Since 1996, Congress has taken important steps to increase Medicare program integrity funding and oversight, including the establishment of the Medicare Integrity Program. Table 1 summarizes several key congressional actions. CMS has made progress in strengthening provider and supplier enrollment provisions, but needs to do more to identify and prevent potentially fraudulent providers and suppliers from participating in Medicare. Additional improvements to prepayment and postpayment claims review would help prevent and recover improper payments. Addressing payment vulnerabilities already identified could further help prevent or reduce fraud. PPACA authorized and CMS has implemented new provider and supplier enrollment procedures that address past weaknesses identified by GAO and HHS’s Office of Inspector General (OIG) that allowed entities intent on committing fraud to enroll in Medicare. CMS has also implemented other measures intended to improve existing procedures. Specifically, to strengthen the existing screening activities conducted by CMS contractors, the agency added screenings of categories of provider and supplier enrollment applications by risk level, contracted with new national enrollment screening and site visit contractors, began imposing moratoria on new enrollment of certain types of providers and suppliers, and issued regulations requiring certain prescribers to enroll in Medicare. CMS and OIG issued a final rule in February 2011 to implement many of the new screening procedures required by PPACA. CMS designated three levels of risk—high, moderate, and limited—with different screening procedures for categories of Medicare providers and suppliers at each level. Providers and suppliers in the high-risk level are subject to the most rigorous screening. (See table 2.) Based in part on our work and that of OIG, CMS designated newly enrolling home health agencies and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) as high risk, and designated other providers and suppliers as lower risk levels. Providers and suppliers at all risk levels are screened to verify that they meet specific requirements established by Medicare, such as having current licenses or accreditation and valid Social Security numbers. High- and moderate-risk providers and suppliers are also subject to unannounced site visits. Further, depending on the risks presented, PPACA authorizes CMS to require fingerprint- based criminal history checks. In March 2014, CMS awarded a contract that is to enable the agency to access Federal Bureau of Investigation information to help conduct those checks of high-risk providers and suppliers. PPACA also authorizes the posting of surety bonds for certain providers and suppliers. CMS has indicated that the agency will continue to review the criteria for its screening levels and will publish changes if the agency decides to update the assignment of screening levels for categories of Medicare providers and suppliers. Doing so could become important because the Department of Justice (DOJ) and HHS reported multiple convictions, judgments, settlements, or exclusions against types of providers and suppliers not currently at the high-risk level, including community mental health centers and ambulance suppliers. CMS’s implementation of accreditation for DMEPOS suppliers, and of a competitive bidding program, including in geographic areas thought to have high fraud rates, may be helping to reduce the risk of DMEPOS fraud. While continued vigilance of DMEPOS suppliers is warranted, other types of providers may become more problematic in the future. Specifically, in September 2012 we reported that a range of providers have been the subjects of fraud investigations. According to 2010 data from OIG and DOJ, over 10,000 providers and suppliers that serve Medicare, Medicaid, and Children’s Health Insurance Program beneficiaries were involved in fraud investigations, including not only home health agencies and DMEPOS In addition, suppliers but also physicians, hospitals, and pharmacies.the provider type constituting the largest percentage of subjects in criminal health care fraud investigations was medical facilities—including medical centers, clinics, or practices—which constituted almost a quarter of subjects in such investigations. DMEPOS suppliers made up a little over 16 percent of subjects. We are currently examining the ability of CMS’s provider and supplier enrollment system to prevent and detect the continued enrollment of ineligible or potentially fraudulent providers and suppliers in Medicare. Specifically, we are assessing the process used to enroll and verify the eligibility of Medicare providers and suppliers in Medicare’s Provider Enrollment, Chain, and Ownership System (PECOS) and the extent to which CMS’s controls are designed to prevent and detect the continued enrollment of potentially ineligible or fraudulent providers and suppliers in PECOS. We plan to issue a report this winter. CMS contracted with two new types of entities at the end of 2011 to assume centralized responsibility for two functions that had been the responsibility of multiple contractors. One of the new contractors is conducting automated screenings to check that existing and newly enrolling providers and suppliers have valid licensure, accreditation, and a National Provider Identifier (NPI), and are not on the OIG list of providers and suppliers excluded from participating in federal health care programs. The second contractor conducts site visits of providers and suppliers, except for DMEPOS suppliers, to determine whether sites are legitimate and the providers and suppliers meet certain Medicare standards. A CMS official reported that, since the implementation of the PPACA screening requirements, the agency had revoked over 17,000 suspect providers’ and suppliers’ ability to bill the Medicare program. CMS has suspended enrollment of new home health providers and ground ambulance suppliers in certain fraud “hot spots” and other geographic areas. In July 2013, CMS first exercised its authority granted by PPACA to establish temporary moratoria on enrolling new home health agencies in Chicago and Miami, and new ambulance suppliers in Houston. In January 2014, CMS extended its first moratoria and added enrollment moratoria for new home health agency providers in Fort Lauderdale, Detroit, Dallas, and Houston, and new ambulance suppliers in Philadelphia. These moratoria are scheduled to be in effect until July 2014, unless CMS extends or lifts them. CMS officials cited areas of potential fraud risk, such as a disproportionate number of providers and suppliers relative to beneficiaries and extremely high utilization as rationales for suspending new enrollments of home health providers or ground ambulance suppliers in these areas. CMS recently issued a final rule requiring prescribers of drugs covered within Medicare’s prescription drug program, Part D, to enroll in Medicare by June 2015. As a result of this rule, CMS is to screen these prescribers to verify that they meet specific requirements, such as having current licenses or accreditation and valid Social Security numbers. OIG has identified concerns with CMS oversight of fraud, waste, and abuse in Part D, including the contractors tasked with this work. A June 2013 OIG report found that the Part D program inappropriately paid for drugs ordered by individuals who clearly did not have the authority to prescribe, such as massage therapists, athletic trainers, home contractors, and OIG recommended, among other things, that there should interpreters.be verification of prescribers’ authority to prescribe drugs, and that CMS should ensure that Medicare does not pay for prescriptions from individuals without such authority. CMS agreed with OIG’s recommendations and, in discussing the final rule, stated that this new enrollment requirement is to help ensure that Part D drugs are prescribed only by qualified physicians and eligible professionals. To continue to help address potential vulnerabilities in the Part D program, we are currently examining practices for promoting prescription drug program integrity and the extent to which CMS’s oversight of Medicare Part D reflects those practices. We plan to issue a report this fall. Although CMS has taken many needed actions, we and OIG have found that CMS has not fully implemented other enrollment screening actions authorized by PPACA. These actions could help further reduce the enrollment of providers and suppliers intent on defrauding the Medicare program, which is important because identifying and prosecuting providers and suppliers engaged in potentially fraudulent activity is time consuming, resource intensive, and costly. These actions include issuing a rule to implement surety bonds for certain providers and suppliers, issuing a rule on provider and supplier disclosure requirements, and establishing the core elements for provider and supplier compliance programs. PPACA authorized CMS to require a surety bond for certain types of at- risk providers and suppliers. Surety bonds may serve as a source for recoupment of erroneous payments. DMEPOS suppliers are currently required to post a surety bond at the time of enrollment. CMS reported in April 2014 that it had not yet scheduled for publication a proposed rule to implement the PPACA surety bond requirement for other types of at- risk providers and suppliers—such as home health agencies and independent diagnostic testing facilities. In light of the moratoria that CMS has placed on enrollment of home health agencies in fraud “hot spots,” implementation of this rule could help the agency address potential concerns for these at-risk providers across the Medicare program. 42 U.S.C. § 1395m(a)(16)(B). A DMEPOS surety bond is a bond issued by an entity guaranteeing that a DMEPOS supplier will fulfill its obligation to Medicare. If the obligation is not met, the surety bond is paid to Medicare. Medicare Program; Surety Bond Requirement for Suppliers of Durable Medical Equipment, Prosthetics, Orthotics, and Supplies (DMEPOS), 74 Fed. Reg. 166 (Jan. 2, 2009). suspension from a federal health care program.indicated that developing the additional disclosure requirements has been complicated by provider and supplier concerns about what types of information will be collected, what CMS will do with it, and how the privacy and security of this information will be maintained. CMS has not established the core elements of compliance programs for providers and suppliers, as required by PPACA. We previously reported that agency officials indicated that they had sought public comments on the core elements, which they were considering, and were also studying criteria found in OIG model plans for possible inclusion.2014, CMS reported that it had not yet scheduled a proposed rule for publication. Medicare uses prepayment review to deny claims that should not be paid and postpayment review to recover improperly paid claims.