In our June 2015 and April 2016 reports examining CMS screening procedures, we found weaknesses in CMS’s verification of provider practice location, physician licensure status, providers listed as deceased or excluded from participating in federal programs or health care–related programs, and criminal-background histories. These weaknesses may have resulted in CMS improperly paying thousands of potentially ineligible providers and suppliers. We made recommendations to address these weaknesses, which CMS has indicated it has implemented or is taking steps to address. Additionally, as a result of our work, we referred 597 unique providers and suppliers to CMS. According to CMS officials, they have taken some actions to remove or recover overpayments from the potentially ineligible providers and suppliers we referred to them in April 2015 and April 2016, but CMS’s review and response to the referrals are ongoing. In our June 2015 report, we found thousands of questionable practice location addresses for providers and suppliers listed in PECOS, as of March 2013, and DMEPOS suppliers, listed as of April 2013. Under federal regulations, providers and suppliers must be “operational” to furnish Medicare covered items or services, meaning that they have a qualified physical practice location that is open to the public for the purpose of providing health care–related services. The location must be properly staffed, equipped, and stocked to furnish these items or services. Addresses that generally would not be considered a valid practice location include post office boxes, and those associated with a certain type of CMRA, such as a United Parcel Service (UPS) store. We checked PECOS practice location addresses for all records that contained an address using the USPS address-management tool, a commercially available software package that standardizes addresses and provides specific flags on the address such as a CMRA, vacant, or invalid address. As illustrated in figure 1, on the basis of our analysis of a generalizable stratified random sample of 496 addresses, we estimate that about 23,400 (22 percent) of the 105,234 addresses we initially identified as a CMRA, vacant, or invalid address are potentially ineligible addresses. About 300 of the addresses were CMRAs, 3,200 were vacant properties, and 19,900 were invalid. Of the 23,400 potentially ineligible addresses submitted as practice locations, we estimate that, from 2005 to 2013, about 17,900 had no claims associated with the address, 2,900 were associated with providers that had claims that were less than $500,000 per address, and 2,600 were associated with providers that had claims that were $500,000 or more per address. Because some providers are associated with more than one address, it is possible that some of the claim amounts reported may be associated with a different, valid practice location. Due to how we compiled claims by the National Provider Identifier, we were unable to determine how much, if any, of the claim amount may be associated with a different, valid address. In our June 2015 report, we found limitations with CMS’s Finalist software used to validate practice location addresses. The Finalist software is one technique used by the Medicare Administrative Contractors (MAC) and the National Supplier Clearinghouse (NSC) to validate a practice location. According to CMS, Finalist is integrated into PECOS to standardize addresses and does so by comparing the address listed on the application to USPS records and correcting any misspellings in street and city names, standardizing directional markers (such as NE or West) and suffixes (such as Ave. or Lane), and correcting errors in the zip code. However, the Finalist software does not indicate whether the address is a CMRA, vacant, or invalid address—in other words, whether the location is potentially ineligible to qualify as a legitimate practice location. CMS does not have these flags in Finalist because the agency added coding in PECOS that prevents post office box addresses from being entered, and believed that this step would prevent these types of ineligible practice locations from being accepted. Further, some CMRA addresses are not listed as post office boxes. For example, in our June 2015 report we identified 46 out of the 496 sample addresses that were allowed to enroll in Medicare with a practice location that was inside a mailing store similar to a UPS store. These providers’ addresses did not appear in PECOS as a post office box, but instead were listed as a suite or other number, along with a street address. Figure 2 shows an example of one provider we identified through our search and site visits as using a mailbox-rental store as its practice location and where services are not actually rendered. This provider’s address appears as having a suite number in PECOS and remained in the system as of January 2015. According to our analysis of CMS records, this provider was paid approximately $592,000 by Medicare from the date it enrolled in PECOS with this address to December 2013, which was the latest date for which CMS had claims data at the time of our review. Our June 2015 report also found locations that were vacant or addresses that belonged to an unrelated establishment. For example, we visited a provider’s stated practice location in December 2014 and instead found a fast-food franchise there (see fig. 3—the name of the franchise has been blurred). In addition, we found a Google Maps image dated September 2011 that shows this specific location as vacant. Although the provider was not paid by Medicare from the date this practice location address was flagged as vacant, by remaining actively enrolled into PECOS, the provider may be eligible to bill Medicare in the future. In March 2014, CMS issued guidance to the MACs that revised the practice location verification methods by requiring MACs to only contact the person listed in the application to verify the practice location address and use the Finalist software that is integrated in PECOS to standardize the practice location address. Additional verification, such as using 411.com and USPS.com, which was required under the previous guidance, is only needed if Finalist cannot standardize the actual address. In our June 2015 report, we noted that our findings suggest that the revised screening procedure of contacting the person listed in the application to verify all of the practice location addresses may not be sufficient to verify such practice locations. For example, two providers in our sample of 496 addresses that the USPS address-management tool flagged as CMRA, invalid, or vacant successfully underwent a MAC revalidation process in 2014. The MAC used the new procedure of calling the contact person to verify the practice location. Each of these two providers had a UPS or similar store as its practice location. To help further improve CMS’s enrollment-screening procedures to verify applicants’ practice location, we made two recommendations to CMS in our June 2015 report. First, we recommended that CMS modify the CMS software integrated into PECOS to include specific flags to help identify potentially questionable practice location addresses, such as CMRA, vacant, and invalid addresses. The agency concurred with this recommendation. On May 16, 2016, CMS provided us with supporting documentation that shows that the agency replaced its current PECOS address verification software to include Delivery Point Verification (DPV)—which is similar to the software we used when conducting the work in the June 2015 report—as an addition to the existing functionality. According to CMS officials, this new DPV functionality flags addresses that may be CMRA, vacant, or invalid. By updating the address verification software, CMS can ensure that providers with ineligible practice location are not listed in PECOS. Second, we recommended in our June 2015 report that CMS revise its guidance for verifying practice locations to include, at a minimum, the requirements contained in the guidance in place prior to March 2014. Such a revision would require that MACs conduct additional research, beyond phone calls to applicants, on the practice location addresses that are flagged as a CMRA, vacant, or invalid address to better ensure that the address meets CMS’s practice location criteria. The agency did not concur with this recommendation, stating that the March 2014 guidance was sufficient to verify practice locations. However, our audit work shows that additional checks on addresses flagged by the address-matching software as a CMRA, vacant, or invalid can help verify whether the addresses are ineligible. As our report highlighted, we identified providers with potentially ineligible addresses that were approved by MACs using the process outlined in the existing guidance. Therefore, we continue to believe that the agency should update its guidance for verifying potentially ineligible practice locations. In February 2016, CMS officials told us that, as part of configuring the PECOS address verification software to include the DPV functionality and flag CMRAs, vacancies, invalid addresses, and other potentially questionable practice locations, the agency plans to validate the DPV through site visits and follow its current process to take administrative action if the results are confirmed. CMS officials told us that they believe that by implementing the first recommendation by incorporating software flags and revising its guidance for verifying potentially ineligible practice location, if necessary, the second recommendation will be addressed. As of May 17, 2016, CMS had not provided us with details and supporting documentation of how it will revise its guidance. Accordingly, it is too early for us to determine whether the agency’s actions would fully address the intent of the recommendation. We plan to continue to monitor the agency’s efforts in this area. CMS has taken some actions to remove or recover overpayments from potentially ineligible providers and suppliers that we referred to it, based on our June 2015 report. On April 29, 2015, we referred 286 unique providers to CMS for further review and action as a result of our identification of providers with potentially ineligible practice location address. From August 2015 to May 2016, CMS has provided updates on these referrals.