This is the accessible text file for GAO report number GAO-15-66 
entitled 'Medicare Program Integrity: CMS Pursues Many Practices to 
Address Prescription Drug Fraud, Waste, and Abuse' which was released 
on November 24, 2014. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as 
part of a longer term project to improve GAO products' accessibility. 
Every attempt has been made to maintain the structural and data 
integrity of the original printed product. Accessibility features, 
such as text descriptions of tables, consecutively numbered footnotes 
placed at the end of the file, and the text of agency comment letters, 
are provided but may not exactly duplicate the presentation or format 
of the printed version. The portable document format (PDF) file is an 
exact electronic replica of the printed version. We welcome your 
feedback. Please E-mail your comments regarding the contents or 
accessibility features of this document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

United States Government Accountability Office: 
GAO: 

Report to the Chairman, Subcommittee on Health, Committee on Ways and 
Means, House of Representatives: 

October 2014: 

Medicare Program Integrity: 

CMS Pursues Many Practices to Address Prescription Drug Fraud, Waste, 
and Abuse: 

GAO-15-66: 

GAO Highlights: 

Highlights of GAO-15-66, a report to the Chairman, Subcommittee on 
Health, Committee on Ways and Means, House of Representatives. 

Why GAO Did This Study: 

Recent media reports and law enforcement actions have highlighted the 
problem of prescription drug fraud, waste, and abuse in the United 
States. Medicare, and the Part D prescription drug benefit, are 
susceptible to such fraud—a risk made greater by Medicare's size, 
scope, and complexity. GAO and others have raised questions about 
CMS's oversight of its activities to address fraud, waste, and abuse 
in Part D, as well as oversight of the contractors tasked with this 
work. 

GAO examined (1) practices for promoting prescription drug program 
integrity, and (2) the extent that CMS's oversight of Medicare Part D 
program integrity, including the program integrity contractors, 
reflects these practices. To develop a list of practices, GAO 
interviewed 14 stakeholder groups involved in various aspects of 
prescription drug program integrity, including provider, beneficiary, 
and anti-fraud groups; identified and reviewed related documents; and 
conducted a search of eight bibliographic databases that included peer-
reviewed articles and government documents. GAO organized the 
practices based on the three categories of GAO's Fraud Prevention 
Framework. To determine how CMS's oversight reflects these practices, 
GAO analyzed agency documents, such as contracts, manuals, work 
products, and CMS audits of contractors; and interviewed agency 
officials. 

What GAO Found: 

GAO identified 23 practices for addressing prescription drug fraud, 
waste, and abuse that fall within three categories based on GAO's 
Fraud Prevention Framework—prevention, detection and monitoring, and 
investigation and prosecution. 

The Department of Health and Human Services'(HHS) Centers for Medicare 
& Medicaid Services (CMS) activities to address prescription drug 
fraud, waste, and abuse in the Medicare Part D prescription drug 
program reflect 14 of these 23 identified practices, some of which are 
in multiple categories, and the agency plans to implement 3 additional 
practices. 

Table: Practices Implemented, Planned, and Not Pursued by CMS and Its 
Contractors to Address Prescription Drug Fraud, Waste, and Abuse: 

Category: Prevention; 

Practice[A]: Providing clinical guidelines; 
Not pursuing. 

Practice[A]: Practicing collaboration; 
Implemented. 

Practice[A]: Educating clinicians and others; 
Implemented. 

Practice[A]: Using health information technology; 
Not pursuing. 

Practice[A]: Limiting supply of abused drugs; 
Not pursuing. 

Practice[A]: Using prepayment edits; 
Implemented. 

Practice[A]: Screening participants of health insurance programs; 
Implemented. 

Practice[A]: Using Prescription Drug Monitoring Programs (PDMP)[B]; 
Not pursuing. 

Category: Detection and monitoring; 

Practice[A]: Providing clinical guidelines; 
Not pursuing. 

Practice[A]: Practicing collaboration; 
Implemented. 

Practice[A]: Having compliance programs; 
Implemented. 

Practice[A]: Conducting data analysis; 
Implemented. 

Practice[A]: Conducting drug utilization reviews; 
Implemented. 

Practice[A]: Educating patients and others; 
Implemented. 

Practice[A]: Limiting certain patients to certain providers 
(“lock-ins)”; 
Not pursuing. 

Practice[A]: Using PDMPs[B]; 
Planned. 

Practice[A]: Conducting postpayment reviews; 
Implemented. 

Category: Investigation and prosecution: 

Practice[A]: Practicing collaboration; 
Implemented. 

Practice[A]: Educating law enforcement and others; 
Implemented. 

Practice[A]: Pursuing enforcement options; 
Planned. 

Practice[A]: Having investigative staff; 
Implemented. 

Practice[A]: Reporting to law enforcement; 
Implemented. 

Practice[A]: Using PDMPs[B]; 
Planned. 

Source: GAO analysis of relevant literature, CMS documents, and 
interviews with officials. GAO-15-66. 

[A] GAO determined that CMS had implemented a practice if the agency 
required or documented at least one activity within that practice, 
that CMS planned a practice if documentation or officials described 
activities as pilots or in the process of development, and that CMS 
was not pursuing a practice based on reviews of documentation and 
interviews with officials. 

[B] PDMP are state-based programs that operate electronic databases 
that gather information from pharmacies on certain dispensed 
prescriptions, such as whether a patient has multiple opioid 
prescriptions from multiple providers. 

[End of table] 

HHS generally agreed with our findings. 

View [hyperlink, http://www.gao.gov/products/GAO-15-66]. For more 
information, contact Kathleen M. King at (202) 512-7114 or 
kingk@gao.gov. 

[End of section] 

Contents: 

Letter: 

Background: 

We Identified Multiple Prevention, Detection, and Investigation 
Practices to Address Prescription Drug Fraud, Waste, and Abuse: 

CMS's Part D Program Integrity Efforts Reflect Many of the Practices 
We Identified: 

Agency Comments: 

Appendix I: Status of Practices by CMS and Its Contractors to Address 
Prescription Drug Fraud, Waste, and Abuse: 

Appendix II: Comments from the Department of Health and Human Services: 

Appendix III: GAO Contact and Staff Acknowledgments: 

Tables: 

Table 1: Prevention Practices for Prescription Drug Fraud, Waste, and 
Abuse: 

Table 2: Detection and Monitoring Practices for Prescription Drug 
Fraud, Waste, and Abuse: 

Table 3: Investigation and Prosecution Practices for Prescription Drug 
Fraud, Waste, and Abuse: 

Table 4: Practices Implemented by CMS and Its Contractors for 
Addressing Prescription Drug Fraud, Waste, and Abuse: 

Table 5: CMS Implementation Status and Examples of 23 Prevention, 
Detection and Monitoring, and Investigation and Prosecution Practices 
GAO Identified: 

Figures: 

Figure 1: Example of How a Part D Plan Sponsor Contracts with Other 
Entities: 

Figure 2: CMS Entities with Primary Responsibility for Part D Plan 
Sponsor Oversight: 

Abbreviations: 

CMS: Centers for Medicare & Medicaid Services: 

CPARS: Contractor Performance Assessment Reports System: 

CPI: Center for Program Integrity: 

D&M: detection and monitoring: 

DEA: Drug Enforcement Administration: 

DUR: drug utilization review: 

FDR: First Tier, Downstream or Related Entity: 

HHS: Department of Health and Human Services: 

I&P: investigation and prosecution: 

MEDIC: Medicare Drug Integrity Contractor: 

MMA: Medicare Prescription Drug, Improvement, and Modernization Act of 
2003: 

NBI: National Benefit Integrity: 

O&E: outreach and education: 

OIG: Office of Inspector General: 

OMS: Overutilization Monitoring System: 

PDMP: Prescription Drug Monitoring Program: 

RAC: Recovery Audit Contractor: 

SIU: Special Investigation Unit: 

[End of section] 

United States Government Accountability Office: 
GAO:
441 G St. N.W. 
Washington, DC 20548: 

October 24, 2014: 

The Honorable Kevin Brady: 
Chairman: 
Subcommittee on Health: 
Committee on Ways and Means: 
House of Representatives: 

Dear Mr. Chairman: 

Recent media reports and law enforcement actions have highlighted the 
problem of prescription drug fraud, waste, and abuse in the United 
States.[Footnote 1] Examples of problematic activities include 
beneficiaries "doctor shopping" to receive multiple prescriptions for 
opioids, such as OxyContin or Vicodin, from different providers; 
providers found to have questionable prescribing and billing 
practices; and diversion of prescription drugs by beneficiaries, 
pharmacies, and others for uses other than intended. Medicare and its 
prescription drug benefit, Part D, are susceptible to such fraud--a 
risk made greater by Medicare's size, scope, and complexity.[Footnote 
2] 

Since 2006, the Part D program has provided voluntary, outpatient 
prescription drug coverage to the Medicare population. In 2013, Part D 
had nearly 40 million beneficiaries and cost almost $70 billion, or 
about 12 percent of total Medicare expenditures. The program is 
administered by the Centers for Medicare & Medicaid Services (CMS), 
within the Department of Health and Human Services (HHS). CMS 
contracts with private companies to provide benefits under Part D. 

GAO, the HHS Office of Inspector General (OIG), and others have raised 
questions about CMS's oversight of its activities to address fraud, 
waste, and abuse in Part D, as well as oversight of the contractors 
tasked with assisting in these activities, the Medicare Drug Integrity 
Contractors (MEDIC).[Footnote 3] You asked us to examine practices for 
addressing fraud, waste, and abuse in prescription drug programs, and 
CMS's use of these practices. We examined (1) practices for promoting 
prescription drug program integrity, and (2) the extent that CMS's 
oversight of Medicare Part D program integrity, including the MEDICs, 
reflects these practices. 

To develop a list of practices for addressing prescription drug fraud, 
waste, and abuse, we interviewed stakeholders involved in prescription 
drug program integrity, such as groups representing prescribers, 
pharmacies, beneficiaries, and others, to discuss program integrity 
practices and identify documents that describe such practices. 
[Footnote 4] Through these interviews we identified an initial 213 
documents that appeared to address program integrity practices related 
to prescription drug fraud, waste, and abuse. We reviewed each 
document to identify specific practices and any relevant activities 
within those practices. We then conducted an additional search of 
eight bibliographic databases that included peer-reviewed articles and 
government documents that yielded an additional 642 documents that 
appeared to address program integrity practices related to 
prescription drug fraud, waste, and abuse. We reviewed the most 
recently published 10 percent, or 64 documents, to determine whether 
they were relevant and if they described additional specific practices 
not already determined through our review of the initial 213 
documents. We did not identify any significantly different practices 
and therefore discontinued our review of documents. We reviewed, in 
total, 277 documents. We used GAO's Fraud Prevention Framework to 
organize the prescription drug program integrity practices we 
identified in our review into one of three categories: prevention, 
detection and monitoring, and investigation and prosecution.[Footnote 
5] We did not evaluate the practices we identified for their relative 
effectiveness. 

To determine the extent to which CMS's oversight of Medicare Part D, 
including the MEDICs, reflects the practices we identified, we 
interviewed agency officials involved in the oversight of the MEDICs 
and plan sponsors. We also analyzed agency documents, such as the 
MEDIC contracts and manuals; MEDIC work products, including the 
MEDICs' most recent performance evaluations; plan sponsor contract 
materials and memos; CMS findings from its 2013 audits of selected 
plan sponsors; and CMS regulations. We used the reviewed materials and 
interviews with CMS officials to determine which of the practices we 
identified that CMS incorporates into its oversight of the Part D 
program, as well as the practices CMS does not incorporate or plans to 
incorporate in the future. We determined that CMS had implemented a 
practice if the agency required or documented at least one activity 
within that practice, that CMS planned a practice if documentation or 
officials described activities as pilots or in the process of 
development, and that CMS was not pursuing practices based on reviews 
of documentation and interviews with officials. 

We conducted this performance audit from January 2014 to October 2014 
in accordance with generally accepted government auditing standards. 
Those standards require that we plan and perform the audit to obtain 
sufficient, appropriate evidence to provide a reasonable basis for our 
findings and conclusions based on our audit objectives. We believe 
that the evidence obtained provides a reasonable basis for our 
findings and conclusions based on our audit objectives. 

Background: 

Part D Plan Sponsors: 

The Medicare Part D program was designed to be administered by private 
organizations--referred to as plan sponsors--that CMS contracts with 
to provide outpatient prescription drug benefit plans to Medicare 
beneficiaries.[Footnote 6] These sponsors may contract with other 
entities--called First Tier, Downstream or Related Entities (FDR)--to 
help provide these benefits. (See figure 1.) FDRs include pharmacy 
benefit managers--companies that provide services such as 
contracting with a network of pharmacies, managing formularies, and 
performing drug utilization reviews on behalf of the sponsors--and 
pharmacies. CMS holds plan sponsors responsible for oversight of their 
FDRs. 

Figure 1: Example of How a Part D Plan Sponsor Contracts with Other 
Entities: 

[Refer to PDF for image: flow chart] 

Top level: 
Plan sponsor. 

Second level: 
First Tier Entity: such as a Pharmacy Benefit Manager PBM. 

Third level: 
Downstream entity such as a pharmacy: 
* Downstream entity such as a pharmacist; 
Downstream entity such as a marketing firm: 
* Downstream entity such as a healthcare marketing consultant; 
Downstream entity such as a quality assurance firm; 
Downstream entity such as a claims processing firm. 

Source: GAO analysis of CMS Information. GAO-15-66. 

[End of figure] 

Part D Program Integrity: 

Program integrity responsibilities in Medicare Part D are shared by 
plan sponsors, CMS's Center for Program Integrity (CPI) and Center for 
Medicare, and CMS's program integrity contractors. 

Plan Sponsors' Responsibilities: 

Plan sponsors are required to have comprehensive compliance programs 
that include elements intended to safeguard the Part D program from 
fraud, waste, and abuse.[Footnote 7] CMS issued requirements for these 
programs based on input from various sources, including plan sponsors 
and industry representatives.[Footnote 8] CMS requires plan sponsors 
to: 

* monitor and audit their FDRs; 

* analyze data to detect and prevent potential fraud, waste, and 
abuse; and: 

* have a unit, such as a Special Investigation Unit (SIU), 
specifically tasked with identifying and addressing fraud, waste, and 
abuse, or ensure that the responsibilities generally conducted by an 
SIU are conducted by a plan sponsor's compliance department. 

CMS's Oversight: 

CMS's CPI oversees Part D program integrity and coordinates with other 
groups within CMS's Center for Medicare that monitor plan sponsor 
compliance with the Part D program. (See fig. 2.) Within the Center 
for Medicare, one such group is the Medicare Parts C and D Oversight 
and Enforcement Group, which ensures contractual compliance through 
audits of plan sponsors. If those audits identify noncompliance with 
the terms of the Part D contract, CMS may take a variety of actions 
that include requiring corrective action plans, sending warning 
letters, assessing civil money penalties, and terminating or not 
renewing a contract. The other group, the Medicare Drug Benefit and C 
& D Data Group, analyzes data to identify potential patient safety 
concerns, such as overutilization of opioid drugs, that may also 
indicate potential fraud or abuse. 

CPI has primary responsibility for overseeing the two MEDICs tasked 
with promoting program integrity in Medicare Part D: [Footnote 9] 

* The National Benefit Integrity (NBI) MEDIC is responsible for 
preventing, detecting, and deterring Part D fraud, waste, and abuse. 
This includes intake and handling of complaints from beneficiaries and 
others as well as requests for information from law enforcement; 
investigating providers and others and referring them to law 
enforcement; and analyzing Part D program prescription drug event 
records and other data to identify patterns indicative of potential 
fraud, waste, or abuse.[Footnote 10] 

* The Outreach & Education (O&E) MEDIC provides Part D fraud, waste, 
and abuse education to plan sponsors and other stakeholders by working 
in concert with CMS to develop educational and training tools, and by 
facilitating information-sharing opportunities, such as fraud alerts, 
conferences, and other meetings. 

CPI also oversees the Part D Recovery Audit Contractor (RAC) program, 
which is tasked with reviewing paid Medicare claims--or, for Part D, 
prescription drug event data--from plan sponsors and their pharmacies 
to determine overpayments and underpayments; providing information to 
CPI to help prevent future improper payments; and referring any 
potential fraud identified during the auditing process to the NBI 
MEDIC to investigate. While the Part D RAC may conduct work similar to 
the NBI MEDIC, the focus of the RAC is improper payments--such as 
overpayments--while the MEDIC's focus is potential fraud, waste, and 
abuse. 

Figure 2: CMS Entities with Primary Responsibility for Part D Plan 
Sponsor Oversight: 

[Refer to PDF for image: flow chart] 

Top level: 

CMS Administrator: 
* CMS Principal Deputy Administrator/Chief Operating Officer[A]. 

Second level: 

Center for Medicare[A]: 
* Medicare Part C and D Oversight and Enforcement Group (including the 
Division of Audit Operations[A]: 
- Part D Plan Sponsors[B]; 
* Medicare Drug Benefit and C and D Data Group[A]: 
- Part D Plan Sponsors[B]. 

Center for Program Integrity[A]: 
* Medicare Program Integrity Group's Division of Plan Oversight and 
Accountability[A]: 
- National Benefit Integrity: Medicare Drug Integrity Contractor 
(MEDIC)[B]; 
- Outreach and Education MEDIC[B]; 
- Part D Recovery Audit Contractor[B]. 

Source: GAO analysis of CMS Information. GAO-15-66. 

[A] CMS entity. 

[B] CMS contractor that CMS entity oversees. 

[End of figure] 

We Identified Multiple Prevention, Detection, and Investigation 
Practices to Address Prescription Drug Fraud, Waste, and Abuse: 

We identified a total of 23 practices for addressing prescription drug 
fraud, waste, and abuse that fall within one or more of the three 
categories based on the Fraud Prevention Framework: (1) prevention, 
(2) detection and monitoring, and (3) investigation and prosecution. 
Counting only once the practices that fall within more than one 
category, we identified 16 unique practices. 

Prevention: 

We identified eight practices related to the prevention of 
prescription drug fraud, waste, and abuse that can include multiple 
activities, as shown in table 1. For example, one prevention practice, 
limiting the supply of abused drugs, can help prevent abuse by 
restricting the amount of potentially abused drugs that are available. 
This is done by conducting the following activities: 

* offering "take-back" programs where patients can safely dispose of 
any unused medications, preventing use or abuse by others; 

* securing information and materials, such as Drug Enforcement 
Administration (DEA) registration numbers and prescription 
pads,[Footnote 11] that could prevent bad actors from illegally 
obtaining prescription drugs; and: 

* developing abuse-resistant drugs that could hamper efforts to abuse 
them. 

Table 1: Prevention Practices for Prescription Drug Fraud, Waste, and 
Abuse: 

Practice: Clinical guidelines; 
Description/examples: 
Providing clinical guidance to prescribers and pharmacies regarding 
topics such as: 
* using the lowest effective dose and judicious prescribing; 
* encouraging use of generic drugs as alternatives to brand drugs; 
* alternatives to opioid drugs, such as physical therapy; and; 
* appropriate prescribing of noncontrolled substances, such as to 
reduce inappropriate prescribing of antibiotics. 

Practice: Collaboration; 
Description/examples: 
Establishing mutually reinforcing or joint strategies among 
stakeholders when developing programs and/or strategies to address 
prevention of prescription drug fraud, waste, and abuse. 

Practice: Education; 
Description/examples: 
Providing education or training to clinicians, patients, and others on 
how to prevent abuse, such as: 
* training clinicians on appropriate prescribing of opioid drugs; and; 
* educating the public on correct use and safe disposal of 
prescription drugs. 

Practice: Health information technology; 
Description/examples: 
Adopting health information technology, such as: 
* electronic-prescribing; and; 
* electronic health records. 

Practice: Limit the supply of abused drugs; 
Description/examples: 
Limiting the supply of abused drugs can include: 
* "take back" programs for safe prescription drug disposal; 
* physical and information security, including: 
- safe storage of drugs; 
- safeguarding Drug Enforcement Administration, Medicare National 
Provider Identifier, and other identifiers that can be used to obtain 
prescription drugs fraudulently; 
- securing the prescription drug supply chain; and; 
- restricting distribution of certain prescription drugs to appropriate 
entities; 
* developing abuse-resistant drugs, including generic versions; and; 
* prescription verification (by provider or pharmacist), including: 
- using tamper-resistant prescription pads; 
- checking patients identification prior to dispensing certain drugs, 
and; 
- verifying certain prescriptions with the prescriber. 

Practice: Prepayment edits; 
Description/examples: 
Using prepayment edits--controls built into payment systems--to deny 
claims that should not be paid or to flag claims for additional review 
before payment. 

Practice: Prescription Drug Monitoring Programs (PDMP)[A]; 
Description/examples: 
Having clinicians use their state's PDMP to ensure patients are not 
inappropriately receiving multiple prescriptions, including: 
* prescribers checking PDMPs prior to first prescribing certain 
prescription drugs; and; 
* pharmacists checking PDMPs prior to dispensing those drugs. 

Practice: Screening; 
Description/examples: 
Screening the eligibility of beneficiaries, prescribers, pharmacies, 
and other entities to ensure that they have coverage under or 
participate in a health insurance program. (Note: This does not 
include screening for potential drug abuse.) 

Source: GAO analysis of relevant literature. GAO-15-66. 

[A] PDMPs are state-based programs that operate electronic databases 
that gather information from pharmacies on certain dispensed 
prescriptions. Authorized users access the information about a 
patient's prescription drug history, such as whether a patient has 
multiple opioid prescriptions from multiple providers. 

[End of table] 

Detection and Monitoring: 

We identified nine practices related to the detection and monitoring 
of prescription drug fraud, waste, and abuse, as shown in table 2. For 
example, the collaboration practice includes sharing information about 
specific fraud schemes and potentially fraudulent providers that can 
help other interested parties--such as other insurers--find those 
schemes and providers within their own systems. These practices also 
help monitor individuals who have been identified as potentially 
abusing drugs or health care benefits. For example, one practice we 
identified is recipient restriction programs--called "lock-ins"--that 
typically require certain patients to use one prescribing physician 
and one dispensing pharmacy--to better track their prescription drug 
use. 

Table 2: Detection and Monitoring Practices for Prescription Drug 
Fraud, Waste, and Abuse: 

Practice: Clinical guidelines; 
Description/examples: 
Providing clinical guidance to prescribers and pharmacies regarding 
topics such as: 
* screening patients for potential drug abuse, such as through 
urine testing or other screening tools; and; 
* more frequent evaluations of patients who are prescribed certain 
drugs. 

Practice: Collaboration; 
Description/examples: 
Establishing mutually reinforcing or joint strategies among 
stakeholders to help in detection and monitoring efforts, such as 
sharing information on specific fraud schemes, results of data 
analysis, and disciplinary actions taken against providers. 

Practice: Compliance program; 
Description/examples: 
Establishing effective compliance programs that include the following 
elements: 
* written policies, procedures, and standards of conduct; 
* designation of a compliance officer and committee; 
* effective training and education; 
* effective lines of communication; 
* enforcing standards; 
* internal monitoring and auditing; and; 
* responding promptly to offenses and developing corrective actions. 

Practice: Data analysis; 
Description/examples: 
Having dedicated and appropriate staff for collecting and actively 
analyzing data to identify outliers or other markers of potential 
fraud, waste or abuse. 

Practice: Drug utilization review (DUR); 
Description/examples: 
Having authorized, structured, ongoing reviews of prescribing, 
dispensing, and use of medication. DURs can include: 
* prospective reviews, such as requiring prior authorization for 
certain drugs, high drug doses, or large drug quantities before the 
drugs are dispensed; 
* concurrent reviews; and; 
* retrospective or retroactive reviews. 

Practice: Education; 
Description/examples: 
Educating insurers, providers, patients, and others on how to detect 
potential prescription drug fraud, waste, and abuse. This can include 
alerting providers to their prescribing patterns. 

Practice: Postpayment reviews; 
Description/examples: 
Reviewing claims and other documents after payment to ensure 
compliance with payment rules and that the prescription was medically 
necessary. This includes the ability to suspend payments and obtain 
and review medical records. 
Postpayment reviews also include alerting providers and beneficiaries 
to potential errors in services provided or received, such as by 
sending explanation of benefit reports to beneficiaries for their 
review. 

Practice: Prescription Drug Monitoring Programs (PDMP)[A]; 
Description/examples: 
Using PDMP reports to help detect potential problems. These can be 
solicited reports, such as prescribers requesting a report about a 
particular patient, or unsolicited reports, such as a PDMP system 
automatically sending a prescriber a report on his or her patients and 
prescribing patterns. 

Practice: Recipient restriction programs ("lock ins"); 
Description/examples: 
Requiring certain patients--such as those at risk for abusing 
drugs, high-users of controlled substances, and others--typically to 
use only one prescribing physician and one dispensing pharmacy. 

Source: GAO analysis of relevant literature. GAO-15-66. 

[A] PDMPs are state-based programs that operate electronic databases 
that gather information from pharmacies on certain dispensed 
prescriptions. Authorized users access the information about a 
patient's prescription drug history, such as whether a patient has 
multiple opioid prescriptions from multiple providers. 

[End of table] 

Investigation and Prosecution: 

We identified six practices related to the investigation and 
prosecution of prescription drug fraud, waste, and abuse, as shown in 
table 3. Practices include having investigative staff knowledgeable of 
prescription drug schemes and experienced in investigating them, as 
well as having the ability to take actions to enforce prescription 
drug rules. 

Table 3: Investigation and Prosecution Practices for Prescription Drug 
Fraud, Waste, and Abuse: 

Practice: Collaboration; 
Description/examples: 
Participating in joint investigations, task forces, and other 
investigative efforts. Sharing information, as appropriate, regarding 
ongoing fraud investigations, including information about the 
providers under investigation. 

Practice: Education; 
Description/examples: 
Providing education to law enforcement and other investigators 
specifically on how to investigate prescription drug fraud, waste, and 
abuse. 

Practice: Enforcement; 
Description/examples: 
Having and using punitive measures against those involved in potential 
fraud, waste, or abuse of prescription drugs, such as: 
* restricting providers' or beneficiaries' access to or removing them 
from insurance programs; and; 
* pursuing prosecutions. 

Practice: Investigations/Investigative staff; 
Description/examples: 
Having in-house investigators, such as a Special Investigative Unit. 
These entities are to take investigative steps such as on-site audits, 
medical record reviews, and other actions. 

Practice: Prescription Drug Monitoring Programs (PDMP)[A]; 
Description/examples: 
Accessing and/or analyzing PDMP data in support of investigations 
and/or prosecutions. 

Practice: Reporting to law enforcement; 
Description/examples: 
Reporting suspect bad actors and problems to law enforcement agencies. 

Source: GAO analysis of relevant literature. GAO-15-66. 

[A] PDMPs are state-based programs that operate electronic databases 
that gather information from pharmacies on certain dispensed 
prescriptions. Authorized users access the information about a 
patient's prescription drug history, such as whether a patient has 
multiple opioid prescriptions from multiple providers. 

[End of table] 

CMS's Part D Program Integrity Efforts Reflect Many of the Practices 
We Identified: 

CMS pursues many of the practices we identified that can be used to 
prevent, detect, and investigate prescription drug fraud, waste, and 
abuse. In addition, CMS plans to add new and strengthen certain 
existing practices, but will not adopt certain other practices for a 
variety of reasons. 

CMS, with Its Contractors, Has Implemented Many Program Integrity 
Practices, Particularly within the Categories of Detection and 
Monitoring and Investigation and Prosecution: 

CMS activities to address prescription drug fraud, waste, and abuse 
reflect 14 of the 23 total practices we identified, based on 
interviews with officials and review of agency documents. Most of the 
practices CMS pursues--10 of its 14 practices--relate to the detection 
and monitoring, and investigation and prosecution categories. 

CMS implements its prescription drug program integrity practices by 
assigning activities to and working with plan sponsors, the MEDICs, 
and others. For example, 

* for prevention, CMS works with the O&E MEDIC to develop educational 
materials that plan sponsors can download from the O&E MEDIC's website 
and customize for their beneficiaries; 

* for detection and monitoring, CMS requires plan sponsors to have 
compliance programs, which incorporate multiple practices we 
identified, such as data analysis, collaboration, and education; the 
NBI MEDIC also analyzes data and shares the results with plan 
sponsors; and: 

* for investigations and prosecutions, plan sponsors and the NBI MEDIC 
are expected to have staff who can identify and investigate potential 
fraud, waste, and abuse. 

The NBI and O&E MEDICs reported completing work for a variety of 
practices, and CMS rated elements of the MEDICs' work from 
satisfactory to exceptional on their most recent performance 
assessments.[Footnote 12] 

NBI MEDIC: 

CMS paid approximately $17 million in 2013 to the NBI MEDIC to analyze 
data, process and review complaints, and develop investigations to 
promote Part D program integrity. In the most recently completed 
contract year, the NBI MEDIC reported the following: 

* processing almost 7,000 complaints to determine whether they 
identified potential fraud, for which CMS most recently rated the 
contractor "exceptional"; 

* completing 7 data analysis projects and initiating 41 new projects, 
for which CMS most recently rated the contractor "exceptional"; and: 

* referring almost 400 cases that represented approximately $5.1 
billion in potential fraud to law enforcement, for which CMS most 
recently rated the contractor "satisfactory" for its investigations 
and "exceptional" for its law enforcement referrals.[Footnote 13] 

O&E MEDIC: 

CMS paid approximately $1.7 million in 2013 to the O&E MEDIC to 
provide outreach and education that assists CMS in communicating 
program integrity efforts as well as supporting fraud, waste, and 
abuse oversight audits. In the most recently completed contract year, 
the O&E MEDIC reported the following: 

* developing 59 outreach and education materials, such as fraud 
awareness flyers and frequently asked questions; 

* developing 33 training products, such as webinars and job aids; and: 

* executing 8 conferences, including with stakeholders we interviewed, 
and providing 22 presentations at other conferences and meetings. 

* CMS rated each element of the O&E MEDIC's work as "satisfactory." 
[Footnote 14] 

Table 4 identifies the practices implemented by CMS and its 
contractors. 

Table 4: Practices Implemented by CMS and Its Contractors for 
Addressing Prescription Drug Fraud, Waste, and Abuse: 

Category: Prevention; 

Practice: Collaboration (prevention); 
Responsible entities and examples of activities[A]: CMS has established 
relationships with a variety of stakeholders to help develop programs 
and strategies to address prescription drug fraud, waste, and abuse, 
including, for example, the agency's participation in the Public-
Private Partnership to Prevent Health Care Fraud and as a member of the 
National Health Care Anti-Fraud Association. 

Practice: Education (prevention); 
Responsible entities and examples of activities[A]: Outreach & 
Education Medicare Drug Integrity Contractor (O&E MEDIC), in concert 
with CMS Center for Program Integrity (CPI), offers a variety of 
materials and events, such as an insert on safe drug disposal that 
plan sponsors can provide to their beneficiaries, and training to 
Medicare beneficiaries on how to prevent potential fraud. 

Practice: Prepayment edits; 
Responsible entities and examples of activities[A]: Plan sponsors may 
implement edits at the point-of-sale to control specific 
beneficiaries' access to certain medications (see also drug 
utilization review (DUR) below). 
For every prescription, plan sponsors must check a range of 
information, typically at the point-of-sale or distribution, such as 
drug interactions, incorrect amounts, and age or gender 
contraindications, such as a woman receiving medications prescribed 
only to men. 

Practice: Screening; 
Responsible entities and examples of activities[A]: Plan sponsors must 
verify beneficiaries' Part D eligibility. CMS finalized a rule in May 
2014 establishing a Medicare enrollment requirement for Part D 
prescribers effective June 1, 2015, and strengthening screening for 
ineligible incarcerated beneficiaries starting January 1, 2015.[B]. 

Category: Detection and monitoring (D&M); 

Practice: Collaboration (D&M); 
Responsible entities and examples of activities[A]: Plan 
sponsors are to share information with CMS regarding potentially 
fraudulent providers or schemes. 
National Benefit Integrity (NBI) and O&E MEDICs convene conferences 
and share information on prescription drug fraud, waste, and abuse 
with plan sponsors, law enforcement, beneficiaries, and other 
stakeholders. 
CMS sends memos to all plan sponsors about new Part D fraud schemes 
and potentially fraudulent providers that are also made available on 
the O&E MEDIC website. In addition, CMS sends the results of the NBI 
MEDIC's data analyses directly to a plan sponsor if the NBI MEDIC 
identifies particular issues for that sponsor to address. 

Practice: Compliance program; 
Responsible entities and examples of activities[A]: Plan sponsors are 
to have effective compliance programs. 

Practice: Data analysis; 
Responsible entities and examples of activities[A]: The NBI MEDIC 
conducts data analysis projects, such as identifying deceased 
prescribers across all plan sponsors, and is to have clinical and 
analytic staff to conduct that work. The NBI MEDIC is also 
implementing predictive analytic models to identify potential fraud in 
the Part D program. 
Plan sponsors are to have clinical and analytic staff, or contract 
with an entity that can provide such staff, to monitor and analyze 
data as part of their compliance programs. 

Practice: Drug utilization review (DUR); 
Responsible entities and examples of activities[A]: Plan sponsors are 
to review beneficiaries' drug utilization patterns to identify 
potential patient harm and beneficiaries at risk for overutilization, 
and refer those beneficiaries for case management. Plan sponsors are 
to share information on these beneficiaries when they move from one 
Part D plan to another. 
CMS also reports to plan sponsors, on a quarterly basis, the names of 
their beneficiaries overutilizing opioids and certain other drugs 
through CMS's Overutilization Monitoring System (OMS). Plan sponsors 
must report back to CMS in a quarterly report how each identified case 
is addressed. 

Practice: Education (D&M); 
Responsible entities and examples of activities[A]: O&E MEDIC, in 
coordination with CMS and the NBI MEDIC, provides training and 
materials to plan sponsors and others on how to identify potential 
fraud, waste, and abuse. For example, the O&E MEDIC, with CMS 
oversight, developed a Fraud Handbook that plan sponsors can access to 
learn about practical techniques and approaches on preventing, 
detecting, and investigating potential prescription drug fraud. 

Practice: Postpayment reviews; 
Responsible entities and examples of activities[A]: Plan sponsors are 
to conduct certain postpayment reviews (see also DUR above). 
Plan sponsors are also to provide beneficiaries with an explanation of 
benefits document to review for potential errors that also has a 
telephone number to report potential fraud. 
Part D Recovery Audit Contractor (RAC) is to review paid Part D claims 
to identify over--and under--payments and recoup overpayments, and 
refer potential fraud identified during that postpayment review to the 
NBI MEDIC. 

Category: Investigation and prosecution (I&P); 

Practice: Collaboration (I&P); 
Responsible entities and examples of activities[A]: The NBI MEDIC 
responds to law enforcement requests for information and has 
participated in task forces and other investigative efforts. 
The O&E MEDIC trains insurance investigators, law enforcement, and 
others. CMS hosts quarterly meetings with a variety of stakeholders on 
prescription drug fraud, waste, and abuse. 

Practice: Education (I&P); 
Responsible entities and examples of activities[A]: Category: O&E 
MEDIC, in consultation with the NBI MEDIC, provides educational 
materials on how to investigate potential fraud. 

Practice: Investigations/Investigative staff; 
Responsible entities and examples of activities[A]: Plan sponsors are 
to have staff who can identify potential fraud. The NBI MEDIC is to 
have investigative staff knowledgeable of prescription drug fraud. 

Practice: Reporting to law enforcement; 
Responsible entities and examples of activities[A]: The NBI MEDIC is 
required to refer investigations to law enforcement. CMS encourages 
but does not require plan sponsors to refer potential fraud to law 
enforcement and/or CMS, including the NBI MEDIC.[C] 

Source: GAO analysis of CMS documents and interviews with officials. 
GAO-15-66. 

[A] This table does not include all instances of CMS's activities to 
implement the practices GAO identified. 

[B] Once prescribers are enrolled, the rule provides that CMS will be 
able to revoke prescriber billing privileges for certain abuses of the 
program or noncompliance with applicable licensure requirements. To 
implement the exclusion of incarcerated individuals from Part D 
coverage, the rule redefined eligible Medicare service areas to 
exclude facilities in which individuals are incarcerated. See Medicare 
Program: Contract Year 2015 Policy and Technical Changes to the 
Medicare Advantage and the Medicare Prescription Drug Benefit 
Programs. 79 Fed. Reg. 29,844 (May 23, 2014). 

[C] In a March 2014 report, OIG reiterated previous recommendations 
that it had made to CMS to amend regulations to require Part D plan 
sponsors to report to CMS their identification of and response to 
potential fraud and abuse incidents. CMS did not concur with this 
recommendation, citing concerns about creating duplicative reporting. 
See Department of Health and Human Services Office of Inspector 
General, Less than Half of Part D Sponsors Voluntarily Reported Data 
on Potential Fraud and Abuse, OEI-03-13-00030 (Washington, D.C.: March 
2014). CMS officials told us in September 2014 that if the agency were 
to impose such a requirement, it would be able to evaluate sponsors' 
compliance with the reporting requirement, but not whether the reports 
identified actual fraud as defined by law enforcement. 

[End of table] 

CMS May Adopt Some Practices, but Not Others, for a Number of Reasons: 

CMS is planning to implement another 3 of the 23 total practices and 
to strengthen 4 that it has already implemented, but officials stated 
that the agency is not pursuing 6 practices for a number of reasons. 

The three additional practices CMS plans to implement are the 
following: 

* Detection and Monitoring: Prescription Drug Monitoring Program 
(PDMP). CMS officials said the agency is seeking access to PDMP data 
through several avenues.[Footnote 15] For example, CMS and the NBI 
MEDIC are working with the PDMP Center of Excellence to obtain de-
identified PDMP data to assist the MEDIC in detecting potential 
patterns of prescription drug fraud, waste, and abuse. 

* Investigation and Prosecution: PDMPs. CMS officials said CMS and the 
NBI MEDIC are also working with four states--Idaho, Indiana, 
Massachusetts, and New York--to obtain PDMP data as another data 
source to help investigate potential prescription drug diversion. 
Idaho currently is the only state that allows Medicare access to its 
PDMP, while the other states have expressed interest in providing 
information to CMS. 

* Investigation and Prosecution: Enforcement. Under the recently 
issued rule, which established a Medicare enrollment requirement for 
prescribers of drugs covered by Part D,[Footnote 16] CMS can revoke a 
physician's or eligible professional's Medicare enrollment if the DEA 
or a state agency has suspended or revoked the individual's prescriber 
privileges. CMS may also revoke enrollment where it determines the 
individual has prescribing patterns or conducts practices that are 
abusive or represent a threat to the health and safety of Medicare 
beneficiaries, or both. Prior to this new requirement, CMS could not 
directly take administrative actions against a Part D provider. CMS 
officials also reported that they are working with OIG on how best to 
pursue other enforcement options, such as "permissive exclusions," 
which allow OIG to exclude providers from federal health programs for 
certain other actions, such as misdemeanor convictions for certain 
offenses.[Footnote 17] 

CMS is planning to strengthen four practices that it has already 
implemented, which correspond to all three categories. 

* Prevention: Screening. CMS issued a final rule in May 2014 that is 
intended to strengthen Part D prescriber and beneficiary screening. 
The rule establishes a Medicare enrollment requirement for prescribers 
of drugs covered by Part D, effective June 2015.[Footnote 18] As a 
result, CMS is to screen these prescribers during the Medicare 
enrollment process to verify that they meet specific requirements, 
such as having current licenses or accreditation and valid Social 
Security numbers. Additionally, this final rule authorizes CMS to 
revoke a physician's or eligible professional's Medicare enrollment 
for certain abuses of the program, or based upon a suspension or 
revocation of the prescriber's DEA certificate or state authority to 
prescribe drugs. As with fee-for-service providers, CMS will 
revalidate enrollment information when changes or updates are 
submitted and during a 5-year revalidation process. CMS is still 
considering whether to require pharmacies that dispense covered Part D 
drugs to enroll into the Medicare program. 

* The rule is also intended to strengthen screening of Part D 
beneficiaries.[Footnote 19] Currently, plan sponsors are to verify 
beneficiaries' Part D eligibility. While incarcerated or confined 
beneficiaries are generally ineligible for Part D coverage, recent OIG 
reports found that CMS paid for prescription drugs for such 
beneficiaries.[Footnote 20] The new rule implements the exclusion of 
beneficiaries incarcerated for 30 days or more from receiving Part D 
benefits starting January 1, 2015, by removing the facilities where 
individuals are incarcerated from the definition of a plan's service 
area. 

* Detection and Monitoring: Collaboration. CMS is seeking to 
strengthen collaboration through a new voluntary web-based system 
created by the NBI MEDIC--PLATO--that is intended to allow CMS and 
plan sponsors to more easily share information on fraud schemes and 
potential bad actors.[Footnote 21] For example, plan sponsors may use 
the system to share information on specific suspect providers so that 
other plan sponsors can determine whether they should also investigate 
or take actions against those providers. CMS officials said that they 
anticipate that PLATO will be accessible to plan sponsors by the end 
of 2014. In addition, according to agency officials, CMS is working 
with the NBI MEDIC to develop and implement predictive models in PLATO 
to help identify potential fraud schemes that can be shared with plan 
sponsors, such as a model for identifying prescribers who provide 
certain controlled substances to patients without a valid medical need. 

* Detection and Monitoring: Compliance Program. CMS is pursuing 
options for improving its oversight of plan sponsors' compliance 
programs. In 2013, among the plan sponsors that it audited, CMS found 
weaknesses in the majority of plan sponsors' compliance programs for 
addressing fraud, waste, and abuse. During that year, CMS audited 29 
plan sponsors, representing 14 percent of all plan sponsors and, of 
those, nearly all (94 percent) had findings related to fraud, waste, 
and abuse activities, according to officials.[Footnote 22] These 
officials also reported that almost all weaknesses were addressed 
through a corrective action plan.[Footnote 23] In January 2014, CMS 
proposed a rule that would require, among other things, that plan 
sponsors hire an independent auditor to verify that any required 
corrective action plans addressed deficiencies found during a program 
audit.[Footnote 24] CMS did not finalize this requirement in the final 
rule issued in May 2014, and as of October 2014, CMS officials did not 
provide a proposed completion date. 

In addition, CMS officials reported that the agency has an initiative 
under way to gather information that could help improve oversight of 
plan sponsors' practices to address fraud, waste, and abuse. As part 
of this initiative, CMS interviewed five plan sponsors about how they 
use the information CMS provided to them on new fraud schemes and 
potentially fraudulent providers. Based on this information, CMS 
officials reported that they could change how the agency audits plan 
sponsors' fraud, waste, and abuse activities, or increase the 
requirements for sponsors' activities, in order to improve oversight. 
[Footnote 25] However, CMS officials noted that any changes will be 
based on the agency's final assessment of lessons learned from the 
initiative, which was still in progress as of August 2014. 

* Investigation and Prosecution: Collaboration. CMS is working to 
develop a more formal way to share information about fraudulent 
providers with relevant state medical boards, CMS officials said, so 
that the medical boards can conduct additional investigations to 
determine whether the board should impose sanctions on those 
providers, such as revoking a provider's medical license. 

CMS is not pursuing six practices that appear in two categories, 
prevention and detection and monitoring, because the agency considers 
the practices to be outside the scope of its program integrity 
activities, is concerned about limiting beneficiaries' access to 
services, or for other reasons. 

* Prevention, and Detection and Monitoring: Clinical Guidelines. While 
CMS uses clinical guidelines to review plan sponsors' formularies to 
ensure access to certain drugs, CMS does not require plan sponsors to 
carry out activities within these program integrity practices, such as 
filling only the prescriptions for the lowest effective dose, 
promoting alternatives to opioids, or screening their patients for 
potential drug abuse. However, CMS provides training materials to 
providers on such topics to promote patient safety, and other parts of 
Medicare cover screening for drug abuse under certain conditions. 

* Prevention: Health Information Technology. CMS does not use health 
information technology for program integrity purposes, but encourages 
its use by, for example, providing information to Medicare 
beneficiaries on the benefits of electronic health records. 

* Prevention: PDMPs. CMS guidance to physicians has encouraged 
prescribers to check their states' PDMP prior to prescribing certain 
drugs; however, variations in state practices regarding access to 
PDMPs means that not all prescribers may be able to conduct checks,
according to CMS officials. 

* Prevention: Limit the Supply of Abused Drugs. CMS officials told us 
that the agency does not conduct activities to limit the supply of 
abused drugs because this practice is beyond the scope of Part D 
program integrity efforts. For example, CMS does not operate "take 
back" days where beneficiaries can dispose of any unneeded 
prescription drugs, since, until recently, such events were the 
responsibility of DEA and required a law enforcement presence at such 
events, which CMS cannot provide.[Footnote 26] CMS also does not 
address the supply of abuse-resistant drugs, officials said, since 
that is the responsibility of the Food and Drug Administration and 
pharmaceutical manufacturers. 

* Detection and Monitoring: Lock-ins. CMS does not monitor Medicare 
beneficiaries through a "lock-in" or restricted recipient program. We 
previously recommended that CMS consider a restricted recipient 
program for Medicare Part D that would limit certain beneficiaries to 
one prescriber, one pharmacy, or both for receiving prescriptions, and 
that the agency should seek congressional authority, as appropriate, 
to do so.[Footnote 27] CMS, in responding to our recommendation, 
stated that it did not agree that a restricted recipient program was 
necessarily the appropriate control for the Part D program, and raised 
concerns about restricting beneficiaries' access to services.[Footnote 
28] However, in August 2014, OIG recommended that CMS restrict certain 
beneficiaries to a limited number of pharmacies and prescribers, and 
CMS concurred with the recommendation, but stated the agency needs--
and is receptive to--legislative authority to "lock in" beneficiaries 
in Part D.[Footnote 29] 

Currently, the agency requires plan sponsors to review data to 
identify beneficiaries potentially at risk for overutilization of 
certain drugs, including opioids, and to monitor those beneficiaries. 
[Footnote 30] Monitoring may include notifying their prescribers of 
the overutilization, case management, and point-of-sale edits, which 
are beneficiary-specific edits that can vary based on the situation. 
For example, the edits may prevent a beneficiary from receiving 
certain types of prescription drugs or an excessive amount of a 
particular drug.[Footnote 31] 

See appendix I for the status of all 23 program integrity practices we 
identified and whether CMS and its contractors have implemented, 
planned to implement, or are not pursuing them. 

Agency Comments: 

We provided a draft of this report to the Department of Health and 
Human Services (HHS) for comment and HHS provided written comments, 
which are reprinted in appendix II. In its comments, HHS generally 
agreed with our findings, and provided more information regarding our 
finding that CMS is not pursuing 6 of the 23 practices we identified 
for prescription drug fraud, waste, and abuse. Generally, the agency 
provided additional information for why CMS is not pursuing certain 
practices as part of its program integrity efforts, such as the use of 
clinical guidelines, PDMPs, and lock-in programs. Regarding the 
practice of health information technology, while HHS noted that CMS 
requires the development by Part D sponsors of electronic prescription 
drug programs and the use of e-prescribing is encouraged, these 
activities were not identified by CMS officials as specific program 
integrity efforts. Regarding the practice of limiting the supply of 
abused drugs, HHS described CMS activities that we considered under a 
different practice--the use of prepayment edits. Our descriptions and 
examples of these practices, as well as the other 17 practices, are 
included in tables 1, 2, and 3 in this report. HHS also provided a 
recent example of its program integrity efforts to address fraud, 
waste, and abuse in the Part D program, in which HHS sent letters to 
providers identified as very high prescribers of certain controlled 
substances to give information to these providers to help them 
evaluate whether their high prescribing level of these drugs is 
appropriate for their patient population, and to identify areas where 
their prescribing could be modified. HHS also provided technical 
comments, which we incorporated as appropriate. 

As agreed with your office, unless you publicly announce the contents 
of this report earlier, we plan no further distribution until 30 days 
from the report date. At that time, we will send copies to the 
Secretary of Health and Human Services, appropriate congressional 
committees, and other interested parties. In addition, the report will 
be available at no charge on the GAO website at [hyperlink, 
http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me at (202) 512-7114 or at kingk@gao.gov. Contact points for 
our Offices of Congressional Relations and Public Affairs may be found 
on the last page of this report. GAO staff who made key contributions 
to this report are listed in appendix III. 

Sincerely yours, 

Signed by: 

Kathleen King: 
Director, Health Care: 

[End of section] 

Appendix I: Status of Practices by CMS and Its Contractors to Address 
Prescription Drug Fraud, Waste, and Abuse: 

Table 5 shows the 23 prevention, detection and monitoring, and 
investigation and prosecution practices we identified, their CMS 
status (implemented, planned, or not pursuing), and examples of the 
activities. We determined that CMS had implemented a practice if the 
agency required or documented at least one activity within that 
practice, that CMS planned a practice if documentation or officials 
described activities as pilots or in the process of development, and 
that CMS was not pursuing practices based on reviews of documentation 
and interviews with officials. 

Table 5: CMS Implementation Status and Examples of 23 Prevention, 
Detection and Monitoring, and Investigation and Prosecution Practices 
GAO Identified: 

Category: Prevention; 

Practice: Clinical guidelines (prevention); 
Status: Not pursuing; 
Responsible entities and examples of activities[A] or explanation of 
status: The Centers for Medicare & Medicaid Services (CMS) does not 
use clinical guidelines for program integrity purposes, but the agency 
provides educational materials related to appropriate prescribing. 

Practice: Collaboration (prevention); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS has established relationships with a variety of 
stakeholders to help develop programs and strategies to address 
prescription drug fraud, waste, and abuse, including, for example, the 
agency's participation in the Public-Private Partnership to Prevent 
Health Care Fraud and as a member of the National Health Care Anti-
Fraud Association. 

Practice: Education (prevention); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Category: Outreach & Education Medicare Drug Integrity 
Contractor (O&E MEDIC), in concert with CMS Center for Program 
Integrity (CPI), offers a variety of materials and events, such as an 
insert on safe drug disposal that plan sponsors can provide to their 
beneficiaries, and training to Medicare beneficiaries on how to 
prevent potential fraud. 

Practice: Health information technology; 
Status: Not pursuing; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS does not use health information technology for program 
integrity purposes, but has encouraged its use, such as by providing 
information to Medicare beneficiaries on the benefits of electronic 
health records. 

Practice: Limit the supply of abused drugs; 
Status: Not pursuing; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS does not limit the supply of abused drugs because the 
associated activities of this practice are beyond the scope of Part D 
program integrity efforts, according to CMS officials. For example, 
until recently, to accept unneeded controlled substances in a "take 
back" program, the Drug Enforcement Administration required a law 
enforcement presence, which CMS cannot provide. 

Practice: Prepayment edits; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors may implement edits at the point-of-sale to 
control specific beneficiaries' access to certain medications (see 
also drug utilization review (DUR) below). For every prescription, 
plan sponsors must check a range of information, typically at the 
point-of-sale or distribution, such as drug interactions, incorrect 
amounts, and age or gender contraindications, such as a woman 
receiving medications prescribed only to men. 

Practice: Screening; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors must verify beneficiaries' Part D eligibility; 
CMS finalized a rule in May 2014 establishing a Medicare enrollment 
requirement for Part D prescribers effective June 1, 2015, and 
strengthening screening for ineligible incarcerated beneficiaries 
starting January 1, 2015.[B] 

Practice: Prescription Drug Monitoring Programs (PDMP)[C] (Prevention); 
Status: Not pursuing; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS guidance encourages but does not require prescribers to 
check PDMPs prior to prescribing and variations in state practices 
mean not all prescribers may be able to conduct checks. 

Category: Detection and monitoring (D&M); 

Practice: Clinical guidelines (D&M); 
Status: Not pursuing; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS does not use clinical guidelines for Part D program 
integrity purposes, but other parts of Medicare provide training 
materials to providers, such as on the topic of coverage for Screening, 
Brief Intervention, and Referral to Treatment services to identify, 
reduce, and prevent problematic substance use, abuse, and dependence. 

Practice: Collaboration (D&M); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors are to share information with CMS regarding 
potentially fraudulent providers or schemes; National Benefit 
Integrity (NBI) and O&E MEDICs convene conferences and share 
information on prescription drug fraud, waste, and abuse with plan 
sponsors, law enforcement, beneficiaries, and other stakeholders. CMS 
sends memos to all plan sponsors about new Part D fraud schemes and 
potentially fraudulent providers that are also made available on the 
O&E MEDIC website. In addition, CMS sends the results of the NBI 
MEDIC's data analyses directly to a plan sponsor if the NBI MEDIC 
identifies particular issues for that sponsor to address. 

Practice: Compliance program; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors are to have effective compliance programs. 

Practice: Data analysis; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: The NBI MEDIC conducts data analysis projects, such as 
identifying deceased prescribers across all plan sponsors, and is to 
have clinical and analytic staff to conduct that work. The NBI MEDIC 
is also implementing predictive analytic models to identify potential 
fraud in the Part D program. Plan sponsors are to have clinical and 
analytic staff, or contract with an entity that can provide such 
staff, to monitor and analyze data as part of their compliance 
programs. 

Practice: Drug utilization review (DUR); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors are to review beneficiaries' drug utilization 
patterns to identify potential patient harm and beneficiaries at risk 
for overutilization, and refer those beneficiaries for case management. 
Plan sponsors are to share information on these beneficiaries when they 
move from one Part D plan to another. CMS also reports to plan 
sponsors, on a quarterly basis, the names of their beneficiaries 
overutilizing opioids and certain other drugs through CMS's 
Overutilization Monitoring System (OMS). Plan sponsors must report back 
to CMS in a quarterly report how each identified case is addressed. 

Practice: Education (D&M); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: O&E MEDIC, in coordination with CMS and the NBI MEDIC, provides 
training and materials to plan sponsors and others on how to identify 
potential fraud, waste, and abuse. For example, the O&E MEDIC, with CMS 
oversight, developed a Fraud Handbook that plan sponsors can access to 
learn about practical techniques and approaches on preventing, 
detecting, and investigating potential prescription drug fraud. 

Practice: Recipient restriction programs ("lock-ins"); 
Status: Not pursuing; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS does not monitor Medicare beneficiaries through a "lock 
in" program. The agency has reported that it has taken a beneficiary-
centric approach that discourages such restrictions, and lacks the 
legislative authority to implement such a program, although the agency 
has stated that it is receptive to such authority. In addition, in 
2012, CMS conducted a study that identified few beneficiaries (less 
than 1 percent) who would merit such a program.[D] (see also DUR 
above). 

Practice: PDMPs[C] (D&M); 
Status: Planned; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS is negotiating with a national organization to obtain 
access to its PDMP data. 

Practice: Postpayment reviews; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors are to conduct certain postpayment reviews (see 
also DUR above). Plan sponsors are also to provide beneficiaries with 
an explanation-of-benefits document to review for potential errors 
that also has a telephone number to report potential fraud. Part D 
Recovery Audit Contractor (RAC) is to review paid Part D claims to 
identify over-and under-payments and recoup overpayments, and refer 
potential fraud identified during that postpayment review to the NBI 
MEDIC. 

Category: Investigation and prosecution (I&P); 

Practice: Collaboration (I&P); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: The NBI MEDIC responds to law enforcement requests for 
information and has participated in task forces and other investigative 
efforts. The O&E MEDIC trains insurance investigators, law 
enforcement, and others. CMS hosts quarterly meetings with a variety 
of stakeholders on prescription drug fraud, waste, and abuse. 

Practice: Category: Education (I&P); 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: The O&E MEDIC, in consultation with the NBI MEDIC, provides 
educational materials on how to investigate potential fraud. 

Practice: Category: Enforcement; 
Status: Planned; 
Responsible entities and examples of activities[A] or explanation of 
status: Starting June 1, 2015, CMS may revoke prescribers' Medicare 
enrollment[B] and CMS officials reported they are starting to work with 
the Health and Human Services Office of the Inspector General (OIG) to 
remove more providers from Medicare through "permissive exclusions."[E] 

Practice: Investigations/Investigative staff; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: Plan sponsors are to have staff who can identify potential 
fraud. The NBI MEDIC is to have investigative staff knowledgeable of 
prescription drug fraud. 

Practice: Reporting to law enforcement; 
Status: Implemented; 
Responsible entities and examples of activities[A] or explanation of 
status: The NBI MEDIC is required to refer investigations to law 
enforcement. CMS encourages but does not require plan sponsors to 
refer potential fraud to law enforcement and/or CMS, including the NBI 
MEDIC.[F] 

Practice: PDMPs[C] (I&P); 
Status: Planned; 
Responsible entities and examples of activities[A] or explanation of 
status: CMS is negotiating with certain states to obtain access to 
their PDMP data. 

Source: GAO analysis of CMS documents and interviews with officials. 
GAO-15-66. 

[A] This table does not include all instances of CMS's activities to 
implement the practices we identified. 

[B] Once prescribers are enrolled, the rule provides that CMS will be 
able to revoke prescriber billing privileges for certain abuses of the 
program or noncompliance with applicable licensure requirements. To 
implement the exclusion of incarcerated individuals from Part D 
coverage, the rule redefined eligible Medicare service areas to 
exclude facilities in which individuals are incarcerated. See Medicare 
Program: Contract Year 2015 Policy and Technical Changes to the 
Medicare Advantage and the Medicare Prescription Drug Benefit 
Programs. 79 Fed. Reg. 29,844 (May 23, 2014). 

[C] PDMPs are state-based programs that operate electronic databases 
that gather information from pharmacies on certain dispensed 
prescriptions. Authorized users access the information about a 
patients' prescription drug history, such as whether a patient has 
multiple opioid prescriptions from multiple providers. 

[D] In 2012, CMS analyzed Part D data to identify beneficiaries 
receiving potentially unsafe doses of prescription opioids for 90 or 
more consecutive days, excluding beneficiaries with cancer or in 
hospice care. CMS concluded that .71 percent (224,964) of all Part D 
beneficiaries were at high risk for potential adverse effects and had 
a high likelihood of inappropriately using opioids. CMS also analyzed 
the number of prescribers and pharmacies associated with these 
beneficiaries' opioid prescriptions and found that .07 percent 
(22,222) of Part D beneficiaries received high dosages of opioids from 
at least four prescribers and at least four pharmacies. 

[E] Under section 1128 of the Social Security Act, exclusions from 
federal health programs are permissive under certain circumstances and 
mandatory in others. 42 U.S.C. § 1320a-7. Permissive exclusions are 
allowed for a variety of reasons, including licensure suspension, 
surrender, or revocation, or misdemeanor controlled substance 
conviction. Mandatory exclusions are required for felony convictions 
relating to health care fraud or controlled substances and any 
convictions relating to patient abuse/neglect or to the delivery of 
Medicare or state health care programs. 

[F] In a March 2014 report, OIG reiterated previous recommendations 
that it had made to CMS to amend regulations to require Part D plan 
sponsors to report to CMS their identification of and response to 
potential fraud and abuse incidents. CMS did not concur with this 
recommendation, citing concerns about creating duplicative reporting. 
See Department of Health and Human Services Office of Inspector 
General, Less than Half of Part D Sponsors Voluntarily Reported Data 
on Potential Fraud and Abuse, OEI-03-13-00030 (Washington, D.C.: March 
2014). CMS officials told us in September 2014 that if the agency were 
to impose such a requirement, it would be able to evaluate sponsors' 
compliance with the reporting requirement, but not whether the reports 
identified actual fraud as defined by law enforcement. 

[End of table] 

[End of section] 

Appendix II: Comments from the Department of Health and Human Services: 

Department of Health & Human Services: 
Office of The Secretary: 
Assistant Secretary for Legislation: 
Washington, DC 20201: 

October 10, 2014: 

Kathleen M. King: 
Director, Health Care: 
U.S. Government Accountability Office: 
441 G Street NW: 
Washington, DC 20548: 

Dear Ms. King: 

Attached are comments on the U.S. Government Accountability Office's 
(GAO) report entitled, "Medicare Program Integrity: CMS Pursues Many 
Practices to Address Prescription Drug Fraud, Waste, and Abuse" (GAO-
15-66). 

The Department appreciates the opportunity to review this report prior 
to publication. 

Sincerely, 

Signed by: 

Jim R. Esquea: 
Assistant Secretary for Legislation: 

Attachment: 

General Comments Of The Department Of Health And Human Services (HHS) 
On The Government Accountability Office's Report Entitled: Medicare 
Program Integrity: CMS Pursues Many Practices To Address Prescription 
Drug Fraud, Waste, And Abuse: 

The Department of Health and Human Services (HHS) appreciates the 
opportunity to review and comment on this draft report. 

HHS is strongly committed to program integrity efforts in Medicare and 
has a number of ongoing activities to address fraud, waste and abuse 
in the Part D program. For instance, HHS recently sent letters to 
providers who have been identified as very high prescribers of 
Schedule II controlled substances under Part D compared to other 
providers in their specialty and state. The letter informs the 
prescribers of the extent of their outlier status for Schedule II 
drugs in order to provide insight into their prescribing practices. 
The letter is intended to provide information to help these 
prescribers evaluate whether their high prescribing level for these 
drugs is appropriate for their patient population and identify areas 
where their prescribing could be modified. The letter encourages the 
providers to share the information in the letter with other clinicians. 

As the report notes, HHS has implemented or plans to implement a 
majority of the program integrity practices identified by GAO to curb 
prescription drug fraud, waste, and abuse. In addition, CMS is 
addressing the other practices identified by GAO through coordination 
with Part D sponsors, prescribers, and beneficiaries. 

These practices and HHS' responses to the GAO are below. 

Clinical Guidelines: 

CMS does not use clinical guidelines for program integrity purposes, 
but the agency provides educational materials related to appropriate 
prescribing. 

HHS Response: 

Part D plan sponsors have relationships with pharmacies. They 
generally do not have relationships with prescribers that would allow 
them to require their adherence to clinical guidelines. 

Health Information Technology (Prevention): 

CMS does not use health information technology for program integrity 
purposes, but has encouraged its use, such as by providing information 
to Medicare beneficiaries on the benefits of electronic health records. 

HHS Response: 

HHS recognizes that technologies such as e-prescribing can be a 
helpful tool in protecting program integrity and has encouraged their 
use. For instance, Part D sponsors must establish and maintain an 
electronic prescription drug program, and e-prescribing is generally 
required of eligible professionals and hospitals for achieving 
meaningful use in the Medicare electronic health record incentive 
program. In addition, HHS has consulted on Drug Enforcement Agency 
rulemaking that allows for the use of e-prescribing for controlled 
substances. 

Limit the Supply of Abused Drugs (Prevention): 

CMS does not limit the supply of abused drugs because the associated 
activities of this practice are beyond the scope of Part D program 
integrity efforts, according to CMS officials. For example, until 
recently, to accept unneeded controlled substances in a "take back" 
program, the Drug Enforcement Administration required a law 
enforcement presence, which CMS cannot provide. 

HHS Response: 

HHS has worked to limit the supply of abused drugs while maintaining 
access for beneficiaries. HHS has promulgated regulations that require 
short-cycle dispensing of brand drugs in long-term care. Also, under 
our guidance, plan sponsors may provide quantity limits of drugs, 
including on those drugs that have no U.S. Food and Drug 
Administration quantity limits. 

Prescription Drug Monitoring Programs (PDMP) (Prevention): 

CMS guidance encourages but does not require prescribers to check 
PDMPs prior to prescribing and variations in state practices mean not 
all prescribers may be able to conduct checks. 

HHS Response: 

As noted by GAO, variations in state practices and in Part D plan 
sponsors relationships with prescribers make it difficult for HHS to 
develop a national requirement for prescribers to check PDMPs prior to 
prescribing. 

Recipient Restriction Programs ("lock ins"): 

CMS does not monitor Medicare beneficiaries through a "lock in" 
program. The agency has reported that it has taken a beneficiary-
centric approach that discourages such restrictions, and lacks the 
legislative authority to implement such a program, although the agency 
has stated that it is receptive to such authority. In addition, in 
2012, CMS conducted a study that identified few beneficiaries (less 
than 1 percent) who would merit such a program. 

HHS Response: 

As noted by GAO, HHS would need legislative authority to implement 
"lock in" programs in Part D. HHS currently responds to abuse 
identified at the beneficiary level through other programs. Part D 
sponsors review reports to identify the number of prescriptions for 
opioids and acetaminophen filled by individual enrollees, typically 
with multiple prescribers and pharmacies, to identify possible abuse 
or illegal activity. Prescribers for enrollees with abnormal 
prescription patterns for these drugs are contacted by their Part D 
plan sponsors to confirm the medical necessity of the prescription 
patterns. When medical necessity is not confirmed, Part D sponsors may 
impose beneficiary-level claim edits to prevent the coverage of an 
unsafe level of opioids and acetaminophen. The sponsor also notifies 
HHS has systems in place to notify a new sponsor of the edit if the 
beneficiary changes plans. 

HHS thanks GAO for their efforts on this issue and looks forward to 
working with GAO on this and other issues in the future. 

[End of section] 

Appendix III: GAO Contact and Staff Acknowledgments: 

GAO Contact: 

Kathleen M. King, (202) 512-7114 or kingk@gao.gov. 

Staff Acknowledgments: 

In addition to the contact named above, Karen Doran, Assistant 
Director; Elizabeth Morrison; Lisa Rogers; Eden Savino; and Jennifer 
Whitworth made key contributions to this report. 

[End of section] 

Footnotes: 

[1] Fraud involves an intentional act or representation to deceive 
with the knowledge that the action or representation could result in 
gain. Waste includes inaccurate payments for services, such as 
unintentional duplicate payments. Abuse represents actions 
inconsistent with acceptable business or medical practices. In this 
report, we use the term "program integrity" to refer to activities and 
practices that address fraud, waste, and abuse. 

[2] Medicare is a federal health insurance program for people age 65 
and older, individuals under age 65 with certain disabilities, and 
individuals diagnosed with end-stage renal disease. Medicare Parts A 
and B are known as original Medicare or Medicare fee-for-service; Part 
A covers hospital and other inpatient stays, and Part B covers 
hospital outpatient, physician, and other services. Part C is Medicare 
Advantage, under which beneficiaries receive health benefits through 
private health plans. In Part D, plan sponsors offer prescription drug 
coverage through stand-alone prescription drug plans or through 
Medicare Advantage prescription drug plans, which combine medical and 
prescription drug benefits. 

In 1990, we began to report on government operations that we 
identified as "high risk" for serious weaknesses in areas that involve 
substantial resources and provide critical services to the public. 
Medicare has been included among such programs since 1990. See GAO, 
High-Risk Series: An Update, [hyperlink, 
http://www.gao.gov/products/GAO-13-283] (Washington, D.C.: Feb. 14, 
2013). 

[3] See, for example, Department of Health and Human Services Office 
of Inspector General, Prescribers with Questionable Patterns in 
Medicare Part D, OEI-02-09-00603 (Washington, D.C.: June 2013); MEDIC 
Benefit Integrity Activities in Medicare Parts C and D, OEI-03-11-
00310 (Washington, D.C.: January 2013); and GAO, Medicare Part D: 
Instances of Questionable Access to Prescription Drugs, [hyperlink, 
http://www.gao.gov/products/GAO-11-699] (Washington, D.C.: Sept. 6, 
2011). 

[4] We interviewed a total of 14 stakeholder groups: the National 
Health Care Anti-Fraud Association and the Health Care Compliance 
Association, which represent antifraud and compliance entities; AARP, 
which represents Medicare beneficiaries; America's Health Insurance 
Plans, which represents private insurers; the Academy of Managed Care 
Pharmacy, the American Pharmacists Association, the National 
Association of Chain Drug Stores, and the National Community 
Pharmacists Association, which represent pharmacies; the 
Pharmaceutical Care Management Association, which represents pharmacy 
benefit managers; the American Medical Association, which represents 
prescribers; and the Federation of State Medical Boards, the National 
Association of Attorneys General, the National Association of Medicaid 
Fraud Control Units, the National Association of Medicaid Directors, 
and the Prescription Drug Monitoring Programs Center for Excellence, 
which represent state-based programs. 

[5] The Fraud Prevention Framework was developed by GAO and informed 
by GAO's internal control standards for the federal government. See 
GAO, Individual Disaster Assistance Programs: Framework for Fraud 
Prevention, Detection, and Prosecution, [hyperlink, 
http://www.gao.gov/products/GAO-06-954T] (Washington, D.C.: July 12, 
2006). We are currently considering revisions to the Fraud Prevention 
Framework, which we plan to publish in 2015. 

[6] In this report, we use the term "plan sponsors" to refer to both 
stand-alone Part D plan sponsors as well as Medicare Advantage 
prescription drug sponsors. 

[7] To protect beneficiaries and the fiscal integrity of the Medicare 
program, the Medicare Prescription Drug, Improvement, and 
Modernization Act of 2003 (MMA), which established the Part D program, 
requires all Part D sponsors to have programs to safeguard Part D from 
fraud, waste, and abuse. Pub. L. No. 108-173 § 101, 117 Stat. 2066, 
2086 (codified at 42 U.S.C. § 1395w-104(c)(1)(D)). As a result, CMS 
issued regulations requiring that sponsors adopt and implement a 
compliance program that includes measures to prevent, detect, and 
correct fraud, waste, and abuse. 42 C.F.R. § 423.504(b)(4)(vi). 

[8] CMS Compliance Program Guidelines appear in Chapter 9 of the 
Medicare Prescription Drug Benefit Manual, revised January 11, 2013. 
CMS issues this manual in tandem with Chapter 21 of the Medicare 
Managed Care Manual, which includes the Compliance Program Guidelines 
for Medicare Advantage. 

[9] Beginning in fiscal year 2007, CMS awarded contracts to MEDICs to 
address potential fraud and abuse related to the Part D benefit. In 
fiscal year 2009, CMS added oversight of Part C to the MEDICs' 
responsibilities. 

[10] Every time a Medicare beneficiary fills a prescription covered 
under Part D, the sponsor must submit a prescription drug event record 
to CMS. These records include drug cost and payment information that 
enables CMS to administer and monitor the Part D benefit. 

[11] Among other things, the Controlled Substances Act requires those 
who manufacture, distribute, prescribe, import, or export controlled 
substances to register with the DEA. 21 U.S.C. §§ 822, 957. Once 
registered, DEA provides a certificate with a registration number. 

[12] CMS evaluates each MEDIC's performance annually based on metrics 
it sets for each contractor, primarily related to the timeliness of 
contractors' work. For example, CMS expects that the NBI MEDIC will 
send an acknowledgment letter to complainants within 5 days of 
receiving the complaint, and expects that the O&E MEDIC will conduct a 
minimum of 10 training presentations each contract year. Scores are 
based on a five-point scale: (1) unsatisfactory, (2) marginal, (3) 
satisfactory, (4) very good, and (5) exceptional. 

CMS rated the contractors on additional elements not included in the 
examples we described. 

[13] The NBI MEDIC's most recently completed Contractor Performance 
Assessment Reports System (CPARS) evaluation was for April 2011 
through March 2012. While CMS has conducted two subsequent reviews, 
the ratings had not been posted to CPARS as of August 2014. Therefore, 
we report the MEDIC's 2013 activities from the most recently completed 
contract year, and the CPARS ratings as of March 2012, since those are 
the most recently available results. 

[14] The O&E MEDIC's most recently completed contract year for which 
its CPARS ratings are available was October 2012 through September 
2013. 

[15] PDMPs are state-based programs that operate electronic databases 
that gather information from pharmacies on certain dispensed 
prescriptions, such as whether a patient has multiple opioid 
prescriptions from multiple providers. Authorized users access the 
information about a patient's prescription drug history. Each state 
determines what data are collected, and who may access the PDMP and 
for what purpose. For example, some states only allow health care 
providers to access the PDMP as a patient-safety tool for their 
patients, while others allow law enforcement access for active 
investigations. According to Brandeis University's PDMP Training and 
Technical Assistance Center, as of June 2014, 49 of 50 states and the 
District of Columbia had legislation authorizing PDMPs, and 48 of 
those have operational PDMPs. 

[16] Medicare Program: Contract Year 2015 Policy and Technical Changes 
to the Medicare Advantage and the Medicare Prescription Drug Benefit 
Programs. 79 Fed. Reg. 29,844 (May 23, 2014). 

[17] Under section 1128 of the Social Security Act, exclusions from 
federal health programs are permissive under certain circumstances and 
mandatory in others. 42 U.S.C. § 1320a-7. Permissive exclusions are 
allowed for a variety of reasons, including licensure suspension, 
surrender, or revocation, or misdemeanor controlled substance 
conviction. Mandatory exclusions are required for felony convictions 
relating to health care fraud or controlled substances, and any 
convictions relating to patient abuse/neglect or to the delivery of 
Medicare or state health care programs. 

[18] Medicare Program: Contract Year 2015 Policy and Technical Changes 
to the Medicare Advantage and the Medicare Prescription Drug Benefit 
Programs. 79 Fed. Reg. 29,844 (May 23, 2014). 

[19] Id. 

[20] See Department of Health and Human Services Office of Inspector 
General, Medicare Improperly Paid Millions of Dollars for Prescription 
Drugs Provided to Incarcerated Beneficiaries during 2006 through 2010, 
A-07-12-06035 (Washington, D.C.: January 2014); and The Centers for 
Medicare & Medicaid Services Provided Medicare Part D Coverage to 
Beneficiaries Confined in Mental Health Facilities for Court-Ordered 
Purposes, A-07-13-06041 (Washington, D.C.: July 2014). 

[21] PLATO stands for "predictive learning analytics tracking 
outcome." Predictive analytic technologies are a variety of automated 
systems and tools that can be used to identify particular types of 
behavior, including fraud, before transactions are completed. 

[22] CMS selects sponsors to audit based on size, past audit findings, 
and risk, selecting both sponsors that may serve as role models, as 
well as those that are at risk. As of August 2014, CMS officials 
reported that 97 percent of beneficiaries are enrolled with plan 
sponsors that have been audited.CMS's 2013 audit findings included a 
lack of evidence that plan sponsors' FDRs or governing bodies were 
trained in compliance or in how to identify and report potential 
fraud, waste, or abuse; a lack of evidence that plan sponsors were 
conducting reasonable inquiries of potential fraud, waste, or abuse in 
a timely manner; and a lack of evidence that plan sponsors were 
implementing procedures to ensure appropriate corrective actions were 
taken in response to potential fraud, waste, or abuse. 

[23] Corrective action plans are developed by the plan sponsor to 
address deficiencies identified by CMS. Plans are to provide an 
attainable time frame for implementing corrective actions, and include 
a process for validating and monitoring that the corrective actions 
were taken and remain effective. 

A CMS official noted that stricter penalties--specifically, civil 
money penalties--are reserved for weaknesses that result in direct 
adverse effects on beneficiaries, such as not being able to access 
medications and care. 

[24] Medicare Program: Contract Year 2015 Policy and Technical Changes 
to the Medicare Advantage and the Medicare Prescription Drug Benefit 
Programs. 79 Fed. Reg. 1,918 (proposed Jan. 10, 2014). 

[25] Both GAO and OIG have reported problems with CMS's audits of Part 
D plan sponsors. See GAO, Medicare Part D: Some Plan Sponsors Have Not 
Completely Implemented Fraud and Abuse Programs, and CMS Oversight Has 
Been Limited, [hyperlink, http://www.gao.gov/products/GAO-08-760] 
(Washington, D.C.: July 21, 2008), and Department of Health and Human 
Services Office of Inspector General, Audits of Medicare Prescription 
Drug Plan Sponsors, OEI-03-09-00330 (Washington, D.C.: December 2011). 

[26] DEA finalized a rule effective October 9, 2014, expanding the 
options available to dispose of controlled substances. See Disposal of 
Controlled Substances. 79 Fed. Reg. 53,520 (Sept. 9, 2014). 

[27] See [hyperlink, http://www.gao.gov/products/GAO-11-699]. In that 
report, CMS policy officials stated that Part D cannot have a 
restricted recipient program because MMA, which established the Part D 
program, did not authorize CMS to establish such restrictions on 
beneficiaries. 

[28] Following our report, in 2012 CMS conducted a study that 
identified few beneficiaries (less than 1 percent) who would merit a 
lock-in program. CMS analyzed Part D data to identify beneficiaries 
receiving potentially unsafe doses of prescription opioids for 90 or 
more consecutive days, excluding beneficiaries with cancer or in 
hospice care. CMS concluded that .71 percent (224,964) of all Part D 
beneficiaries were at high risk for potential adverse effects and had 
a high likelihood of inappropriately using opioids. CMS also analyzed 
the number of prescribers and pharmacies associated with these 
beneficiaries' opioid prescriptions and found that .07 percent 
(22,222) of Part D beneficiaries received high dosages of opioids from 
at least four prescribers and at least four pharmacies. 

[29] See Department of Health and Human Services Office of Inspector 
General, Part D Beneficiaries with Questionable Utilization Patterns 
for HIV Drugs, OEI-02-11-00170 (Washington, D.C.: August 2014). 

[30] CMS requires plan sponsors to have drug utilization review (DUR) 
programs that include retrospective reviews of claims and case 
management for drugs susceptible to abuse, including opioids. 42 C.F.R 
§ 423.153. Starting in 2013, CMS implemented a Medicare Part D 
Overutilization Monitoring System (OMS). OMS is similar and in 
addition to the DUR programs, but is focused on opioids and certain 
other drugs, and includes CMS sending quarterly reports to plan 
sponsors to alert them to their beneficiaries who are receiving 
excessive amounts of those drugs. 

OIG recommended in August 2014 that CMS expand both the plan sponsors' 
DUR programs and OMS to include additional drugs susceptible to fraud, 
waste, and abuse. CMS concurred with the recommendation to expand DUR 
programs, noting the agency already encourages plan sponsors to 
examine nonopioids as part of those programs. CMS did not concur that 
it should similarly expand OMS, stating that the program is a "safety-
focused tool," not a "fraud identification tool." See OEI-02-11-00170. 

[31] Beneficiaries have a right to appeal the use of these edits, as 
set forth at 42 C.F.R Part 423 Subpart (M) and Chapter 18 of the 
Medicare 
Prescription Drug Benefit Manual. 

[End of section] 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation, and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the 
performance and accountability of the federal government for the 
American people. GAO examines the use of public funds; evaluates 
federal programs and policies; and provides analyses, recommendations, 
and other assistance to help Congress make informed oversight, policy, 
and funding decisions. GAO's commitment to good government is 
reflected in its core values of accountability, integrity, and 
reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's website [hyperlink, http://www.gao.gov]. Each 
weekday afternoon, GAO posts on its website newly released reports, 
testimony, and correspondence. To have GAO e-mail you a list of newly 
posted products, go to [hyperlink, http://www.gao.gov] and select 
"E-mail Updates." 

Order by Phone: 

The price of each GAO publication reflects GAO's actual cost of 
production and distribution and depends on the number of pages in the 
publication and whether the publication is printed in color or black 
and white. Pricing and ordering information is posted on GAO's 
website, [hyperlink, http://www.gao.gov/ordering.htm]. 

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or 
TDD (202) 512-2537. 

Orders may be paid for using American Express, Discover Card, 
MasterCard, Visa, check, or money order. Call for additional 
information. 

Connect with GAO: 

Connect with GAO on facebook, flickr, twitter, and YouTube.
Subscribe to our RSS Feeds or E mail Updates. Listen to our Podcasts.
Visit GAO on the web at [hyperlink, http://www.gao.gov]. 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 
Website: [hyperlink, http://www.gao.gov/fraudnet/fraudnet.htm]; 
E-mail: fraudnet@gao.gov; 
Automated answering system: (800) 424-5454 or (202) 512-7470. 

Congressional Relations: 

Katherine Siggerud, Managing Director, siggerudk@gao.gov: 
(202) 512-4400: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7125: 
Washington, DC 20548. 

Public Affairs: 

Chuck Young, Managing Director, youngc1@gao.gov: 
(202) 512-4800: 
U.S. Government Accountability Office: 
441 G Street NW, Room 7149: 
Washington, DC 20548. 

[End of document]