To address Medicare’s vulnerability to fraud, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) established the Medicare Integrity Program (MIP). In particular, HIPAA required the Secretary of HHS to enter into contracts to promote the integrity of the Medicare program. In exercising its authority to identify and combat improper payments, CMS created 18 Program Safeguard Contractors (PSC) to identify and investigate potential fraud in specific parts of Medicare, such as Part A, in particular states or regions. In 2008, as part of the implementation of broader agency contracting reform, CMS began replacing PSCs with ZPICs, reducing the total number of contractors and giving additional responsibilities to ZPICs to investigate potential fraud across the Medicare fee-for-service program. In September 2008, CMS awarded the first two ZPIC contracts for Zones 4 and 7. As of September 2013, all but one of the ZPICs— Zone 6—was in operation. PSCs continue to operate in Zone 6 because of protest-related delays with respect to the Zone 6 ZPIC contract. The term of each ZPIC contract is generally for a 1-year base period followed by 4 option years, enabling CMS to extend each contract through 5 years of performance. (See table 1 for contract performance timelines and fig. 1 for a map of the seven ZPIC zones.) In 2010, CMS established the Center for Program Integrity (CPI), which oversees the agency’s program integrity efforts, including ZPICs. CPI’s stated mission is to ensure that correct payments are made to legitimate providers for covered, appropriate, and reasonable services for eligible beneficiaries. CPI has undertaken an effort to try to move beyond the “pay and chase” approach—which focused on the recovery of funds lost due to payments of fraudulent claims—to focusing on fraud prevention. To enhance these efforts, the Small Business Jobs Act of 2010 appropriated funds for and required CMS to implement predictive analytics technologies, which are automated systems and tools that can help identify patterns of potentially fraudulent claims before they are paid. In turn, CMS developed the Fraud Prevention System (FPS), an electronic system in which Medicare claims data are compared against models of potentially fraudulent behavior to identify and prioritize for investigation providers with aberrant billing patterns. As part of implementing FPS, CPI modified ZPICs’ work. They are to continue to investigate and quickly initiate actions to protect Medicare, but are also charged with investigating certain referrals from FPS. To detect and investigate potential fraud within each zone, ZPICs develop leads, investigate them, and initiate appropriate actions against suspect providers, suppliers, and others. ZPICs do this with teams of investigators, data analysts, and medical reviewers. Investigators perform a range of actions to examine potential fraud, including conducting provider audits, making site visits to suspect providers’ offices, and interviewing Medicare beneficiaries. Data analysts, including statisticians, examine Medicare claims and other data to support investigations and search for potential fraud and new schemes. Medical reviewers, primarily nurses, provide clinical knowledge to support the work of investigators and data analysts. ZPICs identify potential targets for fraud investigations using three categories of sources: 1. Reactive sources. Reactive sources are notifications of potential fraud submitted to ZPICs, which may result in a ZPIC conducting an investigation. A number of entities refer potential fraud to ZPICs for investigation. These entities include Medicare Administrative Contractors (MAC), which examine their contacts with beneficiaries for indications of potential fraud and may forward the contacts to ZPICs for additional scrutiny. In addition, HHS OIG operates a fraud hotline and may refer calls from it to the MACs for initial screening and then to the ZPICs for further investigation. Other sources include investigations ZPICs receive directly from CMS. 2. Proactive sources. ZPICs are required to maintain at least 3 years of Medicare claims data for analysts to examine for potential fraud using a variety of analytic tools and methods. For example, analysts examining these data may identify providers that, compared with their peers, have aberrant billing patterns, which can indicate potentially fraudulent behavior. If analysts identify such patterns, those findings may result in a ZPIC investigation. 3. FPS. FPS identifies providers for ZPICs to investigate, with the goal of identifying aberrant billing patterns early so that ZPICs can investigate suspect providers before they generate large amounts of potentially fraudulent claims. ZPICs prioritize their investigations according to CMS guidance, which states that ZPICs should give priority to investigations with the greatest program impact and/or urgency. CMS’s Program Integrity Manual defines such investigations as those involving patient abuse or harm, multistate fraud, high dollar amounts of potential overpayments, likely increase in the amount of fraud or enlarged pattern of fraud, and complaints made by Medicare supplemental insurers. In addition, with the implementation of FPS in July 2011, CMS directed the ZPICs to investigate certain high-risk leads from that system. As part of their investigations, ZPICs initiate administrative actions against Medicare providers or suppliers, coordinating with CMS and MACs to carry out those actions, which may result in Medicare savings. (See table 2 for the administrative actions ZPICs may initiate as part of their investigations.) For example, ZPICs may initiate payment suspensions that allow CMS to stop payment on suspect claims and prevent the payment of future claims until an investigation is resolved. In addition, a ZPIC may recommend to CMS that the agency revoke a provider’s Medicare billing privileges and will coordinate with a MAC to implement that action following CMS approval. In addition to administrative actions, ZPICs may forward vulnerabilities identified during an investigation to CMS for consideration as possible local or national prepayment edits. In addition to administrative actions, if a ZPIC investigation uncovers suspected instances of fraud, the ZPIC must refer the investigation to HHS OIG for further examination and, if HHS OIG declines to investigate, the ZPIC may refer the issue to the FBI or any other interested law enforcement entity, such as a U.S. Attorney’s Office. A ZPIC investigation that is referred to and accepted by law enforcement for further exploration and potential prosecution is then called a case. As long as law enforcement entities have not closed a case, it is considered open by both law enforcement and ZPICs. CMS also requires ZPICs to support HHS OIG, the Department of Justice (DOJ), and other law enforcement entities with their Medicare fraud investigations. This support can be for these entities’ own, independently initiated cases, or for those that ZPICs initiated and then referred to law enforcement. ZPICs provide support on ZPIC-initiated and non-ZPIC- initiated cases by responding to law enforcement requests for information. These requests may be for data analysis; provider enrollment records, which ZPICs obtain from MACs; medical review; or other investigative support. ZPIC contracts cover three areas of work: 1. Fee-for-service program integrity work. ZPICs are to identify and investigate potential fraud in Medicare fee-for-service. The contracts for this work outline four categories of investigations: Part A, Part B, durable medical equipment (DME), and home health and hospice. Although DME providers and home health and hospice suppliers provide services covered under Medicare Parts A and B, the ZPIC contracts identify them separately and ZPICs track their fee-for- service program integrity work based on these four categories. 2. Medicare-Medicaid Data Match Program (Medi-Medi). Medi-Medi is a joint effort between CMS and states to identify providers with aberrant Medicare and Medicaid billing patterns through analyses of claims for individuals with both Medicare and Medicaid coverage. States participate voluntarily and ZPIC Medi-Medi work and funding is dependent on the number of states, if any, actively participating in each zone. 3. Special projects. CMS may also fund ZPICs for special zone- or fraud- specific projects. Special projects can vary in duration and can be as short as several months or run for multiple years. The total award amount for the six operating ZPIC contracts through all option years is more than $600 million. Of that amount, $411 million is for fee-for-service program integrity work, $169 million is for Medi-Medi, and $62 million is for special zone- and fraud-specific projects over the life of the contracts. (See fig. 2.) The contract award amounts for the six operating ZPIC contracts (inclusive of option years) range from $67 million to $182 million, which reflects variations between the zones in terms of their size, exposure to fraud risk, and receipt of special projects. For example, Zone 7 covers a geographically small area comprising one state and one territory, but is an area CMS considers to be at high risk for fraud. In comparison, Zone 2 is a geographically large but predominantly rural area comprising 14 states and including areas that may be at a lower risk of fraud. In addition, although not all ZPICs currently receive funding for a special project, all six operating ZPICs have at some time received such funding. For example, one ZPIC was awarded almost $50 million for an ongoing state-specific fraud hotline and another received almost $3 million for a completed project specifically examining potential fraud among home health providers. CMS primarily oversees ZPICs through the coordinated efforts of CPI and the Office of Acquisition and Grants Management (OAGM). The ZPIC Contracting Officer in OAGM is responsible for ensuring effective contracting, and the Contracting Officer’s Representatives (COR) are in CPI. Each ZPIC is assigned a different COR, who helps oversee ZPIC contractor compliance through ongoing reviews.