Opioids, such as hydrocodone, oxycodone, morphine, and methadone, can be prescribed to treat both acute and chronic pain. Because many opioids have a high potential for abuse and may lead to severe psychological or physical dependence, many of them are classified as Schedule II drugs under the Controlled Substances Act. The abuse of opioids has been associated with serious consequences, including addiction, overdose, and death. Medicare Part D plan sponsors are private organizations, such as health insurance companies and pharmacy benefit managers, contracted by CMS to provide outpatient drug benefit plans to Medicare beneficiaries. CMS provides guidance to plan sponsors that are responsible for establishing reasonable and appropriate drug utilization review (DUR) programs that assist in preventing misuse of prescribed medications in general, including the unsafe use of opioid pain medications. In 2013, CMS implemented the Medicare Part D opioid overutilization policy intended to improve medication safety. Through the Overutilization Monitoring System (OMS), CMS seeks to ensure that plan sponsors establish reasonable and appropriate DUR programs to prevent overutilization of opioids. CMS uses criteria in the OMS to identify high- risk use of opioids. Plan sponsors may, but are not required to, use these guidelines as part of their DUR. CMS’s Center for Program Integrity (CPI) oversees Part D program integrity and coordinates with other parts of CMS that monitor plan sponsor compliance with the Part D program. CPI has primary responsibility for overseeing NBI MEDIC, which is responsible for identifying and investigating potential Part D fraud, waste, and abuse, in general. NBI MEDIC handles complaints from beneficiaries and others, as well as requests from law enforcement; investigates providers and refers them to law enforcement as appropriate; and analyzes Part D program prescription drug event records and other data to identify patterns that may indicate fraud, waste, or abuse. NBI MEDIC’s responsibilities are for all Part D drugs and are not opioid-specific. One concern associated with prescribed opioids is their diversion—that is, the redirection of prescription drugs for an illegal purpose such as recreational use or resale. Diversion can include selling prescription drugs that were obtained legally, transferring a legitimately prescribed opioid to family or friends who may be trying to self-medicate, or pretending to be in pain to obtain a prescription opioid due to an addiction. It is often associated with “doctor shopping,” the attempt to obtain large amounts of opioids through multiple providers, or from multiple pharmacies. Doctor shopping can be used to help support an individual’s addiction or to obtain opioids for resale on the black market. Drug diversion can also include illicit prescribing, whereby providers—commonly known as “pill mills”—write unnecessary prescriptions or prescribe larger quantities than are medically necessary. Opioids are among the drugs with the highest potential for drug diversion. In 2016, CDC issued guidelines with recommendations for prescribing opioids in outpatient settings for chronic pain, based on consultation with experts and a review of scientific evidence. CDC noted in the guidelines that primary care physicians have reported concerns about opioid misuse and addiction, and find managing patients with chronic pain a challenge, possibly because of insufficient training in prescribing opioids. According to the guidelines, most experts agreed that long-term opioid dosage of 50 milligrams (mg) morphine equivalent dose (MED) per day or more generally increases overdose risk without necessarily adding benefits for pain control or function. Experts also noted that daily opioid dosages close to or greater than 100 mg MED per day are associated with significant risks. The guidelines therefore recommended that providers use caution when prescribing opioids at any dose, carefully reassess evidence of individual benefits and risks when increasing the dosage to 50 mg MED per day or more, and either avoid or carefully justify dosage at 90 mg MED or more. In making these recommendations, CDC noted that there is not a dosage threshold below which the risk of overdose is eliminated, but found that dosages less than 50 mg MED would reduce the risk for a large portion of patients. CDC also noted that providers should use additional caution in prescribing opioids to patients aged 65 and older, because the drugs can accumulate in the body to toxic levels. CMS provides guidance to plan sponsors on how they should monitor opioid overutilization problems among Part D beneficiaries. The agency includes this guidance in its annual letters to plan sponsors, known as call letters; it also provided a supplemental memo to plan sponsors in 2012. Among other things, these guidance documents instructed plan sponsors to implement a retrospective drug utilization review (DUR) system to monitor beneficiary utilization starting in 2013. As part of the DUR systems, CMS requires plan sponsors to have methods to identify beneficiaries who are potentially overusing specific drugs or groups of drugs, including opioids. Also in 2013, CMS created the Overutilization Monitoring System (OMS), which outlines criteria to identify beneficiaries with high-risk use of opioids and to oversee sponsors’ compliance with CMS’s opioid overutilization policy. Plan sponsors may use the OMS criteria for their DUR systems, but they have some flexibility to develop their own targeting criteria, within CMS guidance. The OMS considers beneficiaries to be at a high risk of opioid overuse when they meet all three of the following criteria: (1) receive a total daily MED greater than 120 mg for 90 consecutive days, (2) receive opioids prescriptions from four or more providers in the previous 12 months, and (3) receive opioids from four or more pharmacies in the previous 12 months. The criteria exclude beneficiaries with a cancer diagnosis and those in hospice care, for whom higher doses of opioids may be appropriate. Officials from all six plan sponsors we interviewed confirmed they have a DUR system that specifically looks at opioids. In addition, to be consistent with CMS, all of the plan sponsors adopted criteria similar to the OMS, with some minor modifications—typically involving the number of months in which they measured beneficiaries’ opioid prescriptions. Through the OMS, CMS generates quarterly reports that list beneficiaries who meet all of the criteria and who are identified as high-risk and then distributes the reports to the plan sponsors. Plan sponsors are expected to review the list of identified beneficiaries, determine appropriate action, and then respond to CMS with information on their actions within 30 days. According to CMS officials, the agency also expects that plan sponsors will share any information with CMS on beneficiaries that they identify through their own DUR systems. Some actions plan sponsors may take include Case management. After plan sponsors identify beneficiaries with patterns of inappropriate opioid use and possible coordination of care issues through their DUR analysis, they may conduct case management. Case management may include an attempt to improve coordination issues, and often involves provider outreach, whereby the plan sponsor will contact the providers associated with the beneficiary to let them know that the beneficiary is receiving high levels of opioids and may be at risk of harm. In addition to outreach, officials from two of the six plan sponsors we interviewed told us they focus on provider education and one plan sponsor said they may direct the providers to the CDC guidelines or other information to help reduce overutilization. Officials from two plan sponsors reported that they also reach out to beneficiaries to let them know they are receiving high levels of opioids and may be at risk of harm. Beneficiary-specific point-of-sale (POS) edits. When plan sponsors determine that a beneficiary is at risk for opioid harm, they may choose to implement a beneficiary-specific POS edit to prevent overutilization. Beneficiary-specific POS edits are restrictions that limit these beneficiaries to certain opioids and amounts. Pharmacists receive a message when a beneficiary attempts to fill a prescription that exceeds the limit in place for that beneficiary. CMS expects plan sponsors to report on the POS edits they use through CMS’s Medicare Advantage and Prescription Drug System for information sharing and monitoring purposes. That way, if a beneficiary changes plans, the new plan sponsor will receive an alert about the beneficiary’s record of POS edits. From February 2014 through March 10, 2016, there were 2,693 POS edits reported in that system for 2,520 beneficiaries. Formulary-level POS edits. CMS expects plan sponsors to use formulary-level POS edits to prospectively prevent opioid overutilization. These edits alert providers who may not have been aware that their patients are receiving high levels of opioids from other doctors. CMS recommends these formulary-level edits to be used when a beneficiary has a cumulative opioid MED of at least 90 mg. Referrals for investigation. According to the six plan sponsors we interviewed, the referrals can be made to NBI MEDIC or to the plan sponsor’s own internal investigative unit, if they have one. After investigating a particular case, if a plan sponsor or NBI MEDIC determines that a beneficiary is suspected of diverting opioids, they may refer the case to the HHS-OIG, or a law enforcement agency, according to CMS, NBI MEDIC, and one plan sponsor. Pharmacy lock-ins. Beginning in 2019, Medicare Part D plan sponsors will be able to restrict certain beneficiaries identified as at- risk for prescription drug abuse to a single pharmacy for all their opioid prescriptions, known as a pharmacy “lock in.” Some plan sponsors explained that they use pharmacy lock-ins for their commercial and Medicaid lines of business, and generally found them to be a useful tool for controlling opioid use. Based on CMS’s use of the OMS and the actions taken by plan sponsors, CMS reported a decrease in the number of beneficiaries meeting the OMS criteria of high-risk—which agency officials consider an indication of success toward its goal of decreasing opioid use disorder. From calendar years 2011 through 2016, there was a 61 percent decrease in the number of beneficiaries meeting the OMS criteria. (See table 1.) In addition to using the OMS as a monitoring tool to oversee plan sponsors’ compliance with their DUR system requirements, CMS relies on patient safety measures to assess how well Part D plan sponsors are monitoring beneficiaries and taking appropriate actions. Specifically, CMS tracks data on plan sponsors’ performance for 15 measures related to Part D patient safety that are developed and maintained by the Pharmacy Quality Alliance, and CMS communicates with plan sponsors about their performance. In 2016, CMS started tracking plan sponsors’ performance on three Pharmacy Quality Alliance-approved patient safety measures that are directly related to opioids, which were 1. The proportion of beneficiaries that use opioids at high dosages (more than 120 mg MED for 90 days or longer) in persons without cancer or not in hospice care. 2. The proportion of beneficiaries that use opioids from multiple providers (four or more providers and four or more pharmacies) in persons without cancer or not in hospice care. 3. The proportion of beneficiaries that use opioids at high dosage and from multiple providers in persons without cancer or not in hospice care, and that meet both of the other measures. The three measures are similar to the OMS criteria in that they identify beneficiaries with high dosages of opioids (120 mg MED) from multiple providers and pharmacies (four or more of each). However, there are a number of differences between these measures and the OMS. For example, the OMS counts actual beneficiaries, while the patient safety measures report member-years, which are adjusted to account for beneficiaries who are enrolled in a plan for only part of a year. In addition, these measures separately identify beneficiaries who fulfill each of those criteria individually. For example, data gathered on the first measure indicate that about 285,119 beneficiaries, counted as member- years across all Part D plans, received high doses (more than 120 mg MED) of opioids for 90 days or longer during calendar year 2016. CMS also uses these data in different ways from how it uses OMS data. The OMS criteria were developed and maintained by CMS to identify patients at risk for harm who may warrant case management and to examine opioid use trends across the Part D program, including progress toward its goal of decreasing opioid use disorder. In contrast, CMS officials told us that the agency uses the patient safety measures to assess plan sponsor performance. The patient safety measures also serve as a tool for Part D sponsors to compare their performance to overall averages, and to track progress in improving these measures over time. CMS also tracks sponsors’ progress in improving the measures, according to agency officials. Each quarter, CMS contacts plan sponsors who have the lowest performance on each measure and expects them to respond about actions they take to improve performance. Beginning in April 2017, the agency began distributing to plan sponsors the beneficiary-level files for the patient safety measures. CMS officials said that these files provide a complete list of beneficiaries included in each of the measures. While CMS tracks the total number of beneficiaries who meet all three OMS criteria as part of its opioid overutilization oversight across the Part D program, it does not have comparable information on most beneficiaries who may be at risk for harm. CMS has goals to reduce the risk of opioid use disorders, overdoses, inappropriate prescribing, and drug diversion in its Opioid Misuse Strategy, but OMS does not track the number of beneficiaries with prescriptions for high doses of opioids unless those beneficiaries are also receiving them both from four or more providers and from four or more pharmacies; and agency officials told us that CMS has no plans for OMS to begin doing so. According to CDC guidelines, long-term use of high opioid dosages—those above a MED of 90 mg per day—are associated with significant risk of harm and should be avoided if possible. Based on the CDC guidelines, outreach to Part D plan sponsors, and CMS analyses of Part D data, CMS has revised its current OMS criteria to include more at-risk beneficiaries beginning in 2018. The new OMS criteria define a high user as having an average daily MED greater than 90 mg for any duration, and who receives opioids from four or more providers and four or more pharmacies, or from six or more providers regardless of the number of pharmacies, for the prior 6 months. According to CMS officials, the revised OMS criteria, like the current criteria, are intended to identify the beneficiaries it determined are at the greatest risk of harm: those who may lack coordinated care as a result of using multiple pharmacies and providers. CMS officials also noted that the revised criteria are intended to limit the increase in the number of beneficiaries for whom plan sponsors are expected to take action, such as case management, to avoid overburdening plan sponsors with unreasonable workload levels. While the revised criteria will help identify beneficiaries who CMS determined are at the highest risk of opioid misuse and therefore may need case management by plan sponsors, they will not provide information on most Part D beneficiaries who may also be at risk of harm. In developing the revised criteria, CMS conducted a one-time analysis that estimated there were 727,016 beneficiaries with an average MED of 90 mg or more, for any length of time during a 6 month measurement period in 2015, regardless of the number of providers or pharmacies used. These beneficiaries may be at risk of harm from opioids, according to CDC guidelines, and therefore tracking the number of these beneficiaries over time could help CMS to determine whether it is making progress toward meeting the goals specified in its Opioid Misuse Strategy. However, CMS officials told us that the agency does not keep track of these beneficiaries, and does not have plans to do so as part of OMS. Instead, CMS uses the number of beneficiaries who meet the OMS criteria as an indicator of progress toward its goals. CMS estimated that 33,223 beneficiaries would have met its revised criteria based on 2015 data, which is a much smaller number than the estimated 727,016 beneficiaries at risk of harm from opioids. (See fig. 1.) In 2016, CMS began to gather information from its patient safety measures on the number of beneficiaries who use more than 120 mg MED of opioids for 90 days or longer, regardless of the number of providers and pharmacies. However, this information does not include all at-risk beneficiaries, because the threshold is more lenient than indicated in CDC guidelines and CMS’s new criteria for OMS. Specifically, CMS’s one-time analysis of 2015 data indicated that 727,016 beneficiaries received prescriptions with an average MED of 90 mg or more for any length of time during a 6-month measurement period. In contrast, the 2016 patient safety measures reports identified significantly fewer beneficiaries, 285,119, in its most comparable measure—member years for opioid prescriptions at 120 mg MED for 90 consecutive days or longer. According to CMS officials, CMS shared feedback with the Pharmacy Quality Alliance to consider updating the threshold to 90 mg MED to align with CDC guidelines and the revised OMS criteria. CMS officials said the agency will consider adopting these updates once complete. In addition, while CMS monitors the patient safety measure data, these data are relatively new. CMS officials told us that, as a result, the agency does not yet have enough data to report changes over time toward its goals to reduce the risk of opioid use disorders, overdoses, and inappropriate prescribing. Neither the data gathered as part of OMS, nor patient safety measures gathered so far are adequate to provide CMS with the information necessary to track progress toward meeting its goal of reducing harm from opioids. While tracking a smaller number of beneficiaries in OMS is useful for targeting resource-intensive plan sponsor actions, keeping track of the larger number of beneficiaries at risk of harm from high doses of opioids—greater than 90 mg MED for any duration regardless of the number of providers and pharmacies—could provide CMS with information on progress toward its goals without additional monitoring by plan sponsors. Doing so would also be consistent with federal internal control standards, which require agencies to use quality information to achieve objectives and address risks. Without tracking the number of beneficiaries who receive potentially dangerous levels of opioids regardless of the number of providers or pharmacies, and then examining changes in that number over time, CMS lacks key information that would be useful to determine if it is making progress toward reducing the risk of opioid harm for Part D beneficiaries. CMS oversees providers who prescribe opioids to Medicare Part D beneficiaries through its contractor, NBI MEDIC, and the Part D plan sponsors. CMS requires NBI MEDIC to identify providers who prescribe high amounts of drugs classified as Schedule II under the Controlled Substances Act, which indicates a high potential for abuse and includes many opioids. Using prescription drug event data, NBI MEDIC conducts a peer comparison of providers’ prescribing practices to identify outlier providers—the highest prescribers of Schedule II drugs, which include, but are not limited to, opioids. NBI MEDIC’s initial analyses focuses on providers associated with at least 100 prescription drug event records or at least $100,000 in total Part D payments for Schedule II drugs over the course of one year. These providers are then classified as outliers if they are listed as high in both the number of prescription drug records per prescriber and prescriptions per beneficiary by specialty within each state. NBI MEDIC reports to CMS on the providers with the highest number of prescriptions identified by the analysis. Beginning with the October 2016 report, CMS began sharing NBI MEDIC’s prescriber outlier report with the plan sponsors quarterly to supplement their own investigations of potential fraud, waste, and abuse. According to data from NBI MEDIC, the number of outlier providers identified has generally remained stable except for an increase in 2015. NBI MEDIC and CMS officials said this increase occurred when a commonly used opioid, hydrocodone, was added to the analysis after it was reclassified as a Schedule II drug. NBI MEDIC gathers data on Medicare Part C and Part D and uses its Predictive Learning Analytics Tracking Outcome (PLATO) system to conduct a number of data analysis projects. According to NBI MEDIC officials, these PLATO projects seek to identify potential fraud by examining data on provider behaviors. In addition, according to officials, PLATO is capable of allowing NBI MEDIC to share information on providers with plan sponsors. NBI MEDIC officials stated there are two current PLATO projects that include a focus on some opioids. The TRIO data project identifies providers who prescribe beneficiaries a combination of an opioid, a benzodiazepine, and the muscle relaxant Carisoprodol. This well-known combination of drugs is used to increase the effects of opioids. The Pill Mill data project identifies providers with abnormal prescribing behavior in authorizing controlled substances, including opioids, absent medical necessity. To identify providers potentially operating a pill mill, 17 risk factors are considered, including the number of beneficiaries for whom a provider prescribed controlled substances, the quantity of these medications, the number of beneficiaries who travel long distances to receive medications, and the number of beneficiaries treated for drug abuse or misuse at emergency rooms. Another analysis that NBI MEDIC conducts, according to its officials, is the Transmucosal Immediate Release Fentanyl project, which identifies potential improper payments for medicines containing fentanyl, a prescription opioid pain reliever. NBI MEDIC looks for instances of this drug being prescribed to beneficiaries who do not have cancer combined with breakthrough pain, the only approved use for this drug. NBI MEDIC officials said they conduct investigations to assist CMS in identifying cases of potential fraud, waste, and abuse among providers for Medicare Part C and Part D. The investigations are prompted by complaints from plan sponsors, calls to NBI MEDIC’s call center, NBI MEDIC’s analysis of outlier providers, or from one of its other data analysis projects. As part of its investigations, NBI MEDIC officials said they may access data from Medicare Part B, which includes coverage for doctors’ services and outpatient care, to determine whether providers’ diagnoses coincide with their prescriptions. Officials added that they investigate inappropriate prescribing by reviewing Part D prescription records, medical records, or PLATO data; or by conducting background checks, interviewing beneficiaries, or conducting site visits, among other activities. NBI MEDIC data indicates that the total number of its investigations decreased from 2013 to 2016, which, according to NBI MEDIC officials, occurred because it increased activities related to data analysis and collaboration with plan sponsors. After identifying providers engaged in potential fraudulent overprescribing, NBI MEDIC officials said they may refer cases to agencies for further investigation and potential prosecution, such as the HHS-OIG, state and local law enforcement, the Federal Bureau of Investigations, or the Drug Enforcement Administration. In 2016, NBI MEDIC data showed that it referred a total of 119 cases to the HHS-OIG and 48 to agencies within the Department of Justice, including the Federal Bureau of Investigations and the Drug Enforcement Agency. CMS officials told us that they do not routinely track the results of individual cases referred by NBI MEDIC to other agencies. A 2016 Senate committee report indicated that the HHS- OIG declined and returned more than half of the cases referred to it from 2013 through 2015. According to NBI MEDIC officials, cases may be rejected for reasons such as not meeting prosecutorial thresholds for evidence, or HHS-OIG does not having enough staff to take on the workload. NBI MEDIC officials told us that HHS-OIG does not always inform NBI MEDIC of its reasons for declining the referrals. CMS requires all plan sponsors to adopt and implement an effective compliance program, which must include measures to prevent, detect, and correct Part C or Part D program noncompliance, as well as fraud, waste, and abuse. CMS communicates guidance for plan sponsor’s compliance programs through Chapter 9 of CMS’s Prescription Drug Benefit Manual and in annual letters. CMS’s guidance focuses broadly on prescription drugs, and does not specifically address opioids. To detect fraud, waste, and abuse among providers, plan sponsors told us they use their own data analysis and criteria, as well as NBI MEDIC’s list of outlier providers. For example, plan sponsors identify providers suspected of fraud, waste, or abuse by looking for certain characteristics, such as providers who have a large number of beneficiaries traveling from a different zip code to receive prescriptions, or providers who prescribe large quantities of commonly abused drugs with no associated medical claims to support the prescriptions. Once the suspected providers are identified, plan sponsors said that they conduct their own investigations to determine if there is sufficient evidence of inappropriate prescribing. Plan sponsors told us they may choose to take a number of actions based on these investigations, including choosing to refer the case to NBI MEDIC. Additionally, if appropriate, plan sponsors can educate providers about prescribing guidelines and best practices, or notify them that their patients may be doctor shopping, in order to improve coordination of care. They may also terminate a provider from their plan if they find evidence of fraud or abuse. CMS lacks the information necessary to adequately determine the number providers potentially overprescribing opioids, and therefore cannot determine the effectiveness of efforts to achieve the agency’s goals of reducing the risk of opioid use disorders, overdoses, inappropriate prescribing, and drug diversion. CMS’s oversight actions focus broadly on Schedule II drugs rather than specifically on opioids. For example, NBI MEDIC’s analyses to identify outlier providers do not indicate the extent to which they may be overprescribing opioids specifically. According to CMS officials, they direct NBI MEDIC to focus on Schedule II drugs, because they have a high potential for abuse, whether they are opioids or other drugs. However, without specifically identifying opioids in these analyses—or an alternate source of data— CMS lacks data on providers who prescribe high amounts of opioids, and therefore cannot assess progress toward meeting its goals related to opioid use. CMS also lacks key information necessary for oversight of opioid prescribing, because it does not require plan sponsors to report to NBI MEDIC or CMS cases of fraud, waste, and abuse; cases of overprescribing; or any actions taken against providers. Plan sponsors collect information on cases of fraud, waste, and abuse, and can choose to report this information to NBI MEDIC or CMS. PLATO, a voluntary reporting system, is one way that plan sponsors can report information to NBI MEDIC or CMS, and share with other plan sponsors about providers they investigate and about actions they take. While CMS receives some information from plan sponsors who voluntarily report their actions, it does not know the full extent to which plan sponsors have identified providers who have prescribed high amounts of opioids and taken action to reduce overprescribing. Without this information, CMS cannot determine the extent to which plan sponsors are taking action to reduce overprescribing, making it difficult to assess progress in this area. CMS officials told us that they receive reports on what information plan sponsors enter into PLATO. However, according to these officials, they do not have information on all actions taken by plan sponsors; therefore, CMS does not know how often plan sponsors use PLATO or what proportion of actions they report. A 2015 HHS-OIG report recommended that CMS require plan sponsors to report all potential fraud and abuse to CMS and/or NBI MEDIC. CMS disagreed with this recommendation, and stated that plan sponsors currently have several options for referring incidents, that CMS has worked with plan sponsors to improve organizational performance, and that plan sponsors regularly share information on best practices for prevention and detection of fraud. The HHS-OIG continues to recommend that CMS require reporting due to the lack of a comprehensive set of data needed to monitor providers’ inappropriate prescribing. Without specifically monitoring providers’ overprescribing of opioids, CMS cannot determine if its efforts, or the efforts of NBI MEDIC and plan sponsors, are helping to contribute to its goals related to opioid use. Federal internal control standards require agencies to conduct monitoring activities and to use quality information to achieve objectives and address risks. Without adequate information on providers’ opioid prescribing patterns in Part D, CMS is unable to determine whether its related oversight efforts—including such efforts by NBI MEDIC or Part D plan sponsors—are effective or should be adjusted. A large number of Medicare Part D beneficiaries use prescription opioids, and reducing the inappropriate prescribing of these drugs is a key part of CMS’s strategy to decrease the risk of opioid use disorder, overdoses, and deaths. Despite working to identify and decrease egregious opioid use behavior—such as doctor shopping—among beneficiaries in Medicare Part D, CMS lacks the necessary information to effectively determine the full number of beneficiaries at risk of opioid harm. CMS recently expanded the number of beneficiaries for whom it expects plan sponsors to conduct intervention efforts, such as case management, and has begun to collect additional patient safety measure data on beneficiaries at risk of harm from opioids. However, these efforts have not yet provided CMS with sufficient data to track how many beneficiaries are receiving large doses of opioids, and therefore are at risk of harm. Without expanding and enhancing its data collection efforts to include information on more at-risk beneficiaries, CMS cannot fully assess whether it is making sufficient progress toward its goals of reducing opioid use disorders, overdoses, inappropriate prescribing, and drug diversion. CMS’s efforts to oversee opioid prescribing specifically are also inadequate. CMS directs NBI MEDIC to focus its analyses on providers who prescribe any drugs with a high risk of abuse, but NBI MEDIC does not specifically track those providers who prescribe opioids. Absent opioid-specific monitoring, CMS cannot assess whether its efforts to reduce opioid overprescribing are effective, or if opioid prescribing patterns are changing over time. In addition, neither CMS nor NBI MEDIC can be sure they have complete information about providers potentially overprescribing opioids to Part D beneficiaries, because plan sponsors are not required to report to CMS or NBI MEDIC all potential fraud and abuse incidents or actions sponsors have taken against providers. As a result, CMS lacks information about plan sponsors’ monitoring of providers who overprescribe opioids, and is therefore unable to determine if the agency’s and plan sponsors’ efforts are successful in achieving CMS’s goals. We are making the following three recommendations to CMS. The Administrator of CMS should gather information over time on the number of beneficiaries at risk of harm from opioids, including those who receive high opioid morphine equivalent doses regardless of the number of pharmacies or providers, as part of assessing progress over time in reaching the agency’s goals related to reducing opioid use. (Recommendation 1) The Administrator of CMS should require its contractor, NBI MEDIC, to identify and conduct analyses on providers who prescribe high amounts of opioids separately from providers who prescribe high amounts of any Schedule II drug. (Recommendation 2) The Administrator of CMS should require plan sponsors to report to CMS on investigations and other actions taken related to providers who prescribe high amounts of opioids. (Recommendation 3) We provided a draft of this report to HHS for comment. HHS provided written comments, which are reprinted in appendix I, and technical comments, which we incorporated as appropriate. In its written comments, HHS described its efforts to reduce opioid overutilization in Medicare Part D. HHS noted that these efforts include a medication safety approach to improve care coordination for high-risk beneficiaries using opioids, quality metrics for plan sponsors, and data analysis of prescribing patterns to target potential fraud, waste, and abuse. For example, HHS noted that CMS adopted a Medicare Part D opioid overutilization policy in 2013 that provided specific guidance to Part D plans on effective drug utilization review programs to reduce overutilization of opioids. As described in our report, CMS’s opioid overutilization policy requires sponsors to implement retrospective drug utilization review programs to identify beneficiaries who are potentially overusing opioids. Among other things, sponsors may choose to implement beneficiary-specific edits that limit high-risk beneficiaries to certain opioids and amounts, and CMS expects them to use formulary- level edits to alert providers when their patients are receiving high levels of opioids from other doctors. HHS also concurred with two of our three recommendations. HHS concurred with our recommendation that CMS gather information over time on the number of beneficiaries at risk of harm from opioids, as part of assessing progress toward agency goals. HHS commented that CMS tracks beneficiaries who meet these criteria through the patient safety measures. However, while these patient safety measures are a potential source of this information, they currently do not include all at-risk beneficiaries, because the opioid use threshold they use (120 mg MED for 90 days or longer) is more lenient than indicated in CDC guidelines or in CMS’s revised OMS criteria. In addition, while CMS uses the patient safety measures to assess plan sponsor performance, the data are relatively new, and CMS has not yet used them to report progress over time toward its goals. HHS concurred with our recommendation that CMS require NBI MEDIC to gather separate data on providers who prescribe high amounts of opioids, and HHS noted that it intends to work with NBI MEDIC to identify trends in outlier prescribers of opioids. HHS did not concur with our recommendation that CMS require plan sponsors to report on investigations and other actions taken related to providers who prescribe high amounts of opioids. HHS noted that plan sponsors have the responsibility to detect and prevent fraud, waste, and abuse and that CMS reviews cases when it conducts audits. HHS also stated that it seeks to balance requirements on plan sponsors when considering new regulatory requirements. As noted in our report, plan sponsors conduct investigations and take actions against providers, and some plan sponsors report actions to CMS and NBI MEDIC. However, without complete reporting, such as reporting from all plan sponsors on the actions they take to reduce overprescribing, CMS is missing key information that could help assess progress in this area. Due to the importance of this information, we continue to believe that CMS should require plan sponsors to report on the actions they take. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the Secretary of HHS and the Administrator of CMS. In addition, the report will be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact me at (202) 512-7114 or CurdaE@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II. In addition to the contact named above, Will Simerl (Assistant Director), Carolyn Feis Korman (Analyst-in-Charge), Amy Andresen, Samantha Pawlak, and Patricia Roy made key contributions to this report. Also contributing were Muriel Brown, Drew Long, and Emily Wilson.

Summary: Misuse of prescription opioids can lead to overdose and death. In 2016, over 14 million Medicare Part D beneficiaries received opioid prescriptions, and spending for opioids was almost $4.1 billion. GAO and others have reported on inappropriate activities and risks associated with these prescriptions, such as receiving multiple opioid prescriptions from different providers. GAO was asked to describe what is known about CMS’s oversight of Medicare Part D opioid use and prescribing. This report examines (1) CMS oversight of beneficiaries who receive opioid prescriptions under Part D, and (2) CMS oversight of providers who prescribe opioids to Medicare Part D beneficiaries.GAO reviewed CMS opioid utilization and prescriber data, CMS guidance for plan sponsors, and CMS’s strategy to prevent opioid misuse. GAO also interviewed CMS officials, the six largest Part D plan sponsors, and 12 national associations selected to represent insurance plans, pharmacy benefit managers, physicians, patients, and regulatory and law enforcement authorities. The Centers for Medicare & Medicaid Services (CMS) provides guidance on the monitoring of Medicare beneficiaries who receive opioid prescriptions to plan sponsors—private organizations that implement the Medicare drug benefit, Part D—but lacks information on most beneficiaries at risk of harm. CMS provides plan sponsors guidance on how they should monitor opioid overutilization among Medicare Part D beneficiaries and requires them to implement drug utilization review systems that use criteria similar to CMS's. CMS's criteria focus on beneficiaries who (1) receive prescriptions of high doses of opioids, (2) receive prescriptions from four or more providers, and (3) fill the prescriptions at four or more pharmacies. According to CMS officials, this approach allows plan sponsors to focus their actions on those beneficiaries it determined to have the highest risk of harm from opioid use. CMS’s criteria, including recent revisions, do not provide sufficient information about the larger population of potentially at-risk beneficiaries. CMS estimates that while 33,223 beneficiaries would have met the revised criteria in 2015, 727,016 would have received high doses of opioids regardless of the number of providers or pharmacies. In 2016, CMS began to collect information on some of these beneficiaries using a higher dosage threshold for opioid use. This approach misses some who could be at risk of harm, based on Centers for Disease Control and Prevention guidelines. As a result, CMS is limited in its ability to assess progress toward meeting the broader goals of its Opioid Misuse Strategy, which includes activities to reduce the risk of harm from opioid use. CMS Estimates of 2015 Part D Beneficiaries with High Opioid Doses and Those Who Would Have Met Revised Overutilization Monitoring Criteria CMS oversees the prescribing of drugs at high risk of abuse through a variety of projects, but does not analyze data specifically on opioids. According to CMS officials, CMS and plan sponsors identify providers who prescribe large amounts of drugs with a high risk of abuse, and those suspected of fraud or abuse may be referred to law enforcement. However, GAO found that CMS does not identify providers who may be inappropriately prescribing large amounts of opioids separately from other drugs, and does not require plan sponsors to report actions they take when they identify such providers. As a result, CMS is lacking information that it could use to assess how opioid prescribing patterns are changing over time, and whether its efforts to reduce harm are effective. GAO recommends that CMS (1) gather information on the full number of at-risk beneficiaries receiving high doses of opioids, (2) identify providers who prescribe high amounts of opioids, and (3) require plan sponsors to report to CMS on actions related to providers who inappropriately prescribe opioids. HHS concurred with the first two recommendations, but not with the third. GAO continues to believe the recommendation is valid, as discussed in the report.