Medicare’s 25 supplier standards were introduced to deter individuals intent on committing fraud from entering the program and to safeguard Medicare beneficiaries by ensuring that suppliers were qualified. The 25 standards apply to a variety of business practices and establish certain requirements and prohibitions (see app. I for a list of the standards). For example, the standards require suppliers to have a physical facility on an appropriate site that is accessible to beneficiaries and to CMS, with stated business hours clearly posted. The following are the most pertinent standards for the purposes of this report: Standard 1: Operate business and furnish Medicare-covered items in compliance with all applicable federal and state licensure and regulatory requirements. Standard 4: Fill orders for equipment or supplies using its own inventory or by contracting with other companies. If the supplier contracts with other companies, it must provide copies of the contracts upon request. Standard 7: Maintain a physical facility that contains space for storing business records including the supplier’s delivery, maintenance, and beneficiary communication records. Standard 8: Permit CMS to conduct on-site inspections. In addition, the supplier’s location must be accessible during reasonable business hours to beneficiaries and to CMS, and must maintain a visible sign and posted hours of operation. Standard 9: Maintain a primary business telephone listed under the name of the business locally or toll-free for beneficiaries. Standard 10: Have a comprehensive liability insurance policy in the amount of at least $300,000 that covers both the supplier’s place of business and all customers and employees of the supplier. Failure to maintain required insurance at all times will result in revocation of the supplier’s billing privileges retroactive to the date the insurance lapsed. Standard 14: Must maintain and replace at no charge or repair directly, or through a service contract with another company, Medicare-covered items it has rented to beneficiaries. The item must function as required and intended after being repaired or replaced. NSC verifies compliance with the 25 standards, primarily during enrollment and reenrollment, through on-site inspections conducted by subcontractors, and desk reviews conducted by NSC analysts. NSC requires that site inspectors arrive unannounced for any inspection. Before the inspection, NSC provides the inspectors with briefing information on the supplier, including information on whether the supplier is enrolling or reenrolling and the type of state licenses to verify. While on site, inspectors are expected to take photographs of the supplier’s sign with its business name, posted hours of operation, complete inventory in stock, and facility. NSC also expects site inspectors to obtain copies of relevant documents, such as state licenses, comprehensive liability insurance policies, contracts with companies for inventory, and contracts for the service and maintenance of DMEPOS supplies. NSC analysts are expected to check that the supplier has all the state licenses that it would need to provide the items it disclosed in its application. The NSC analyst is also expected to contact the insurance underwriter to ensure that the supplier’s policy is valid and the post office to make sure the supplier’s address is listed. NSC also has a procedure to match data from its supplier database with computerized lists maintained by the federal government to ensure that supply company owners are not prohibited from participating in federal health care programs or debarred from federal contracting. In addition, suppliers submitting an enrollment application to NSC on or after March 1, 2008, must also be accredited by an approved organization prior to submitting the application. These accrediting organizations are supposed to ensure that prospective DMEPOS suppliers meet quality standards related to financial and human resource management, consumer management, product safety, product delivery, and beneficiary training, among others. DMEPOS suppliers that enrolled for the first time between January 1, 2008, and February 29, 2008, must obtain accreditation by January 1, 2009. Suppliers that enrolled with Medicare before January 1. 2008, must obtain accreditation by September 30, 2009. Further, CMS is beginning to implement competitive bidding, which will change how suppliers obtain the right to participate in the program. Competitive bidding is a process in which suppliers of medical equipment and supplies compete for the right to provide their products on the basis of established criteria, such as quality and price. Competitive bidding provides CMS with the authority to select suppliers by screening their financial documents such as income statements and credit reports and other application materials. CMS has chosen suppliers to serve beneficiaries in 10 Metropolitan Statistical Areas and the program is scheduled to begin July 1, 2008. Apart from the competitive bidding program, as long as suppliers can demonstrate that they comply with all the standards and have not been excluded from participating in any federal health care program, NSC must enroll or reenroll them in Medicare. Enrolled suppliers are issued a Medicare billing number. If NSC discovers that a new applicant or enrolled supplier is not in compliance with any of the 25 standards, NSC can deny the application or, with CMS’s approval, revoke the supplier’s billing number. Suppliers whose applications have been denied or whose numbers have been revoked can submit a plan to NSC to correct the noncompliance, appeal the denial or revocation by requesting a hearing or both. In January 2008, CMS proposed creating five new standards and strengthening several of the existing standards. The new standards require most suppliers to be open to the public for at least 30 hours per week and prohibit them from sharing an office with another supplier. They will also be required to maintain ordering and referring documentation received from physicians for 7 years. Finally, suppliers that have a federal or state tax delinquency will be prohibited from obtaining or retaining billing privileges. With regard to strengthening the existing standards, CMS will, among other things, require that suppliers maintain an office to store business records and will limit the use of cell phones, beeper numbers, pagers, and answering services as the primary DMEPOS business telephone number during posted hours of operation. After establishing two fictitious DMEPOS storefronts with no inventory and no clients, our undercover investigators were able to successfully complete the Medicare enrollment process. Although CMS and NSC initially requested corrections to our paperwork and then denied our applications because we failed to comply with 2 of the 25 standards, they never detected the fact that our companies were fictitious. After submitting corrective action plans addressing the standards we failed, both companies were approved for Medicare billing privileges and provided with billing numbers. These numbers, in conjunction with billing passwords and software, allowed us to successfully complete Medicare’s test billing process for our Virginia office. Based on a review of case studies we obtained from HHS IG, we believe that, had our operation continued successfully, we could have fraudulently billed Medicare for substantial sums—potentially reaching millions of dollars. Prior to submitting applications to CMS to become approved DMEPOS suppliers, investigators easily set up two fictitious durable medical equipment companies during April and May 2007 using undercover names and bank accounts. Although we did not actually obtain any inventory, we decided that both companies would be generic medical supply companies, providing, among other things, commodes, diabetic supplies, surgical dressings, urinals and bedpans, walkers and canes, and manual wheelchairs. To appear legitimate, we rented 100 square foot commercial offices in both Maryland and Virginia. Both rentals cost approximately $1,000 per month and came complete with Internet, phone and fax service, and a shared secretary. We also set up fictitious Web sites, created brochures and business cards, and purchased a few “props” to be prepared for on-site inspections, including a wheelchair and bed pan. Our investigators for the most part followed the general procedures that any legitimate business would use to begin DMEPOS operations. First, they paid online registration companies about $400 per supplier to obtain required state business licenses, such as sales tax licenses. In addition, for each company, investigators obtained employer identification numbers (EIN) from the Internal Revenue Service (IRS) and National Provider Identification (NPI) numbers from CMS. Investigators obtained both numbers for free online using basic information, such as the business name and address. To make sure that our companies would meet the requirements for DMEPOS suppliers as outlined in the 25 standards, we did the following. We created phony contracts with two fictitious DMEPOS wholesale suppliers to demonstrate that we had the capacity to supply equipment and supplies to clients. We also established phone numbers for each fictitious wholesale supplier. In reality, these phone numbers were unmanned extensions in the GAO building. We created signs for the office doors listing hours of operations and staffed the offices with undercover agents posing as sales representatives. We purchased approximately $3 million worth of general liability insurance covering, among other things, property damage and employee injury, at a cost of $550 annually. The approval process for both applications was similar and the site inspections were even conducted by the same individual, who identified several discrepancies related to our office paperwork. Even though we corrected these discrepancies and submitted all required documentation, both of our applications were initially denied due to lack of compliance with two of the standards. In particular, even though we had already submitted our contracts with phony wholesale suppliers, CMS said that we did not demonstrate that we had the capacity to fill orders for equipment or supplies using our own inventory or by contracting with other companies, as per Standard 4. According to CMS, we also did not demonstrate that we could replace or repair the items we provided to beneficiaries, as per Standard 14. To comply with these two standards, we sent NSC corrective action plans that included repair policies and the same phony DMEPOS wholesale supplier contracts that we had previously submitted. CMS accepted this documentation as valid and approved both of our fictitious DMEPOS companies. In short, the subcontractors hired to review our applications ultimately focused on the technical and administrative completeness of our applications rather than attempting to determine whether we were running valid businesses.