In 2003, Congress passed the MMA, which created the Medicare Part D program. The MMA requires that all Part D sponsors have a program to control fraud, waste, and abuse. CMS is responsible for safeguarding the Part D program from fraud, waste, and abuse. In 2003, Congress passed the MMA, which created a prescription drug benefit known as Medicare Part D. Voluntary enrollment in the Medicare Part D program began November 15, 2005, and the benefit went into effect January 1, 2006. Although the Medicare Part D program is overseen by CMS, Part D drug benefit plans are administered by private companies that apply to CMS to participate in the program. When approved, these private companies contract with the federal government to be Part D sponsors and market Part D drug plans directly to Medicare beneficiaries. The MMA includes a requirement that all Part D sponsors have a program to control fraud, waste, and abuse in Part D; CMS regulations establish the requirements for comprehensive compliance plans for Part D plan sponsors. To guide Part D sponsors in designing a fraud and abuse program that addressed Part D risks, in April 2006, CMS issued recommendations for Part D sponsors’ fraud and abuse programs based on input from various sources, including law enforcement and industry representatives. The guidance, issued as chapter 9 in the Prescription Drug Benefit Manual, contains further interpretation and guidelines on the steps sponsors should take to detect, correct, and prevent fraud, waste, and abuse in Part D. CMS required Part D sponsors to have fraud and abuse programs operational and in effect at the time their Part D contracts were awarded and expected sponsors to adopt the recommendations in chapter 9 by January 1, 2007. Table 1 describes the required elements of a comprehensive compliance plan and selected recommended measures for addressing fraud, waste, and abuse specific to Part D in each of the required compliance plan elements. In the chapter 9 guidance, CMS recommends that Part D sponsors design their fraud, waste, and abuse programs to safeguard against identified risk areas and identifies examples of fraud, waste, and abuse risks associated with Part D stakeholders, including internal and external parties. Internal parties include Part D sponsors and their employees; external parties include physicians, pharmacies, and Medicare beneficiaries. Chapter 9 also states that sponsors’ preexisting fraud and abuse programs should be focused on controlling fraud by external parties submitting claims to the sponsor, and stated that Part D sponsors are to identify and address internal fraud, waste, and abuse by the sponsor and its employees as well. In chapter 9, CMS also identified examples of potential fraud, waste, and abuse by Part D sponsors, such as marketing schemes to improperly enroll Medicare beneficiaries in Part D plans or deliberately using inaccurate data to receive improper payments from CMS. CMS identified examples of potential fraud, waste, and abuse by Medicare beneficiaries, such as beneficiaries misrepresenting their identity to illegally obtain the drug benefit or engaging in doctor shopping, where a patient seeks prescriptions from multiple physicians with the intent to abuse or sell drugs. CMS identified potential examples of fraud, waste, and abuse by pharmacies, citing improper billing practices, such as billing for nonexistent prescriptions. Regulations and the chapter 9 guidance recognize that contractors can be significant stakeholders in sponsors’ Part D operations. CMS permits Part D sponsors to use contractors to perform various Part D functions. However, CMS regulations and chapter 9 state that the Part D sponsor is ultimately responsible for fulfilling the terms and conditions set out in the sponsor’s contract with CMS, even if the sponsor delegates a Part D function to a contractor. In addition, Part D rules establish contractual obligations for Part D sponsors that delegate tasks to contractors. CMS is responsible for safeguarding the Part D program from fraud, waste, and abuse, including ensuring sponsors’ compliance with applicable requirements. While many groups within CMS are responsible for overseeing different aspects of the Part D program, two divisions provide oversight of Part D sponsors’ fraud and abuse programs. OFM is the lead office for program integrity and financial oversight, including responsibility related to oversight of fraud, waste, and abuse in the Part D program. OFM developed the chapter 9 guidance for sponsors’ fraud and abuse programs and is responsible for reviewing and approving fraud and abuse program plans when organizations first apply to become Part D sponsors. CBC is the lead office for operational oversight of Part D, including sponsor management, program audits, and enforcement actions. OFM and CBC are responsible for conducting audits of Part D sponsors’ compliance with fraud and abuse program requirements. CBC is responsible for conducting broad Part D program audits that include, but are not limited to, Part D sponsors’ implementation of their compliance plans, including fraud and abuse programs. In contrast, OFM is responsible for financial audits and audits of Part D sponsors’ fraud and abuse programs. CMS contracted with the MEDICs to support OFM’s audit, oversight, and antifraud and abuse efforts in Part D. In October 2005, CMS issued its Oversight Strategy for overseeing Part D sponsors, particularly with regard to mitigating fraud, waste, and abuse. In the strategy, CMS noted that in conducting oversight of Part D sponsors CBC would rely on self-reported, unaudited data provided to CMS by Part D sponsors. However, in the strategy, CMS also acknowledged that program audits conducted by CBC would be necessary to ensure compliance and to document that CMS has fulfilled its program oversight responsibilities. According to the Oversight Strategy, CBC would follow a 3-year audit cycle that would include both desk audits—reviews of documents requested from Part D sponsors—and on-site audits covering all aspects of the Prescription Drug Benefit Manual over the 3 years. In December 2006, HHS’s OIG conducted a review of Part D sponsors’ compliance plans that found that many Part D sponsors’ compliance plans did not address all of CMS’s compliance plan requirements, including fraud and abuse program plans. In response, CMS reported that “CMS will begin these compliance plan audits in 2007, and sponsors will be accountable for meeting all requirements.” OFM’s oversight of Part D sponsors relies on the MEDICs to audit Medicare Part D fraud and abuse programs. CMS has entered into contracts under which task orders were issued to three MEDICs to conduct various activities related to Part D. The first MEDIC began its work in November 2005, and the other two MEDICs began work in December 2006. At that time, OFM estimated that the MEDICs would conduct audits of Part D sponsors’ fraud and abuse programs in the first years of Part D. In 2005 and 2006, CMS estimated that at least 10 audits of fraud and abuse programs would be conducted by each of the MEDICs each year under task orders to be issued under the contract. Specifically, CMS estimated that the first MEDIC would complete 10 of these audits during the 2005—2006 contract year and that the three MEDICs would complete 35 of these audits during the 2006—2007 contract year. The five Part D sponsors we reviewed had not completely implemented all of CMS’s seven required compliance plan elements and selected recommended measures for Part D fraud and abuse programs. All Part D sponsors had the required elements and recommended measures for written policies, procedures, and standards of conduct (element 1); effective lines of communication (element 4); and enforcement of standards through disciplinary guidelines (element 5). However, Part D sponsors varied in their implementation of the remaining required elements and selected recommend measures. Table 2 illustrates the variation in the extent to which the five Part D sponsors implemented the required elements and selected recommended measures for their fraud and abuse programs. All five Part D sponsors we reviewed completely met the requirements for written policies, procedures, and standards of conduct. All five had the required written policies, procedures, or the standards of conduct that articulated a commitment to comply with all applicable federal and state standards. All three Part D sponsors that relied on a first-tier entity in carrying out its Part D responsibilities had included provisions in their contract with the entity requiring compliance with all applicable federal laws, regulations, and CMS instructions. All five Part D sponsors completely met the selected recommended measures by having written policies, procedures, or standards of conduct that applied to detecting, correcting, and preventing fraud, waste, and abuse. All five had standards of conduct that were available to employees on the Part D sponsors’ internal Web sites. In addition, Part D sponsors reported that information regarding written policies, procedures, or standards of conduct was disseminated through training or employees had to sign attestations that they had reviewed and understood the policies, or both. Four of the five Part D sponsors completely met the requirements for having both a compliance officer and compliance committee accountable to senior management. The remaining Part D sponsor only partially met the requirement because it did not have a compliance committee. Of the five Part D sponsors’ compliance officers, three of the compliance officers had been in that role since the Part D benefit was implemented in January 2006. The other two compliance officers started in their roles during 2007. All of the Part D compliance committees that existed were overseen by the compliance officer, were accountable to senior management, and were responsible for advising the compliance officer on various issues, ranging from implementing compliance plans to developing their Part D operations. For example, one Part D compliance committee was involved in monitoring the implementation of the activities outlined in the compliance plan, providing regular reports to senior management, and providing input on training. Another Part D sponsor used its corporate compliance committee instead of a separate Part D compliance committee to address Part D issues; a formal Part D compliance committee had not been implemented. The corporate compliance committee meetings included senior executives and the Part D compliance officer. Three Part D sponsors completely met the selected recommended measures for a compliance officer and committee. Two Part D sponsors partially met the recommended measures. Of these, one sponsor’s compliance officer did not report to senior management on at least a quarterly basis. The compliance officer from this Part D sponsor stated that he or she did not report regularly to senior management because the Part D sponsor had yet to have any cases that were determined to be fraud, waste, or abuse.