CMS has made progress strengthening provider enrollment procedures and prepayment controls in the Medicare program to help ensure that payments are made correctly the first time, but the agency could further improve upon its efforts by implementing additional enrollment procedures and prepayment strategies. Likewise, additional improvements to CMS’s postpayment claims review activities could improve their efficiency and effectiveness. CMS has implemented certain provider enrollment screening procedures authorized by the Patient Protection and Affordable Care Act (PPACA) and put in place other measures intended to strengthen existing procedures. The changes to provider screening procedures are intended to address past weaknesses identified by GAO and the HHS’s Office of Inspector General (OIG) that allowed entities intent on committing fraud to enroll in Medicare. Blocking the enrollment of such providers helps to prevent Medicare from making improper payments. Specifically, CMS added screenings of categories of provider enrollment applications by risk level and contracted with new national enrollment screening and site visit contractors. Screening Provider Enrollment Applications by Risk Level: CMS and the OIG issued a final rule in February 2011 to implement many of the new screening procedures required by PPACA. CMS designated three levels of risk—high, moderate, and limited—with different screening procedures for categories of Medicare providers at each level. Providers in the high-risk level are subject to the most rigorous screening. Based in part on our work and that of the OIG, CMS designated newly enrolling home health agencies and suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) as high risk, and designated other providers as lower risk. Providers at all risk levels are screened to verify that they meet specific requirements established by Medicare, such as having current licenses or accreditation and valid Social Security numbers. High- and moderate-risk providers are also subject to unannounced site visits. Further, PPACA authorizes CMS to require fingerprint-based criminal background checks of providers and suppliers depending on the risks presented. In March 2014, CMS awarded a contract to a Federal Bureau of Investigation-approved contractor that will enable the agency to access criminal history information to help conduct those checks of high-risk providers and suppliers. CMS has indicated that the agency will continue to review the criteria for its screening levels and will publish changes if the agency decides to update the assignment of screening levels for categories of Medicare providers. Doing so could become important because the Department of Justice and HHS reported multiple convictions, judgments, settlements, or exclusions against types of providers not currently at the high-risk level, including community mental health centers and ambulance providers. National Enrollment Screening and Site Visit Contractors: CMS contracted with two new contractors at the end of 2011 to assume centralized responsibility for two functions that had been the responsibility of multiple contractors. One of the new contractors is conducting automated screenings to check that existing and newly enrolling providers and suppliers have valid licensure, accreditation, and a National Provider Identifier, and are not on the OIG list of providers and suppliers excluded from participating in federal health care programs. The second contractor conducts site visits of providers to determine whether sites are legitimate and the providers meet certain Medicare standards. A CMS official reported that, since the implementation of the PPACA screening requirements, the agency had revoked over 17,000 suspect providers’ privileges to bill the Medicare program. Although CMS has taken actions to strengthen the provider enrollment process, we and the OIG have found that CMS has not taken other actions authorized by PPACA and that could improve screening and ultimately reduce improper payments. They include issuing a rule to require surety bonds for certain providers and suppliers as well as a rule on provider and supplier disclosure requirements. Surety Bonds: PPACA authorized CMS to require a surety bond for Surety bonds may certain types of at-risk providers and suppliers. serve as a source for recoupment of erroneous payments. DMEPOS suppliers are currently required to post a surety bond at the time of enrollment. CMS told us in April 2014 that the agency collected about $1.6 million in DMEPOS supplier overpayments between February 2012 and March 2013. However, also in April 2014, CMS reported that it had not scheduled for publication a proposed rule to impose a surety bond requirement as authorized by PPACA for other types of at-risk providers and suppliers—such as home health agencies and independent diagnostic testing facilities. Providers and Suppliers Disclosure: CMS has not yet scheduled the publication of a proposed rule for increased disclosures of prior actions taken against providers and suppliers enrolling or revalidating enrollment in Medicare, such as whether the provider or supplier has been subject to a payment suspension from a federal health care program. As we reported in April 2012, agency officials indicated that developing the additional disclosure requirements has been complicated by provider and supplier concerns about what types of information will be collected, what CMS will do with it, and how the privacy and security of this information will be maintained. We are currently examining the ability of CMS’s provider enrollment system to prevent and detect the continued enrollment of ineligible or potentially fraudulent providers in Medicare. Specifically, we are assessing the process used to enroll and verify the eligibility of Medicare providers in Medicare’s Provider Enrollment, Chain, and Ownership System (PECOS) and the extent to which CMS’s controls are designed to prevent and detect the continued enrollment of ineligible or potentially fraudulent providers in PECOS. CMS has enhanced its efforts to reduce improper payments by improving prepayment controls, particularly prepayment edits to deny claims that should not be paid. CMS has stated that one of its key goals is to pay claims properly the first time—that is, to ensure that payments go to legitimate providers in the right amount for reasonable and necessary services covered by the program for eligible beneficiaries. To do so, among other things, CMS uses prepayment controls such as prepayment edits—instructions that CMS’s contractors, including Medicare Administrative Contractors (MAC), program into claims processing systems that compare claim information to Medicare requirements in order to approve or deny claims or to flag them for additional review. For example, some prepayment edits are related to service coverage and payment, while others are implemented to verify that the claim is properly filled out, that providers are enrolled in Medicare, or that patients are eligible Medicare beneficiaries.and its contractors are automated and applied to all claims; if a claim does not meet the criteria of the edits, it is automatically denied. Other prepayment edits are manual; they flag a claim for individual review by trained staff to determine whether it should be paid. Most of the edits implemented by CMS We previously evaluated CMS’s implementation of prepayment edits and found that while use of prepayment edits saved Medicare at least $1.76 billion in fiscal year 2010, the savings could have been greater had prepayment edits been used more widely. For example, based on our analysis of a limited number of national policies and local coverage determinations in 2012, we identified $14.7 million and $100 million in payments, respectively, that were inconsistent with policies and determinations and were therefore improper. Such inconsistencies could have been identified using automated edits. As we recommended, CMS has taken steps to improve the development of certain prepayment edits that are implemented nationwide. For example, the agency has centralized the development and implementation of automated edits based on a type of national policy called national coverage determinations. In addition, CMS has modified its processes for identifying provider billing of services that are medically unlikely, in order to prevent circumvention of automated edits designed to identify an unusually large quantity of services provided to the same patient. However, as of April 2014, CMS had not fully implemented several of the recommendations we made in 2013 that we believe would promote greater use of prepayment edits and better ensure proper payment. For example, the agency did not include, in its written guidance to agency staff on procedures for ensuring consideration of automated edits, time frames for making decisions on whether an edit would be developed nor did it include requirements for assessing the effects of corrective actions taken. In addition, although CMS has taken initial steps to improve the data it collects about local prepayment edits implemented by its contractors, it had not yet determined a final process for how it would obtain and disseminate information about these edits across contractors. Nor does CMS require contractors to share information with each other about the underlying policies and savings related to their most effective edits, as the agency currently lacks a database to collect such information. Having information about the most effective local edits would enable contractors to determine the most appropriate approach for implementing Medicare payment policy effectively, which could help reduce improper payments. To help prevent improper payments, CMS also implemented a specific type of national edit, called a Medical Unlikely Edit (MUE), which limits the amount of a service that is paid when billed by a provider for a beneficiary on the same day. The limits for certain services that have been fraudulently or abusively billed are unpublished to deter providers from billing up to the maximum allowable limit. In 2013, we reported that CMS may be missing opportunities to prevent improper payments because it has not systematically evaluated MUE limits to determine whether In national edits should be revised to reflect more restrictive local limits.addition, we found that CMS and its contractors did not have a system in place for examining claims to determine the extent to which providers may be exceeding unpublished MUE limits and whether payments for such services were proper. As a result, we recommended that CMS examine contractor edits to determine whether any national unpublished MUE limits should be revised, consider reviewing claims to identify providers that exceed the unpublished MUE limits, and determine whether the provider’s billing was proper. HHS agreed with these recommendations, but as of April 2014, CMS had not implemented them. Medicare uses four types of contractors to conduct postpayment claims reviews to identify and recoup overpayments.the same Medicare coverage and payment guidelines.