FFS Medicare generally pays providers directly for the services they perform—such as paying physicians for office visits—based on predetermined payment formulas. FFS payments are based on claims data received directly from providers. CMS relies primarily on prepayment automated checks and postpayment medical reviews to identify and recover FFS improper payments. Under the Improper Payments Information Act of 2002 (IPIA), as amended, CMS reported that the FFS improper payment rate was 11 percent for fiscal year 2016. Two-thirds of the FFS improper payment rate, according to CMS, was a result of insufficient documentation. CMS and its contractors engage in a number of activities to prevent, identify, and recover improper payments in FFS. The Patient Protection and Affordable Care Act of 2010 included provisions designed to strengthen Medicare’s provider enrollment and screening requirements. Subsequently, CMS implemented a revised screening process for new and existing providers and suppliers based on the potential risk of fraud, waste, and abuse. In November 2016, we evaluated this revised screening process and found that CMS used the new process to screen and revalidate over 2.4 million unique applications and existing enrollment records. As a result of this process, over 23,000 new applications were denied or rejected, and over 703,000 existing enrollment records were deactivated or revoked. CMS estimates that this process saved $2.4 billion in Medicare payments to ineligible providers and suppliers from March 2011 to May 2015. Also in FFS, CMS uses different types of contractors to conduct prepayment and postpayment reviews of Medicare claims at high risk for improper payments. We examined the review activities of these contractors and in April 2016 reported that using prepayment reviews to deny improper claims and prevent overpayments is consistent with CMS’s goal to pay claims correctly the first time. In addition, prepayment reviews can better protect Medicare funds because not all overpayments can be collected. We recommended that CMS seek legislation to allow Recovery Auditors, who are currently paid on a postpayment contingency basis from recovered payments, to conduct prepayment reviews. Although CMS did not concur with this recommendation, we continue to believe CMS should seek legislative authority to allow Recovery Auditors to conduct these reviews. Medicare Administrative Contractors (MACs) process Medicare claims, identify areas vulnerable to improper billing, and develop general education efforts focused on these areas. In March 2017, we evaluated MACs’ provider education efforts to help reduce improper billing. We found that CMS collects limited information about how the efforts focus on the areas MACs identify as vulnerable to improper billing, and recommended that CMS require MACs to report in sufficient detail to determine the extent to which their provider education efforts focus on vulnerable areas. According to CMS, the agency has updated its reporting guidance and MACs will begin reporting more detailed information beginning in July 2017. Whereas Medicare pays FFS providers for services provided, Medicare pays MAOs a fixed monthly amount per enrollee regardless of the services enrollees use. To identify and recover MA improper payments resulting from unsupported data submitted by MAOs for risk adjustment purposes, CMS conducts two types of RADV audits: national RADV activities and contract-level RADV audits. Both types determine whether the diagnosis codes submitted by MAOs are supported by a beneficiary’s medical record. CMS conducts national RADV activities annually to estimate the national IPIA improper payment rate for MA. For 2016, CMS estimated that 71 percent of the improper payments resulted from the insufficient medical record documentation MAOs submitted to CMS that did not support diagnoses they had previously submitted to CMS. The second type of RADV audit, contract-level audits, seeks to identify and recover improper payments from MAOs, and thus deter MAOs from submitting inaccurate diagnosis information. CMS conducted contract- level audits of 2007 payments for a sample of enrollees in 32 MA contracts. CMS’s goal is to conduct contract-level audits annually to recover improper payments efficiently, among other things. It plans to recoup overpayments by calculating a payment error rate for a sample of enrollees in each audited contract and extrapolating the error rate to estimate the total amount of improper payments made under the contract. CMS has RADV audits underway for three payment years—2011, 2012, and 2013. In general, CMS audits about 5 percent of contracts for each year, or roughly 30 contracts. CMS calculates a beneficiary’s risk score—a relative measure of projected Medicare spending—based on both demographic characteristics and health status (diagnoses). The agency uses Medicare data to determine a beneficiary’s demographic characteristics; however, it must rely on data submitted by MAOs for health status information. CMS requires MAOs to submit diagnosis codes for each beneficiary in a contract in order to calculate risk scores. Since 2004, CMS has used the Risk Adjustment Processing System (RAPS) to collect diagnosis information from MAOs. In 2012, CMS began requiring MAOs to submit encounter data. Such data include diagnosis and treatment information for all medical services and items provided to an enrollee, with a level of detail similar to FFS claims. Since 2015, CMS has used both RAPS and encounter data submitted by MAOs to risk adjust MA payments. When CMS proposed collecting encounter data in 2008, the agency stated it would use the data for risk adjustment and may also use them for specified additional payment and oversight purposes. CMS has recognized the importance of ensuring that the data collected are complete—representing all encounters for all enrollees—and accurate— representing a correct record of all encounters that occurred—given the important functions for which the data will be applied. In our 2016 report, we found several factors that hamper CMS’s recovery activities, including its failure to select contracts for audit that have the greatest potential for payment recovery, delays in conducting CMS’s first two RADV payment audits, and its lack of specific plans or a timetable for incorporating Recovery Audit Contractors (RACs) into the MA program to identify improper payments and help with their recovery. Our 2016 report found that the results from the RADV audits of 2007 payments indicated that the scores CMS calculates to identify contracts that are candidates for audit, called coding intensity scores, were not strongly correlated with the percentage of unsupported diagnoses. CMS defines coding intensity as the average change in the risk score component specifically associated with the reported diagnoses for the beneficiaries in each contract. Increases in coding intensity measure the extent to which the estimated medical needs of the beneficiaries in a contract increase from year to year; thus, contracts whose beneficiaries appear to be getting “sicker” at a relatively rapid rate, based on the information submitted to CMS, will have relatively high coding intensity scores. Figure 1 shows, for example, that CMS reported that the percentage of unsupported diagnoses among the high coding intensity contracts it audited (36 percent) was nearly identical to the percentage among the medium coding intensity contracts (35.7 percent). Our report also found that the RADV audits were not targeted to contracts with the highest potential for improper payments. We identified two reasons that the RADV audits were not targeted on the contracts with the greatest potential for recoveries. The first reason is that the coding intensity scores have shortcomings. For example, our report found that CMS’s calculation may be based on scores that are not comparable across contracts, because the years of data used for each contract may differ, and there are known year-to-year differences in coding intensity scores. In addition, CMS’s calculation does not distinguish between diagnoses likely coded by providers and diagnoses subsequently coded by MAOs. Medical records that providers create from diagnoses are apt to support the diagnoses better than diagnoses subsequently coded by the MAO through medical record review. CMS has a method available to it—the Encounter Data System—that will distinguish between the two diagnoses. Although using encounter data would help target the submitted diagnoses that may be most likely related to improper payments, CMS has not outlined plans for using it. Furthermore, CMS follows contracts that are renewed or consolidated under a different existing contract within the same MAO, but CMS’s coding intensity calculation does not incorporate prior risk scores from an earlier contract into the MAO’s renewed contract. This could result in an improper payment risk if MAOs move beneficiaries with higher risk scores, such as those with special needs, into one consolidated contract. The second reason audits are not targeted to the contracts with the greatest potential for recovery is that CMS does not always use the information available to it to select audit contracts with the highest potential for improper payments. CMS did not always target the contracts with the highest coding intensity scores, use results from prior contract- level RADV audits, account for contract consolidation, or account for contracts with high enrollment. For example, only four of the contracts selected for the 2011 RADV audit had coding intensity scores at the 90th percentile or above. Even though we found that coding intensity scores are not strongly correlated with diagnostic discrepancies, they are still somewhat correlated. Also, CMS’s 2011 contract selection methodology did not consider results from the agency’s prior RADV audits, potentially overlooking information indicating contracts with known improper payment risk. Finally, even though the potential dollar amount of improper payments to MAOs with high rates of unsupported diagnoses is likely greater when contract enrollment is large, CMS officials stated that the 2011 contract-level RADV audit contract selection did not account for contracts with high enrollment. We made two recommendations to address these issues: We recommended that (1) CMS improve the accuracy of coding intensity calculations, and (2) modify its processes for selecting contracts for RADV audit to focus on those most likely to have improper payments. In July 2017, CMS officials told us that the agency is working to implement these recommendations regarding the selection of contracts for audit.