Since the Medicare program was created in 1965, it has been administered largely by private contractors under federal oversight. These contractors enroll and pay providers and suppliers while also maintaining the responsibility to help ensure Medicare program integrity. CMS currently contracts with 12 MACs, each of which is responsible for its own geographic region, known as a “jurisdiction.” Figure 1 shows the MACs’ jurisdiction areas. The NSC manages the DMEPOS suppliers’ enrollment, performs site visits for DMEPOS suppliers, and interacts with the durable medical equipment MACs, which pay claims for durable medical equipment items. MACs and the NSC are instructed by CMS to adhere to the processing guidelines of CMS’s manual to enroll providers, suppliers, and DMEPOS suppliers into PECOS. PECOS is CMS’s centralized database for Medicare provider and supplier enrollment information. Entities enrolled in PECOS are granted Medicare billing privileges and can be reimbursed for services rendered to Medicare beneficiaries. CMS provides additional guidance to the MACs and the NSC using directives such as technical direction letters and, in some cases, has monthly calls with the MACs to discuss new guidance or process changes. MACs and the NSC are responsible for updating PECOS after they have approved or revalidated enrollment for providers and suppliers. CMS requires all enrolled providers or suppliers to report changes to existing profile information within a certain period.practice location address, the provider must notify the MAC or the NSC of this change and the MAC or the NSC is responsible for verifying the new address information, and updating the provider’s profile in PECOS to reflect the current practice location address. PPACA requires all providers and suppliers to be subject to licensure checks. Applicants must provide copies of all applicable federal and state licenses and certifications. A licensure check consists of a MAC checking the provider’s license information with a state licensing board within its jurisdiction to determine whether the provider has an active license and any board disciplinary actions. PPACA also gives CMS the authority to require additional screening procedures beyond those each provider and supplier must undergo, such as criminal-background checks, depending on the type of risk presented by the provider or supplier type. Further, PPACA required new screening procedures based on risk of fraud, waste, and abuse. As a result of PPACA, CMS now assigns categories of providers and suppliers to limited-, moderate-, and high-risk levels; those in the highest level are subject to the most-rigorous screening. For example, whereas providers and suppliers in all three risk levels must undergo licensure checks, those in moderate- and high-risk levels are also subject to unannounced site visits. In addition, the NSC is required to conduct site visits to all of the DMEPOS suppliers (which are Table 1 shows the categories of categorized as moderate or high risk).Medicare providers and suppliers and their associated risk level. According to CMS, as of January 2015, there were 2,506 high-risk providers and suppliers, 105,558 moderate-risk providers and suppliers, and 1,649,779 limited-risk providers in PECOS. In addition, there were 15,885 high-risk DMEPOS suppliers and 74,372 moderate-risk DMEPOS suppliers. In 2011, CMS awarded two contracts to assist the MACs with performing aspects of the provider and supplier enrollment-screening process. The first was issued to an automated screening contractor that collects and analyzes license information and then provides the information to CMS for review. The data are then reviewed by a MAC for further determination. The second was issued to a site-visit contractor, who is in charge of performing site visits to all providers and suppliers, except DMEPOS suppliers. Prior to these awards, MACs were responsible for conducting all site visits and required to manually review individual state medical-licensing boards within their respective jurisdictions. Medicare provider and supplier enrollment entails other screening procedures based on the type of providers and suppliers. For example, MACs and the NSC need to validate the identify of individual providers, owners, and authorized/delegated officials using SSA validation; validate and verify the legal business names for organizations; and validate and verify the provider’s National Provider Identifier, among other things. For the purposes of our review, we will focus on the four specific screening procedures outlined in our report. Medicare provider and supplier enrollment entails other screening procedures based on the type of providers and suppliers. We identified weaknesses in two of the four screening procedures CMS implemented to prevent and detect ineligible or potentially fraudulent providers and suppliers from enrolling in PECOS: the verification of practice location and of licensure status. CMS’s procedures to screen for providers and suppliers listed as deceased or excluded from participating in federal programs or health care–related programs appear to be working, but we identified a few instances of ineligible or potentially fraudulent providers and suppliers that we referred to CMS for further review. Our examination of practice location addresses of providers and suppliers listed in PECOS as of March 2013 and DMEPOS as of April 2013 revealed thousands of questionable practice location addresses. We found limitations with CMS’s Finalist software used to validate practice location addresses. For example, Finalist does not provide flags to indicate whether the practice location is potentially ineligible to qualify as a legitimate location. Additional checks, such as checking for these addresses in Internet searches of sites such as 411.com, USPS.com, or Google Maps, or conducting site visits, are at times required to determine whether a practice location is legitimate. However, the revised screening procedures that CMS issued in March 2014 require MACs to do less verification of providers’ practice locations than before. Federal regulations stipulate the type of physical practice location that applicants must have. Specifically, providers and suppliers must be “operational” to furnish Medicare covered items or services. Federal regulations define “operational” as having a qualified physical practice location, being open to the public for the purpose of providing health care–related services, being prepared to submit valid Medicare claims, and being properly staffed, equipped, and stocked to furnish these items All providers and suppliers are required to list a physical or services.practice location address in their application, regardless of provider or supplier type.would be required to supply his or her own home address in the application. For example, a provider who renders in-home services Addresses that generally would not be considered a valid practice location include post office boxes, and those associated with a certain type of Commercial Mail Receiving Agency (CMRA), such as a United Parcel Service (UPS) store. Based on USPS guidance, a CMRA is a third-party agency that receives and handles mail for a client. Additionally, addresses that can be traced to a virtual office—that is, a company advertising mailboxes, telephone answering services, and dedicated workspaces—raise questions about whether the provider or supplier meets the CMS practice location requirements under CMS regulations. Vacant or invalid addresses are also ineligible for PECOS enrollment. A vacancy refers to a provider or supplier that is no longer at the location provided on the application form. USPS would flag a location as vacant if it used to deliver mail there and has not delivered mail there in more than 90 days. An invalid address is when an address is not recognized by USPS, was incorrectly entered in PECOS, or was missing a street number. Once enrolled in PECOS, providers and suppliers have the responsibility to self-report changes to their practice locations. CMS requires providers, suppliers, and DMEPOS suppliers to report a change in practice location within 30 days. Not all CMRAs would disqualify an applicant from the PECOS enrollment. For example, a hospital may be legitimately designated as a CMRA if it uses or acts as a third party that collects and distributes mail to its employees and would be considered an eligible practice location. Post office boxes and drop boxes are not acceptable except in some cases where the provider is located in rural areas. sites like 411.com and USPS.com, calling the official business telephone number listed on the application, and using software called Finalist to validate the practice location address.issued additional guidance to MACs that requires fewer verification techniques to verify a practice location. This new guidance is discussed later in the report. In March 2014, CMS Our examination of practice location addresses of the providers and suppliers listed in PECOS as of March 2013 and DMEPOS as of April 2013 (the most-current data available at the time of our review) revealed thousands of questionable addresses. Specifically, we checked PECOS practice location addresses for all records that contained an address using the USPS address-management tool, a commercially available software package that standardizes addresses and provides specific flags on the address such as CMRA, vacant, and invalid. The USPS address-management tool includes addresses as of December 15, 2013. This software is not currently being used by CMS. Instead, CMS uses the Finalist software to standardize practice location addresses. As part of our initial analysis using the USPS address-management tool, we identified 105,234 (about 11 percent) of the 980,974 addresses listed in PECOS appeared in the USPS address-management tool as a CMRA, a vacant address, or an invalid address. We took further steps to determine the number of these questionable addresses that could be determined to be ineligible for Medicare providers and suppliers. Specifically, we selected a generalizable stratified random sample of 496 addresses from the population of 105,234 that appeared in the USPS address-management tool as a CMRA, a vacant address, or an invalid address. For each selected or physical site address, we used Google Maps, Internet searches,visits to confirm whether the practice location address was an eligible address.