forwarded to field offices. Letters will be sent to these organizations, describing the specific documentation the OIG needs to process a case for exclusion. When providers defraud federal or state health care programs or give poor quality care, the OIG has authority to exclude them nationwide from participation in these programs. The process for excluding providers can and has operated successfully, with thousands of unacceptable providers excluded from Medicare, Medicaid, and other federal health care programs over the years. However, we found cases in which unacceptable providers in one state’s Medicaid program can be enrolled as providers under Medicare or in other states. Because of the amount of communication and coordination needed at the state and federal levels, the exclusion process is complex. Nevertheless, we believe that more attention must be paid to a system designed to help ensure the integrity of federal health programs and protect beneficiaries from poor quality care. In the long run, certain provisions of the Health Insurance Portability and Accountability Act of 1996 may assist the OIG and states in addressing these problems, but implementation is most likely several years in the future. Interim actions are needed. The OIG has taken several important actions to address some of the problems we identified. Tracking of incoming exclusion referrals should strengthen accountability for referrals received from the states and help ensure that none are overlooked. Training that has been provided to current staff should help reduce inconsistencies among field offices and improve the quality of processing, and plans to hire additional staff should improve the timeliness of exclusion processing. Outreach to states under Project WEED has resulted in identifying previously unknown exclusion cases. The OIG plans for further outreach to states under this project may result in identifying additional cases and may improve the extent to which states refer cases to the OIG. The OIG believes—and we concur—that these actions should help correct many of the problems we identified. However, we believe that refinements to these actions would encourage states to refer more unacceptable providers to the OIG and help the OIG to process these referrals promptly. For example, the OIG can further strengthen its exclusion referral process by clarifying reporting requirements and systematically monitoring key state agencies’ compliance. It could also follow through on its plans to contact state agencies to ensure that states provide the documentation the OIG needs to consider an exclusion action. In addition, the OIG could establish consistent standards—performance goals or benchmarks—to facilitate the timely processing of state referrals. Finally, OIG exclusion data need to be distributed to appropriate state officials in a format that aids timely comparison with state provider files. We recommend that the HHS Inspector General improve oversight of key state agencies that refer cases to the OIG, such as the state Medicaid agency and MFCU, to ensure that states understand and comply with the statutory reporting requirements for state-removed providers; clarify to states that settlements and provider withdrawals to avoid formal sanctions should be reported to the OIG, in accordance with its regulations (42 C.F.R. 1001.601); provide ongoing, clear, and consistent guidance to the states on the documentation needed for timely processing; establish consistent standards—performance goals or benchmarks—for the timely processing of state referrals; and in collaboration with HCFA, transmit OIG exclusion data either electronically or by diskette, including Social Security numbers, to state Medicaid agency officials responsible for enrolling and removing providers. We provided a draft of this report to the HHS Inspector General. In providing written comments, she also incorporated comments from HCFA (see app. IV). In general, she concurred with our recommendations. Concerning our recommendation that the OIG establish consistent standards—performance goals or benchmarks—for the timely processing of state referrals, the HHS Inspector General said she had recently reiterated to regional managers that they should apply criteria in the Office of Investigation’s Special Agent’s Handbook to permissive exclusion cases. The handbook criteria require that exclusion documents be forwarded immediately to the appropriate field office supervisor for evaluation and, as a general rule, within 60 working days of receipt, a decision should be rendered on whether or not the OIG will process the case for a permissive exclusion action. We believe that reemphasizing existing guidance as to time frames for evaluating whether to process an exclusion referral is an important step to improve timeliness. However, evaluating whether processing of a referral is warranted is only the first component of the overall exclusion process. Thus, we believe additional performance measures or goals, such as target time frames for completing the cases and referring them to headquarters, need to be established to improve timeliness, as well as to help the OIG measure the effectiveness of its work. The Inspector General expressed concern with our recommendation to ensure that state Medicaid officials responsible for enrolling and removing providers were aware of the availability of automated exclusion data with Social Security numbers. She said that it would be unreasonable and unnecessarily costly for HCFA, which is responsible for distributing exclusion data to the states, to provide the cumulative and monthly lists to each official in a state agency who might need that information. Instead, she said, the state official who receives the lists should ensure that all appropriate officials who need to be notified of the exclusion also receive the information. Nevertheless, the Inspector General said she would encourage HCFA to remind state officials of their responsibility to ensure the lists reach those who need them. In making this recommendation, our principal concern was that state Medicaid officials responsible for removing unacceptable providers from their programs were unaware that cumulative exclusion data with Social Security numbers were available in automated form. If state officials had such information, they might find it easier to ensure that OIG-excluded providers were not participating in their programs; in addition, the problems we found through computer-matching might not have occurred. To respond to the Inspector General’s comments, we revised this recommendation and combined it with a previous one to emphasize that the OIG and HCFA should collaborate to provide complete exclusion data, in automated form, to the states. We also requested comments on a draft of this report from the six state Medicaid agencies included in our review, as well as the MFCUs in Illinois, Maryland, and New York. We received written responses from the Illinois, Maryland, Missouri, and New York state Medicaid agencies. In general, they agreed with our conclusions and recommendations. In addition, the Illinois and Missouri state Medicaid agencies and the New York MFCU provided clarifying comments, which we incorporated as appropriate. Illinois, however, questioned our language indicating that federal regulations require states to report voluntary withdrawals to the OIG. The state suggested that federal reporting requirements as to negotiated settlements were unclear. Specifically, the state questioned whether a direct link existed between the law—which requires state Medicaid agencies to report providers who are “otherwise sanctioned”—and the federal regulations (42 C.F.R. 1001.601)—which define the term for purposes of explaining the circumstances under which the OIG may impose a permissive exclusion. We agree that the regulation is unclear. Consequently, we revised our language to remove any implication that the state had violated federal regulations by not reporting negotiated settlement agreements to the OIG. Nevertheless,the OIG interprets the regulation as requiring states to report providers who voluntarily withdraw from the Medicaid program to avoid an adverse action and communicated its interpretation in a letter to Illinois, dated February 24, 1997. In addition, the OIG plans to contact all state Medicaid agencies by spring 1997 to provide them with guidelines on the kind of cases that fall within the OIG’s exclusion authority and the documentation needed to support an exclusion. The guidance will cover provider withdrawals to avoid formal exclusion. As arranged with your office, unless you announce its contents earlier, we plan no further distribution of this report until 30 days after the date of this letter. At that time, we will send copies of this report to the Secretary and the Inspector General of HHS, the Administrator of HCFA, state officials in the six states we visited, and other interested parties. We also will make copies available to others upon request. Please call me at (312) 220-7600 or Kathryn G. Allen, Assistant Director, at (202) 512-7059 if you or your staff have any questions about this report. Other major contributors to this report include Robert T. Ferschl; Paul T. Wagner, Jr.; Robert E. Lippencott; Alfred R. Schnupp; and Jonathan H. Barker. To understand federal and state processes for excluding providers from Medicaid, we discussed the processes with Medicaid officials in six states, four OIG field offices, and OIG headquarters. In our six judgmentally selected states—Illinois, Maryland, Missouri, New York, Virginia, and Washington, D.C.—we spoke with officials who managed units that (1) enrolled providers in state Medicaid programs, (2) removed these providers when necessary, or (3) operated computer systems supporting those functions. In these states, we also contacted officials from the state MFCU—to obtain information on its fraud and abuse convictions—and selected state licensing boards—to understand the processes for disciplining providers that violate state licensing requirements. In the OIG’s Chicago, New York, Philadelphia, and Washington, D.C., field offices—which process referrals from the six states—we met with staff responsible for processing referrals; in OIG headquarters, we met with officials who make exclusion decisions and prepare the cumulative and monthly lists of excluded providers. At HCFA, we met with officials responsible for distributing OIG exclusion data to state Medicaid agencies and others. We also interviewed officials at OIG headquarters and HCFA to determine their plans to establish an Adverse Action Data Bank and develop a unique health care identifier, as required by the Health Insurance Portability and Accountability Act of 1996. To examine how well the OIG’s provider exclusion process was working, we examined a sample of cases, referred by selected state agencies, to determine their disposition by the OIG. Because field offices did not always log in or otherwise account for all referrals they received, we could not identify the universe of all cases from which we could draw a sample. Instead, we judgmentally sampled referrals made by state agencies to the Chicago, New York, and Philadelphia OIG field offices. See table I.1 for the OIG field offices and state agencies we visited and the number of cases we reviewed. In general, these cases represented referrals that state agencies had made to OIG field offices during 1994 and 1995. We reviewed the case files at OIG field offices from the Illinois and New York state Medicaid agencies and the Maryland MFCU. For the Illinois MFCU and Missouri Medicaid agency cases, we only determined their status at the OIG. In addition, for selected Illinois and New York Medicaid referrals, we determined if the providers were enrolled in Medicare, according to the Medicare contractors serving those states. Because these cases were not randomly selected, results cannot be generalized to all such cases referred by the states or processed by the OIG field offices and headquarters. However, the results of the OIG’s Project WEED indicate that the problems we identified through our work may be pervasive. In determining the disposition of permissive cases, we did not question OIG decisions on whether an exclusion was warranted. To determine whether any nationally excluded providers were still providing services under state Medicaid programs, we compared the OIG’s February 1996 list of excluded providers against states’ active provider files. To ascertain whether states were reporting to the OIG as required, we also compared states’ lists of providers excluded from their programs against the OIG’s excluded provider list. We performed our work between November 1995 and January 1997 in accordance with generally accepted government auditing standards. 1128(a)(1)1128(a)(2) Conviction for patient abuse or neglect 1128(a)(3) Felony conviction related to health care fraud 1128(a)(4) Felony conviction related to controlled substances 1128(b)(1) Misdemeanor conviction related to health care fraud 1128(b)(2) Conviction for obstructing an investigation 1128(b)(3) Misdemeanor conviction related to controlled substances 1128(b)(4) 1128(b)(5) Suspension or exclusion under a federal or state health care program 1128(b)(6) Excessive claims or furnishing of unnecessary or substandard items and services 1128(b)(7) Fraud, kickbacks, and related activities 1128(b)(8) Entities owned or controlled by a sanctioned individual 1128(b)(9) Failure to disclose required information 1128(b)(10) Failure to supply requested information on subcontractors and suppliers 1128(b)(11) Failure to provide payment information 1128(b)(12) Failure to grant immediate access 1128(b)(13) Failure to take corrective action 1128(b)(14) Default on health education loan or scholarship obligations 1128(b)(15) Individuals controlling an excluded entity 1128A(a) Imposition of a civil money penalty or assessment 1156(b) Mandatory exclusion provisions. Several examples of (1) cases for which the OIG had no record of state exclusion referrals when we initially inquired and (2) delays in OIG processing of state exclusion referrals (discussed on pp. 5-8). The following are additional examples of these two problems, which we identified in both the Chicago and New York field offices. On June 2, 1995, Illinois notified the OIG’s Chicago field office that it had removed a physician from its Medicaid program for providing poor quality care to Medicaid beneficiaries. For example, the state found that the physician often prescribed medications that had no correlation to patient symptoms or diseases and that his diagnoses were often unsupported. In one instance, the physician had prescribed a medication with a high sugar content for a diabetic. In another, he had prescribed the wrong medication for an eye problem. The OIG field office had no record of this case, when we inquired in March 1996. After our review, the field office obtained information on the removal and began processing the case. The physician was excluded in December 1996—18 months after the state first reported the case to the OIG. During this time period, the physician was enrolled in, but did not bill, Medicare. The Chicago field office had no record, when we inquired in March 1996, of a physician who had (1) been removed from the state Medicaid program in September 1995 for defaulting on a state student loan and (2) had his license revoked in October 1995 for leaving a hospitalized patient without physician coverage. As in the case above, the field office obtained information on the case after our review and forwarded the case to headquarters in June 1996. The case remained unresolved, however, as of January 1997, over 14 months after it was first referred by the state of Illinois. When we inquired in March 1996, the Chicago field office had no record of a physician who, according to state files, had been removed from the Illinois Medicaid program in September 1995 and reported to the OIG the following month. The state had removed the physician for repeatedly providing harmful and grossly inferior care to Medicaid beneficiaries. Among the state’s charges were that the physician failed to observe a patient during the 18 hours she was in labor in a hospital or to be present at the delivery, placed a patient at risk by not promptly treating a bladder infection, and failed to refer a patient to a specialist after long-term treatment did not control his blood pressure. The field office subsequently opened a case on the physician in April 1996. According to field office officials, the case remains unresolved as of January 1997. After this physician was excluded from Medicaid, he was paid over $9,000 (through Dec. 1996) for services provided to Medicare beneficiaries in Illinois. In March 1996, the Chicago field office had no record of a referral sent by the Illinois Medicaid agency 9 months earlier, in June 1995. The state had removed the provider, a transportation company, from the Medicaid program for overbilling. The case did not meet OIG criteria for exclusion, OIG officials later said. New York excluded a durable medical equipment supplier from Medicaid, effective June 1994, on the basis of a consistent disregard for Medicaid rules and regulations, as well as unacceptable recordkeeping practices. The state found over 2,000 claims, totaling more than $120,000, for which the provider could supply no documentation; for another 148 claims, totaling about $9,000, the documentation available was inadequate. About $21,500 of these overpayments had been collected as of November 1996. Over 2 years have elapsed since this provider was removed by the state, but the New York field office had no record of an exclusion. The New York field office had no record of a durable medical equipment dealer who had been excluded from the state’s Medicaid program in September 1994, after an audit revealed that the provider had billed for items not ordered by physicians and had “upcoded” some bills, charging for custom-made items when standard items were provided. The OIG excluded a transportation company 16 months after the Illinois Medicaid program reported that it had removed the company for billing for unauthorized services, using improper procedure codes, and failing to keep proper records. The field office case file showed no activity for lengthy periods. Over 16 months elapsed—including one 9-month period when no processing occurred—before the OIG excluded a pharmacy that had overcharged the Illinois Medicaid program by $136,000. After an audit revealed incomplete medical records, no documentation of patient medical histories, and multiple quality-of-care problems, New York removed a physician from Medicaid for 5 years, effective March 1995. The OIG’s New York field office was notified of the case in June 1995, but did not start processing the case until February 1996. Fourteen months after receiving the referral, the OIG excluded the provider. New York’s Medicaid agency excluded a physician for 5 years, in April 1994, after (1) an audit concluded the physician was overprescribing drugs and (2) an undercover investigator was able to obtain prescriptions on request, after a cursory examination. We could not determine from state or OIG case files when the OIG was notified, but about a year after state removal, the New York field office—because it had a backlog of work—transferred the case to the Boston field office. Thirteen months later, the Boston field office recommended exclusion and, in September 1996, the physician was excluded nationwide—more than 2 years after first being removed from New York’s Medicaid program. Between the state removal and federal exclusion dates, Medicare paid this provider over $8,700. New York excluded an ophthalmologist for 2 years, effective May 1995, after an audit determined that the physician rendered inappropriate care to Medicaid beneficiaries. The state charged, among other things, that the provider performed excessive glaucoma testing and treated patients inappropriately, using medications that were not indicated. In some cases, patients were placed at substantial risk. The state notified the New York OIG field office of this case in August 1995, and the OIG excluded the provider 1 year later. New York excluded a registered physician assistant for 5 years, effective March 1995, for conducting an unacceptable practice, maintaining inadequate records, and providing medical care and services far in excess of patients’ needs. Among other things, the state charged that the physician assistant often prescribed medications without adequate indication and provided medical care to Medicaid beneficiaries without adequate supervision of a licensed physician. The state notified the OIG of this case in late April 1995, but other than assigning the case a file number some time in 1996, the case file showed no activity when we reviewed it almost 19 months later. Given the age of this case and the office’s backlog, the regional inspector general said the case was unlikely to be processed for exclusion. New York removed a physician from its Medicaid program for 5 years, effective May 1994, for false claims, unacceptable recordkeeping, excessive services, and failure to meet recognized standards. For example, the state claimed that the physician provided potentially dangerous care by frequently prescribing the drug Elavil to substance abusers. The state also referred the provider to the state licensing board. We could not determine precisely when the field office received this case, but more than 2-1/2 years after the state removed the physician, the case remained unresolved. Like the case above, the regional inspector general said that because of the age of this case, it was unlikely to be processed for exclusion. New York removed a podiatrist from Medicaid, in May 1995, after she was convicted of billing Medicaid for services not actually provided. The OIG’s New York field office was already aware of this case at the time of the state removal because it had been notified of the physician’s indictment in February 1994. Although the field office lacked key documents needed to process the case for exclusion, the case file showed no evidence of follow-up until November 1996. Since the time the podiatrist had been removed from Medicaid in New York, Medicare had paid her about $1,900. A physician assistant was removed from Medicaid in New York, effective September 1995, based on an evaluation of quality of care, which showed that he did little to attempt to improve the health of patients other than frequently repeating laboratory tests. The Medicaid agency concluded that this was particularly dangerous because many of his patients had serious illnesses. In addition, there was no evidence of the assistant’s supervision by a licensed physician. The OIG was notified of this case in November 1995, but did not open its own case file until May 1996. The case was referred to headquarters in July 1996 and was still pending when we reviewed the file in November 1996. The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. VISA and MasterCard credit cards are accepted, also. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (202) 512-6000 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: Pursuant to a congressional request, GAO reviewed the Department of Health and Human Services (HHS) Inspector General's (OIG) process for excluding providers from federal health care programs. GAO noted that: (1) over the years, the OIG, working with state agencies, has excluded thousands of providers from participating in federal health care programs because of health care fraud, abuse, or quality-of-care problems, thus helping to protect the financial integrity of those programs and decreasing the likelihood that program beneficiaries receive substandard care; (2) several weaknesses in this exclusion process allow many unacceptable providers to remain on the rolls of federal health programs; (3) the weaknesses GAO identified include: (a) lack of controls at OIG field offices to ensure that all state referrals received are reviewed and acted on promptly; (b) inconsistencies among OIG field offices as to the criteria for excluding providers; (c) lack of oversight to ensure that states make appropriate exclusion referrals to the OIG; and (d) problems states experience in attempting to identify and remove from their programs providers that appear on the OIG's exclusion list; (4) these weaknesses place the health and safety of beneficiaries at risk and compromise the financial integrity of Medicaid; (5) moreover, difficulties states experienced in using OIG exclusion data allowed some providers to continue to be enrolled in a state Medicaid program after they had been excluded nationwide by the OIG; (6) OIG officials attributed many of these problems to repeated cutbacks in resources occurring in the past several years; (7) the Health Insurance Portability and Accountability Act of 1996, however, addresses this concern by providing the OIG with extra funding, specifically for dealing with health care fraud; (8) some of this funding, officials said, will be used to hire additional staff to process exclusion referrals; (9) the act also includes tools and resources to facilitate identifying unacceptable providers; (10) these tools include a system of unique billing numbers for health care providers, to be developed to reduce the potential for inappropriate payments, and an adverse action data bank, to be established to record information on any adverse action taken against a health care provider; (11) when implemented, these tools should help to limit the number of providers excluded from one program that continue to participate in others; (12) in the interim, the HHS Inspector General has initiated actions to improve the effectiveness of the exclusion process; and (13) while these efforts are significant, GAO believes further refinements are necessary to improve the exclusion process.