GAO has identified key strategies to help CMS address challenges it faces in preventing fraud, waste, and abuse, and ultimately to reducing improper payments. These strategies are: (1) strengthening provider enrollment processes and standards, (2) improving pre-payment review of claims, (3) focusing post-payment claims review on most vulnerable areas, (4) improving oversight of contractors, and (5) developing a robust process for addressing identified vulnerabilities. In the course of our work, we have found that CMS has made progress in some of these areas, and recent legislation may provide it with enhanced authority. However, CMS has not implemented some of our recommendations and other challenges remain. Given the large number of providers filing claims with Medicare and the volume of payments the agency and its contractors handle, ensuring that providers are legitimate businesses before allowing them to bill Medicare is important. Checking the background of providers at the time they apply to become Medicare providers is a crucial step to reduce the risk of enrolling providers intent on defrauding or abusing the program. In particular, we have recommended stricter scrutiny of enrollment processes for two types of providers whose services and items CMS has identified as especially vulnerable to improper payments—home health agencies (HHA) and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS). CMS contractors are responsible for screening enrollment applications from prospective HHAs. We found that the screening process was not thorough. This may have contributed to a rapid increase in the number of HHAs that billed Medicare in certain states with unusually high rates of billing patterns indicative of fraud and abuse. For example, the contractors were not required to verify the criminal history of persons named on the application. We recommended that CMS assess the feasibility of such a criminal history verification of all key officials’ names on an HHA enrollment application; to date, CMS has not implemented this recommendation. Regarding DMEPOS suppliers, we also found that CMS had not taken sufficient steps to prevent entities intent on defrauding Medicare from enrolling in the program. In 2005, we reported that more effective screening and stronger enrollment standards were needed. CMS implemented new supplier enrollment standards in January 2008, partly in response to our recommendation. However, in that same year, we exposed persistent weaknesses when we created two fictitious medical equipment companies that were enrolled by CMS’s contractor and given permission to begin billing Medicare. As an enrollment requirement, suppliers are required to show that they have contracts for obtaining inventory—but the contracts provided with the applications of our fictitious companies would have been shown to be fabricated if they had been reviewed properly. Since January 2008, CMS has taken two additional steps to ensure that only legitimate DMEPOS suppliers can bill Medicare. First, it implemented a requirement for DMEPOS suppliers to post a surety bond to help ensure that the Medicare program recoups erroneous payments that result from fraudulent or abusive billing practices. Second, CMS required that all DMEPOS suppliers be accredited by a CMS-approved accrediting organization to ensure that they meet minimum standards. CMS told us that thousands of DMEPOS suppliers were removed as result of these requirements. In addition, Congress has directed CMS to implement a competitive bidding program for DME, which could also help reduce fraud, waste, and abuse because it authorizes CMS to select suppliers based in part on new scrutiny of their financial documents and other application materials. However, the program will not take effect until January 2011 and it will initially be implemented in only nine metropolitan areas. Implementation of additional authorities in PPACA and HCERA also may help the agency strengthen provider enrollment, including addressing vulnerabilities our work has identified. In particular, among other provisions, the legislation allows HHS to (1) add criminal and background checks to its enrollment screening processes, depending on the risks presented by the provider; and (2) impose a temporary moratorium on enrollment of providers, if the agency deems it necessary to prevent fraud and abuse. In addition, there are specific requirements for providers to disclose any current or previous affiliation with a provider or supplier that has uncollected debt, has been or is subject to a payment suspension under a federal health care program, has been excluded from participation under Medicare, Medicaid or the State Children’s Health Insurance Program (CHIP) or has had its billing privileges denied or revoked. HHS may deny enrollment to any such provider whose previous affiliations pose an undue risk. However, the effectiveness of these authorities is unknown and will depend on CMS’s implementation. CMS told us that the agency is in the process of implementing these authorities, including drafting regulations on criminal and background checks. Pre-payment reviews of claims are essential to helping ensure that Medicare pays correctly the first time; however, these reviews are challenging due to the volume of claims. Overall, less than 1 percent of Medicare’s claims are subject to a medical record review by trained personnel—so having robust automated payment controls called edits in place that can deny inappropriate claims or flag them for further review is critical. However, we have found weaknesses in these pre-payment controls. For example, in 2007, we found that contractors responsible for reviewing DMEPOS suppliers’ claims did not have automated pre-payment controls in place to identify questionable claims that might connote fraud, such as those associated with atypically rapid increases in billing or for items unlikely to be prescribed in the course of routine quality medical care. As a result, we recommended in 2007 that CMS require its contractors to develop thresholds for unexplained increases in billing and use them to develop automated pre-payment controls. Although CMS has not implemented that recommendation specifically, it has added edits to flag claims for services that were unlikely to be provided in the normal course of medical care. This is a valuable addition to the program’s safeguards, but additional pre-payment controls, such as using thresholds for unexplained increases in billing, could further enhance CMS’s ability to identify improper claims before they are paid. Post-payment reviews are critical to identifying payment errors to recoup overpayments. CMS’s contractors have conducted limited post-payment reviews—for example, we reported in 2009 that two contractors paying home health claims conducted post-payment reviews on fewer than 700 of the 8.7 million claims that they paid in fiscal year 2007. Further, we found that they were not using evidence, such as findings from pre-payment reviews, to target their post-payment review resources on providers with a demonstrated high risk of improper payments. We recommended that post-payment reviews be conducted on claims submitted by HHAs with high rates of improper billing identified through pre-payment review. In response, CMS commented that other types of post-payment review may already include claims from these HHAs. We continue to believe including this targeted post-payment review should be a priority. Cross-checking claims for home health services with the physicians who prescribed them can be a further safeguard against fraud, waste, and abuse, but we have found that this is not always done. For example, CMS does not routinely provide physicians responsible for authorizing home health care with information that would enable them to determine whether an HHA was billing for unauthorized care. In one instance, a CMS contractor identified overpayments in excess of $9 million after interviewing physicians who had referred beneficiaries with high home health costs. The physicians indicated that their signatures had been forged or that they had not realized the amount of care they had authorized. We recommended that CMS require that physicians receive a statement of services beneficiaries received based on the physicians’ certification, but to date, the agency has not taken action. CMS’s new national recovery audit contracting program, begun in March 2009, was intended to address post-payment efforts; however, we continue to have concerns about post-payment reviews of HHAs and DMEPOS. Congress authorized the national program after completion of a three-year recovery audit contracting demonstration program in 2008. The national program is designed to help the agency supplement the pre- and post- payment reviews of other contractors. Recovery audit contractors (RAC) review claims after payment, with reimbursement to them contingent on finding improper overpayments and underpayments. Because RACs are paid on a contingent fee based on the dollar value of the improper payments identified, during the demonstration RACs focused on claims from inpatient hospital stays, which are generally more costly services. Therefore, other contractors’ post-payment review activities could be more valuable if CMS directed these contractors to focus on items and services where RACs are not expected to focus their reviews, and where improper payments are known to be high, specifically home health and durable medical equipment. Because Medicare is administered by contractors, such as drug plan sponsors, overseeing their activities to address fraud, waste, and abuse and prevent improper payment is critical. All drug plan sponsors are required to have programs to safeguard the Medicare prescription drug program from fraud, waste, and abuse. CMS’s oversight of these programs has been limited but is expanding. In March 2010, we testified that CMS had completed desk audits of selected sponsors’ compliance plans. At that time, CMS was beginning to implement an expanded oversight strategy, including revising its audit protocol and piloting on-site audits, to assess the effectiveness of these programs more thoroughly. As of June 2010, the agency has conducted 5 on-site audits and plans to conduct a total of 30 on-site audits by the end of the fiscal year. These audits are in response to a recommendation we made in our 2008 study that found that the five sponsors we reviewed (covering more than one-third of total Medicare prescription drug plan enrollees) had not completely implemented all seven of CMS’s required compliance plan elements and selected recommended measures for a Medicare prescription drug fraud, waste, and abuse program. In addition, CMS published a final rule in April 2010 to increase its oversight efforts and ensure that sponsors have effective compliance programs in place. In issuing the proposed rule, CMS noted that we requested that the agency take actions to evaluate and oversee fraud and abuse programs to ensure sponsors have effective programs in place.